General DarkSword improvements - #786
Conversation
Update Localizable.strings
…ixes Frida attaching on process launch)
- Fixed some grammar mistake (making it more understandable for Filipino users). - Some grammar still needs further inspection but over-all it's understandable. - Long stanza might create overlapping?
Added new translations in: + Removed Jailbreak alert + Settings Alerts + Duplicate Apps Errors Fixed grammar and names in Logs
but idk why...
* Fix some edge cases when finding pcb struct; fix mach_vm_map failed error on free_thread * search for corrupted filter backwards instead
|
"Manually killing the exploit process resolves the initial issue, but upon the next jailbreak attempt, the device immediately triggers a kernel panic, forcing a hard reboot.16.3.1 |
|
"A respring is now required before re-jailbreaking, but the process is noticeably faster. Great work on the performance boost." |
You shouldn't be able to jailbreak when jailbroken. The kernel panic is a known issue but you shouldn't be attempting it in the first place.
Most of my commits didn't affect performance. However, the ones that did are indirect. This may be related to the removal of dead code and libraries but this only resulted in faster compile time. |
|
“我没有使用 Dopamine。在成功运行并正常结束进程之后，再次利用该漏洞往往会 |
|
"Not using Dopamine. After a successful run and process exit, re-exploiting the vulnerability often results in a kernel panic." |
|
"For Dopamine, this behavior is sufficient." |
|
"The kernel exploit for the PPL bypass has been reverse-engineered. Can anyone verify or analyze this further?" |
|
This PR has some stuff I definitely missed, but a lot of stuff seems completely unnecessary. Also, is there anyone here that isn't an LLM?! |
Hello, what is the stuff that is completely unnecessary? This is my first time dealing with exploit code and obviously some stuff may be unnecessary. I'd like to know what stuff is unnecessary so I can look into it. Is the memory freeing useless? Is the 256 MB floor useless? If so, I can completely remove it and focus elsewhere. My formatting is a little too AI and that's my bad lol. (it also helps that this is a draft PR ;)) Thanks for responding though. |
675ff5a to
0bd7b31
Compare
- The unused xpc/xpc.h library has been removed - getTargetKaddr, a function with the same body as get_target_kaddr which is a used function has been removed This cleanup ensures that the code is more maintainable and better. Removing the library speeds up preprocessor times and getting rid of the function improves code quality.
- The fopen and open calls are now checked for errors amongst other calls - One usage of the mach_make_memory_entry_64 function is now correctly checked - In some functions, memory allocated with calloc() wasn't being freed after use causing possible memory leaks. This has been fixed. By implementing error handling, it ensures that users won't be met with a unexpected kernel crash or another issue. When allocated memory is deallocated, it prevents memory leaks and other problems. By doing so, the exploit's reliability is increased and it should crash less.
The exploit's reliability has been increased by calculating the offset from the target address in a usecase of set_target_kaddr.
0bd7b31 to
8271b99
Compare
Hello, I removed a lot of unnecessary stuff that was probably adding complexity to the exploit and I realized just how stupid some of my changes were. In short, I tried to have a while loop based on a condition that when achieved, it would break anyways. There were some changes that were truly unnecessary and added more bloat. I limited this PR to removing dead code, error handling and some minimal changes regarding reliability. |
65d70f1 to
63b580d
Compare
20 participants
I have made quite a few improvements to the DarkSword exploit to ensure better error handling, removal of dead code, graceful exits on some places instead of a kernel panic. These improvements should hopefully speed up compile time, increase reliability and make the code better.
Changes
Error handling
First of all, the return value of a instance of
mach_make_memory_entry_64is now checked.fopenandopenfunctions are also being checked. If there is a error, it will be printed and the program will exit.It also includes checks for values that are out of bounds (idx+1 on the last item of the array) and other problems.
Less unused code
A function, namely
setTargetKaddrhas been removed. It isn't used anywhere and it's function body is identical toset_target_kaddr, another function that is actually used.xpc/xpc.hhas been removed since it has no use in the code. This should speed up preprocessor times.It's more stable overall
Not accounting for memory leak fixes which will always increase stability, there is a minimal fix that accounts for the offset when specifying the target address.
Sockets and buffers that don't get used anymore are now
free-d.You can test it yourself if you want by just trying out the latest release! I always make sure to test it.