v2.0 — 31 C POC twins + harness fixes
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
This commit is contained in:
1 parent
1ea76ab005
commit
7949c7ce9f
79 files changed
+4109
-892
No files matched your search
@@ -1,19 +1,4 @@
|
||||
#!/usr/bin/env python3
|
||||
# arc.rr · libarchive · RockRidge CL/PL · —
|
||||
# 原语: 探测 · 进程内 | Primitive: probe · in-process
|
||||
#
|
||||
# [zh] RockRidge 重定位环(未修复孪生)
|
||||
# 上游已于 2026 年 9 月修复 RockRidge 重定位环导致的无限循环(d14de384fcc6),Apple 未取该提交。该缺陷在 27.0 与 27.2 上均存在,是本工程中唯一一条对当前系统同样成立的候选。
|
||||
#
|
||||
# [en] RockRidge relocation cycle (unfixed sibling)
|
||||
# Upstream fixed the infinite loop caused by a RockRidge relocation cycle in September 2026
|
||||
# (d14de384fcc6) and Apple did not take the commit. The defect is present on both 27.0 and 27.2,
|
||||
# making it the only candidate in this project that also holds on current systems.
|
||||
#
|
||||
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
|
||||
# 触发器(run 闭包)与非种子构建器: 同目录 arc.rr.swift
|
||||
# triggers (run closures) & non-seed builders: arc.rr.swift in this folder
|
||||
|
||||
import struct
|
||||
|
||||
SECTOR = 2048
|
||||
|
||||
+2
-18
@@ -1,23 +1,8 @@
|
||||
// arc.rr · libarchive · RockRidge CL/PL · —
|
||||
// 原语: 探测 · 进程内 · tier 3
|
||||
// Primitive: probe · in-process · tier 3
|
||||
//
|
||||
// [zh] RockRidge 重定位环(未修复孪生)
|
||||
// 上游已于 2026 年 9 月修复 RockRidge 重定位环导致的无限循环(d14de384fcc6),Apple 未取该提交。该缺陷在 27.0 与 27.2 上均存在,是本工程中唯一一条对当前系统同样成立的候选。
|
||||
//
|
||||
// [en] RockRidge relocation cycle (unfixed sibling)
|
||||
// Upstream fixed the infinite loop caused by a RockRidge relocation cycle in September 2026 (d14de384fcc6)
|
||||
// and Apple did not take the commit. The defect is present on both 27.0 and 27.2, making it the only
|
||||
// candidate in this project that also holds on current systems.
|
||||
// ── 判别 / oracle ──
|
||||
// 以 Joliet 种子的同级结构构造 CL 指向自身的目录项。该路径一旦成立即会挂起,故测量耗时并设阈值判断。
|
||||
//
|
||||
// 种子构建器(python,可直接运行): arc.rr/arc.rr.py
|
||||
// runnable python seed builder: arc.rr/arc.rr.py
|
||||
|
||||
// RockRidge relocation cycle (unfixed sibling)
|
||||
import Foundation
|
||||
|
||||
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
||||
// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
|
||||
enum B {
|
||||
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
||||
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
||||
@@ -39,4 +24,3 @@ enum B {
|
||||
}
|
||||
|
||||
|
||||
|
||||
Reference in new issue
Block a user