Cleanup

ANALYSIS.md

@@ -164,21 +164,20 @@ coruna-main/
 ├── utility_module.js               # Crypto helpers, Int64, LZW
 ├── Stage3_VariantB.js              # Sandbox escape + MachOPayloadBuilder
 ├── other/
-│   └── bootstrap.dylib  # Extracted dylib with ChaCha20 + LZMA
+│   └── bootstrap.dylib             # Extracted dylib with ChaCha20 + LZMA
 ├── downloaded/                     # 17 files fetched from C2 server
 │   └── <hash>.min.js               # Raw encrypted payloads
 ├── extracted/                      # Base64-decoded qbrdr payloads (from repo JS files)
 │   └── <hash>.bin
-└── decrypted/
-    ├── all/                        # All 19 decrypted + decompressed F00DBEEF containers
-    │   ├── <hash>.bin              # F00DBEEF container
-    │   └── <hash>/                 # Extracted entries per container
-    │       ├── entry0_type0x08.dylib
-    │       ├── entry1_type0x09.dylib
-    │       ├── entry2_type0x0f.dylib
-    │       ├── entry3_type0x07.bin
-    │       └── ...
-    └── 7a7d...payload              # Decrypted manifest (F00DBEEF with 19 download entries)
+└── payload/                        # All 19 decrypted + decompressed F00DBEEF containers
+    ├── 7a7d...payload              # Decrypted manifest (F00DBEEF with 19 download entries)
+    ├── <hash>.bin                  # F00DBEEF container
+    └── <hash>/                     # Extracted entries per container
+        ├── entry0_type0x08.dylib   # powerd implant?
+        ├── entry1_type0x09.dylib   # Kernel exploit <- what jailbreak developers are most interested in
+        ├── entry2_type0x0f.dylib   # Persistence?
+        ├── entry3_type0x07.bin
+        └── ...
 ```
 
 ## Reproduction Steps

README.md

@@ -6,6 +6,9 @@ Partially deobfuscated, symbolicated, and modified to load decrypted payloads by
 
 These scripts are modified in a way that allows you to host them locally. Note that this only includes exploit chains for tested devices.
 
+## Analysis
+There are so many analysis by other people right now so I'm not doing it again, however I have a generated [ANALYSIS.md](ANALYSIS.md) specifically talking about decryption process and iOS payloads version table.
+
 ## Tested on
 | Device| Version | WebKit exploit chain |
 | :--- | --- | --- |

decrypted/377bed7460f7538f96bbad7bdc2b8294bdc54599_entry0.bin

@@ -1 +0,0 @@
-X

decrypted/377bed7460f7538f96bbad7bdc2b8294bdc54599_entry1.bin

@@ -1 +0,0 @@
-)��

decrypted/377bed7460f7538f96bbad7bdc2b8294bdc54599_entry3.bin

@@ -1 +0,0 @@
-_�

decrypted/377bed7460f7538f96bbad7bdc2b8294bdc54599_entry4.bin

@@ -1 +0,0 @@
-Y
�

decrypted/377bed7460f7538f96bbad7bdc2b8294bdc54599_entry5.bin

@@ -1 +0,0 @@
-��T

decrypted/377bed7460f7538f96bbad7bdc2b8294bdc54599_entry6.bin

@@ -1 +0,0 @@
-��

decrypted/38af3c8ba461079a0edc83585023f76843066dcf_entry1.bin

@@ -1 +0,0 @@
-JH

decrypted/38af3c8ba461079a0edc83585023f76843066dcf_entry3.bin

@@ -1 +0,0 @@
-pac

decrypted/38af3c8ba461079a0edc83585023f76843066dcf_entry4.bin

@@ -1 +0,0 @@
-ort