| theme | class | highlighter | fonts | ||||||
|---|---|---|---|---|---|---|---|---|---|
default |
text-center |
MaskRay |
|
| @import Darwin; | |
| @import Foundation; | |
| @import MachO; | |
| #import <mach-o/fixup-chains.h> | |
| // you'll need helpers.m from Ian Beer's write_no_write and vm_unaligned_copy_switch_race.m from | |
| // WDBFontOverwrite | |
| // Also, set an NSAppleMusicUsageDescription in Info.plist (can be anything) | |
| // Please don't call this code on iOS 14 or below | |
| // (This temporarily overwrites tccd, and on iOS 14 and above changes do not revert on reboot) |
got ---> global offset table
virtual address space (VAS) or address space ---> is the set of ranges of virtual addresses that an operating system makes available to a process.
Here is easy steps to try Windows 10 on ARM or Ubuntu for ARM64 on your Apple Silicon Mac. Enjoy!
NOTE: that this is current, 10/1/2021 state.
- Install Xcode from App Store or install Command Line Tools on your Mac
MathSH was a very innovative challenge in the category sandbox escape. Three members of our team - ALLES! - worked for several hours and eventually drew first blood on this challenge. This writeup is split into several parts, namely: dumping the binary, analysing the sandbox, gaining a better primitive for code execution and finally escaping the sandbox.
The description Calculator as a Service (CAAS) already hints to CAS, a legacy .NET technology to run code in various level of trusts.
We are given a restricted "shell" to calculate math expressions:
- Download & Install Sublime Text 3.2.2 Build 3211
- Visit https://hexed.it/
- Open file select sublime_text.exe
- Offset
0x8545: Original84->85 - Offset
0x08FF19: Original75->EB - Offset
0x1932C7: Original75->74(remove UNREGISTERED in title bar, so no need to use a license)
| void inject_trusts(int pathc, const char *paths[]) | |
| { | |
| printf("[+] injecting into trust cache...\n"); | |
| extern uint64_t g_kern_base; | |
| static uint64_t tc = 0; | |
| if (tc == 0) { | |
| /* loaded_trust_caches | |
| iPhone11,2-4-6: 0xFFFFFFF008F702C8 |
See the official Differentiable Programming Manifesto instead.
For a brief user-level introduction to CMake, watch C++ Weekly, Episode 78, Intro to CMake by Jason Turner. LLVM’s CMake Primer provides a good high-level introduction to the CMake syntax. Go read it now.
After that, watch Mathieu Ropert’s CppCon 2017 talk Using Modern CMake Patterns to Enforce a Good Modular Design (slides). It provides a thorough explanation of what modern CMake is and why it is so much better than “old school” CMake. The modular design ideas in this talk are based on the book [Large-Scale C++ Software Design](https://www.amazon.de/Large-Scale-Soft