2 out of 3 devices panic if app is stopped in Xcode or force closed

[modernpwner]

2 out of 3 devices panic if app is stopped in Xcode or force closed

[mattsolol]

i can also confirm that this happens on XR running iOS 14.0

[pwned4ever]

How do u guys find offsets for your devices? I got kernel panic on old SE with 13.4 also. So maybe we misconfigured smth or missed some variable or address that should be set

There's 2 offsets you need to change and is really stupid that this researcher couldn't have added offsets to the list so it can be used on all devices. I'll push a commit that should've been part of their project and see if they accept it. You can also manually find offsets from the kernelcache of said device and version. You're looking for the ucred and bsdinfo offsets which is 0x100 for ucreds on iOS 13 and depends on device for the bsd_info. Arm64e is like 0x390 or smthn iirc and 0x380 or 0x388 for arm64 devices. Just grab them from opensource projects for iOS 13

[pwned4ever]

First off I'm changing the offsets for other devices, not to prevent the crash. Secondly why don't you say the device will panic after the app/exploit is closed? Stability is 0 after used.

…

Sent from my iPhone On Feb 16, 2021, at 10:46 AM, ModernPwner <[email protected]> wrote:  Because this is by design of exploit PoC. And you really know nothing if you think that changing offsets can fix crash on process exit. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#9 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACHLHABV4XH6YO2MEJQQ7DTS7KHN5ANCNFSM4XTSWJDQ>.

[ModernPwner]

If stability is 0 - then just do not use this exploit and everyone will be happy.

[ItsmeMrV]

somebody has defiinitley illegally been controlling my devices using some of this software

[dev3ee]

How do u guys find offsets for your devices? I got kernel panic on old SE with 13.4 also. So maybe we misconfigured smth or missed some variable or address that should be set

[hazefreak1]

You can sharing this app who you used ?

[waterdragon78]

Yea agreed with hazefreak1, can u send the app?

[hazefreak1]

I have the app not I asked for the app

[waterdragon78]

Oh can i have the app

[pwned4ever]

You can sharing this app who you used ?

I built it in Xcode. Not making any apps from it, yet!

[ModernPwner]

Can you just read?

[pwned4ever]

if you try to close the app or stop its process after exploiting is complete the whole system panics and crashes, tested on Xr 14.3 and iPhone 8 14.3, only device that allowed the app to be closed without panic was the iphone 7 14.1 iirc. what is the reason behind this crash?

Why did you close this issue?

[ModernPwner]

Because this is by design of exploit PoC. And you really know nothing about this exploit if you think that changing offsets can fix crash on process exit.

[pwned4ever]

Well that was an easy answer. I was asking and mentioning this crash because I thought it was something on my end, which no one else has mentioned. Knowing now that you yourself says that the exploit in nature will crash the device upon exit. Helps. I just didnt want to keep testing to see if it was my own mistakes somewhere. Appreciate the replies and the info. Guess I'll keep trying to see if I'm able to resolve the crash on my own. The crash logs are always pointing to a kfree address in Mac Labels and sometimes a different process. Have yourself a nice day

…

On Feb 17, 2021, at 1:04 AM, ModernPwner ***@***.***> wrote:  If stability is 0 - then just do not use this exploit and everyone will be happy. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[ItsmeMrV]

is there a way of checking to see if your device has been jail broken