Hi,
I’ve encountered a puzzling code (and behavior) in iOS’s mach_absolute_time. I’m looking at 32 bit. It starts from reading a byte from 0xffff4088+0x8. These addresses should be kernel addresses, no? mach_vm_region on this address fails. In your book you mention commpage, but at another address.
When I try to read it via lldb – it fails as well. I can read the same byte with the injected code though.
Do you know:
- What is there?
- How big is this region and where it starts?
P.S. I ran a quick disassembly of all functions in the same dylib and only this one starts with reading from this address