arm64eabi

This is for iOS 26+ only. Read mineek's secret.txt for more info.

I didn't plan to release this that early, but as iOS 27 has already nuked partial restore; and A12/A13 being jailbreakable (including A12 iPads EOL at 26) as soon as a new kernel exploit drops, there is not much to lose.

MissedRevoke

^{(the "secret.txt" for iOS 26)}

iOS has had a long time storing revocation details in separate plists, it was trivially bypassable by zeroing and chflags immutable on them. Since iOS 26.0b2, all of these files have been migrated to mis.db.

Bypass PAC in JIT

The code snippets and conceptual analysis presented in this document are based on iOS 16.2.

The bug was disclosed and patched after Pwn2Own 2024 and was assigned CVE-2024-27834. Details of the patch can be found in the WebKit repository.

2023 predator sample

Thanks to Google for sharing the sample.

VersionDispatcher

The int uname(struct utsname *); function retrieves the current device information, containing info such as iPhone13,2\x00 to identify the device model.

	This will permanently block revokes and some ppq stuff.
	Use this together with the profile to block some domains "without" a DNS.
	Even if you don't have the profile, after applying this your device just cannot register revokes anymore. So you'll just not be able to install the app, but you will not get permanently blacklisted.

	note this may lead to side effects. I am not sure. However, it does work.

	AS ALWAYS, USE AT YOUR OWN RISK.

	Basically all u need to do is run these commands one by one in a terminal on a jailbroken device:

	CVE-2025-43520 - DarkSword

	1. cluster_read_ext and cluster_write_ext call cluster_io_type to determine what IO operation to perform
	2. cluster_io_type calls vm_map_get_upl with UPL_QUERY_OBJECT_TYPE to query type of the vm_object that backs the user-supplied virtual address range
	3. If this object is physically contiguous it returns IO_CONTIG, otherwise it returns IO_DIRECT or IO_COPY
	4. If cluster_io_type returns IO_CONTIG, cluster_[read\|write]_ext will call the "contig" variant, cluster_[read\|write]_contig
	5. cluster_[read\|write]_contig then calls vm_map_get_upl a second time to get the UPL from the uio
	6. It then grabs the first physical page from the UPL using upl_phys_page and performs a physical copy
	7. This is a TOCTOU. An attacker can remap the virtual address range so that the region is no longer physically contiguous after the first call to vm_map_get_upl, causing an OOBR/OOBW to physmem

	#!/bin/sh
	set -eu

	# Mirror IP addresses for updates.cdn-apple.com
	MIRRORS="
	17.253.53.35
	17.253.53.203
	17.253.53.202
	37.143.84.100
	37.143.84.113

	[
	{
	"name": "DSPSR",
	"enc": [3, 3, 4, 5, 0],
	"minel": 0,
	"width": 32,
	"fields": [
	{
	"name": "N",

	[
	{
	"name": "DSPSR",
	"enc": [3, 3, 4, 5, 0],
	"minel": 0,
	"width": 32,
	"fields": [
	{
	"name": "N",