Peterpan0927’s gists

JJTech0130 / debugger_jit_improved.m

Last active March 4, 2025 06:10

Improved method of using a debugger for JIT on iOS... Uses split rx/rw regions, and works on iOS 18.4b1

	#import <Foundation/Foundation.h>
	#import <mach/mach.h>
	#import <stdio.h>
	#import <stdlib.h>
	#import <string.h>
	#include <libkern/OSCacheControl.h>

	const int REGION_SIZE = 0x4000*1;

	void write_instructions(void* page)

aemmitt-ns / quinefuck.m

Last active October 14, 2023 19:36

a brainfuck interpreter made with an NSExpression that evaluates on itself. idk.

	// yields brainfuck when quined
	char *h = "++++++++[>++++[>++>+++>+++>+<<<<-]>+>+>->>+[<]<-]"
	">>.>---.+++++++..+++.>>.<-.<.+++.------.--------.>>+.>++."; // -> Hello World!
	#import <Foundation/Foundation.h>
	int main(int argc, char *argv[]) {
	NSString *program = [NSString stringWithUTF8String: argc > 1 ? argv[1] : h];
	NSMutableArray *prog = [NSMutableArray array]; // make the program into an array cuz its easier
	for (int i = 0; i < program.length; i++) {
	NSString *c = [program substringWithRange: NSMakeRange(i, 1)];
	if ([@".,<>-+[]" rangeOfString: c].location != NSNotFound) [prog addObject: c];

jakeajames / IOSurface_stuff.c

Last active September 1, 2022 02:45

WIP CVE-2021-30955 exploit

	//
	// IOSurface_stuff.c
	// time_waste
	//
	// Created by Jake James on 2/22/20.
	// Copyright © 2020 Jake James. All rights reserved.
	//

	#import "IOSurface_stuff.h"

theevilbit / get_apple_oss.sh

Last active April 25, 2022 04:32

Download All Apple OSS Tarballs from Github

	#!/bin/zsh

	: '
	You need a personal access token for GitHub to avoid hitting the rate limit. Refer to the docs:
	https://docs.github.com/en/rest/guides/getting-started-with-the-rest-api
	https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token
	'

	APPLE_OSS_DIR="all_apple_oss_archives"
	APPLE_OSS_REPO_FILE="all_apple_oss_repo_names.txt"

sleirsgoevy / ps4.html

Created October 27, 2021 16:06

PS4 WebKit exploit on 9.00

	<script>
	var PAGE_SIZE = 16384;
	var SIZEOF_CSS_FONT_FACE = 0xb8;
	var HASHMAP_BUCKET = 208;
	var STRING_OFFSET = 20;
	var SPRAY_FONTS = 0x1000;
	var GUESS_FONT = 0x200430000;
	var NPAGES = 20;
	var INVALID_POINTER = 0;
	var HAMMER_FONT_NAME = "font8"; //must take bucket 3 of 8 (counting from zero)

tothi / usbgadget_razer.sh

Created August 22, 2021 09:52

Razer USB gadget on Android for Local Privilege Escalation on Windows

	# MINIMAL USB gadget setup using CONFIGFS for simulating Razer Gaming HID
	# devices for triggering the vulnerable Windows Driver installer
	# credits for the Windows Driver install vuln: @j0nh4t
	#
	# https://twitter.com/j0nh4t/status/1429049506021138437
	# https://twitter.com/an0n_r0/status/1429263450748895236
	#

	# the script was developed & tested on Android LineageOS 18.1

NyanSatan / t8101-ap_keys-180821.json

Created August 17, 2021 22:28

T8101 AP keys 18.08.21, credits: @nicolas09F9 and @1nsane_dev

	[
	{
	"device": "iPad13,1",
	"build": "18A373",
	"type": "LLB",
	"filename": "LLB.j307.RELEASE.im4p",
	"kbag": "676bf28f579b3fda712e29018b0a716149f1f048e7be83dbc62861ef91ba82388782caa400827db9cc0b4c3b79bdf348",
	"key": "5fb08c72053ab558760f6b7329934406e89893dbe995e443e67732168aab5330979ccce7129c8cb2a96a41f1084dbb28"
	},
	{

cd789 / concat_exploit.js

Created August 14, 2021 06:44

	class Helpers {
	constructor() {
	this.buf = new ArrayBuffer(8);
	this.f64 = new Float64Array(this.buf);
	this.f32 = new Float32Array(this.buf);
	this.u32 = new Uint32Array(this.buf);
	this.u64 = new BigUint64Array(this.buf);
	this.state = {};
	}

Proteas / com.apple.private.allow-explicit-graphics-priority.txt

Created July 28, 2021 03:01

com.apple.private.allow-explicit-graphics-priority, iOS-v15.0-19A5261w-iPhone13,2

	/usr/libexec/backboardd
	/usr/sbin/mediaserverd
	/System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.GPU.xpc/com.apple.WebKit.GPU
	/System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.WebContent.xpc/com.apple.WebKit.WebContent
	/System/Library/Frameworks/AssetsLibrary.framework/Support/assetsd
	/System/Library/PrivateFrameworks/NanoTimeKitCompanion.framework/nanotimekitcompaniond
	/System/Library/PrivateFrameworks/NanoTimeKitCompanion.framework/XPCServices/NTKFaceSnapshotService.xpc/NTKFaceSnapshotService
	/System/Library/PrivateFrameworks/IMTranscoding.framework/XPCServices/IMTranscoderAgent.xpc/IMTranscoderAgent
	/System/Library/PrivateFrameworks/CoreSuggestions.framework/suggestd
	/private/var/staged_system_apps/Maps.app/Maps

rickmark / certificate.pem.txtq

Created July 12, 2021 08:09

Apple Adding old Certificate?

	Certificate:
	Data:
	Version: 3 (0x2)
	Serial Number: 45 (0x2d)
	Signature Algorithm: sha1WithRSAEncryption
	Issuer: C = US, O = Apple Inc., OU = Apple Certification Authority, CN = Apple iPhone Certification Authority
	Validity
	Not Before: Jul 14 22:32:48 2011 GMT
	Not After : Jul 14 22:32:48 2018 GMT
	Subject: C = US, O = Apple Inc., OU = Apple iOS Asset Manifest, CN = Asset Manifest Signing

Peterpan0927 Peterpan0927