Skip to content

Instantly share code, notes, and snippets.

Siguza Siguza

Block or report user

Report or block Siguza

Hide content and notifications from this user.

Learn more about blocking users

Contact Support about this user’s behavior.

Learn more about reporting abuse

Report abuse
View GitHub Profile
View FullScreen.m
// This is a patch for the macOS version of Graveyard Keeper (might work for arbitrary apps, but zero guarantees).
// The game completely fails to support fullscreen, yet runs beautifully with it if you force it to.
// So this patch simply brings back the functionality of the little green button in the window's upper left corner.
// I have sadly not found a way to automatically inject this by means of a Steam interface - if you do, please let me know!
// For the rest, you should probably be an advanced user to use this. No support or warranty.
// Compile and inject with:
// clang -shared -o FullScreen.dylib FullScreen.m -Wall -O3 -framework AppKit
// DYLD_INSERT_LIBRARIES=/path/to/FullScreen.dylib /path/to/Graveyard\ Keeper
View JBdetection.md

Thoughts on jailbreak detection

The controversy of jailbreak detection has been brought up multiple times in my Twitter feed, so in order to not have to repeat myself, I'll write my thoughts down here.
One day I'll hopefully get round to set up a realistic blog and then I'll move this there, but for now I'll just dump it here on GitHub.

Motivation

Hi. I'm Siguza, and among other things I write exploits for a hobby and help make jailbreaks. One of the reasons I do that is because I believe we should have the ability to run whatever we want on our iDevices, just as we do with laptops and desktop computers. Now, a lot of app developers however seem to despise jailbreaks, and try to make their apps refuse service on jailbroken devices. I think that firstly sucks big time, and secondly always misses the point. From what I gathered, the two arguments for using jailbreak detection seem to be:

  • "J
View PayPalPhishing.md

Analysing some PayPal phishing

Not long ago I tweeted about some PayPal phishing mails I got, which appeared to use hacked websites for their cause, and of which all traces were gone 24h after my initial recon.
Well, I got another such mail:

Return-Path: <rcp133066@jmenviro.com>
X-Original-To: Contact@siguza.net
Delivered-To: siguza@siguza.net
Received: from linuxhosting09.rediff.com (host152-150.mxout.rediffmailpro.com [119.252.152.150])
@Siguza
Siguza / dsc_syms.c
Last active Apr 8, 2019
dyld_shared_cache symbols to r2 flags
View dsc_syms.c
#include <errno.h>
#include <fcntl.h> // open
#include <stdint.h>
#include <stdio.h> // printf, fprintf, stderr
#include <stdlib.h> // exit
#include <string.h> // strerror, strncmp
#include <sys/mman.h> // mmap
#include <sys/stat.h> // fstat
#include <mach-o/loader.h>
#include <mach-o/nlist.h>
View dpkg_merge.c
// Siguza
// Treat as public domain.
#include <ctype.h> // isspace
#include <stdlib.h> // malloc, free,
#include <string.h> // strlen, strncmp, strstr
// Turn delimiter tokens into null terminators and
// create array of pointers to each new string.
static void destructive_split(char *str, const char *delim, char ***out, size_t *outlen)
View zIVA_tfp0.md

Sadly I don't have a dev device on iOS 10, but for anyone playing around with zIVA caring about the kernel task port:

Starting with iOS 10.3 (and macOS 10.12.4), Apple changed convert_port_to_locked_task (and a few other port-to-something conversion functions) to blacklist the kernel task by means of a direct check. As a result, you can still obtain the kernel task port, but almost all APIs will simply treat it like MACH_PORT_NULL, thus rendering it useless. The check is a simple pointer comparison though, so it can be circumvented by just remapping the task struct at an additional virtual address and creating a new port from that with a ROP equivalent of:

vm_map_remap(
    kernel_map,
    &remap_addr,
    sizeof(task_t),
    0,
    VM_FLAGS_ANYWHERE | VM_FLAGS_RETURN_DATA_ADDR,
View keybase.md

Keybase proof

I hereby claim:

  • I am Siguza on github.
  • I am siguza (https://keybase.io/siguza) on keybase.
  • I have a public key whose fingerprint is 6393 3A9D E301 7C59 ADE5 3EBB 1591 E8CA 0BCA 036F

To claim this, I am signing this object:

View build_libimobiledevice.sh
#!/bin/bash
set -e;
urls=('https://github.com/libimobiledevice/libplist.git' \
'https://github.com/libimobiledevice/libusbmuxd.git' \
'https://github.com/libimobiledevice/libimobiledevice.git' \
'https://github.com/libimobiledevice/libirecovery.git' \
'https://github.com/Siguza/libcrippy-1.git' \
'https://github.com/Siguza/libpartialzip-1.git' \
@Siguza
Siguza / ianbeer.txt
Last active Dec 25, 2016
C̶h̶u̶c̶k̶ ̶N̶o̶r̶r̶i̶s̶ Jon Skeet-style facts about Ian Beer
View ianbeer.txt
When the XNU kernel goes to sleep, it checks under the bed for Ian Beer.
Use-after-free or free-after-use doesn't matter, Ian Beer can exploit both.
Ian Beer's device has panicked long ago, the kernel just doesn't have the courage to tell him.
If Ian Beer is hacking Android, that's just because all his Apple devices are still busy rebooting back to unjailbroken states.
Ian Beer spends more time in EL1 than the kernel does.
Ian Beer can map at __PAGEZERO.
Ian Beer can sandbox the kernel.
Whoever you think you're sending mach messages to, it's really just Ian Beer.
Ian Beer has send rights to your mach port.
When AMFI wants to kill a process, it has to ask Ian Beer for permission.
@Siguza
Siguza / img3ex.c
Created Sep 18, 2016
Img3 extractor
View img3ex.c
/*
* img3ex.c - Extract Img3 files from any binary blob, e.g. a /dev/disk* dump.
*
* Placed in the Public Domain, do whatever you want with it. No warranty of any kind.
*
* Compile with: cc -o img3ex -std=c11 -Wall -O3 img3ex.c
*/
#include <errno.h> // errno
#include <fcntl.h> // open, O_RDONLY
You can’t perform that action at this time.