Skip to content

Instantly share code, notes, and snippets.

View zweed4u's full-sized avatar

Zachary Weeden zweed4u

View GitHub Profile
@zweed4u
zweed4u / unlocknvram.c
Created December 20, 2017 23:13 — forked from stek29/unlocknvram.c
async_wake nvram
// iOS 11 moves OFVariables to const
// https://twitter.com/s1guza/status/908790514178301952
// however, if we:
// 1) Can find IODTNVRAM service
// 2) Have tfp0 / kernel read|write|alloc
// 3) Can leak kernel address of mach port
// then we can fake vtable on IODTNVRAM object
// async_wake satisfies those requirements
// however, I wasn't able to actually set or get ANY nvram variable
// not even userread/userwrite