Ok, so A12 kernel pointers are messed up. If a ptr's highest bit is zero, everything in this post applies: https://bazad.github.io/2018/06/ios-12-kernelcache-tagged-pointers/ … If the highest bit is one, then: actualValue = ((value & 0x0000ffff00000000) << 8) | ((kernelBase + (value & 0xffffffff)) & 0xffffffffffff);
-
-
Yes, a virtual method call looks like this in an iPhone11,8 kernel: ldr x8, [x0] ldraa x9, [x8, ...]! movk x8, 0x3771, lsl 48 blraa x9, x8 It's just a real pain decoding these atm, I need to get ARMv8.3 support into radare2 somehow...
-
I think it’s capstone’s fault: https://github.com/aquynh/capstone/pull/1011 … this should add ARMv8.1/2 support, for ARMv8.3 we “only” have to keep adding the new instructions
- 1 more reply
New conversation -
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
don’t reply if you don’t understand it
- 7 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.