openjailbreak / acorn Goto Github PK
View Code? Open in Web Editor NEWThis project forked from xerub/acorn
untethered+unsandboxed code execution in iOS 11
This project forked from xerub/acorn
untethered+unsandboxed code execution in iOS 11
Bugs and techniques to achieve untethered+unsandboxed code execution in iOS 11 Credits: @littlelailo - racoon bug (originally @pod2g) @S1guza - ASLR bug @ZecOps - sandbox escape writeup @_bazad - memory spray Add iOS racoon executable and dyld_shared_cache_arm64 to device/ and type make. Then collect racoon.conf and stage2.bin. Enjoy! === racoon.conf use 'wins4'/'dns4' to write arbitrary bytes at relative offset, targeting `lcconf` point `lcconf` at the `_platform_memmove` lazy pointer and smash it use 'banner' to call `strlcpy` which loads the smashed lazy pointer with controlled data stage1 sits inside the banner string and must not contain local pointers (runs at unknown address): 1. remap shared cache at known address 2. remap stage2 at known address inside racoon address space (stage2 must be on-disk, and must be accessible from the racoon sandbox) 3. stash the current slide at stage2[0] 4. jump to stage2 stage2 runs inside racoon at fixed address: 1. relocate itself using stage2[0] 2. fix back `_platform_memmove` lazy pointer 3. unmap the secondary shared cache 4. relocate stage3 5. relocate stage4 and write it to disk (stage4 location must be accessible from the racoon sandbox) 6. trigger cfprefsd bug push stage3 at GUESS_ADDR in a spray thread trigger cfprefsd bug which will execute stage3 in the faulty thread stage3 is inside cfprefsd spray thread and must not contain local pointers (runs at unknown address after pivot): 1. copy back itself on the faulty thread stack, because the spray thread will vanish 2. pivot by means of `memmove+4` 3. remap stage4 at known address inside cfprefsd address space stage4 runs inside cfprefsd at fixed address: 1. run the unsandboxed payload === stage2 is split in two parts a. the auto-reloc code: uses gadgets from the shadow cache b. the actual code: uses gadgets from the main shared cache stage2 begins with `rope` and ends with `rope_end` *rope = stage2[0] = slide external relocations is an array of offsets, each offset being relative to `rope` external relocations start with a 0, so it can be parsed backwards stage3/4 have the same type of external relocations as stage2
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.