Skip to content

Instantly share code, notes, and snippets.

Sadly I don't have a dev device on iOS 10, but for anyone playing around with zIVA caring about the kernel task port:

Starting with iOS 10.3 (and macOS 10.12.4), Apple changed convert_port_to_locked_task (and a few other port-to-something conversion functions) to blacklist the kernel task by means of a direct check. As a result, you can still obtain the kernel task port, but almost all APIs will simply treat it like MACH_PORT_NULL, thus rendering it useless. The check is a simple pointer comparison though, so it can be circumvented by just remapping the task struct at an additional virtual address and creating a new port from that with a ROP equivalent of:

vm_map_remap(
    kernel_map,
    &remap_addr,
    sizeof(task_t),
    0,

VM_FLAGS_ANYWHERE | VM_FLAGS_RETURN_DATA_ADDR,

/*
* SEP firmware split tool
*
* Copyright (c) 2017 xerub
*/
#include <fcntl.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
@matthewaveryusa
matthewaveryusa / grab_io_kbm.c
Created May 20, 2016 03:13
linux grab io from keyboard and mouse
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <linux/input.h>
#include <time.h>
#include <stdint.h>
int main(int argc, char* argv[]){
sleep(1);
@briancroom
briancroom / Swift.md
Last active February 6, 2024 18:26
How to create a Swift modular library

I am trying to determine if it is possible to build a Swift dynamic library which is itself composed of one of more private modules, without needing to expose to that fact to outside users. My hope was that I could build the private module as a static library, which would be linked into the primary (dynamic) library. The dylib could then be deployed together with its swiftmodule and swiftdoc and be imported, with the private module and its symbols not being exposed at all.

Unfortunately, what I'm currently observing seems to indicate that the private module's swiftmodule also has to be available for the primary library to be successfully imported.

This can be reproduced as follows. I have the following directory structure:

./Greeter/Logger/Logger.swift:

public func log(_ message: String) {
@vasanthk
vasanthk / System Design.md
Last active April 24, 2024 17:22
System Design Cheatsheet

System Design Cheatsheet

Picking the right architecture = Picking the right battles + Managing trade-offs

Basic Steps

  1. Clarify and agree on the scope of the system
  • User cases (description of sequences of events that, taken together, lead to a system doing something useful)
    • Who is going to use it?
    • How are they going to use it?
@dropmeaword
dropmeaword / browser_history.md
Last active April 5, 2024 17:37
Playing around with Chrome's history

Browser histories

Unless you are using Safari on OSX, most browsers will have some kind of free plugin that you can use to export the browser's history. So that's probably the easiest way. The harder way, which seems to be what Safari wants is a bit more hacky but it will also work for other browsers. Turns out that most of them, including Safari, have their history saved in some kind of sqlite database file somewhere in your home directory.

The OSX Finder cheats a little bit and doesn't show us all the files that actually exist on our drive. It tries to protect us from ourselves by hiding some system and application-specific files. You can work around this by either using the terminal (my preferred method) or by using the Cmd+Shft+G in Finder.

Finder

Once you locate the file containing the browser's history, copy it to make a backup just in case we screw up.

@xerub
xerub / Simp.py
Last active July 15, 2022 00:18
AArch64 mov simplifier IDA plugin
# AArch64 mov simplifier IDA plugin
#
# Copyright (c) 2015 xerub
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
@jj1bdx
jj1bdx / avr-devenv-install-macos.md
Last active January 25, 2023 10:47
Installing 8bit AVR development kit from macOS HomeBrew and FreeBSD Ports with the optiboot environment

AVR 8bit HomeBrew installation for macOS

In case you have a trouble for updating the tap, perform uninstalling of the related tools and osx-cross/avr tap:

brew remove avr-binutils avr-gcc
brew untap osx-cross/avr

For installing the tap, do the following:

@wkrsz
wkrsz / README
Last active March 6, 2018 03:12
Git pre-push hook that shows changes and ask for confirmation when pushing to production repo.
Whenever you push to remote that has "production" in its name,
this hook will show commits and changes and then ask for confirmation.
Copy or symlink to .git/hooks/pre-push.
Deployment by pushing code to remote github repo are very convenient
but prone to accidents. I wanted something that would force me to
review what's being pushed.
My Bash-foo is very limited to suggestions for improvements are very welcome.
@domenic
domenic / 0-github-actions.md
Last active April 8, 2024 23:35
Auto-deploying built products to gh-pages with Travis

Auto-deploying built products to gh-pages with GitHub Actions

This is a set up for projects which want to check in only their source files, but have their gh-pages branch automatically updated with some compiled output every time they push.

A file below this one contains the steps for doing this with Travis CI. However, these days I recommend GitHub Actions, for the following reasons:

  • It is much easier and requires less steps, because you are already authenticated with GitHub, so you don't need to share secret keys across services like you do when coordinate Travis CI and GitHub.
  • It is free, with no quotas.
  • Anecdotally, builds are much faster with GitHub Actions than with Travis CI, especially in terms of time spent waiting for a builder.