Skip to content

Instantly share code, notes, and snippets.

@Cryptiiiic

Cryptiiiic/offsets_multipath_kfree.md

Last active March 1, 2023 05:45
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Cryptiiiic/ca5834b4567b6958c29fa7ca695d2875 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Cryptiiiic/ca5834b4567b6958c29fa7ca695d2875 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Cryptiiiic revised this gist Jun 3, 2018. 1 changed file with 4 additions and 1 deletion.
    5 changes: 4 additions & 1 deletion offsets_multipath_kfree.md
    View file
    Original file line number Diff line number Diff line change
    @@ -12,4 +12,7 @@ It should take you to this.
    ![](https://i.imgur.com/qEiU4or.png)
    6. Now take the address we are at, in this example it's 0xFFFFFFF006FFA3C0, and add 0x10 to it.
    The final offset will be, in my example 0xFFFFFFF006FFA3D0.
    0xFFFFFFF006FFA3D0 is the kaslr_shift address.
    0xFFFFFFF006FFA3D0 is the kaslr_shift address.
    7. Run `nm kernelcache.dec | grep -E "__ZNK12OSSerializer9serializeEP11OSSerialize|__ZNK8OSString12getMetaClassEv| _copyout$| _copyin$| _copyin$"`
    ![](https://i.imgur.com/Lb2E3bk.png)
    This will get us `osserializer_serialize`(0xfffffff0074dc3c8), `get_metaclass`(0xfffffff0074de4e4), `copyin`(0xfffffff0071a7090), and `copyout`(0xfffffff0071a72b4) addresses.
  2. Cryptiiiic revised this gist Jun 3, 2018. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions offsets_multipath_kfree.md
    View file
    Original file line number Diff line number Diff line change
    @@ -6,10 +6,10 @@ This should take you to `com.apple.AGXG5P:__cstring` section.
    ![](https://i.imgur.com/CdnEIwq.png)
    3. Double click on the first text:FFFFFFF...
    4. Scroll down all the way until you see something like this.
    ![](https://i.imgur.com/qEiU4or.png)
    ![](https://i.imgur.com/NLniAnk.png)
    5. Double click on unk_FFFFFFF... which is located at the second ADRP.
    It should take you to this.
    ![]()
    ![](https://i.imgur.com/qEiU4or.png)
    6. Now take the address we are at, in this example it's 0xFFFFFFF006FFA3C0, and add 0x10 to it.
    The final offset will be, in my example 0xFFFFFFF006FFA3D0.
    0xFFFFFFF006FFA3D0 is the kaslr_shift address.
  3. Cryptiiiic revised this gist Jun 3, 2018. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions offsets_multipath_kfree.md
    View file
    Original file line number Diff line number Diff line change
    @@ -6,10 +6,10 @@ This should take you to `com.apple.AGXG5P:__cstring` section.
    ![](https://i.imgur.com/CdnEIwq.png)
    3. Double click on the first text:FFFFFFF...
    4. Scroll down all the way until you see something like this.
    ![](https://i.imgur.com/CdnEIwq.png)
    ![](https://i.imgur.com/qEiU4or.png)
    5. Double click on unk_FFFFFFF... which is located at the second ADRP.
    It should take you to this.
    ![](https://i.imgur.com/qEiU4or.png)
    ![]()
    6. Now take the address we are at, in this example it's 0xFFFFFFF006FFA3C0, and add 0x10 to it.
    The final offset will be, in my example 0xFFFFFFF006FFA3D0.
    0xFFFFFFF006FFA3D0 is the kaslr_shift address.
  4. Cryptiiiic created this gist Jun 3, 2018.
    15 changes: 15 additions & 0 deletions offsets_multipath_kfree.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,15 @@
    1. Open Terminal and run `nm kernelcache.dec | grep _kernproc`
    ![](https://i.imgur.com/8tzLUil.png)
    In this example, 0xfffffff0075d50a0 is our kernproc address.(iPhone6S on 11.3.1)
    2. Drag your kernelcache.dec into ida and stringsearch for `fStampMapping[kAGXHostMemoryTimestamp]`
    This should take you to `com.apple.AGXG5P:__cstring` section.
    ![](https://i.imgur.com/CdnEIwq.png)
    3. Double click on the first text:FFFFFFF...
    4. Scroll down all the way until you see something like this.
    ![](https://i.imgur.com/CdnEIwq.png)
    5. Double click on unk_FFFFFFF... which is located at the second ADRP.
    It should take you to this.
    ![](https://i.imgur.com/qEiU4or.png)
    6. Now take the address we are at, in this example it's 0xFFFFFFF006FFA3C0, and add 0x10 to it.
    The final offset will be, in my example 0xFFFFFFF006FFA3D0.
    0xFFFFFFF006FFA3D0 is the kaslr_shift address.