search

razmashat / voucher_swap

the voucher_swap exploit by @_bazad with offsets for tested devices
45 stars 12 forks source link

It doesn't support A12 #6

Open s8ngyu opened 5 years ago

s8ngyu commented 5 years ago

I'm using iPhone Xs. Torngat - Badges and voucher_swap works fine but, this rootKit panics after received fake port. Here is the log what Xcode shows.

2019-02-02 10:29:27.531386+0900 rootKit[290:5532] [Accessibility] ****************** Loading GAX Client Bundle ****************
offsets selected for iOS 11.3 or above
[D] platform: iPhone11,2 16C50
[+] created 1024 pipes
[+] created 8000 ports
[+] sprayed 16777216 bytes to 1024 pipes in kalloc.16384
[+] created 3564 vouchers
[+] sprayed 590453760 bytes to 15 ports in kalloc.1024
[+] stashed voucher pointer in thread
................................................................................................................................................................................................................................................................................................................................
[+] sprayed 669253632 bytes of OOL ports to 7 ports in kalloc.32768
[+] recovered voucher port 0x400b for freed voucher
[+] adding references to the freed voucher to change the OOL port pointer
[+] receiving the OOL ports will leak port 0x1e8603
[+] received voucher port 0x400b in OOL ports
[+] voucher overlapped at offset 0x6f80
[+] received fake port 0x5913
[+] port is at pipe index 258
razmashat commented 5 years ago

we know. we are working on a fix

razmashat commented 5 years ago

Dose it work now

Dev1352 commented 5 years ago

Dose it work now

no still broken

s8ngyu commented 5 years ago

@razmashat https://github.com/razmashat/voucher_swap/commit/0783faf904c958e7ab96bc36f4bf3457337fefd5 This commit doesn't change anything in exploit. There is a fork of voucher_swap by Alticha. You may look into that.