Skip to content

Instantly share code, notes, and snippets.

View verygenericname's full-sized avatar
💀

Nathan verygenericname

💀
View GitHub Profile
@jakeajames
jakeajames / IOSurface_stuff.c
Last active September 1, 2022 02:45
WIP CVE-2021-30955 exploit
//
// IOSurface_stuff.c
// time_waste
//
// Created by Jake James on 2/22/20.
// Copyright © 2020 Jake James. All rights reserved.
//
#import "IOSurface_stuff.h"
Also see https://github.com/zhuowei/CoreTrustDemo/blob/main/littlemis.txt for my previous notes
first time X509ChainCheckPathWithOptions, param3 (options) is null
second time X509ChainCheckPathWithOptions, param3 (options) is set
-> This is the call out of CTEvaluateAMFICodeSignatureCMS_MaxDigestType, and is the one that sets the flags
struct ContentInfoSignedData {
int always4; // 0x0
void* someBufferFromCTParseContentInfoSignedDataArg6; // 0x8
// ?