pwned4ever / freya15 Goto Github PK

        off_kalloc_data_external = 0xFFFFFFF0071D4040;
        off_kfree_data_external = 0xFFFFFFF0071D4BA8;
	off_add_x0_x0_0x40_ret = 0xFFFFFFF005C2AEC0;
        off_empty_kdata_page = 0xFFFFFFF007820000 + 0x100;
        off_trustcache = 0xFFFFFFF0078B6570;
        off_gphysbase = 0xFFFFFFF00714E5C0;
        off_gphyssize = 0xFFFFFFF00714E5C8;
        off_pmap_enter_options_addr = 0xFFFFFFF0072C7BD0;
        off_allproc = 0xFFFFFFF007896198; //done
	off_pmap_find_phys = 0xFFFFFFF0072CEAE4;
        off_ml_phys_read_data = 0xFFFFFFF0072DFEB4;
        off_ml_phys_write_data = 0xFFFFFFF0072E011C;
       off_zm_fix_addr_kalloc = 0xFFFFFFF0071373E0;

[i] iPhone 7 offsets selected for iPhone 7 iOS 15.5
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_IOSurface
[krkw_init]: method_name = kwrite_IOSurface
[i] Still root? uid: 0, gid: 0
[*] Unsandboxing pid 327
[*] Sandboxing pid 327 with slot at 0xffffffe406f525b0
Printing description of pid:
(pid_t) pid = 327
Printing description of proc:
(uint64_t) proc = 18446744005714501480
Printing description of off_p_pid:
(uint32_t) off_p_pid = 104
Printing description of where:
(uint64_t) where = 18446744005714501584
Printing description of where:
(uint64_t) where = 18446744005714501584
Printing description of out:
(uint32_t) out = 1
Printing description of _kfd:
(uint64_t) _kfd = 4309743984
Printing description of kaddr:
(u64) kaddr = 18446744005714501584
Printing description of uaddr:
(void *) uaddr = 0x000000016f852c64
Printing description of size:
(u64) size = 4
Printing description of kfd:
(u64) kfd = 4309743984
Printing description of kfd:
(kfd *) kfd = 0x0000000100e17970
Printing description of kaddr:
(u64) kaddr = 18446744005714501584
Printing description of uaddr:
(void *) uaddr = 0x000000016f852c64
Printing description of size:
(u64) size = 4
Printing description of kaddr:
(u64) kaddr = 18446744005714501584
Printing description of iosurface_uaddr:
(u64) iosurface_uaddr = 4530292060
Printing description of kfd:
(kfd *) kfd = 0x0000000100e17970
Printing description of krwObject:
(iosurface_obj) krwObject = (port = 9014512, surface_id = 1)
Printing description of backup:
(u64) backup = 6165965856
Printing description of krwObject:
(iosurface_obj) krwObject = (port = 15115, surface_id = 28)
Printing description of iosurface_uaddr:
(u64) iosurface_uaddr = 12129796096
Printing description of objectStorage:
(iosurface_obj *) objectStorage = 0x000000010e03c000
Printing description of krwObject:
(iosurface_obj) krwObject = (port = 15115, surface_id = 28)
Printing description of backup:
(u64) backup = 18446743965388162128
Printing description of kfd:
(kfd *) kfd = 0x0000000100e17970
Printing description of kaddr:
(u64) kaddr = 18446744005714501584
Printing description of iosurface_uaddr:
(u64) iosurface_uaddr = 12129796096
Printing description of objectStorage:
(iosurface_obj *) objectStorage = 0x000000010e03c000
Printing description of krwObject:
(iosurface_obj) krwObject = (port = 15115, surface_id = 28)
Printing description of backup:
(u64) backup = 18446743965388162128
Printing description of read32:
(u32) read32 = 2
Printing description of krwObject:
(iosurface_obj) krwObject = (port = 15115, surface_id = 28)
Printing description of read32:
(u32) read32 = 0
Printing description of c:
(io_connect_t) c = 15115
Printing description of surface_id:
-8.622435e+15
Printing description of output:
(uint32_t *) output = 0x000000016f852b4c
Printing description of *(output):
(uint32_t) *output = 0
Printing description of kr:
eeeiekk1Mp3ttC1
Printing description of args[0]:
(uint64_t) [0] = 6165965808
Printing description of output:
(uint32_t *) output = 0x000000016f852b4c
Printing description of *(output):
(uint32_t) *output = 0
Printing description of kr:
(kern_return_t) kr = 1
Printing description of args[0]:
<nil>
Printing description of args[0]:
(uint64_t) [0] = 28
Printing description of outsize:
(uint32_t) outsize = 1
Printing description of out:
(uint64_t) out = 6165965600
Printing description of out:
<nil>
Printing description of out:
<nil>
Printing description of kr:
(kern_return_t) kr = 1

[*] Unsandboxing pid 314
[*] before kwrite unsandbox_slot 
[*] Sandboxing pid 314 with slot at 0xffffffe4d1640c90
[*] before kwrite sandbox_slot 
[*] after kwrite64 on sandbox