From 7ddc3650f1f4a95beac8e9012c9e9e2d9eba459d Mon Sep 17 00:00:00 2001 From: kaffeindecaf Date: Wed, 2 Sep 2026 13:44:46 +0200 Subject: [PATCH] fix: off_proc_p_name - XPF-verified values for 17.1-17.3 and 26.0.x proc.p_name is per-xnu-build, not per-SoC: the 0x579 (17.x base) and 0x57D (26.0) values were KDK approximations. Corrected from real kernelcache pulls (libgrabkernel2 + XPF): - 17.1-17.3: 0x520, verified on iPhone14,6 (A15/T8110) 17.1 (21B74), xnu-10002.42.9~2 - 26.0-26.0.1: 0x6A0, verified on iPhone14,7 (A15/T8110) 26.0.1 (23A355). per-build notes: 26.6 resolves 0x488, 17.4+/18.x = 0x57d 17.4+ already set 0x57d (kept). iOS 16.x untouched - issue #299 (16.2 should be 0x381 per IDA) is outside this XPF dataset; flagging it here so it can be confirmed against a 16.x kernelcache. --- lara/kexploit/offsets.m | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lara/kexploit/offsets.m b/lara/kexploit/offsets.m index 604190147..6fc12082b 100644 --- a/lara/kexploit/offsets.m +++ b/lara/kexploit/offsets.m @@ -649,7 +649,10 @@ void offsets_init(void) { off_proc_p_flag = 0x25c; off_proc_p_textvp = 0x350; } - off_proc_p_name = 0x579; + off_proc_p_name = (SYSTEM_VERSION_GREATER_THAN_OR_EQUAL_TO(@"17.1") && SYSTEM_VERSION_LESS_THAN(@"17.4")) ? 0x520 : 0x579; + // 17.1-17.3 = 0x520: XPF-verified on iPhone14,6 (A15/T8110) 17.1 (21B74) + // kernelcache (xnu-10002.42.9~2) - the old 0x579 was KDK-approx and wrong + // on that range (17.4+ re-sets 0x57d below, 26.0.x re-sets 0x6A0). off_proc_ro_pr_task = 0x8; off_proc_ro_p_ucred = 0x20; off_ucred_cr_label = 0x78; @@ -1231,7 +1234,7 @@ void offsets_init(void) { off_proc_p_fd = 0xd0; off_proc_p_flag = 0x454; off_proc_p_textvp = 0x548; - off_proc_p_name = 0x57D; + off_proc_p_name = 0x6A0; // 26.0-26.0.1: XPF-verified on iPhone14,7 (A15/T8110) 26.0.1 (23A355) kernelcache — per-BUILD: 26.6 resolves 0x488, 18.x/17.4+ = 0x57d; the old 0x57D was KDK-approx and wrong off_proc_ro_pr_task = 0x8; off_proc_ro_p_ucred = 0x28; off_ucred_cr_label = 0x78;