I've disassembled the function in question (_utilPurgeDiskBuffers
) from the CHUD framework. The function doesn't seem to be very complex, but since I'm no MacOS programmer, the imports and called sys APIs don't make much sense to me.
The first thing the API does is to call another function, namely _miscUtilsUserClientConnect_internal
. This function seems to establish a connection to the CHUD kernel extension.
To do this, it calls _getCHUDUtilsKextService
which tries to locate the CHUD kernel extension by enumerating all kexts using the IORegistryCreateIterator
imported from the I/O kit. After the kext has been found, it is opened via _IOServiceOpen
.
At this point we have a connection to the CHUD kext (at least that's my understanding from the disassembly listing).
Finally a call to IOConnectMethodStructureIStructureO
is made, which I guess carries out the real magic.
Without knowing some internal details or the signature of this function the parameters don't make sense to me.
Here's the disassembly, though:
__text:4B0157A7 lea eax, [ebp+var_1C]
__text:4B0157AA mov dword ptr [esp+14h], 0
__text:4B0157B2 mov [esp+10h], eax
__text:4B0157B6 mov [esp+0Ch], eax
__text:4B0157BA mov dword ptr [esp+8], 0
__text:4B0157C2 mov dword ptr [esp+4], 0Eh
__text:4B0157CA mov [esp], edx
__text:4B0157CD call _IOConnectMethodStructureIStr
Note that var_1C
has been zeroed out before.
Hopefully some of you can make more sense out of those syscalls. If you want more information, let me know.
Update:
To get you started, just take the AppleSamplePCIClient.c
example from the IO kit SDK. This does basically what the purge application from the CHUD tools does.
The only thing you would have to change are the parameters to the final _IOConnectMethodStructureIStr
call. Take them from the disassembly listing above. I cannot test all this stuff since I don't have a Mac.