Brandon Saldan brandonsaldan

## offsets_multipath_kfree.md

      
        
          
            
              
              1 file
            
          
          
            
              
              1 fork
            
          
          
            
              
              0 comments
            
          
          
            
              
              4 stars
            
          
        
        
          
              
          
          
            
                Cryptiiiic
                / offsets_multipath_kfree.md
            
            
              Last active
              March 1, 2023 05:45
            
              
                How to find offsets for Multipath_KFree
              
          
        
      
        
  
      
    
Open Terminal and run nm kernelcache.dec | grep _kernproc

In this example, 0xfffffff0075d50a0 is our kernproc address.(iPhone6S on 11.3.1)
Drag your kernelcache.dec into ida and stringsearch for fStampMapping[kAGXHostMemoryTimestamp]
This should take you to com.apple.AGXG5P:__cstring section.

Double click on the first text:FFFFFFF...
Scroll down all the way until you see something like this.

Double click on unk_FFFFFFF... which is located at the second ADRP.