lrdsnow / kfd_offsets Goto Github PK

View Code? Open in Web Editor NEW

80.0 8.0 9.0 103 KB

Offsets for KFD

C 100.00%

kfd_offsets's People

Contributors

Stargazers

Watchers

Forkers

p5-2005 shabbypenguin jackson392 ademehenni equati0n os-exploitation-repo mns82 electrikyouthh

kfd_offsets's Issues

Where are the offsets of iPads?

There are no offsets for iPads. I hope you can add it.

my contribs

got the tool working but still has a crash I think from debugging the offsets generated are wrong (due to a bug with the tihmstar tool)
https://github.com/GenericCoding/offsets/blob/main/iphone13.1_16.12/gen.h -- feel free to add here I can git clone this and continue adding if the tool gets fixed and I can get kfd working on my device

There is no option for iPhone SE 2020 16.6b1

iPhone11,8 - 16.1.1 - failed!!!

[info_init]: kfd->info.env.pid = 577
[info_init]: kfd->info.env.tid = 11085
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.1.0: Thu Oct  6 19:33:53 PDT 2022; root:xnu-8792.42.7~1/RELEASE_ARM64_T8020
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 81
[puaf_helper_give_ppl_pages]: 🟢 0s 1ms 53us
[puaf_run]: 🟢 0s 15ms 492us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 1132
[krkw_helper_grab_free_pages]: 🟢 0s 25ms 691us
[krkw_helper_run_allocate]: 🟢 0s 8ms 377us
[krkw_helper_run_allocate]: kread ---> object_id = 1726, object_uaddr = 0x00000002d28a0080, object_size = 16, allocated_id = 2048/10140, batch_size = 1024
[0x0000]: ffffffe5c2556200 0000000000000000 
``

iPhoneXS 16.2 not supprted

Hello, when I compile and run kfd, I encountered the following error. My device is iPhone XS 16.2(iPhone11,2 16.2 offset). Is it not supported on this device?

[info_init]: kfd->info.env.pid = 461
[info_init]: kfd->info.env.tid = 13791
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.2.0: Mon Nov 28 20:10:15 PST 2022; root:xnu-8792.62.2~1/RELEASE_ARM64_T8020
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 209
[puaf_helper_give_ppl_pages]: 🟢 0s 2ms 530us
[puaf_run]: 🟢 0s 10ms 203us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 1580
[krkw_helper_grab_free_pages]: 🟢 0s 30ms 117us
[krkw_helper_run_allocate]: 🟢 0s 2ms 848us
[krkw_helper_run_allocate]: kread ---> object_id = 651, object_uaddr = 0x00000003d2844000, object_size = 16, allocated_id = 1024/10140, batch_size = 1024
[0x0000]: ffffffe3d7769de0 0000000000000000

A12 iOS 16.1.2 incorrectly has A13 16.1.2 offsets

kfd_offsets/A12/iOS_16.1.2/dynamic_info.h

Line 108 in f5e6ef3

    
           .kern_version = "Darwin Kernel Version 22.1.0: Thu Oct  6 19:32:38 PDT 2022; root:xnu-8792.42.7~1/RELEASE_ARM64_T8030",

T8030 is A13

iPhone12,1 - 16.3.1 - failed !!!

[info_init]: kfd->info.env.pid = 487
[info_init]: kfd->info.env.tid = 8998
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.3.0: Wed Jan  4 21:25:00 PST 2023; root:xnu-8792.82.2~1/RELEASE_ARM64_T8030
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 211
[puaf_helper_give_ppl_pages]: 🟢 0s 2ms 396us
[puaf_run]: 🟢 0s 8ms 71us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 740
[krkw_helper_grab_free_pages]: 🟢 0s 17ms 404us
[krkw_helper_run_allocate]: 🟢 0s 6ms 334us
[krkw_helper_run_allocate]: kread ---> object_id = 1338, object_uaddr = 0x00000003d25f8000, object_size = 16, allocated_id = 2048/10140, batch_size = 1024
[0x0000]: ffffffe1d2cb2560 0000000000000000

Could you add my offsets I HAVE THE FILE

A12 16.2b1 kfd offsets.zip

p_fd_fd_ofiles and fileglob__fg_ops are wrong for A16 / iOS 16.1

kfd_offsets/A16/iOS_16.1/dynamic_info.h

Line 130 in f5e6ef3

.proc__p_fd__fd_ofiles = 0x0,

Should be 0xf8 (same as upstream kfd)
The version in PureKFD has 0xf8, but not the one here.

add device

I have an iphone 12 running ios 16.6 beta 1 hope you add it

iPhone13,2 - 16.3.1 - failed!!!

[info_init]: kfd->info.env.pid = 382
[info_init]: kfd->info.env.tid = 6033
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.3.0: Wed Jan  4 21:24:52 PST 2023; root:xnu-8792.82.2~1/RELEASE_ARM64_T8101
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = physpuppet
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 210
[puaf_helper_give_ppl_pages]: 🟢 0s 4ms 531us
[puaf_run]: 🟢 0s 54ms 85us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 16220
[krkw_helper_grab_free_pages]: 🟢 0s 94ms 776us
[krkw_helper_run_allocate]: 🟢 0s 3ms 879us
[krkw_helper_run_allocate]: kread ---> object_id = 1744, object_uaddr = 0x0000000332b14000, object_size = 16, allocated_id = 2048/10140, batch_size = 1024
[0x0000]: ffffffe1f0f16920 0000000000000000 
[krkw_helper_run_allocate]: 🟢 0s 1ms 523us
[krkw_helper_run_allocate]: kwrite ---> object_id = 2148, object_uaddr = 0x0000000356f70000, object_size = 32, allocated_id = 2560/10140, batch_size = 512
[0x0000]: 0000000000000001 0000000000000001 43b86a60283c5198 0000000000000000 
[krkw_helper_run_deallocate]: 🟢 0s 0ms 4us

iPhone11,2 - 16.1.1 - failed !!!

[info_init]: kfd->info.env.pid = 385
[info_init]: kfd->info.env.tid = 5633
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.1.0: Thu Oct  6 19:33:53 PDT 2022; root:xnu-8792.42.7~1/RELEASE_ARM64_T8020
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 212
[puaf_helper_give_ppl_pages]: 🟢 0s 2ms 810us
[puaf_run]: 🟢 0s 8ms 596us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 23628
[krkw_helper_grab_free_pages]: 🟢 0s 373ms 671us
[krkw_helper_run_allocate]: 🟢 0s 5ms 870us
[krkw_helper_run_allocate]: kread ---> object_id = 1303, object_uaddr = 0x00000003d2c44000, object_size = 16, allocated_id = 2048/10140, batch_size = 1024
[0x0000]: ffffffe49091fa60 0000000000000000

iPhone14,2 iOS 16.3 Failed.

2023-08-04 00:24:41.168007+0100 kfd[556:10058] Successfully load keyboard extensions
[info_init]: kfd->info.env.pid = 556
[info_init]: kfd->info.env.tid = 10058
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.3.0: Wed Jan  4 21:25:19 PST 2023; root:xnu-8792.82.2~1/RELEASE_ARM64_T8110
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 208
[puaf_helper_give_ppl_pages]: 🟢 0s 2ms 873us
[puaf_run]: 🟢 0s 10ms 484us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 40592
[krkw_helper_grab_free_pages]: 🟢 0s 202ms 562us
[krkw_helper_run_allocate]: 🟢 0s 5ms 336us
[krkw_helper_run_allocate]: kread ---> object_id = 2321, object_uaddr = 0x00000003d397c000, object_size = 16, allocated_id = 3072/10140, batch_size = 1024
[0x0000]: ffffffe93a7b4d00 0000000000000000 
[krkw_helper_run_allocate]: 🟢 0s 1ms 72us
[krkw_helper_run_allocate]: kwrite ---> object_id = 1265, object_uaddr = 0x00000003d2358000, object_size = 32, allocated_id = 3584/10140, batch_size = 512
[0x0000]: 0000000000000001 0000000000000001 55fc406a1e248538 0000000000000000 
[krkw_helper_run_deallocate]: 🟢 0s 0ms 5us

ipad 8th gen ios 16.5 version thing 20F66

add offsets and if you cant how can i get them for you as i have that device

iPhone12,1 16.0 - failed!!!

[info_init]: kfd->info.env.pid = 386
[info_init]: kfd->info.env.tid = 5804
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.0.0: Tue Aug 16 20:50:57 PDT 2022; root:xnu-8792.2.11.0.1~1/RELEASE_ARM64_T8030
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 210
[puaf_helper_give_ppl_pages]: 🟢 0s 3ms 314us
[puaf_run]: 🟢 0s 11ms 219us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 28904
[krkw_helper_grab_free_pages]: 🟢 0s 338ms 702us
[krkw_helper_run_allocate]: 🟢 0s 4ms 294us
[krkw_helper_run_allocate]: kread ---> object_id = 1470, object_uaddr = 0x00000003d25f4000, object_size = 16, allocated_id = 2048/10140, batch_size = 1024
[0x0000]: ffffffe26baccca0 0000000000000000

iPhone11,6 - 16.4.1 - success!(commit before refactoring)

tried first from last commit didn't worked
so i tried the commit before refactor got success
like we talked before 16.4.1 or plus all fine with offsetfinder

[info_init]: kfd->info.env.pid = 387
[info_init]: kfd->info.env.tid = 5344
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.4.0: Mon Mar  6 20:42:48 PST 2023; root:xnu-8796.102.5~1/RELEASE_ARM64_T8020
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 208
[puaf_helper_give_ppl_pages]: 🟢 0s 2ms 376us
[puaf_run]: 🟢 0s 8ms 495us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 832
[krkw_helper_grab_free_pages]: 🟢 0s 16ms 586us
[krkw_helper_run_allocate]: 🟢 0s 2ms 946us
[krkw_helper_run_allocate]: kread ---> object_id = 486, object_uaddr = 0x00000003d2808000, object_size = 16, allocated_id = 1024/10140, batch_size = 1024
[0x0000]: ffffffdf066e4580 0000000000000000 
[krkw_helper_run_allocate]: 🟢 0s 2ms 359us
[krkw_helper_run_allocate]: kwrite ---> object_id = 1356, object_uaddr = 0x00000003d25a0000, object_size = 32, allocated_id = 1536/10140, batch_size = 512
[0x0000]: 0000000000000001 0000000000000001 81b2dade219f7fa8 0000000000000000 
[krkw_helper_run_deallocate]: 🟢 0s 0ms 5us
[krkw_helper_run_deallocate]: 🟢 0s 0ms 641us
[krkw_run]: 🟢 0s 6ms 633us
[info_run]: kfd->info.kaddr.current_proc = ffffffe0d1681540
[info_run]: kfd->info.kaddr.current_task = ffffffe0d1681c70
[info_run]: kfd->info.kaddr.current_map = ffffffdc06cfda80
[info_run]: kfd->info.kaddr.current_pmap = fffffff112b3fa80
[info_run]: kfd->info.kaddr.kernel_proc = ffffffe0d383c7e8
[info_run]: kfd->info.kaddr.kernel_task = ffffffe0d383cf18
[info_run]: kfd->info.kaddr.kernel_map = ffffffdc06ba87c0
[info_run]: kfd->info.kaddr.kernel_pmap = fffffff020f6c0e8
[info_run]: 🟢 0s 0ms 18us
[perf_run]: kfd->perf.kernel_slide = 0000000016c80000
[perf_run]: kfd->perf.gVirtBase = fffffff01b72c000
[perf_run]: kfd->perf.gPhysBase = 000000080172c000
[perf_run]: kfd->perf.gPhysSize = 00000000eae94000
[smith_helper_cleanup]: old_nentries = 254
[puaf_cleanup]: 🟢 0s 4ms 860us
[kopen]: 🟢 0s 48ms 360us

iPhone13,2 16,4 - success!

[info_init]: kfd->info.env.pid = 459
[info_init]: kfd->info.env.tid = 7957
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.4.0: Mon Mar  6 20:42:59 PST 2023; root:xnu-8796.102.5~1/RELEASE_ARM64_T8101
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 208
[puaf_helper_give_ppl_pages]: 🟢 0s 2ms 299us
[puaf_run]: 🟢 0s 8ms 718us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 3128
[krkw_helper_grab_free_pages]: 🟢 0s 30ms 824us
[krkw_helper_run_allocate]: 🟢 0s 12ms 740us
[krkw_helper_run_allocate]: kread ---> object_id = 2528, object_uaddr = 0x00000003d2e94000, object_size = 16, allocated_id = 3072/10140, batch_size = 1024
[0x0000]: ffffffe2aedb1c60 0000000000000000 
[krkw_helper_run_allocate]: 🟢 0s 2ms 306us
[krkw_helper_run_allocate]: kwrite ---> object_id = 386, object_uaddr = 0x00000003d2820000, object_size = 32, allocated_id = 3584/10140, batch_size = 512
[0x0000]: 0000000000000001 0000000000000001 8daafe61c360c958 0000000000000000 
[krkw_helper_run_deallocate]: 🟢 0s 0ms 15us
[krkw_helper_run_deallocate]: 🟢 0s 1ms 862us
[krkw_run]: 🟢 0s 17ms 810us
[info_run]: kfd->info.kaddr.current_proc = ffffffe2ae4972a8
[info_run]: kfd->info.kaddr.current_task = ffffffe2ae4979d8
[info_run]: kfd->info.kaddr.current_map = ffffffdfaef49840
[info_run]: kfd->info.kaddr.current_pmap = fffffff08adeacb8
[info_run]: kfd->info.kaddr.kernel_proc = ffffffe2af12caa0
[info_run]: kfd->info.kaddr.kernel_task = ffffffe2af12d1d0
[info_run]: kfd->info.kaddr.kernel_map = ffffffdec8b30040
[info_run]: kfd->info.kaddr.kernel_pmap = fffffff02fc9c0e8
[info_run]: 🟢 0s 0ms 24us
[perf_run]: kfd->perf.kernel_slide = 0000000025828000
[perf_run]: kfd->perf.gVirtBase = fffffff028194000
[perf_run]: kfd->perf.gPhysBase = 0000000802194000
[perf_run]: kfd->perf.gPhysSize = 00000000e56dc000
[smith_helper_cleanup]: old_nentries = 253
[puaf_cleanup]: 🟢 0s 5ms 707us
[kopen]: 🟢 0s 74ms 508us

add device

Hi can XS max 16.6b1 please be added