Skip to content

Instantly share code, notes, and snippets.

struct FileEntry {
char tag[4];
u32 offset;
u32 length;
u32 pad;
};
struct FTAB_Header {
u32 unk[8];
char magic[8];
  • `brew install libusb``
  • ./configure --enable-bonobo --disable-werror CFLAGS=-I/opt/homebrew/Cellar/libusb/1.0.27/include/libusb-1.0
ROM:00003965 DCB 0, 0x60, 0
ROM:00003968 aArgumentD DCB "argument = %d",0xA,0
ROM:00003977 DCB 0xA,0
ROM:00003979 aPullingTz0Blac DCB "pulling TZ0 blackbird",0xA,0
ROM:00003990 aTz000xX DCB "TZ0[0]: 0x%x",0xA,0
ROM:0000399E aTz010xX DCB "TZ0[1]: 0x%x",0xA,0
ROM:000039AC aTz0RegsModifie DCB "TZ0 regs modified",0xA,0
ROM:000039BF aTz0FailedToLoc DCB "TZ0 failed to lock",0xA,0
ROM:000039D3 aTz1FailedToLoc DCB "TZ1 failed to lock",0xA,0
ROM:000039E7 aTz0Base0xLlx DCB "tz0_base: 0x%llx",0xA,0
fio --filename=/tmp/test --rw=randread --size=2Go --direct=1 --bs=1M --ioengine=libaio --runtime=60 --numjobs=1 --time_based --group_reporting --name=seq_read --iodepth=16
fio --filename=/tmp/test --rw=read --size=5Go --direct=1 --bs=1M --ioengine=libaio --runtime=60 --numjobs=1 --time_based --group_reporting --name=seq_read --iodepth=16
@matteyeux
matteyeux / decrypted.json
Created November 20, 2023 13:15
Apple Vision Pro firmware keys for VisionOS 1.0 beta 1-5
[
{
"url": "https://updates.cdn-apple.com/2023SummerSeed/patches/042-21091/60572AF0-9BC3-465F-89ED-77117194CB26/com_apple_MobileAsset_SoftwareUpdate/3df121022bd578846478faa25a4dcf3055396954.zip",
"build": "21N5207g",
"filename": "iBEC.n301.RELEASE.im4p",
"kbag": "AB7893B981E44BFF298328C89C826F8BA6EF1A7ADC80DB156C9D55D9F4E27E8AD2CC21AFA42A41E1392B57E9FE90D992",
"key": "34b218667cd03eb93e073b9b3bca4a865b20f130550a800b2aa2c1c2348041865cee47db7e3bcda739d05adde9f9f716"
},
{
"url": "https://updates.cdn-apple.com/2023SummerSeed/patches/042-21091/60572AF0-9BC3-465F-89ED-77117194CB26/com_apple_MobileAsset_SoftwareUpdate/3df121022bd578846478faa25a4dcf3055396954.zip",
@matteyeux
matteyeux / f.md
Last active March 22, 2025 18:47
macOS and iOS Security Internals Advent Calendar
@matteyeux
matteyeux / sptm.py
Last active December 4, 2024 18:14
Binary Ninja snippet to symbolize sptm
# void _panic(char const* func, char const* str, ...)
def get_panic():
for s in bv.strings:
if "somehow a violation was triggered in early boot" in s.value:
break
ref = list(bv.get_code_refs(s.start))[0]
real_panic = bv.get_functions_containing(ref.address)[0]
panic_ref = list(bv.get_code_refs(real_panic.start))[0]
panic_wrapper = bv.get_functions_containing(panic_ref.address)[0]
@matteyeux
matteyeux / avp.md
Last active November 14, 2023 13:01

We will add a 15GB disk for a specific partition : /var/db/elasticsearch

List the disks :

[root@centos8s vagrant]# fdisk -l 
Disk /dev/vda: 128 GiB, 137438953472 bytes, 268435456 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
@matteyeux
matteyeux / m2.txt
Last active July 25, 2023 23:16
AP and SEP key for j493ap
LLB.j493.RELEASE.im4p_23A5276g_14.0beta2 642e245057dde4318e4a08e1b4b8678c4194a9f0a7ca485eaeb2fc49d327fc436b979d2c291e8eeb59600ffcaacd0832
iBoot.j493.RELEASE.im4p_23A5276g_14.0beta2 999880852a0fcdf07fc3bd7f2d8f86cbf81cd0a2fafcf3444c1245ba4bbedd826420f777abfbb4d2b066d9a268e8b856
iBootData.j493.RELEASE.im4p_23A5276g_14.0beta2 8c45bf542bd33f9a166e22bc4cb77552540aff204451a5d4a32516fea9b48a2df4d21deda4a4e19f065e5079fce63d56
iBEC.j493.RELEASE.im4p_23A5276g_14.0beta2 cf412bca06ef2def7789bc0747a4d184e0972ab810682ab25f980760de1bc36d1f982667c51df0821822542a03b9d69b
iBSS.j493.RELEASE.im4p_23A5276g_14.0beta2 d539a033053deace9db769564d575196a6fb55806a595f56a8e73f4b518bd3c946492f64948df282aaa89fba3e90c513
LLB.j493.RELEASE.im4p_22F82_13.4.1 1d0c4b102b75f102548f23be154a25bb6916dfd1f91f1338bbc370faf4494598302d1691defb13c6eeb360b46fd7c594
iBoot.j493.RELEASE.im4p_22F82_13.4.1 8745c8ca87bfad1b2be9538c5add23fe2d8ab7751128949f56d53acb22d8309b1e1b0d5667d58da2241345ea32597831
iBootData.j493.RELEASE.im4p_22F82_13.4.1 7172fe2c46c183ac1