Aleksei Kulaev flatz

This is for iOS 26+ only. Read mineek's secret.txt for more info.

I didn't plan to release this that early, but as iOS 27 has already nuked partial restore; and A12/A13 being jailbreakable (including A12 iPads EOL at 26) as soon as a new kernel exploit drops, there is not much to lose.

MissedRevoke

^{(the "secret.txt" for iOS 26)}

iOS has had a long time storing revocation details in separate plists, it was trivially bypassable by zeroing and chflags immutable on them. Since iOS 26.0b2, all of these files have been migrated to mis.db.

amfid-allow

This script hooks into macOS amfid to grant restricted entitlements to selected executables. Tested on macOS 15.4.

Prerequisites

Only disabling Debugging Restrictions (ALLOW_TASK_FOR_PID) is required and other SIP restrictions can be left enabled:

Getting serial on modern Macs

Modern devices default to serial output over DockChannel by default, which is why macvdmtool serial doesn't work. In order to use legacy UART:

On the target device:

Disable SIP
Disable boot-arg filtering
Set the following boot args:

serial=3 (or serial=7 or whatever)

BIND 9 Cache Poisoning via Unsolicited Answer Records (CVE-2025-40778)

Overview

A vulnerable BIND 9 resolver (version 9.18.39) accepts and caches resource records that were not requested in the original DNS query. An off-path attacker who can race or spoof responses may inject forged address data into the resolver cache. Once poisoned, subsequent clients are redirected to attacker-controlled infrastructure without triggering fresh lookups. The issue is tracked as CVE-2025-40778 and carries a published CVSS v3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).

Affected Software

Product: BIND 9 recursive resolver
Version tested: 9.18.39 (affected)
Known affected ranges:
9.11.0 – 9.16.50

Syscall Provider

Background

SyscallProvider is a feature available from Windows 11 22H2, that allows for inline hooking of syscalls.
This unfinished research was done on Windows 11 22H2. The feature is fully undocumented at the moment and it looks like it's locked to Microsoft-signed drivers.
All of the information here was gathered by manual reverse engineering of securekernel.exe, skci.dll and ntoskrnl.exe.
The kernel exports three functions to work with the new feature: PsRegisterSyscallProvider, PsQuerySyscallProviderInformation, PsUnregisterSyscallProvider.
This writeup will explore how this feature is initialized, how it works internally, and how to interact with it and use it.

	<?xml version="1.0" encoding="utf-8"?>
	<configuration>
	<system.diagnostics>
	<trace autoflush="true" />

	<sources>
	<source name="System.Net" switchValue="Verbose">
	<listeners>
	<add name="netlog" />
	</listeners>

	This will permanently block revokes and some ppq stuff.
	Use this together with the profile to block some domains "without" a DNS.
	Even if you don't have the profile, after applying this your device just cannot register revokes anymore. So you'll just not be able to install the app, but you will not get permanently blacklisted.

	note this may lead to side effects. I am not sure. However, it does work.

	AS ALWAYS, USE AT YOUR OWN RISK.

	Basically all u need to do is run these commands one by one in a terminal on a jailbroken device:

	#!/usr/bin/env bash

	# Bash script to complile LLVM

	# @hoyhoy
	# 11/18/2025

	# Installs to /opt/llvm-${LLVM_VERSION} i.e. /opt/llvm-21.1.6
	# and then symbolically link /opt/llvm-latest to /opt/llvm-21.1.6

	# Note
	# I am using Raspberry pi 4 to send CEC commands
	# /dev/cec1 is pi's second HDMI port
	# '4' is PS5 address that TV assigned, change if you need

	# Turn on PS5 (You need to enable "Power off Link" at PS5 HDMI settings to turn on from rest mode)
	cec-ctl -d /dev/cec1 --to 4 --user-control-pressed ui-cmd=power-on-function

	# Turn on PS5 from rest mode (When you didn't enable "Power off Link" at PS5 HDMI settings)
	cec-ctl -d /dev/cec1 --to 4 --user-control-pressed ui-cmd=power-toggle-function

	#!/usr/bin/env python3
	import sys
	import json
	import requests
	import feedparser
	import re

	BUG_ID = sys.argv[1] if len(sys.argv) > 1 else None
	if not BUG_ID or not BUG_ID.isdigit():
	print("Usage: python3 chrome-bug-commit-tracker.py <bug_id>")