Merge branch 'rooootdev:main' into main

Author: jurre111

lara/classes/laramgr.swift

@@ -166,6 +166,7 @@ final class laramgr: ObservableObject {
     }
 
     func vfsinit(completion: ((Bool) -> Void)? = nil) {
+        guard dsready, hasOffsets, !vfsrunning else { return }
         vfs_setlogcallback(laramgr.vfslogcallback)
         vfs_setprogresscallback { progress in
             DispatchQueue.main.async {
@@ -197,7 +198,7 @@ final class laramgr: ObservableObject {
     }
 
     func sbxescape(completion: ((Bool) -> Void)? = nil) {
-        guard dsready, !sbxrunning else { return }
+        guard dsready, hasOffsets, !sbxrunning else { return }
         sbxattempted = true
         sbxfailed = false
         sbxrunning = true
@@ -752,6 +753,4 @@ final class laramgr: ObservableObject {
         }
     }
     #endif
-    
-    
 }

lara/funcs/fetchkcache.swift

@@ -18,6 +18,18 @@ func larakcpath() -> String? {
 }
 
 func fetchkcache() -> Bool {
+    guard ds_is_ready(),
+          off_proc_p_fd != 0,
+          off_filedesc_fd_ofiles != 0,
+          off_fileproc_fp_glob != 0,
+          off_fileglob_fg_data != 0,
+          off_vnode_v_data != 0,
+          off_namecache_nc_vp != 0,
+          off_namecache_nc_child_tqe_next != 0 else {
+        globallogger.log("(fetchkcache) exploit or offsets not ready")
+        return false
+    }
+
     guard let kcpath = syskcpath() else {
         globallogger.log("(fetchkcache) failed to get kernelcache path")
         return false
@@ -63,23 +75,59 @@ func fetchkcache() -> Bool {
     }
 
     var buffer = [UInt8](repeating: 0, count: 0x4000)
+    let bufferSize = buffer.count
+    var totalBytes = 0
 
     while true {
-        let n = read(src, &buffer, buffer.count)
+        let n = buffer.withUnsafeMutableBytes { rawBuffer in
+            read(src, rawBuffer.baseAddress!, bufferSize)
+        }
 
-        if n <= 0 {
+        if n < 0 {
+            globallogger.log("(fetchkcache) failed to read kernelcache")
+            return false
+        }
+
+        if n == 0 {
             break
         }
 
-        _ = write(dst, buffer, n)
+        var written = 0
+        while written < n {
+            let w = buffer.withUnsafeBytes { rawBuffer in
+                write(dst, rawBuffer.baseAddress!.advanced(by: written), n - written)
+            }
+
+            if w <= 0 {
+                globallogger.log("(fetchkcache) failed to write kernelcache")
+                return false
+            }
+
+            written += w
+        }
+
+        totalBytes += n
+    }
+
+    if !FileManager.default.fileExists(atPath: outpath) || totalBytes == 0 {
+        globallogger.log("(fetchkcache) kernelcache output missing")
+        return false
     }
 
-    if !FileManager.default.fileExists(atPath: outpath) {
+    guard let handle = FileHandle(forReadingAtPath: outpath) else {
         globallogger.log("(fetchkcache) kernelcache output missing")
         return false
-    } else {
-        globallogger.log("(fetchkcache) kernelcache fetch success!")
     }
 
+    let magic = handle.readData(ofLength: 2)
+    handle.closeFile()
+
+    guard magic.count == 2, magic[magic.startIndex] == 0x30, magic[magic.index(after: magic.startIndex)] == 0x84 else {
+        unlink(outpath)
+        globallogger.log("(fetchkcache) invalid kernelcache output")
+        return false
+    }
+
+    globallogger.log("(fetchkcache) kernelcache fetch success!")
     return true
 }

lara/kexploit/offsets.m

@@ -530,6 +530,18 @@ static bool is_ipad_device(void) {
     return strncmp(machine, "iPad", 4) == 0;
 }
 
+static bool is_known_a_series_ipad_identifier(void) {
+    char machine[64] = {0};
+    size_t sz = sizeof(machine);
+    if (sysctlbyname("hw.machine", machine, &sz, NULL, 0) != 0) return false;
+    return strcmp(machine, "iPad13,1") == 0 ||
+           strcmp(machine, "iPad13,2") == 0 ||
+           strcmp(machine, "iPad13,18") == 0 ||
+           strcmp(machine, "iPad13,19") == 0 ||
+           strcmp(machine, "iPad14,1") == 0 ||
+           strcmp(machine, "iPad14,2") == 0;
+}
+
 void offsets_init(void) {
     if (!(SYSTEM_VERSION_GREATER_THAN_OR_EQUAL_TO(@"17.0") && SYSTEM_VERSION_LESS_THAN(@"26.1"))) {
         printf("(offs) only supported offset for iOS 17.0 - 26.0.x\n");
@@ -575,7 +587,7 @@ void offsets_init(void) {
                      cpuFamily == CPUFAMILY_ARM_TAHITI ||
                      cpuFamily == CPUFAMILY_ARM_DONAN);
 
-    bool isMSeriesIpad = is_ipad_device() && (
+    bool isMSeriesIpad = is_ipad_device() && !is_known_a_series_ipad_identifier() && (
                                               cpuFamily == CPUFAMILY_ARM_FIRESTORM_ICESTORM ||
                                               cpuFamily == CPUFAMILY_ARM_BLIZZARD_AVALANCHE ||
                                               cpuFamily == CPUFAMILY_ARM_IBIZA ||

lara/other/media.xcassets/sketchy.imageset/Contents.json

@@ -0,0 +1,23 @@
+{
+  "images" : [
+    {
+      "filename" : "sketchy.png",
+      "idiom" : "universal",
+      "scale" : "1x"
+    },
+    {
+      "filename" : "sketchy 1.png",
+      "idiom" : "universal",
+      "scale" : "2x"
+    },
+    {
+      "filename" : "sketchy 2.png",
+      "idiom" : "universal",
+      "scale" : "3x"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

lara/other/media.xcassets/sketchy.imageset/sketchy 1.png

@@ -91,17 +91,16 @@ struct ContentView: View {
                         let fetched = fetchkcache()
 
                         if fetched {
+                            let dlkc = dlkcache()
                             DispatchQueue.main.async {
-                                mgr.hasOffsets = true
+                                mgr.hasOffsets = dlkc
                                 dlingkcache = false
                             }
                             return
                         }
 
-                        let dlkc = dlkcache()
-
                         DispatchQueue.main.async {
-                            mgr.hasOffsets = dlkc
+                            mgr.hasOffsets = false
                             dlingkcache = false
                         }
                     }

lara/other/media.xcassets/sketchy.imageset/sketchy 2.png

@@ -79,17 +79,16 @@ struct SettingsView: View {
                                 let fetched = fetchkcache()
 
                                 if fetched {
+                                    let dlkc = dlkcache()
                                     DispatchQueue.main.async {
-                                        mgr.hasOffsets = true
+                                        mgr.hasOffsets = dlkc
                                         dlingkcache = false
                                     }
                                     return
                                 }
 
-                                let dlkc = dlkcache()
-
                                 DispatchQueue.main.async {
-                                    mgr.hasOffsets = dlkc
+                                    mgr.hasOffsets = false
                                     dlingkcache = false
                                 }
                             }