jamf / freethesandbox_lpe_poc_13.7 Goto Github PK

Detecting tfp0
Model: iPhone 6S
Version: 13.3.1
require to run exploit first
Execution pause: Not found offsets set for current device(model: iPhone 6S)

The website https://analytics.freethesandbox.org has no longer any more. Can you just update the address ?

Kernel exploit does not work on A8 or A9 devices as those use AppleAVEDriver (AppleAVEH8.kext) instead of AppleAVE2Driver. (Userland exploit works successfully though if I tell it to grab AppleAVEDriver instead)

Kernel exploit will require porting though as AppleAVEDriver takes different parameters compared to AppleAVE2Driver

iphone 11 gadgets not found?

also for a13 userspace_pac.c should be compiled right?

instead userspace.c is getting compiled!

`if(check_if_iOS_version_greater_than_or_equal_to("13.3") && check_if_iOS_version_less_then("13.3.2")){
//57 crash
zone_index_tasks = 58;

    // iOS 13.3/13.3.1
    HARDCODED_infoleak_addr = 0xFFFFFFF00791FA18;
    HARDCODED_allproc = 0xFFFFFFF00934E930;
    HARDCODED_kernel_map = 0xfffffff00787d768;
}`

That's the offset I found. But for zone_index_tasks, I don't know how to find the right one, so I tried 57, 58, 59. But all failed.
Xcode Console prints "kaslr: 0xe00ffc8."
And on the iPhone, it prints "Setting up new kernel r/w primitives"

And computer console prints "kernel AVE ERROR:Enqueue Order Check failed" and "AVEUC ERROR:m_NotificationPort NULL" all the time ~

So what's wrong and how to find the right zone_index_tasks?