saelo

|=-----------------------------------------------------------------------=|
|=-------------=[ 3 Years of Attacking JavaScript Engines ]=-------------=|
|=-----------------------------------------------------------------------=|
|=------------------------------=[ saelo ]=------------------------------=|
|=-----------------------------------------------------------------------=|

The following are some brief notes about the changes that have taken place
since the release of the "Attacking JavaScript Engines" paper [1]. In
general, no big conceptional changes have happened since. Mitigations have
been added to break some of the presented techniques and, as expected, a

lategoodbye

Raspberry Pi: How to cross-compile and use Mainline Kernel

Notes on how to set up a new Ubuntu LTS x64 environment, how to build a recent Mainline Kernel and place it on a Raspberry Pi OS SD card.

Procedure

1. Install tools needed:

$ apt install git make gcc g++ device-tree-compiler bc bison flex libssl-dev libncurses-dev python3-ply python3-git libgmp3-dev libmpc-dev

christianchristensen

import json
import sqlite3
import zlib

# ~/Library/Safari/CloudTabs.db
# Ref: https://www.reddit.com/r/mac/comments/89qx5n/iphone_safari_tabs_into_text_list_via_icloud/
db = sqlite3.connect('CloudTabs.db')

tabs = []

itszn

// Load Int library, thanks saelo!
load('util.js');
load('int64.js');


// Helpers to convert from float to in a few random places
var conva = new ArrayBuffer(8);
var convf = new Float64Array(conva);
var convi = new Uint32Array(conva);
var convi8 = new Uint8Array(conva);

christianloopp

# Created to make RE-ing XPC a bit easier (in a shitty way)
# yes, somethings are hard-coded but I've done it because I don't want to spend more time on this
# created by Abraham Masri @cheesecakeufo

import re
import idaapi
import idautils

paths = ["/usr/include/xpc/xpc.h",
         "/usr/include/xpc/activity.h",

mems

#!/usr/bin/env node

/*
Generate a markdown links list from iCloud tabs, on macOS

Usage:
./icloudtabs2md.js > icloudtabs.md
./icloudtabs2md.js | pbcopy

Require:

bahorn

import requests
import hashlib
import time
import uuid
import os
import copy
import json

# This is based on my personal implementation but stripped down to only what is
# needed to verify it.

Siguza

// Moved here: https://github.com/Siguza/misc/blob/master/dsc_syms.c

alexander-hanel

import re
import sys 
import os 

def load_apis():
    new_old_apis = [
        # start of changes for idc.py
        ("hasValue", "has_value"),
        ("byteValue", "byte_value"),
        ("isLoaded", "is_loaded"),

Siguza

Sadly I don't have a dev device on iOS 10, but for anyone playing around with zIVA caring about the kernel task port:

Starting with iOS 10.3 (and macOS 10.12.4), Apple changed convert_port_to_locked_task (and a few other port-to-something conversion functions) to blacklist the kernel task by means of a direct check. As a result, you can still obtain the kernel task port, but almost all APIs will simply treat it like MACH_PORT_NULL, thus rendering it useless. The check is a simple pointer comparison though, so it can be circumvented by just remapping the task struct at an additional virtual address and creating a new port from that with a ROP equivalent of:

vm_map_remap(
    kernel_map,
    &remap_addr,
    sizeof(task_t),
    0,

VM_FLAGS_ANYWHERE | VM_FLAGS_RETURN_DATA_ADDR,