Skip to content

Instantly share code, notes, and snippets.

@argp
argp / sandbox_i12pm_15.0_b1_19A5261w_operations.txt
Created June 15, 2021 13:44
iOS 15.0 beta 1 (19A5261w) sandbox operations
default
appleevent-send
authorization-right-obtain
boot-arg-set
device*
device-camera
device-microphone
darwin-notification-post
distributed-notification-post
dynamic-code-generation
@argp
argp / gist:1958479e8eef5b2f14b5e851714e471e
Created March 18, 2021 15:57
iOS 14.5 beta 4 (18E5178a) new sandbox operations
process-codesigning
process-codesigning-blob-get
process-codesigning-cdhash-get
process-codesigning-entitlements-blob-get
process-codesigning-identity-get
process-codesigning-teamid-get
process-codesigning-text-offset-get
socket-option
socket-option-get
socket-option-set
@argp
argp / sandbox_i11p_14.0_b1_18A5301v_operations.txt
Created June 26, 2020 13:54
iOS 14.0 beta 1 (18A5301v) sandbox operations
default
appleevent-send
authorization-right-obtain
boot-arg-set
device*
device-camera
device-microphone
darwin-notification-post
distributed-notification-post
dynamic-code-generation
@argp
argp / i11p_13.4.1_17E262_kernelcache_sandboxhelper_log.txt
Created May 18, 2020 10:06
Sandboxhelper log for the i11p 13.4.1 kernelcache
[+] Sandboxhelper | [email protected]
[+] Processed __text for additional functions
[+] _variables_populate() at: 0xfffffff008ee4824
[+] _profile_init() at: 0xfffffff008ee46c8
[+] _hook_policy_init() at: 0xfffffff008ede9d4
[+] _profile_create() at: 0xfffffff008ee4e90
[+] _the_real_platform_profile_data at: 0xfffffff00740f300
[+] _the_real_platform_profile_data size: 0xad62
[+] iOS version identified: 13.x+
[+] Sandbox operations found at: 0xfffffff007b65e88
@argp
argp / sandbox_i11p_13.4.5_b1_17F5034c_operations.txt
Created April 9, 2020 15:26
iOS 13.4.5 beta 1 (17F5034c) sandbox operations
default
appleevent-send
authorization-right-obtain
boot-arg-set
device*
device-camera
device-microphone
darwin-notification-post
distributed-notification-post
dynamic-code-generation
@argp
argp / libsandbox_10.15.4_19E266_filters.txt
Last active April 10, 2020 07:05
Filters supported by libsandbox.dylib from macOS 10.15.4 (19E266)
path
mount-relative-path
xattr
file-mode
ipc-posix-name
global-name
local-name
local
remote
control-name
@argp
argp / sandbox_i6s_13.3.1_profiles_vs_sandbox_iX_12.4_profiles.txt
Created February 7, 2020 16:43
iOS 13.3.1 vs iOS 12.4 sandbox profiles
$ diff -q sandbox_i6s_13.3.1_profiles/ sandbox_iX_12.4_profiles/ | /bin/grep Only
Only in sandbox_i6s_13.3.1_profiles/: adservicesd.sb
Only in sandbox_i6s_13.3.1_profiles/: akd.sb
Only in sandbox_i6s_13.3.1_profiles/: appsso.sb
Only in sandbox_i6s_13.3.1_profiles/: ArchiveService.sb
Only in sandbox_i6s_13.3.1_profiles/: asd.sb
Only in sandbox_iX_12.4_profiles/: assertiond.sb
Only in sandbox_i6s_13.3.1_profiles/: businesschatd.sb
Only in sandbox_i6s_13.3.1_profiles/: callservicesd.sb
Only in sandbox_i6s_13.3.1_profiles/: cfprefsd.sb
@argp
argp / 11.4-vs-12.0b2-sb-operations.diff
Created June 26, 2018 10:37
iOS 11.4 vs 12.0b2 sandbox kext operations
--- operations-iOS-11.4-15F79.txt 2018-06-26 13:30:06.556874870 +0300
+++ operations-iOS-12.0-b2-16A5308e.txt 2018-06-26 13:30:06.556874870 +0300
@@ -5,6 +5,7 @@
[xxx] operation: device*
[xxx] operation: device-camera
[xxx] operation: device-microphone
+[xxx] operation: darwin-notification-post
[xxx] operation: distributed-notification-post
[xxx] operation: dynamic-code-generation
[xxx] operation: file*

Keybase proof

I hereby claim:

  • I am argp on github.
  • I am argp (https://keybase.io/argp) on keybase.
  • I have a public key whose fingerprint is 9D37 920E 9AA6 0A07 A0BF A9EE 00C5 0762 3A25 F110

To claim this, I am signing this object:

from macholib.MachO import MachO as macho
FILE = './xuanyuansword'
FILE_ICON = './xuanyuansword_icon'
macho_obj = macho(FILE)
for (load_cmd, cmd, data) in macho_obj.headers[0].commands:
try:
segname = getattr(cmd, 'segname')