Skip to content

Instantly share code, notes, and snippets.


Proteas Proteas

View GitHub Profile
Proteas / mac_policy_ops-19E287_vs_20A5343i.diff
Last active Aug 11, 2020
mac_policy_ops diff: macOS-v10.15.4-19E287 vs. macOS-v11.0-B4-20A5343i
View mac_policy_ops-19E287_vs_20A5343i.diff
diff --git a/mac_policy_ops.c b/mac_policy_ops.c
index 798bd29..bb3c425 100644
--- a/mac_policy_ops.c
+++ b/mac_policy_ops.c
@@ -2,10 +2,10 @@ struct mac_policy_ops
mpo_audit_check_postselect_t *mpo_audit_check_postselect;
mpo_audit_check_preselect_t *mpo_audit_check_preselect;
- mpo_bpfdesc_label_associate_t *mpo_bpfdesc_label_associate;
- mpo_bpfdesc_label_destroy_t *mpo_bpfdesc_label_destroy;
Proteas /
Last active Jul 8, 2020
WebContent's sandbox rules of syscall-unix, syscall-mach, mig-kernel in iOS-v14.0-18A5301v



Proteas / ent-diff-iPhone11,2-17E262-vs-17F75.diff
Created May 25, 2020
ent diff of ios: 17E262-iPhone11,2 vs. 17F75-iPhone11,2
View ent-diff-iPhone11,2-17E262-vs-17F75.diff
*** ent-list-17E262-iPhone11,2.json 2020-05-25 11:16:14.000000000 +0800
--- ent-list-17F75-iPhone11,2.json 2020-05-25 11:02:29.000000000 +0800
*** 389,394 ****
--- 389,395 ----
+ "",
*** 820,826 ****
View inject_trusts-iOS-v12.1.2-16C104-iPhone11,x.c
void inject_trusts(int pathc, const char *paths[])
printf("[+] injecting into trust cache...\n");
extern uint64_t g_kern_base;
static uint64_t tc = 0;
if (tc == 0) {
/* loaded_trust_caches
iPhone11,2-4-6: 0xFFFFFFF008F702C8


instructions about setting pac key

__text:FFFFFFF007A0834C                 LDR             X0, =0xFEEDFACEFEEDFACF ; LDR X0, #348, 0xFFFFFFF007A084A8
__text:FFFFFFF007A08350                 MSR             #0, c2, c1, #2, X0 ; APIBKeyLo_EL1
__text:FFFFFFF007A08354                 MSR             #0, c2, c1, #3, X0 ; APIBKeyHi_EL1
__text:FFFFFFF007A08358                 ADD             X0, X0, #1
__text:FFFFFFF007A0835C                 MSR             #0, c2, c2, #2, X0 ; APDBKeyLo_EL1
__text:FFFFFFF007A08360                 MSR             #0, c2, c2, #3, X0 ; APDBKeyHi_EL1
Proteas / xnu-4570.1.46-arm64-steps.txt
Created Oct 9, 2017
steps to build arm64 version of xnu-4570.1.46
View xnu-4570.1.46-arm64-steps.txt
Following are my steps to build the ARM64 version of xnu-4570.1.46, hope this is helpfull for saving time.
1. Use Xcode 9.0
2. Preparation is same as macOS, and there is a guide:
3. There is an ARM64 version libfirehose:
4. Copy and edit the ARM64 config(CFLAGS, LDFLAGS) from darwin-on-arm/xnu to your target project
5. Example CFLAGS: -Darm64 -DARM64 -D__arm64__ -D__ARM64__ -DLP64 -DCONFIG_EMBEDDED -mkernel -DARM64_BOARD_CONFIG_T8011=1
6. Fix compiling stage errors by directly importing the missing headers or editing the code
7. Fix linking stage errors by implementing place holder funcitons for: chudxnu_cpu_alloc, etc
8. If missing symbol __divti3 in linking stage, get the runtime from llvm.
Proteas / dyld-actions-during-loading.txt
Created Jul 13, 2017
actions of dyld when loading /bin/ls
View dyld-actions-during-loading.txt
======== dyld by Proteas ========
seg name: __PAGEZERO
seg name: __TEXT
seg name: __DATA
seg name: __LINKEDIT
ImageLoader=72, ImageLoaderMachO=120, ImageLoaderMachOClassic=144, ImageLoaderMachOCompressed=128
notifySingle(state=10, image=/bin/ls)
addMappedRange(0x100000000->0x10000A000) for ls
sSharedCacheSlide=0x57333000, loadedAddress=0x7fffc7333000, preferedLoadAddress=0x7fff70000000
addRootImage(0x7fdce1f01eb0, /bin/ls)
View macos-kern-info.d
#! /usr/sbin/dtrace -C -s
requirement: disable SIP
#pragma D option quiet
printf("vm_kernel_slide: 0x%p\n", (`vm_kernel_slide));
printf("vm_kernel_base: 0x%p\n", (`vm_kernel_base));
View o_direct_race.c
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/syscall.h>
View dtrace-sample.d
#!/usr/sbin/dtrace -s
#pragma D option flowindent
/* monitor file open */
printf("%s %s", execname, copyinstr(arg0));