21N5207g
sep-firmware.n301.RELEASE.im4p : 3a3bf6617a7e7fb83b7d2412c4f542e7208e16b48dad79e9109ae688bcb03604173d01aefdc37796dbbec9632ecc24bc
iBoot.n301.RELEASE.im4p : 1202606a6048a9d286d19110c983f7eb2ecd9d0b62e5c301dfd916cb3cc635b7e963adf0f3e6e73361bc54dd98d01c3b
| #if 0 | |
| IOAccelContext2::finish_fence_event() race condition OOB read/write | |
| This is a method exposed to user space, it takes a kernel read-only shared memory | |
| (type 2 via clientMemoryForType()) address and treats it as an IOAccelEvents Array. | |
| The user supplied index is checked against the IOAccelEvents array bounds,since there are no | |
| locks held in this method,it is possible to change the array bounds by calling | |
| IOAccelContext2::clientMemoryForType() again in a separate thread, this will expand the size by | |
| multiplying the older size by 2, but we still have a reference to the old shared memory address |
| #! /usr/bin/env python3 | |
| # | |
| # sep_firmware_split.py | |
| # Brandon Azad | |
| # | |
| # Split a decrypted Apple SEP firmware image into individual Mach-O files. | |
| # | |
| # iPhone11,8 17C5053a https://twitter.com/s1guza/status/1203550760102969345 | |
| # iPhone11,8 17E255 https://twitter.com/s1guza/status/1244683851957522435 | |
| # |
