Xin Huang retX0

Bypass PAC in JIT

The code snippets and conceptual analysis presented in this document are based on iOS 16.2.

The bug was disclosed and patched after Pwn2Own 2024 and was assigned CVE-2024-27834. Details of the patch can be found in the WebKit repository.

How-To: Frigate on Apple Container with Apple Silicon NPU

This guide explains how to install Frigate 0.17 on Mac with Apple Silicon using Apple Container (native alternative to Docker) with detection via the Neural Engine.

Prerequisites

Mac with Apple Silicon (M1/M2/M3/M4)
macOS 15+ (Sequoia) with Apple Container CLI
Python 3.11+
RTSP-compatible cameras

NULL Deref

AppleH10CamIn::ISP_RegisterFirmwareWorkProcessor_gated(AppleH10CamIn *this, uint64_t *inStr, io_user_reference_t *asyncRef, uint64_t this2){
	...
		if ( some_os_array->getCount() ){
			while ( true ){
				unk_object = *(uint64_t*)(some_os_array->getObject());
				idk = unk_object->unk_0xD8();

libdispatch efficiency tips

The libdispatch is one of the most misused API due to the way it was presented to us when it was introduced and for many years after that, and due to the confusing documentation and API. This page is a compilation of important things to know if you're going to use this library. Many references are available at the end of this document pointing to comments from Apple's very own libdispatch maintainer (Pierre Habouzit).

My take-aways are:

You should create very few, long-lived, well-defined queues. These queues should be seen as execution contexts in your program (gui, background work, ...) that benefit from executing in parallel. An important thing to note is that if these queues are all active at once, you will get as many threads running. In most apps, you probably do not need to create more than 3 or 4 queues.
Go serial first, and as you find performance bottle necks, measure why, and if concurrency helps, apply with care, always validating under system pressure. Reuse

Autofs on Mac OS X

With autofs you can easily mount network volumes upon first access to the folder where you want to mount the volume. Autofs is available for many OS and is preinstalled on Mac OS X so I show you how I mounted my iTunes library folder using this method.

Prepare autofs to use a separate configuration file

autofs needs to be configured so that it knows where to gets its configuration. Edit the file /etc/auto_master and add the last line:

#
# Automounter master map
#

+auto_master # Use directory service

	#include <stdlib.h>
	#include <stdio.h>
	#include <pthread/pthread.h>
	#include <mach/mach.h>

	struct ool_msg {
	mach_msg_header_t hdr;
	mach_msg_body_t body;
	mach_msg_ool_ports_descriptor_t ool_ports[];
	};

	function sleep( sleepDuration ){
	var now = new Date().getTime();
	while(new Date().getTime() < now + sleepDuration){ /* do nothing */ }
	}
	function gc() {
	for (let i = 0; i < 0x10; i++) {
	new ArrayBuffer(0x1000000);
	}
	}
	let data_view = new DataView(new ArrayBuffer(8));

	#include <IOKit/IOKitLib.h>
	#include <mach/mach.h>
	#include <stdio.h>
	#include <stdint.h>
	#include <stdlib.h>
	#include <ctype.h>

	void hexdump(void *ptr, int buflen) {
	unsigned char buf = (unsigned char)ptr;
	int i, j;

	#! /bin/bash
	#
	# build-xnu-6153.11.26.sh
	# Scott Knight
	#
	# Based on the script by Brandon Azad
	# https://gist.github.com/bazad/654959120a423b226dc564073b435453
	#
	# A script showing how to build XNU version 6153.11.26 on macOS Catalina
	# 10.15 with Xcode 11.13.1.

	# VERSION 1.0.4
	# Author: @madhavajay
	# This currently works for iOS and watchOS in the Simulator and Devices

	# Changes
	# Using ${TOOLCHAIN} in two places now
	# Added double quotes " around paths
	# Fixed watchOS Issues

	# Instructions iOS