Skip to content
webkit; but pwned
Branch: master
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
glue Megamerge Jan 27, 2019
patch updated readme Jan 28, 2019
root Megamerge Jan 27, 2019
.gitignore fuuuuu Aug 29, 2018
.gitmodules Megamerge Jan 27, 2019
LICENSE Should prob. name the team here Feb 21, 2019
README.md credits Jan 27, 2019

README.md

TotallyNotSpyware

This program is definitely not spyware.
Run it on your 64-bit iOS device as soon as possible.
Your compliance will be rewarded.

[ Live version at totally-not.spyware.lol ]

Repo structure & building

Frontend and WebKit exploit are in /root.
Kernel exploit is in /glue.
Post-exploitation is in /glue/dep.

DoubleH3lix and Meridian can be built independently into static libraries with make headless and make all respectively, in their directories.
Those are then used to build the payload in /glue, which is the binary that is ran from JIT after the WebKit exploit. Can be built with just a make, and will build all dependencies as needed.
And that is all finally strung together with the WebKit exploit by running make in /root, which will again build dependencies as needed.

Caveat:
There is a hand-written assembly routine called genesis, which is used to link the Mach-O on JIT memory before it can be used.
This routine is not provided here, as a lowkey attempt at stopping people who don't know what they're doing from messing with this.
People who know what they're doing can just read it at totally-not.spyware.lol/payload ;)
To build the project without genesis, run make first in /glue separately, then in /root.

Patch

We originally wanted to backport the WebKit patch to 10.x, but ultimately gave up.

See /patch for details, but the gist is:
One part of the WebKit bug was incorrect predictions in JSC::DFG::clobberize, which is basically a huge switch-case. The fix for that was to re-route some values to blocks that are already used for other values.
On the versions we checked, the compiler had generated jump tables for that, so our idea would've been to just find and patch all those jump tables, since the correct code would already be present.
The issue is that the values that everything depends on have changed hundreds of times over the lifetime of iOS 10 (yes, much more frequently than there have been iOS releases), and there seem to be no landmarks anywhere nearby in code, so it's virtually impossible for us to determine which values to patch. :(

Credits

You can’t perform that action at this time.