@arm64e

ios hax + re tooling. floundering artist/photographer, not on socials much, you will find me on your messaging apps. [email protected] also

 looking
github.com/0cyn
Joined May 2020
  • Tweets270
  • Following160
  • Followers264
26Media
1
55
1
54
The one year I can't go to conferences, man 😂
90
I'm currently in the job market for a position in security research or RE; If you know anyone hiring remote for client red-teaming, public research, and/or RE/RE automation (worked on BinaryNinja for 4 years) type work, especially in the iOS/macOS space, do give me a shout!
7
15
112
8,517
fun 24hrs. 😛
1
1
8
2,423
u will allow me One (1) of these posts, it's been an exciting few weeks and the ASB "u cant talk about it until we fix it!" thing was invented to cause me suffering. some very cool stuff i can't wait to yap about 😛
1
3
672
cannot believe for the life of me that pixel killed off MTE, every *os kernel r/w bug i've found in the past month suffers greatly from MTE. at the rate these pop up anymore i'm kind of terrified of being on non-MTE devices 😵‍💫
1
1
274
iphone xr 18.7.9 🎉 no restoring unsigned firmware. reboots into stock fine. should be useful for "we have SRD at home" ^..^ autodfu and allat. Procursus, ssh and such is working. also embeds openocd controls into the app. :) /p/var is ephemeral. there is much to be done.
9
18
179
11,947
preemptively: * wifi/bt doesn't currently work but i _think_ that is a solvable problem w/ how we're doing things. * same stuff works for A13 iOS 26/27, yet to be written ^..^ * uart will have a shell in it Eventually 😭 * entire boot payload is <1MB! including ramdisk!
1
3
10
1,622
* /private/var is recreated on every boot, if you don't understand what that means/implies this is not 4 u * ^ a lot of the boot slowness comes from setting up and reformatting a ramdisk for it w/ required flags * ^ this allows keybags n stuff to be stored (re: wifi, etc)
1
8
881
coolest thing that i think i've seen since like, checkra1n, man. MIE emu! at reasonable speed! i've never swapped workflows so fast, this is so important for vr.
Joseph Ravichandran
@0xjprxAug 28
I got the latest iOS and macOS 27 booting in Qemu (with SPTM!) - Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported - Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able - Boots directly to root shell in seconds - Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required - SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs - Automated setup; get running in just a few minutes - Runs anywhere qemu runs... no ARM CPU required 😉 Try it here: github.com/jprx/darwin-vm

GitHub - jprx/darwin-vm: Run iOS/ macOS in Qemu. Virtual iPhone 17, 16, 15, 14, 13, 12 and M5-M1...

Run iOS/ macOS in Qemu. Virtual iPhone 17, 16, 15, 14, 13, 12 and M5-M1 Apple Si Macs supported. - jprx/darwin-vm

github.com
1
2
89
12,094
i am about to get a lot less urgent with finishing the l41ka debugger probe stuff 😅 only good excuse i had for that timesink was needing to do some lldb in kernel.
631
same board for dfu entry -> exploit -> jtag (WS 2350 zero) also works headlessly. longterm i wanna play with plugging a bunch into a server and just having on demand remote reset -> enter-dfu -> exploit -> jtag. could also be a <decompiler> ui plugin? so much to do!
1
6
49
4,323
or per the datasheet, RP2350A-Zreo :floshed:
1
3
640
dunno when i can put this out rel. licensing issues + messy git state but fun things are occurring over here.
1
300
697d1d7ee9b3ed2f7b6c8c0a256f96a2e72f6fb6b774d26257c6be7dd6c9f332 a sturgeon:
📷 : d850 + sigma art 24mm F1.4 DG HSM this is a photo of a sturgeon, wow look at it go it is so pretty

ALT 📷 : d850 + sigma art 24mm F1.4 DG HSM this is a photo of a sturgeon, wow look at it go it is so pretty

2
635
l41ka is an experimental pongoOS loader/rom r/w/x tool and research-focused bootkit for A12/A13 iPhones. tested on: iPhone XR 18.7.9 iPhone 11 26.5 i am broke, cannot reasonably test on more configs at the moment. lmk what configs setup-iboot fails on. github.com/0cyn/l41ka
12
21
178
12,400
more replies
the desktop app is not open source at this time, but if you are an OSS junky or it's not built for your OS, there is scripts/laikadbg.py which implements almost everything you should need.
1
1
1
632
this project is also hopefully informative in terms of what it takes to make "a checkra1n". Although some parts we get to do in easy mode, bootloader is simpler now (in some ways) and we have more space to work with in terms of our stage2.
2
551
Load more