| // From the iOS 16.5 kernelcache for the iPhone 12. | |
| { | |
| .kernel_base = 0xfffffff007004000, | |
| .vn_kqfilter = 0xfffffff007f43d40, | |
| .ptov_table = 0xfffffff0078e3188, | |
| .gVirtBase = 0xfffffff00792e2d8, | |
| .gPhysBase = 0xfffffff007930100, | |
| .gPhysSize = 0xfffffff007930108, | |
| .perfmon_devices = 0xfffffff00a4db540, | |
| .perfmon_dev_open = 0xfffffff007ef4214, |
This is a guide on how to activate ur idevice on ios 15 (maybe ios 14 idk) when its futurerestored on 16 sep.
DISCLAIMER: I am very aware people might use this to bypass icloud, but I am NOT encouraging you to bypass icloud.
ALSO: THIS IS RECOMMENDED FOR ADVANCED USERS ONLY, i am not responsable for ur device being broken (tho idk how it becomes broken via this)
also, i've only tested this on macOS, might work on linux tho if u replace darwin with linux and shit.
| @import Darwin; | |
| @import Foundation; | |
| @import MachO; | |
| #import <mach-o/fixup-chains.h> | |
| // you'll need helpers.m from Ian Beer's write_no_write and vm_unaligned_copy_switch_race.m from | |
| // WDBFontOverwrite | |
| // Also, set an NSAppleMusicUsageDescription in Info.plist (can be anything) | |
| // Please don't call this code on iOS 14 or below | |
| // (This temporarily overwrites tccd, and on iOS 14 and above changes do not revert on reboot) |
| #!/usr/bin/env python3 | |
| from pathlib import Path | |
| from remotezip import RemoteZip | |
| import argparse | |
| import plistlib | |
| import requests | |
| import subprocess | |
| import tempfile |
| HDMI_RESOLUTION=5 #720p | |
| cd /sys/kernel/debug/dispdbg | |
| echo disp0 > name; echo switch1 > command; echo 4 $HDMI_RESOLUTION 0 0 0x4 0x101 0 0 0 8 > param; echo 1 > start; | |
The Streamlabs macOS thick client does have hardened runtime enabled, but specifically allows DYLD environment variables and also disables library validation, which kills the purpose of hardened runtime. Having these settings on the executable enables an attacker to inject custom DYLIB libraries into the application. This would allow an attacker to access data inside the app, and possibly gain persistence on a machine, beyond that, as StreamLabs has access to the microphone and camera a user would gain access to that once exploited.
We can see the wrong permissions with running the codesign utility:
csaby@bigsur ~ % codesign -dv --entitlements :- /Applications/Streamlabs\ OBS.app
Executable=/Applications/Streamlabs OBS.app/Contents/MacOS/Streamlabs OBS
Identifier=com.streamlabs.slobs
Format=app bundle with Mach-O thin (x86_64)
First, add the ubuntu-toolchain-r/test PPA to your system with:
sudo apt install software-properties-common
sudo add-apt-repository ppa:ubuntu-toolchain-r/test
Install the desired GCC and G++ versions by typing:
sudo apt install gcc-7 g++-7 gcc-8 g++-8 gcc-9 g++-9
| # | |
| # arm64_sysregs_ios.py | |
| # Brandon Azad | |
| # | |
| # Based on https://github.com/gdelugre/ida-arm-system-highlight by Guillaume Delugre. | |
| # | |
| import idautils | |
| import idc |