The weightbufs from 0x36

weightbufs's People

Contributors

Stargazers

Watchers

weightbufs's Issues

Is it possible to run this on Linux

Doesn't work on 15.3 rc (ipad air 3rd generation)

it crashes on this line on 15.3 rc

weightBufs/exploit/exploit.m

Line 1048 in c9140d1

 assert(!((aneMemSurface.p_IOSurface - IOSurface_zone_page) % IOSURFACE_OBJ_SIZE)); 

Sometimes kernel panics on iPadOS 15.5 A13/iPad Air 3rd Gen

I have explicitly declared cpusubtype as 1, and the device sometimes kernel panics after the following output. I have also had success with this configuration, so it does work - seems to be unreliable and requires a reboot to work.

[+] Patching model.hwx with custom initInfo section ... OK
[+] Stage 1: Grooming kernel memory ... 
[+] Grooming IOSurface_zone ... OK
[+] Grooming pageable maps ... OK
[+] Grooming kernel_map ... . . . . . OK
[+] Patching model.hwx with custom initInfo section ... OK
[+] Found scratched ShmemID 0x1f73 with size 0x4000
00 40 00 00 00 00 00 00  50 1D 44 EC E3 FF FF FF  |  [email protected]..... 
00 00 E8 05 00 00 00 00  C8 0B 6B D2 E4 FF FF FF  |  ..........k..... 
80 E6 46 EB E3 FF FF FF  00 40 35 08 E6 FF FF FF  |  ..F......@5..... 
10 FB A7 D2 E4 FF FF FF  4B 54 55 4D 01 00 00 00  |  ........KTUM.... 
00 00 00 00 00 00 00 00                           |  ........ 
[+] Leaked mutable kernel section (MUTK) buffer 0xffffffe608354000 
[+] Leaked IOSurface object 0xffffffe3ec441d50 
[+] Kernel location of our input buffer 0xffffffe608214000 
[+] Stage 3: Dumping a memory page from IOSurface_zone  
[+] Patching model.hwx with custom initInfo section ... OK

Recommend Projects