Ensure no RWX pages remain after mach_override_ptr

third_party/mach_override/mach_override.c

 /*******************************************************************************
         mach_override.c
                 Copyright (c) 2003-2009 Jonathan 'Wolf' Rentzsch: <http://rentzsch.com>
                 Some rights reserved: <http://opensource.org/licenses/mit-license.php>
 
         ***************************************************************************/
 
 #include "mach_override.h"
 
 #include <mach-o/dyld.h>
@@ skipping 138 matching lines @@
 *       
 *******************************************************************************/
 #pragma mark    -
 #pragma mark    (Interface)
 
 #if defined(__i386__) || defined(__x86_64__)
 mach_error_t makeIslandExecutable(void *address) {
         mach_error_t err = err_none;
     uintptr_t page = (uintptr_t)address & ~(uintptr_t)(kPageSize-1);
     int e = err_none;
-    e |= mprotect((void *)page, kPageSize, PROT_EXEC | PROT_READ | PROT_WRITE);
+    e |= mprotect((void *)page, kPageSize, PROT_EXEC | PROT_READ);
     e |= msync((void *)page, kPageSize, MS_INVALIDATE );
     if (e) {
         err = err_cannot_override;
     }
     return err;
 }
 #endif
 
     mach_error_t
 mach_override_ptr(
@@ skipping 158 matching lines @@
                                                                                  (void*) ((char *)originalFunctionPtr+eatenCount), originalInstructions );
                 // try making islands executable before planting the jmp
 #if defined(__x86_64__) || defined(__i386__)
         if( !err )
             err = makeIslandExecutable(escapeIsland);
         if( !err && reentryIsland )
             err = makeIslandExecutable(reentryIsland);
 #endif
                 if ( !err )
                         atomic_mov64((uint64_t *)originalFunctionPtr, jumpRelativeInstruction);
+
+                err = vm_protect( mach_task_self(),
+            (vm_address_t) originalFunctionPtr, 8, false,

[Mark Mentovai, 2013/07/30 21:02:27]

The indentation here is a mess.

+            (VM_PROT_READ | VM_PROT_EXECUTE) );    
         }
 #endif
         
         //      Clean up on error.
         if( err ) {
                 if( reentryIsland )
                         freeBranchIsland( reentryIsland );
                 if( escapeIsland )
                         freeBranchIsland( escapeIsland );
         }
@@ skipping 365 matching lines @@
 );
 #elif defined(__x86_64__)
 void atomic_mov64(
                 uint64_t *targetAddress,
                 uint64_t value )
 {
     *targetAddress = value;
 }
 #endif
 #endif