ox1111

저자 commnet 
I guess i can't help but tease you a bit more :P
Here are the patches i used on my iPhone8 to boot into iOS 15.1 jb
https://gist.github.com/tihmstar/faaa1fe3fe9302782800a4d40bb67825
- remove passcode
- kernelpatches may be incomplete (i didn't test tweaks, just sileo)



iPhone8 15.1 19B74

ox1111

// Decompiled by hand (based-ish on a Ghidra decompile) from Hypervisor.framework on macOS 12.0b1
@import Darwin;
#include <assert.h>

typedef uint64_t hv_return_t;
typedef void* hv_vm_config_t;

#define HV_CALL_VM_GET_CAPABILITIES 0
#define HV_CALL_VM_CREATE 1

ox1111

#if 0
// Fixed in iOS 13.1 with CVE-2019-8747

__thiscall
AppleFirmwareUpdateKext::loadFirmware
(AppleFirmwareUpdateKext *this,IOMemoryDescriptor *Memory,void *off_0x10,uint off_0x18)
{
    uint uVar1;
    byte addr;
    byte len;

ox1111

#if 0
Fixed in iOS 13.0 with CVE-2019-8712.

ApplePPM::setProperties() : OSArray::initWithArray called without locks leads to OOB Writes

__thiscall ApplePPM::setProperties(ApplePPM *this,OSDictionary *param_1)
{
    ...
    ...
    

ox1111

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/types.h>
#include <arpa/inet.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/if.h>

ox1111

#define _GNU_SOURCE
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <asm/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <linux/netlink.h>
#include <linux/xfrm.h>

ox1111

# Fix a metacast output in iOS kernelcache 

#@author simo
#@category iOS.kernel
#@keybinding Meta Shift M
#@toolbar logos/m.png

# -*- coding: utf-8 -*-

# This script can be only used in GHIDRA 9.2, so grab the source code and compile it yourself

ox1111

#if 0
IOAccelContext2::finish_fence_event() race condition OOB read/write

This is a method exposed to user space, it takes a kernel read-only shared memory
(type 2 via clientMemoryForType())  address and treats it as an IOAccelEvents Array.

The user supplied index is checked against the IOAccelEvents array bounds,since there are no
locks held in this method,it is possible to change the array bounds by calling
IOAccelContext2::clientMemoryForType() again in a separate thread, this will expand the size by
multiplying the older size by 2, but we still have a reference to the old shared memory address

ox1111

# Fixing LC_DYLD_CHAINED_FIXUPS for macOS M1 kext drivers
# -*- coding: utf-8 -*-
#@category macOS.kext

from  generic.continues import RethrowContinuesFactory
from  ghidra.app.script import GhidraScript
from  ghidra.app.util.bin import ByteProvider, RandomAccessByteProvider, BinaryReader
from  ghidra.app.util.bin.format.macho import MachHeader,Section, commands
from  ghidra.program.model.address import Address
from  java.io import File

ox1111

#if 0
Reported : 19-Jan-2020
Fixed in iOS 13.4 with CVE-2020-9768
AppleJPEGDriverUserClient : mach port use-after-free/type-confusion via race condition 

AppleJPEGDriverUserClient external methods can be used synchronously or asynchronously, when used asynchronously, 
it brings the registered mach port (via registerNotificationPort()) and put it inside jpegRequest data structure,
and no reference count was taken for this operation. since registerNotificationPort() is not gated, it is 
possible to release the port (if the port got substituted)  during the processing of jpeg request and end up
with dangling pointer passed to _mach_msg_send_from_kernel_proper().