Coalfire-Research/iOS-11.1.2-15B202-Jailbreak

A problem in function set_platform_attribs

xuechiyaobai opened this issue · 4 comments

Here is the snippet code:
void set_platform_attribs(uint64_t proc, mach_port_t tfp0) { ... uint64_t vnode_info = rk64(0x248);

I feel a bit confusion here "uint64_t vnode_info = rk64(0x248);"

It seems like the JB will success although the |set_platform_attribs| runs not well.

Correct. That code is the result of coding too late at night ;) It does not work, but due to the error handling doesn't impact the jailbreak. The code that you should actually care about is here:

uint64_t task = rk64(proc+0x18);
uint64_t platform_addr = task + 0x3a0;
uint32_t platform = rk32(platform_addr);
wk32(platform_addr, platform | 0x400);
wk32(proc+0x279+0x2f, 0x24004001);

I've removed the code as of commit 2bca16e

Yes, it is.Thank you for your asking.