theme | class | highlighter | fonts | ||||||
---|---|---|---|---|---|---|---|---|---|
default |
text-center |
MaskRay |
|
@import Darwin; | |
@import Foundation; | |
@import MachO; | |
#import <mach-o/fixup-chains.h> | |
// you'll need helpers.m from Ian Beer's write_no_write and vm_unaligned_copy_switch_race.m from | |
// WDBFontOverwrite | |
// Also, set an NSAppleMusicUsageDescription in Info.plist (can be anything) | |
// Please don't call this code on iOS 14 or below | |
// (This temporarily overwrites tccd, and on iOS 14 and above changes do not revert on reboot) |
got
---> global offset table
virtual address space
(VAS) or address space
---> is the set of ranges of virtual addresses
that an operating system makes available to a process
.
Here is easy steps to try Windows 10 on ARM or Ubuntu for ARM64 on your Apple Silicon Mac. Enjoy!
NOTE: that this is current, 10/1/2021 state.
- Install Xcode from App Store or install Command Line Tools on your Mac
MathSH was a very innovative challenge in the category sandbox escape. Three members of our team - ALLES! - worked for several hours and eventually drew first blood on this challenge. This writeup is split into several parts, namely: dumping the binary, analysing the sandbox, gaining a better primitive for code execution and finally escaping the sandbox.
The description Calculator as a Service (CAAS) already hints to CAS, a legacy .NET technology to run code in various level of trusts.
We are given a restricted "shell" to calculate math expressions:
- Download & Install Sublime Text 3.2.2 Build 3211
- Visit https://hexed.it/
- Open file select sublime_text.exe
- Offset
0x8545
: Original84
->85
- Offset
0x08FF19
: Original75
->EB
- Offset
0x1932C7
: Original75
->74
(remove UNREGISTERED in title bar, so no need to use a license)
void inject_trusts(int pathc, const char *paths[]) | |
{ | |
printf("[+] injecting into trust cache...\n"); | |
extern uint64_t g_kern_base; | |
static uint64_t tc = 0; | |
if (tc == 0) { | |
/* loaded_trust_caches | |
iPhone11,2-4-6: 0xFFFFFFF008F702C8 |
See the official Differentiable Programming Manifesto instead.
For a brief user-level introduction to CMake, watch C++ Weekly, Episode 78, Intro to CMake by Jason Turner. LLVM’s CMake Primer provides a good high-level introduction to the CMake syntax. Go read it now.
After that, watch Mathieu Ropert’s CppCon 2017 talk Using Modern CMake Patterns to Enforce a Good Modular Design (slides). It provides a thorough explanation of what modern CMake is and why it is so much better than “old school” CMake. The modular design ideas in this talk are based on the book [Large-Scale C++ Software Design](https://www.amazon.de/Large-Scale-Soft