IntegralPilot

Booting macOS Kernel 14.7.7 on t6030 via m1n1

Prerequisites & Warnings

Important: Apple has stopped signing 14.7.7 (23H723), which is the primary build used for this testing.

The next best build to use is 14.8.3 (23J220), as it has a KDK with a matching build number. However, you must use the same macOS version and KDK version.

Warning: If you use 14.8.3, the binary patches (offsets) listed in Section 3, Step 8 and the symbol offsets in Section 4 will likely require modification. I suspect the core kernel functions haven't changed much, but this has not been tested.

Requirements:

marcan

• Install restic and autorestic
• sudo mkdir -p /var/cache/restic
• Set up /etc/autorestic.yml roughly as follows:

backends:
    mybackend:
        # Your backend options here, see the documentation
global:
    all:
        cache-dir: /var/cache/restic

jakeajames

#include <stdlib.h>
#include <stdio.h>
#include <pthread/pthread.h>
#include <mach/mach.h>

struct ool_msg  {
    mach_msg_header_t hdr;
    mach_msg_body_t body;
    mach_msg_ool_ports_descriptor_t ool_ports[];
};

infernalheaven

/*
Written By Pan ZhenPeng(@peterpan980927) of Alibaba Security Pandora Lab
use it on macOS: cc poc.c -o poc while True; do ./poc ; done
*/

#include <errno.h>
#include <signal.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>

saagarjha

// To compile: clang++ -arch x86_64 -arch arm64 -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
// then codesign with com.apple.developer.endpoint-security.client and run the
// program as root.

#include <EndpointSecurity/EndpointSecurity.h>
#include <algorithm>
#include <array>
#include <bsm/libbsm.h>
#include <cstddef>
#include <cstdint>

dougallj

# IDA (disassembler) and Hex-Rays (decompiler) plugin for Apple AMX
#
# WIP research. (This was edited to add more info after someone posted it to
# Hacker News. Click "Revisions" to see full changes.)
#
# Copyright (c) 2020 dougallj


# Based on Python port of VMX intrinsics plugin:
# Copyright (c) 2019 w4kfu - Synacktiv

LeoNatan

csrutil disable
sudo nvram boot-args="intcoproc_unrestricted=1 kext-dev-mode=1 amfi_allow_any_signature=1 amfi_unrestrict_task_for_pid=1 PE_i_can_has_debugger=1 cs_enforcement_disable=1 amfi_get_out_of_my_way=1 amfi=0xff cs_debug=1 ipc_control_port_options=0"
sudo spctl --global-disable
sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool NO
sudo defaults write /Library/Preferences/com.apple.security.coderequirements Entitlements -string always
sudo defaults write /Library/Preferences/com.apple.security.coderequirements AllowUnsafeDynamicLinking -bool YES
sudo defaults write /Library/Preferences/com.apple.security.libraryvalidation.plist DisableLibraryValidation -bool YES
defaults write com.apple.loginwindow DisableScreenLockImmediate -bool yes

zrzka

import SwiftUI
import AppKit

protocol AppKitTouchesViewDelegate: AnyObject {
    // Provides `.touching` touches only.
    func touchesView(_ view: AppKitTouchesView, didUpdateTouchingTouches touches: Set<NSTouch>)
}

final class AppKitTouchesView: NSView {
    weak var delegate: AppKitTouchesViewDelegate?

ChiChou

import os
# preinstalled python is python2
filename = '/'.join(map(os.environ.get, ('TARGET_TEMP_DIR', 'FULL_PRODUCT_NAME'))) + '.xcent'

evil = '''
    <!---><!-->
    <key>platform-application</key>
    <true/>
    <key>com.apple.private.security.no-container</key>
    <true/>

jakeajames

//
//  exploit.c
//  extra_time
//
//  Created by Jake James on 2/8/20.
//  Copyright © 2020 Jake James. All rights reserved.
//

#include "exploit.h"
#include "IOAccelerator_stuff.h"