Skip to content

Instantly share code, notes, and snippets.

View JJTech0130's full-sized avatar

James Gill JJTech0130

1k followers · 195 following
View GitHub Profile
@JJTech0130
JJTech0130 / AppleSiliconMacRadios.md
Last active September 14, 2026 13:20
Collection of WiFi radio information extracted from macOS and iOS devicetrees
Model BoardConfig Processor Chipset Module Fillmore[^1]
Mac Pro (2023) J180dAP M2 Ultra 4388 sumatra no
Mac mini (M1, 2020) J274AP M1 4378 atlantisb no
MacBook Pro (13-inch, M1, 2020) J293AP M1 4378 honshu no
MacBook Air (M1, 2020) J313AP M1 4378 shikoku no
MacBook Pro (14-inch, 2021) J314cAP M1 Max 4387 maldives no
MacBook Pro (14-inch, 2021) J314sAP M1 Pro 4387 maldives no
MacBook Pro (16-inch, 2021) J316cAP M1 Max 4387 madagascar no
MacBook Pro (16-inch, 2021) J316sAP M1 Pro 4387 madagascar no
@JJTech0130
JJTech0130 / iPhoneBasebands.md
Created September 13, 2026 05:22
Collection baseband information extracted from iOS devicetrees
Product Model BoardConfig Chipset Baseband
iPhone 6s iPhone8,1 N71mAP mav13
iPhone 6s iPhone8,1 N71AP mav13
iPhone 6s Plus iPhone8,2 N66AP mav13
iPhone 6s Plus iPhone8,2 N66mAP mav13
iPhone SE (1st generation) iPhone8,4 N69AP mav10
iPhone SE (1st generation) iPhone8,4 N69uAP mav10
iPhone 7 iPhone9,1 D10AP mav16
iPhone 7 Plus iPhone9,2 D11AP mav16
@JJTech0130
JJTech0130 / gsa.py
Last active September 4, 2026 18:46
Apple's GrandSlam Authentication protocol
import base64
import hashlib
import hmac
import locale
import plistlib as plist
from datetime import datetime
import logging
import requests
import srp._pysrp as srp
import urllib3
@JJTech0130
JJTech0130 / anisette.py
Last active August 21, 2026 13:22
import base64
import json
import logging
import plistlib
import random
import uuid
from datetime import datetime
import requests
import urllib3
@JJTech0130
JJTech0130 / library_injector.cpp
Last active August 16, 2026 21:14 — forked from saagarjha/library_injector.cpp
Load a library into newly spawned processes (using DYLD_INSERT_LIBRARIES and EndpointSecurity)
// To compile: clang++ -arch x86_64 -arch arm64 -arch arm64e -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
// then codesign with com.apple.developer.endpoint-security.client and run the
// program as root.
#include <EndpointSecurity/EndpointSecurity.h>
#include <algorithm>
#include <array>
#include <bsm/libbsm.h>
#include <cstddef>
#include <cstdint>
@JJTech0130
JJTech0130 / dump_syncp_keys.c
Last active July 29, 2026 13:15
Dumps the 8 SYNCP AES-128 keys + ESN from the DPS partition on SYNC 3
// Dumps the 8 SYNCP AES-128 keys + ESN from the DPS partition on SYNC 3
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#define EMMC_DEVICE "/dev/hd0"
@JJTech0130
JJTech0130 / ford_seedkey.py
Last active July 27, 2026 15:32
Ford UDS SecurityAccess seed-key algorithms [untested]
"""
Ford ECU SecurityAccess seed-key algorithms, reversed from libfnvfsa.so on the ECG2 GWM
Algorithm 0: legacy 24-bit Galois LFSR cipher (3-byte seed, 5-byte/40-bit secret)
Described in https://flaviodgarcia.com/publications/BtB.pdf
Algorithms 1/2: modern HMAC-SHA1 (16-byte seed, 12-byte fixedBytes)
TODO: Test against a real vehicle
"""
@JJTech0130
JJTech0130 / carrier_bundle.py
Created October 29, 2025 01:06
Fetch carrier bundle info from iTunes servers
import sys
import json
import plistlib
import requests
import zipfile
from io import BytesIO
try:
from rich import print
except ImportError:
print=print
@JJTech0130
JJTech0130 / generate_esim.sh
Last active July 22, 2026 04:52
#!/usr/bin/env bash
set -euo pipefail
# Configuration
CONFIG_ID="8da72a14ba6942ac904c2f028aada7cb" # Simlessly eSIM config ID
CBRS_PREFIX="315010" # CBRS MCC+MNC per your request
CBRS_IBN="9999" # CBRS IBN for testing/shared
DEFAULT_KI="$(printf 'A%.0s' {1..32})" # 32 hex chars of 'A' -> 16 bytes (testing)
DEFAULT_OPC="$(printf 'A%.0s' {1..32})" # same for OPc
@JJTech0130
JJTech0130 / debugger_jit_improved.m
Last active July 10, 2026 15:52
Improved method of using a debugger for JIT on iOS... Uses split rx/rw regions, and works on iOS 18.4b1
#import <Foundation/Foundation.h>
#import <mach/mach.h>
#import <stdio.h>
#import <stdlib.h>
#import <string.h>
#include <libkern/OSCacheControl.h>
const int REGION_SIZE = 0x4000*1;
void write_instructions(void* page)