userlandkernel / jailbreakme-unified

Framework for iOS browser exploitation to kernel privileges and rootfs remount
https://racecondition.win
Other
86 stars 26 forks source link

error: could not spawn fake double #13

Closed ghost closed 5 years ago

ghost commented 5 years ago

Hello, My device is iPhone SE running iOS 12.0.1

The logs: iPhone SE OS: 12.01 Build: 15E148 Webkit version: 605.1 DID: fa8172982fef88bb3a4416f4ea240118516b7f16 Chose Kuduma's jailbreakme Exploit has been called and is awaiting shellcode. Shellcode has been received, checking validity. Received 91792 bytes of shellcode. Triggering garbage collector Error: Exploit failed: could not spawn fake double.

userlandkernel commented 5 years ago

Another person filed the exact same issue. The vulnerability of 12.0.1 is a Use after Free type vulnerability. That means that the exploit is a race condition.

The program kind of looks like this:

void* someptr = malloc(1000); // some memory allocation someptr = JSObject; // use it free(someptr); // mark the memory as reusable and punch holes in it ... ... print(&someptr); //the issue is it is used again here

So what this exploit does is try to fill the memory that's marked as reusable with object structures. Therefore it is a bit unreliable until someone improves the exploit to make sure that we end up in that specific memory.

For you this means that you will have to try it multiple times. Best is to even close the webpage if you get this error and then reopen it.

ghost commented 5 years ago

Thanks but why no Cydia icon appeared?

Merculous commented 5 years ago

There are no kernel exploits and no kernel interaction whatsoever for iOS 12. Cydia requires a jailbreak and like Sem said before, this is only a framework that we can build upon to make a web-based jailbreakme of some sort. Right now, the only things we can work upon right now are WebKit exploits and get RCE.