thank you for the kind and professional words. btw, plan to write a short blog about this a7-sep bug.

webkit-lockdown: filter unix, mach, mig calls, and etc.

github.com/Proteas/a7-sep…

xnu-10002.41.9: github.com/apple-oss-dist…

found a security issue in a sep app. this is my first finding in this domain. leaving it there, back to the mainline. will do a deep analysis when I am free.

time flies, it's near the end of 2023. as usual, the cve data: github.com/Proteas/apple-…

Slides-driven Security Research

In case you need it, IDA loader for SEP firmware with dyld cache support: github.com/Proteas/sep-fw…

我们真的有独立的思想吗？ 它来自哪里？

Instead of mythologizing vulnerability research, we should think about how to engineer it.

"PrivateCloudOS detected"

Summarize iOS 18 Sandbox Changes: 1. Profile Dependency, for example: baseline <- restrictive-extension <- secure-capture-extension. 2. Profile Flags. 3. filter `fcntl`.

A high-quality vulnerability can be compared to highly enriched uranium. Whether it can be detonated and the yield of the explosion depend on the exploitation techniques used.

To me, "firebloom" is more of an obfuscator. I don’t know whether this is on purpose.😂

What is the mass of happiness? What is its velocity? What is its momentum?

as usual, the cve data: github.com/Proteas/apple-…

`CVE-2025-24203`: hierarchy of vm_object_t when changing `MAP_SHARED` to `MAP_PRIVATE`. The topmost object has its own physical page.

Self QA：CVE-2025-24203, proteas.github.io/ios/2025/05/21…

ida, 25A5279m, dwarf :(