saagarjha

// clang path_hook.mm -shared -ldl -g -framework Foundation path_hook.o -L/usr/lib/swift

#include <cassert>
#include <cstdint>
#include <dlfcn.h>
#include <mach/arm/vm_param.h>
#include <mach/kern_return.h>
#include <mach/mach_init.h>
#include <mach/vm_map.h>
#include <mach/vm_prot.h>

LinusHenze

iOS 16 introduced launch constraints, which can be used to constraint the launch of an application.
There are three types of constraints:
    Self Constraints, which the launched application itself must meet
    Parent Constraints, which the parent process must meet
    Responsible Constraints, which the "responsible process" must meet (I assume that the responsible process is the process that asked launchd to launch a service)

Additionally, the TrustCache format was updated (see below) to support assigning each binary a "Constraint Category", which forces Self and Parent Constraints.
Note that Self, Parent and Responsible Constraints can also be set by the process performing the launch and they can be included in the code signature, in the new blob type 0xFADE8181. In both cases, the constraints are DER encoded (just like the DER entitlements).

Constraint Categories (from TrustCache, new in version 2):

R167

package main

import (
	"fmt"

	"encoding/json"

	"github.com/slack-go/slack"
)

kazuho

/*
 * NAME: injectaddr.so
 *
 * SYSOPSIS:
 *   % gcc -shared -fPIC injectaddr.c -ldl -o injectaddr.so
 *
 *     -- inject 1s delay, then connect to 127.0.0.1:8888
 *   % LD_PRELOAD=injectaddr.so \
 *     curl http://d1000.p8888.4127-0-0-1.inject.example.com/
 *

theevilbit

/*
Compile:

gcc -framework Foundation -framework AppKit screenshot.m -o screenshot
*/

#import <Foundation/Foundation.h>
#import <AppKit/AppKit.h>

int main(void) {

edmundsmith

Things I wish $Lang had

Sometimes, when programming, I notice that I'm missing some useful features, or when reading I think 'this would be really useful to be part of $Lang'.

Explicit order-invariance and synchronisation points

C compilers are part of why C is hard. They re-order statements based on what appears to be a magic black box. Understanding what's in that black box is much harder than it should be. Many statements (or expressions) in programming act completely independently of each other, and thus their order of execution should not matter. Meanwhile, other statements can depend on the execution of a previous statement (/expression). It would be nice to see the execution dependency graph explicitly and syntactically laid out, rather than being inferred from analysis or assuming every statement to induce a synchronisation point.

Some languages get part of this right. Haskell's laziness means order of execution doesn't need to match the order it's written down, and its purity means that orde

vsivsi

GNU C / Asm test of AVX512 opmask clobbering on Darwin

This is an alternative implemenation of: https://gist.github.com/vsivsi/fff8618ace4b02eb410dd8792779bf32

NOTE! This must be run on an Intel processor supporting AVX512F/DQ

Build and run (in background): gcc testmask.c testmask.s && ./a.out &

Send a bunch of SIGURG signals: for ((x=0;x<20;x++)); do kill -s URG <pid>; sleep 0.01; done

vsivsi

Maskcheck is a repro of opmask clobbering by golang async preemption

A GNU C / Asm implementation is here: https://gist.github.com/vsivsi/8511aca1bac528f49fbb45a636afa4b5

NOTE! This must be run on an Intel processor supporting AVX512F/DQ

To test: go test -count 1 -timeout 15m -run '^TestMask$' gist.github.com/vsivsi/fff8618ace4b02eb410dd8792779bf32

This should fail with something like:

saagarjha

// To compile: clang++ -arch x86_64 -arch arm64 -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
// then codesign with com.apple.developer.endpoint-security.client and run the
// program as root.

#include <EndpointSecurity/EndpointSecurity.h>
#include <algorithm>
#include <array>
#include <bsm/libbsm.h>
#include <cstdint>
#include <cstdlib>

zhuowei

For enabling Universal Control on older Macs, there are three ways.

(All of these requires you to enable the feature flag and disable SIP)

• Use khronokernel's kext: https://twitter.com/khronokernel/status/1428407216931999749

(I haven't tried this but it looks like it'd work)

• use DYLD_INSERT_LIBRARIES: