doing iOS&macOS security research

Joined August 2017
cute😆
Congratulations on your impressive upcoming jailbreak release. Dream achieved! Seeing the dedication behind work like this is always inspiring. (@pattern_F_ requested a little privacy, so he gets a cute sticker instead. 😄)
5
8
81
13,690
Yes😉
Replying to @pattern_F_
done anything fun after?
37
45
2
401
75,067
Just bought an iPad. Let's do something fun with it. 😆 #DarkSword
8
6
1
126
25,841
after months of hardwork 👀
120
119
23
1,011
238,067
I'm an iOS SEP app developer. 👀
4
27
242
50,967
My talk was accepted by BlackHat USA 2023. #BHUSA
5
13
153
28,720
proc_entitlement_is_bool_true("com.apple.private.security.container-manager") is changed to AppleMobileFileIntegrity::AMFIEntitlementGetBool in iOS 16.4. So the hack adding entitlements to the backend OSDictionary of OSEntitlements is not working.
5
10
58
28,358
I hate debugging kernel. The only useful information is register values left in panic log.
1
8
65
24,731
me too🤣
This Post is from an account that no longer exists. Learn more
5
2
1
52
iOS 15.x demo. Run 3 cmds: ls, id, sw_vers. There is a lot of trouble in ios15. Still a long way from a real jailbreak. iPhone XS, iOS 15.0: using cve-2021-30883 (written months ago) iPhone 13 Pro, iOS 15.1: using cve-2021-30955 (thanks @realBrightiup ) I don't promise anything
67
197
14
1,139
pattern-f retweeted
Had succeeded in using my kernel read/write primitive to achieve privilege elevation on macOS 12.1 prior to the release of macOS 12.2. The exploit code can work in many sandboxed context (apps, WebContent, etc.), but the vuln doesn't exist on iOS.
3
20
104
pattern-f retweeted
unc0ver v8.0.0 is NOW OUT with iOS 14.6-14.8 support for A12-A13 iPhones. unc0ver.dev/
460
632
137
2,882
An important thread. I recommend iOS hackers to read this. xitter.cf/WangTielei/status/1470…
iOS 15.2 fixed many bugs in IOMobileFrameBuffer (IOMBF), one of my favorite attack surfaces, and brought me a lot of good memories regarding IOMBF.
6
18
106
Write an iOS 14.6 (iPhoneXR, A12) jailbreak demo for CVE-2021-30883 (fixed in iOS 15.0.2, by @AmarSaar). Use a trick from oob-timestamp (by @_bazad). Run two commands: "id" and "ls /"
119
209
29
1,031
These are the last two. Have stopped doing iOS vulnerability hunt for several months. So, no CVEs next time.
7
1
70
I've been a little busy lately. Hope I could get back to the vulnhunt things soon.
2
39
1 CVE, 3 people. Lucky, or unlucky?
3
1
1
61
CVE-2021-30914 I used this one to complete my first iOS LPE exploit demo, on 2021-02-09, . Unfortunately, it is not easy to exploit it in iOS 14.2 and above.
10
24
1
142