diff --git a/lara/kexploit/offsets.m b/lara/kexploit/offsets.m index 604190147..6fc12082b 100644 --- a/lara/kexploit/offsets.m +++ b/lara/kexploit/offsets.m @@ -649,7 +649,10 @@ void offsets_init(void) { off_proc_p_flag = 0x25c; off_proc_p_textvp = 0x350; } - off_proc_p_name = 0x579; + off_proc_p_name = (SYSTEM_VERSION_GREATER_THAN_OR_EQUAL_TO(@"17.1") && SYSTEM_VERSION_LESS_THAN(@"17.4")) ? 0x520 : 0x579; + // 17.1-17.3 = 0x520: XPF-verified on iPhone14,6 (A15/T8110) 17.1 (21B74) + // kernelcache (xnu-10002.42.9~2) - the old 0x579 was KDK-approx and wrong + // on that range (17.4+ re-sets 0x57d below, 26.0.x re-sets 0x6A0). off_proc_ro_pr_task = 0x8; off_proc_ro_p_ucred = 0x20; off_ucred_cr_label = 0x78; @@ -1231,7 +1234,7 @@ void offsets_init(void) { off_proc_p_fd = 0xd0; off_proc_p_flag = 0x454; off_proc_p_textvp = 0x548; - off_proc_p_name = 0x57D; + off_proc_p_name = 0x6A0; // 26.0-26.0.1: XPF-verified on iPhone14,7 (A15/T8110) 26.0.1 (23A355) kernelcache — per-BUILD: 26.6 resolves 0x488, 18.x/17.4+ = 0x57d; the old 0x57D was KDK-approx and wrong off_proc_ro_pr_task = 0x8; off_proc_ro_p_ucred = 0x28; off_ucred_cr_label = 0x78;