From ba3dc89d34b3ea606eb30cd5b62ef1375d7edee1 Mon Sep 17 00:00:00 2001
From: Sergiu Weisz <sergiu121@gmail.com>
Date: Tue, 29 May 2018 18:45:04 +0300
Subject: [PATCH] Add kernel extension extractor poc

---
 Makefile             |  5 ++++-
 poc/kext_extract.cpp | 28 ++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 poc/kext_extract.cpp

diff --git a/Makefile b/Makefile
index 2296f53..c20e9fa 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,7 @@ INC := -I include
 OS := $(shell uname)
 
 
-build: $(TARGET) bin/poc
+build: $(TARGET) bin/poc bin/kext_extract
 
 $(TARGET): $(OBJECTS)
 	@mkdir -p $(LIBDIR)
@@ -42,5 +42,8 @@ clean:
 bin/poc: poc/poc.cpp
 	@echo " $(CC) -L$(LIBDIR) -o $@ $< -lopenmach $(INC)"; $(CC) -L$(LIBDIR) -o $@ $< -lopenmach $(INC)
 
+bin/kext_extract: poc/kext_extract.cpp
+	@echo " $(CC) -L$(LIBDIR) -o $@ $< -lopenmach $(INC)"; $(CC) -L$(LIBDIR) -o $@ $< -lopenmach $(INC)
+
 .PHONY: clean
 
diff --git a/poc/kext_extract.cpp b/poc/kext_extract.cpp
new file mode 100644
index 0000000..2f85ae1
--- /dev/null
+++ b/poc/kext_extract.cpp
@@ -0,0 +1,28 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <vector>
+#include <iostream>
+#include "MachO.hpp"
+#include "FileReader.hpp"
+
+int main(int argc, char *argv[])
+{
+
+    if (argc < 3) {
+        printf("./kext_extract <kext_name> <kernel_path> [<output_dir>]\n");
+        return -1;
+    }
+
+    MachO bin(argv[2]);
+    std::string output_filename;
+
+    if (argc == 3)
+        output_filename = std::string("./" + std::string(argv[1]) + ".kext");
+    else
+        output_filename = std::string(std::string(argv[3]) + "/" + std::string(argv[1]) + ".kext");
+    std::cout<<output_filename<<std::endl;
+
+    bin.dumpKext((char *) argv[1], (char *) output_filename.c_str());
+
+    return 0;
+}