Orangera1n

iOS 17.6b3:
{
  "device": "iPhone11,2",
  "keybags": [
    {
      "buildnum": "21G5066d",
      "illb": "0AF1E048865508ED01193BC44D4EA6F84D9DA3195B8805379987DC61B4128F7E040BE69B8EA8F53A6E73539F1DE6CC91",
      "ibot": "B1FC5FC83B146F93D8A79FAC373D3313C5EBBBA22072CCDB71A0340DAE1675AD423F55B4E3F03CC70AD5F11BF69660B8",
      "ibec": "2EE1E89ABBC1BCDF8CAAC3E174EC79D2475C84FD76A9A78ABE803A75A1DD47FD8520E4B9EFD1C3C74520E67E06C80F8D",
      "ibss": "214AC6198966311151D56AFC469D32A26702FD70F717D243BBC9960F6D2155FAA9C23312CBFE7026D77F3421D77FA402"

shinyquagsire23

//
// Non-conclusive list of interesting private Metal pixel formats
//
let MTLPixelFormatYCBCR8_420_2P: UInt = 500
let MTLPixelFormatYCBCR8_422_1P: UInt = 501
let MTLPixelFormatYCBCR8_422_2P: UInt = 502
let MTLPixelFormatYCBCR8_444_2P: UInt = 503
let MTLPixelFormatYCBCR10_444_1P: UInt = 504
let MTLPixelFormatYCBCR10_420_2P: UInt = 505
let MTLPixelFormatYCBCR10_422_2P: UInt = 506

v-p-b

Import Existing Ghidra Project to Eclipse

⚠️ Since Ghidra 11.1 the GhidraDev plugin has an Import feature, you can just use that!

Prerequisites

• Working Eclipse installation
• Installed GhidraDev extension in Eclipse

Orangera1n

{
  "device": "iPad8,1",
  "keybags": [
    {
      "buildnum": "22A5297f",
      "illb": "818B9C71517E44B43ABB4286F4E7721D9D2CE2B50ACA54DD1F90F847837922BED757C74645F44D2FFD99A26829C50B5C",
      "ibot": "0341CD7B968FD8FA8F61355CA62CDF8E85746C67C329177954E7EBEE6FB7EAF835F7D6AF8FBA205AD3A0AE2C6FEE6107",
      "ibec": "73F97951EC97654DE13B6EBEE11DD7E750AD1ADAF7892B7D1C84C48FAA4D18410E3DBAD34699F7B9C5FFC2F12B0F6C67",
      "ibss": "00F2DF875304D5474B6A5A21924250DB84A681E5E0E6BAFD3489627D563C102EA5F03EECC4F4EE1EA1EAA5EC83DC66AD"
    }

Orangera1n

{
  "device": "iPhone11,2",
  "keybags": [
    {
      "buildnum": "22A5297f",
      "illb": "57AE11AFCD80CFAA9D3835BEAE2E2868BF8FB8D6E6F2B3824C8F1A36C4CA1F20933C0E8B8959AC776430C2BD46A14302",
      "ibot": "EDF2B23237C5099FF6A766DBFF00B626DCC66B89BB32077308D905A127F23EB01DF70C7035A40FB27650F194356A6951",
      "ibec": "55CCB6E4A0FC64A64DC14EB84465A0FA89DE5829601997936752C57936EF47C8F2789A5EF8E79A70FAC10225E065C87F",
      "ibss": "73C76D990BBF6BF4C91201B232107ACA40E8548EBC4B5CCA4E9213705A56E1ED9C7094EC5B8F44922930E13D7AFB60F9"
    }

whitequark

from amaranth import *
from amaranth.lib import enum, data, wiring, stream, io
from amaranth.lib.wiring import In, Out, connect, flipped
from amaranth.sim import Simulator


class IOStream(wiring.Component):
    def __init__(self, width, *, meta_layout=0, latency=0):
        self._latency = latency

whitequark

from amaranth import *
from amaranth.lib import data, wiring, stream, io
from amaranth.lib.wiring import In, Out
from amaranth.sim import Simulator


class BitSerializer(wiring.Component):
    def __init__(self, *, width, length):
        self._length = length

ArcaneNibble

JLCPCB Color Silkscreen Crypto

JLCPCB color silkscreen files are encrypted using AES-128-GCM and RSA-2048 with OAEP padding with SHA-256 as the hash function. Unfortunately, this means that, although it is possible for tools other than EasyEDA to create files, only JLCPCB can decrypt the resulting files.

File structure

The structure of an encrypted file is as follows:

1. 256 bytes RSA-encrypted AES key
2. 256 bytes RSA-encrypted GCM nonce

Kyle-Ye

Inspired by https://infosec.exchange/@jjtech/112612685494089718

Method 1: LLDB

Step 0

Reboot into Recovery OS + Disable SIP

csrutil disable

tandasat

#include <stdio.h>
#include <assert.h>
#include <Windows.h>

// Some of them were taken (and modified) from https://github.com/winsiderss/systeminformer

typedef struct _SYSTEM_ISOLATED_USER_MODE_INFORMATION
{
    BOOLEAN SecureKernelRunning : 1;
    BOOLEAN HvciEnabled : 1;