yrp604

XNU syscall path

Chart

             +------------------+
             |These push their  |                                  +-----------------------+
             |respective syscall|                                  |This overwrites the    |
             |dispatch functions|                                  |saved dispatch function|
             |onto the stack    |                                  |with hndl_alltraps     |

mattifestation

echo -----BEGIN CERTIFICATE----- > encoded.txt
echo Just Base64 encode your binary data
echo TVoAAA== >> encoded.txt
echo -----END CERTIFICATE----- >> encoded.txt
certutil -decode encoded.txt decoded.bin

ckuethe

{
    "0": {
        "comm": "\nSection .text\n\nRange 0x0 - 0x4000 (16384 bytes)\nFile offset 65536 (16384 bytes)\n", 
        "icom": null, 
        "name": "BOOTROM_BASE", 
        "seg": 0
    }, 
    "148": {
        "comm": null, 
        "icom": null, 

gist:de6b81c556b5dc7cdc8b

#include <unistd.h>
#include <mach/mach.h>
#include <mach/mach_vm.h>
#include <mach-o/dyld.h>

int
main (int argc, char * argv[])
{
  volatile char * library;
  const mach_vm_size_t page_size = getpagesize ();

lyonanderson

python -c "print '`idevicediagnostics  ioreg IOAccessory | grep -A 2 IOAccessoryDigitalID | tail -1`'.strip().decode('base64').encode('hex')" 

christopher-hopper

Resize a Hard Disk for a Virtual Machine

Our Virtual Machines are provisioned using Vagrant from a Linux base box to run using VirutalBox. If the Hard Disk space runs out and you cannot remove files to free-up space, you can resize the Hard Disk using some VirtualBox and Linux commands.

Some assumptions

The following steps assume you've got a set-up like mine, where:

winocm

/*
 * Shadowmapping, a way of bypassing iOS 'kernel page bits protection'. 
 * (ARM32 only for now obviously.)
 *
 * Also a very nice and easy way of copying data in and out of kernel memory
 * by breaking the barrier entirely. Thank you TTBCR and split TTBR0/TTBR1!<3
 *
 * Control flow goes like this if you have a write anywhere exploit:
 *
 *  - Find location of kernel_pmap (dereference to get kernel_pmap_store.)

rspeer

"""
This file contains code that, when run on Python 2.7.5 or earlier, creates
a string that should not exist: u'\Udeadbeef'. That's a single "character"
that's illegal in Python because it's outside the valid Unicode range.

It then uses it to crash various things in the Python standard library and
corrupt a database.

On Python 3... well, this file is full of syntax errors on Python 3. But
if you were to change the print statements and byte literals and stuff:

leifg

file_to_disk = './tmp/large_disk.vdi'

Vagrant::Config.run do |config|
  config.vm.box = 'base'

  config.vm.customize ['createhd', '--filename', file_to_disk, '--size', 500 * 1024]
  config.vm.customize ['storageattach', :id, '--storagectl', 'SATA Controller', '--port', 1, '--device', 0, '--type', 'hdd', '--medium', file_to_disk]
end