-
-
Save uroboro/8a23844e811c5a18bc4a83845d6062fb to your computer and use it in GitHub Desktop.
Proper Indentation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> | |
#include <stdlib.h> | |
#include <strings.h> | |
#include <sys/utsname.h> | |
//#include "offsets.h" | |
// offsets from the main kernel 0xfeedfacf | |
uint64_t allproc_offset; | |
uint64_t kernproc_offset; | |
// offsets in struct proc | |
uint64_t struct_proc_p_pid_offset; | |
uint64_t struct_proc_task_offset; | |
uint64_t struct_proc_p_uthlist_offset; | |
uint64_t struct_proc_p_ucred_offset; | |
uint64_t struct_proc_p_comm_offset; | |
// offsets in struct kauth_cred | |
uint64_t struct_kauth_cred_cr_ref_offset; | |
// offsets in struct uthread | |
uint64_t struct_uthread_uu_ucred_offset; | |
uint64_t struct_uthread_uu_list_offset; | |
// offsets in struct task | |
uint64_t struct_task_ref_count_offset; | |
uint64_t struct_task_itk_space_offset; | |
// offsets in struct ipc_space | |
uint64_t struct_ipc_space_is_table_offset; | |
// offsets in struct ipc_port | |
uint64_t struct_ipc_port_ip_kobject_offset; | |
#pragma mark - arm64 | |
void init_arm64() { | |
struct_proc_p_pid_offset = 0x10; | |
struct_proc_task_offset = 0x18; | |
struct_proc_p_uthlist_offset = 0x98; | |
struct_proc_p_ucred_offset = 0x100; | |
struct_proc_p_comm_offset = 0x26c; | |
struct_kauth_cred_cr_ref_offset = 0x10; | |
struct_uthread_uu_ucred_offset = 0x168; | |
struct_uthread_uu_list_offset = 0x170; | |
struct_task_ref_count_offset = 0x10; | |
struct_task_itk_space_offset = 0x300; | |
struct_ipc_space_is_table_offset = 0x20; | |
struct_ipc_port_ip_kobject_offset = 0x68; | |
} | |
#pragma mark - iPhone | |
void init_iPhone6_1_S5L8960X() { | |
allproc_offset = 0x5a4128; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPhone7_1_T7000() { | |
allproc_offset = 0x5b4168; | |
kernproc_offset = 0x5ba0e0; | |
} | |
void init_iPhone7_1_S8000() { | |
allproc_offset = 0x5a4148; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPhone7_2_T7000() { | |
allproc_offset = 0x5b4168; | |
kernproc_offset = 0x5ba0e0; | |
} | |
void init_iPhone7_2_S8000() { | |
allproc_offset = 0x5a4148; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPhone8_1_T7000() { | |
allproc_offset = 0x5b4168; | |
kernproc_offset = 0x5ba0e0; | |
} | |
void init_iPhone8_1_S8000() { | |
allproc_offset = 0x5a4148; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPhone8_2_T7000() { | |
allproc_offset = 0x5b4168; | |
kernproc_offset = 0x5ba0e0; | |
} | |
void init_iPhone8_2_S8000() { | |
allproc_offset = 0x5a4148; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPhone8_4_S8000() { | |
allproc_offset = 0x5a4148; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPhone9_1_T8010() { | |
allproc_offset = 0x5ec178; | |
kernproc_offset = 0x5f20e0; | |
} | |
void init_iPhone9_3_T8010() { | |
allproc_offset = 0x5ec178; | |
kernproc_offset = 0x5f20e0; | |
} | |
void init_iPhone9_4_T8010() { | |
allproc_offset = 0x5ec178; | |
kernproc_offset = 0x5f20e0; | |
} | |
#pragma mark - iPod | |
void init_iPod7_1_T7000() { | |
allproc_offset = 0x5b4168; | |
kernproc_offset = 0x5ba0e0; | |
} | |
#pragma mark - iPad | |
void init_iPad4_3_S5L8960X() { | |
allproc_offset = 0x5a4128; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPad4_4_S5L8960X() { | |
allproc_offset = 0x5a4128; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPad5_1_T7000() { | |
allproc_offset = 0x5b4168; | |
kernproc_offset = 0x5ba0e0; | |
} | |
void init_iPad5_1_T7001() { | |
allproc_offset = 0x5b4228; | |
kernproc_offset = 0x5ba0e0; | |
} | |
void init_iPad5_1_S5L8960X() { | |
allproc_offset = 0x5a4128; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPad5_4_S5L8960X() { | |
allproc_offset = 0x5a4128; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPad5_4_T7000() { | |
allproc_offset = 0x5b4168; | |
kernproc_offset = 0x5ba0e0; | |
} | |
void init_iPad5_4_T7001() { | |
allproc_offset = 0x5b4228; | |
kernproc_offset = 0x5ba0e0; | |
} | |
void init_iPad6_3_S8000() { | |
allproc_offset = 0x5a4148; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPad6_4_S8000() { | |
allproc_offset = 0x5a4148; | |
kernproc_offset = 0x5aa0e0; | |
} | |
void init_iPad6_8_S8000() { | |
allproc_offset = 0x5a4148; | |
kernproc_offset = 0x5aa0e0; | |
} | |
//here end | |
void unknown_build() { | |
printf("This is an unknown kernel build - the offsets are likely to be incorrect and it's very unlikely this exploit will work\n"); | |
printf("You need to find these two kernel symbols:\n"); | |
printf(" allproc\n"); | |
printf(" kernproc\n\n"); | |
printf("and update the code\n"); | |
} | |
#pragma mark - init_offsets | |
void init_offsets() { | |
struct utsname u = { 0 }; | |
int err = uname(&u); | |
if (err == -1) { | |
printf("uname failed - what platform is this?\n"); | |
printf("there's no way this will work, but trying anyway!\n"); | |
init_iPad4_3_S5L8960X(); | |
return; | |
} | |
printf("sysname: %s\n", u.sysname); | |
printf("nodename: %s\n", u.nodename); | |
printf("release: %s\n", u.release); | |
printf("version: %s\n", u.version); | |
printf("machine: %s\n", u.machine); | |
init_arm64(); | |
#pragma mark - iPhone | |
if (strstr(u.machine, "iPhone6,1")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) { | |
printf("device iPhone6,1 matched\n"); | |
init_iPhone6_1_S5L8960X(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPhone7,1")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) { | |
printf("device iPhone7,1 matched\n"); | |
init_iPhone7_1_T7000(); | |
return; | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) { | |
printf("device iPhone7,1 matched\n"); | |
init_iPhone7_1_S8000(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPhone7,2")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) { | |
printf("device iPhone7,2 matched\n"); | |
init_iPhone7_2_T7000(); | |
return; | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) { | |
printf("device iPhone7,2 matched\n"); | |
init_iPhone7_2_S8000(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPhone8,1")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) { | |
printf("device iPhone8,1 matched\n"); | |
init_iPhone8_1_T7000(); | |
return; | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) { | |
printf("device iPhone8,1 matched\n"); | |
init_iPhone8_1_S8000(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPhone8,2")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) { | |
printf("device iPhone8,2 matched\n"); | |
init_iPhone8_2_T7000(); | |
return; | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) { | |
printf("device iPhone8,2 matched\n"); | |
init_iPhone8_2_S8000(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPhone8,4")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) { | |
printf("device iPhone8,4 matched\n"); | |
init_iPhone8_4_S8000(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPhone9,1")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) { | |
printf("device iPhone9,1 matched\n"); | |
init_iPhone9_1_T8010(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPhone9,3")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) { | |
printf("device iPhone9,3 matched\n"); | |
init_iPhone9_3_T8010(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPhone9,4")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) { | |
printf("device iPhone9,4 matched\n"); | |
init_iPhone9_4_T8010(); | |
return; | |
} | |
} | |
#pragma mark - iPod | |
if (strstr(u.machine, "iPod7,1")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) { | |
printf("device iPod7,1 matched\n"); | |
init_iPod7_1_T7000(); | |
return; | |
} | |
} | |
#pragma mark - iPad | |
if (strstr(u.machine, "iPad4,3")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) { | |
printf("device iPad4,3 matched\n"); | |
init_iPad4_3_S5L8960X(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPad4,4")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) { | |
printf("device iPad4,4 matched\n"); | |
init_iPad4_4_S5L8960X(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPad5,1")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) { | |
printf("device iPad5,1 matched\n"); | |
init_iPad5_1_T7000(); | |
return; | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) { | |
printf("device iPad5,1 matched\n"); | |
init_iPad5_1_T7001(); | |
return; | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) { | |
printf("device iPad5,1 matched\n"); | |
init_iPad5_1_S5L8960X(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPad5,4")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) { | |
printf("device iPad5,4 matched\n"); | |
init_iPad5_4_T7000(); | |
return; | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) { | |
printf("device iPad5,4 matched\n"); | |
init_iPad5_4_T7001(); | |
return; | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) { | |
printf("device iPad5,4 matched\n"); | |
init_iPad5_4_S5L8960X(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPad6,3")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) { | |
printf("device iPad6,3 matched\n"); | |
init_iPad6_3_S8000(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPad6,4")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) { | |
printf("device iPad6,4 matched\n"); | |
init_iPad6_4_S8000(); | |
return; | |
} | |
} | |
if (strstr(u.machine, "iPad6,8")) { | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) { | |
printf("device iPad6,8 matched\n"); | |
init_iPad6_8_S8000(); | |
return; | |
} | |
} | |
printf("don't recognize this platform\n"); | |
unknown_build(); | |
init_iPad4_3_S5L8960X(); // this won't work! | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment