diskutil erasevolume HFS+ 'RAM Disk' `hdiutil attach -nobrowse -nomount ram://XXXXX`where XXXXX is the size of the RAM disk in terms of memory blocks.
Notes:
John Coates JohnCoates
psifertex
/ 1_Snippet_Instructions.txt
Last active
December 31, 2025 23:49
my current collection of snippets
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Welcome to Jordan's grab-bag of common Binary Ninja Snippets. | |
| These snippets are meant to run with the Binary Ninja Snippets Plugin | |
| (http://github.com/Vector35/snippets) though they can all also be pasted | |
| directly into the python console or turned into stand-alone plugins if needed. | |
| To install the entire collection at once, just install the Snippets plugin via | |
| the plugin manager (CMD/CTL-SHIFT-M), confirm the Snippet Editor works | |
| (Tool/Snippets/Snippet Editor), and unzip this bundle (Download ZIP above) into | |
| your Snippets folder. |
0x36
/ oob_events.c
Created
November 5, 2020 23:16
IOAccelContext2::finish_fence_event() race condition OOB read/write
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #if 0 | |
| IOAccelContext2::finish_fence_event() race condition OOB read/write | |
| This is a method exposed to user space, it takes a kernel read-only shared memory | |
| (type 2 via clientMemoryForType()) address and treats it as an IOAccelEvents Array. | |
| The user supplied index is checked against the IOAccelEvents array bounds,since there are no | |
| locks held in this method,it is possible to change the array bounds by calling | |
| IOAccelContext2::clientMemoryForType() again in a separate thread, this will expand the size by | |
| multiplying the older size by 2, but we still have a reference to the old shared memory address |
OlderNewer