@patch1t

Exploring the world with my sword of debugger : )

jhftss.github.io/
Joined August 2013
  • Tweets314
  • Following274
  • Followers5.4K
Love the gifts from @Apple Product Security! ❤️❤️❤️
17
24
2
1,234
68,499
Will share one of them at the Nullcon Berlin @nullcon
4
1
49
22,203
I just got 16 new CVEs in this new release 🤣🤣🤣
20
21
3
533
34,601
I got 14 new Apple CVEs in this release😎
ApplSec@ApplSec31 Mar 2025
🐛 NEW SECURITY CONTENT 🐛 💻 macOS Sequoia 15.4 - 131 bugs fixed 💻 macOS Sonoma 14.7.5 - 91 bugs fixed 💻 macOS Ventura 13.7.5 - 85 bugs fixed 📱 iOS and iPadOS 18.4 - 62 bugs fixed 🥽 visionOS 2.4 - 38 bugs fixed 📱 iPadOS 17.7.6 - 38 bugs fixed
17
37
3
645
52,540
Finally got a reply from Parallels (Alludo), only after the 0-day is dropped. Should I remove the post?
Mickey Jin@patch1t20 Feb 2025
New 0 day dropped: jhftss.github.io/Parallels-0… Conclusion: 1. Don’t trust @thezdi , they are too late to handle our reports. One of my reports was submitted in 2024 Jan, but it is still not disclosed to the vendor. No reply from the ZDI yet! 2. Don’t trust the Parallels security!
19
13
1
113
36,215
“tss_should_crash=0” doesn’t work on XNU production build now :(
Mickey Jin@patch1t4 Apr 2024
So, if your debugger crashed in the API “task_set_exception_ports” or “thread_set_state”, try to use the boot args: sudo nvram boot-args="thid_should_crash=0 tss_should_crash=0"
2
1
1
26
7,538
So, if your debugger crashed in the API “task_set_exception_ports” or “thread_set_state”, try to use the boot args: sudo nvram boot-args="thid_should_crash=0 tss_should_crash=0"
4
10
1
61
20,543
The slides of my talk for #OBTS is uploaded: github.com/jhftss/jhftss.git… POC code: github.com/jhftss/POC/blob/m… Demo video: youtu.be/m_gGHVWLQ0Y?si=FkVX…

jhftss.github.io/res/slides/OBTS_v6_The Nightmare of Apple OTA Update_Mickey Jin.pdf at main ·...

Mickey's Blogs. Contribute to jhftss/jhftss.github.io development by creating an account on GitHub.

github.com
1
33
1
137
38,766
macOS Sonoma patched about 10 reports of mine. But only 2 CVEs are published. 4 of them are newly introduced vulnerabilities in macOS 14 beta version. The weird thing is that Apple removed the CVE entries that they assigned before and put them in Additional Recognitions. 😳😳
11
10
2
89
39,547
It wasn’t until Apple asked to review my slides that I realized @defcon had accepted this topic. I tried to contact them last month, but got no response. Really bad experience, isn’t it? 😳 So I decide to give up DefCon and make my debut at #OBTS
6
5
1
67
17,900
Really excited that this topic was accepted by #OBTS v6.0!@objective_see However, it is now too difficult for a Chinese researcher to apply for a Schengen visa. 😭😭
8
3
68
12,970
Today is my last working day at Trend Micro and I will be working as an independent researcher. 😎
16
1
2
242
30,727
Replying to @yo_yo_yo_jbo
Yes, it's kind of like a phishing attack. The malicious Installer app is asking for your admin credentials! But it is launched automatically by installing a legal software package, and its UI is completely the same as the system one. So the attack is easy: youtu.be/B74tW7hAcAg
2
1
497
Load more