bb33bb

.text

.pool

.set ARM_TTE_BLOCK_PNX, 0x0020000000000000
.set ARM_TTE_BLOCK_NX, 0x0040000000000000
.set SDRAM_PAGE1, 0x180082000
.set SRAM_PAGE1, 0x1800841F0

.global _main

bb33bb

// https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-1048.html

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <mqueue.h>

bb33bb

#!/bin/bash
#
# deboot.sh
# script to build Ubuntu rootfs (for arm64, armhf, powerpc, ppc64el)
#
# Copyright 2017 knotdevel
# Released under the MIT license
# http://opensource.org/licenses/mit-license.php
#
#

bb33bb

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <spawn.h>
#include <sys/wait.h>
#include <string.h>

/* ASLR disabling magic constant from Apple LLDB source code
   https://opensource.apple.com/source/lldb/lldb-76/tools/darwin-debug/darwin-debug.cpp
*/

bb33bb

Downgrade and dualboot status of almost all iOS devices

UPDATED: 2023-12-02

• Reddit mirror: https://www.reddit.com/r/iOSDowngrade/comments/j1x7iv/downgrade_and_dualboot_status_of_almost_all_ios/
• GitHub Gist mirror: https://gist.github.com/LukeZGD/9d781f1b03a69fa46869384a9407a41a
• As of updating this post, there is now a downgrade tool that utilizes a SEP exploit released: https://limefix.tech/?product=limefix-sep-utility-testing
• Here is a futurerestore guide for downgrading with SHSH blobs for 64-bit devices
• How to downgrade checkm8 devices
• Save SHSH blobs for signed versions using blobsaver

bb33bb

1. First, download latest stock firmware from lolinet. You probably want those which names begin with RET but tbh I don't know what the difference is between them. Personally, I used RETEU because that's what I had from factory.
2. Download latest "Light" variant of LineageOS 20 GSI. You can find everything here. "Light" variant has limited compatibility with legacy devices, but it works PERFECTLY on hanoip.
3. Unpack stock firmware into stock directory.
4. Unpack GSI into gsi directory and rename it to system.img.
5. Make sure that you have files structure like this:

nat@blahaj [~/Downloads] ✨ tree
.
├── gsi-update.sh
├── gsi

bb33bb

Welcome to Jordan's grab-bag of common Binary Ninja Snippets.

These snippest are meant to run with the Binary Ninja Snippets Plugin
(http://github.com/Vector35/snippets) though they can all also be pasted
directly into the python console or turned into stand-alone plugins if needed.

To install the entire collection at once, just install the Snippets plugin via
the plugin manager (CMD/CTL-SHIFT-M), confirm the Snippet Editor works
(Tool/Snippets/Snippet Editor), and unzip this bundle (Download ZIP above) into
your Snippets folder.

bb33bb

/*
 *
 * Author: @javierprtd
 * Date  : 01-08-2024
 * Kernel: 5.10.177
 * Samsung A25 NPU: CVE-2022-22265 (bug patched - reintroduced)
 *
 */

// echo 1 > /sys/module/memlogger/holders/npu/drivers/platform:exynos-npu/npu_exynos/npu_err_in_dmesg

bb33bb

#!/bin/bash

rm -rf /home/yen3/ubuntu.qcow2
qemu-img create -f qcow2 /home/yen3/ubuntu.qcow2 10G

virsh undefine ubuntu1604arm64 --nvram

install_from_localtion() {
virt-install -n ubuntu1604arm64 --memory 1024 --arch aarch64 --vcpus 1 \
     --disk /home/yen3/ubuntu.qcow2,device=disk,bus=virtio \

bb33bb

#define MEMSTART		0x80000000UL
#define VIRTUAL_KERNEL_START	0xffffffc008000000UL
#define LINEAR_MAP_START	0xffffff8000000000UL

bool is_lm_addr(uint64_t kaddr) 
{
	return (kaddr & (VIRTUAL_KERNEL_START - (0x8 << (6 * 4)))) == LINEAR_MAP_START;
}

uint64_t virt_to_phys(uint64_t kaddr)