Skip to content

Instantly share code, notes, and snippets.

Avatar

Brandon Azad bazad

View GitHub Profile
@bazad
bazad / arm64_sysregs_ios.py
Created Jul 17, 2020
Label iOS arm64 system registers in IDA Pro
View arm64_sysregs_ios.py
#
# arm64_sysregs_ios.py
# Brandon Azad
#
# Based on https://github.com/gdelugre/ida-arm-system-highlight by Guillaume Delugre.
#
import idautils
import idc
View process_AArch64_SysReg_xml_v86A-2020-03.py
import html
import os
import re
directory = os.fsencode('SysReg_xml_v86A-2020-03')
def output_reg(name, description, spec):
assert(all(map(lambda x: type(x) == int, spec)))
print("{:020b} 'S{}_{}_c{}_c{}_{}' : ( '{}', '{}' ),".format(
(spec[0] << 16) + (spec[1] << 12) + (spec[2] << 8) + (spec[3] << 4) + (spec[4] << 0),
@bazad
bazad / sep_firmware_split.py
Last active Aug 4, 2020
Split a decrypted Apple SEP firmware image into individual Mach-O files.
View sep_firmware_split.py
#! /usr/bin/env python3
#
# sep_firmware_split.py
# Brandon Azad
#
# Split a decrypted Apple SEP firmware image into individual Mach-O files.
#
# iPhone11,8 17C5053a https://twitter.com/s1guza/status/1203550760102969345
# iPhone11,8 17E255 https://twitter.com/s1guza/status/1244683851957522435
#
@bazad
bazad / devicetree-iPhone12,3-17C54.txt
Last active Apr 19, 2020
iPhone12,3 17C54 device tree
View devicetree-iPhone12,3-17C54.txt
device-tree:
target-type (5): "D421"
mlb-serial-number (32): "C07947707R3LTPJB"
compatible (27): "D421AP\0iPhone12,3\0AppleARM\0"
secure-root-prefix (3): "md"
AAPL,phandle (4): 0x1
platform-name (32): "t8030"
device_type (8): "bootrom"
region-info (32): "LL/A"
regulatory-model-number (32): "A2160"
@bazad
bazad / find_kernel_base_checkra1n.c
Created Nov 21, 2019
A demo of one way to find the kernel base on iOS 13.2.2 on an iPhone 8 using the kernel task port as exposed by checkra1n 0.9.5.
View find_kernel_base_checkra1n.c
#include <assert.h>
#include <mach/mach.h>
#include <stdbool.h>
#include <stdio.h>
// ---- mach_vm.h ---------------------------------------------------------------------------------
extern
kern_return_t mach_vm_read_overwrite
(
@bazad
bazad / vmmap.c
Last active Aug 2, 2020
A simple vmmap implementation for macOS.
View vmmap.c
// Brandon Azad (@_bazad)
#include <assert.h>
#include <errno.h>
#include <mach/mach.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
@bazad
bazad / build-xnu-4903.241.1.sh
Created Sep 13, 2019
A script to build XNU version 4903.241.1 (macOS High Sierra 10.14.3) on macOS 10.14.6 with Xcode 9.4.1.
View build-xnu-4903.241.1.sh
#! /bin/bash
#
# build-xnu-4903.241.1.sh
# Brandon Azad
#
# A script showing how to build XNU version 4903.241.1 (which corresponds to
# macOS 10.14.3) on macOS High Sierra 10.14.6 with Xcode 9.4.1.
#
# Note: This process will OVERWRITE files in Xcode's MacOSX10.13.sdk. Make a
# backup of this directory first!
@bazad
bazad / if_value.h
Created Sep 11, 2019
A C preprocessor macro to test whether a macro parameter has a value.
View if_value.h
//
// if_value.h
// Brandon Azad
//
// Public domain
//
#ifndef IF_VALUE
/*
@bazad
bazad / A12-page-table-walk.c
Created May 17, 2019
A C implementation of a simple page table walk on A12 devices (iOS 12.1.2).
View A12-page-table-walk.c
uint64_t
aarch64_page_table_lookup(uint64_t ttbr, uint64_t vaddr,
uint64_t *l1_tte_, uint64_t *l2_tte_, uint64_t *l3_tte_) {
const uint64_t pg_bits = 14;
const uint64_t l1_size = 3;
const uint64_t l2_size = 11;
const uint64_t l3_size = 11;
const uint64_t tte_physaddr_mask = ((1uLL << 40) - 1) & ~((1 << pg_bits) - 1);
uint64_t l1_index = (vaddr >> (l2_size + l3_size + pg_bits)) & ((1 << l1_size) - 1);
uint64_t l2_index = (vaddr >> (l3_size + pg_bits)) & ((1 << l2_size) - 1);
@bazad
bazad / build-xnu-4903.221.2.sh
Created Jan 28, 2019
A script to build XNU version 4903.221.2 (macOS High Sierra 10.14.1) on macOS 10.14.1 with Xcode 9.4.1.
View build-xnu-4903.221.2.sh
#! /bin/bash
#
# build-xnu-4903.221.2.sh
# Brandon Azad
#
# A script showing how to build XNU version 4903.221.2 (which corresponds to
# macOS 10.14.1) on macOS High Sierra 10.14.1 with Xcode 9.4.1.
#
# Note: This process will OVERWRITE files in Xcode's MacOSX10.13.sdk. Make a
# backup of this directory first!
You can’t perform that action at this time.