Kyle-Ye

Inspired by https://infosec.exchange/@jjtech/112612685494089718

Method 1: LLDB

Step 0

Reboot into Recovery OS + Disable SIP

csrutil disable

thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

KhaosT

Displaying HDMI sources on Apple Vision Pro

While it's possible to stream most content to Apple Vision Pro directly over the internet, having the ability to use Apple Vision Pro as an HDMI display can still be useful.

Since Apple Vision Pro does not support connecting to an HDMI input directly or using an HDMI capture card, we have to be a little creative to make this work. NDI provides the ability to stream HDMI content over a local network with really low latency, and it works great with Apple Vision Pro.

This page shows the setup I’m using.

saagarjha

// Sometimes you have a large file on a small disk and would like to "transform"
// it in some way: for example, by decompressing it. However, you might not have
// enough space on disk to keep both the the compressed file and the
// decompressed results. If the process can be done in a streaming fashion, it
// would be nice if the file could be "drained"; that is, the file would be
// sequentially deleted as it is consumed. At the start you'd have 100% of the
// original file, somewhere in the middle you'd have about half of the original
// file and half of your output, and by the end the original file will be gone
// and you'll be left with just the results. If you do it this way, you might
// be able to do the entire operation without extra space!

ole

// UserDefaults KVO observation with AsyncSequence/AsyncStream
// Ole Begemann, 2023-04
// Updated for Swift 6, 2024-11
// https://gist.github.com/ole/fc5c1f4c763d28d9ba70940512e81916

import Foundation

// This is ugly, but UserDefaults is documented to be thread-safe, so this
// should be OK.
extension UserDefaults: @retroactive @unchecked Sendable {}

zhuowei

PurpleSystemAppPort
PurpleSystemEventPort
UIASTNotificationCenter
com.apple.ABDatabaseDoctor
com.apple.AppSSO.service-xpc
com.apple.AuthenticationServicesCore.AuthenticationServicesAgent
com.apple.CARenderServer
com.apple.ClipServices.clipserviced
com.apple.CoreAuthentication.daemon
com.apple.DeviceAccess.xpc

nicolas17

.global _main
.extern _putchar

.align 4

_main:
    // prolog; save fp,lr,x19
    stp x29, x30, [sp, #-0x20]!
    str x19, [sp, #0x10]

Sherlouk

//
// DebugDevice.swift
//
// Copyright 2022 • Sidetrack Tech Limited
//

import Foundation

// This must be called on the main-thread.
var isDebugProfileInstalled: Bool {

aemmitt-ns

NSPredicate *pred = [NSPredicate predicateWithFormat:@"1=cast({" // cast to get nice error in syslog for debugging
    // use format string to read the address of _NSPredicateUtilities ( #self() ), theres prolly a better way
    "$_NSPredicateUtilities    := function('','stringByAppendingFormat:', '%p/%lld', #self()).lastPathComponent.longLongValue,"
    "$_predicateSecurityFlags  := $_NSPredicateUtilities + 0x188c,"      // address of _predicateSecurityFlags
    "$_predicateSecurityOnce   := $_predicateSecurityFlags - 0x276daec," // address of _predicateSecurityOnce
    "$forbiddenClassesLength   := $_predicateSecurityFlags + 0x63a334,"  // address of length field for array of forbidden classes
    "$forbiddenSelectorsLength := $_predicateSecurityFlags + 0x63a3d4,"  // address of length field for array of forbidden selectors

    "$NSTask := $_NSPredicateUtilities + 0x637860," // address of NSTask class
    "$NSPipe := $NSTask - 0x41a0,"                  // address of NSPipe class

jtrivedi

func scrollViewDidScroll(_ scrollView: UIScrollView) {
    for (i, view) in scrollView.subviews.enumerated() {
        var ty = 0.0
        if scrollView.contentOffset.y < 0 {
            // We're scrolling past the top of the scroll view.
            // Translate each item in the scroll view by some amount based on its index and scroll offset.
            ty = CGFloat(i) * abs(offsetY) / 8.0 * pow(1.12, CGFloat(i))
        }
        view.transform = CGAffineTransform(translationX: 0, y: ty)
    }