iMessage: decoding NSSharedKeyDictionary can read ObjC object at attacker controlled address bugs.chromium.org/p/project-zero…

SSD Advisory – iOS Jailbreak via Sandbox Escape and Kernel R/W leading to RCE ssd-disclosure.com/archives/4066/…

I'm presenting on KTRW at #36C3 this year. I'll take you along my journey discovering hardware debugging registers and discuss the challenges of writing a full-featured iOS kernel debugger usable with LLDB: halfnarp.events.ccc.de

ZecOps Task-For-Pwn 0 Bounty: TFP0 POC on PAC-Enabled iOS Devices <= 12.4.2 #FreeTheSandbox blog.zecops.com/vulnerabilitie…

github.com/xerub/acorn untethered+unsandboxed code execution based on media.ccc.de/v/36c3-11034-t… /cc littlelailo @[email protected] ZecOps - A Jamf Company Brandon Azad

#iOS Talks from #36c3 Messenger 0-click- media.ccc.de/v/36c3-10497-m… Untethering iDevices media.ccc.de/v/36c3-11034-t… Trustzone security media.ccc.de/v/36c3-10859-t… checkra1n - media.ccc.de/v/36c3-11238-t… Building an iOS debugger - media.ccc.de/v/36c3-10806-k…

X11 on jailbroken iOS maxleiter.com/X11/ nice

This is your regular reminder that macOS has built-in bulk file renaming and it's insanely simple to use. 🙌🍎

Return of the iOS sandbox escape: lightspeed's back in the race!! The XNU bug johncool described last year was reintroduced and is still exploitable in the last version of iOS, as shown by unc0ver Team: synacktiv.com/posts/exploit/…

It is great to announce the #release of Service Pack 2 for #IDA 7.5 today! SP2 fixes some immediate issues with the new macOS11/iOS14 binaries and focuses principally on enhancing the static analysis for new file formats. Learn more: bit.ly/2BCfkQl #HexRays #IDAPro

The heartbroken family of a 21-year-old man killed on Eyre Highway while cycling across Australia to raise awareness about climate change has described him as a “passionate” and “bright” boy. 🔒 bit.ly/3sZspIK

hbd @brinlyau 🎉

PSA: The BOOL type is a signed integer. So if you define a single bit bitfield of type BOOL, it will be "-1" when it is TRUE. Which means that it won't be equal to TRUE.

Seems like iOS 17 beta 1 puts crash dumps in /private/var/containers/Shared/SystemGroup/systemgroup.com.apple.osanalytics/DiagnosticReports/ instead of the usual /private/var/mobile/Library/Logs/CrashReporter/. As a result, afcd -r won't completely delete the logs after they're

CVE-2023-32412 is a bug in the iOS SIP parser, reachable through a (rogue) mobile network. Details in bugs.chromium.org/p/project-zero…

Instead of SPTM and PPL, they should have called it Page Table Pro and Pages by Dr Dre.

zenbleed so good slay haha reliable cpu bugs gang gang yes yes yes reliable cpu bugs thank you lopez ymm regs so good

when the offsets change