v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.
This commit is contained in:
JBJF committed 2026-10-29 20:08:55 +08:00
1 parent 1ea76ab005
commit 7949c7ce9f
79 files changed
+4109 -892

No files matched your search

-15
View File
@@ -1,19 +1,4 @@
#!/usr/bin/env python3
# arc.rr · libarchive · RockRidge CL/PL · —
# 原语: 探测 · 进程内 | Primitive: probe · in-process
#
# [zh] RockRidge 重定位环(未修复孪生)
# 上游已于 2026 年 9 月修复 RockRidge 重定位环导致的无限循环(d14de384fcc6),Apple 未取该提交。该缺陷在 27.0 与 27.2 上均存在,是本工程中唯一一条对当前系统同样成立的候选。
#
# [en] RockRidge relocation cycle (unfixed sibling)
# Upstream fixed the infinite loop caused by a RockRidge relocation cycle in September 2026
# (d14de384fcc6) and Apple did not take the commit. The defect is present on both 27.0 and 27.2,
# making it the only candidate in this project that also holds on current systems.
#
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
# 触发器(run 闭包)与非种子构建器: 同目录 arc.rr.swift
# triggers (run closures) & non-seed builders: arc.rr.swift in this folder
import struct
SECTOR = 2048
+2 -18
View File
@@ -1,23 +1,8 @@
// arc.rr · libarchive · RockRidge CL/PL · —
// 原语: 探测 · 进程内 · tier 3
// Primitive: probe · in-process · tier 3
//
// [zh] RockRidge 重定位环(未修复孪生)
// 上游已于 2026 年 9 月修复 RockRidge 重定位环导致的无限循环(d14de384fcc6),Apple 未取该提交。该缺陷在 27.0 与 27.2 上均存在,是本工程中唯一一条对当前系统同样成立的候选。
//
// [en] RockRidge relocation cycle (unfixed sibling)
// Upstream fixed the infinite loop caused by a RockRidge relocation cycle in September 2026 (d14de384fcc6)
// and Apple did not take the commit. The defect is present on both 27.0 and 27.2, making it the only
// candidate in this project that also holds on current systems.
// ── 判别 / oracle ──
// 以 Joliet 种子的同级结构构造 CL 指向自身的目录项。该路径一旦成立即会挂起,故测量耗时并设阈值判断。
//
// 种子构建器(python,可直接运行): arc.rr/arc.rr.py
// runnable python seed builder: arc.rr/arc.rr.py
// RockRidge relocation cycle (unfixed sibling)
import Foundation
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
enum B {
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
@@ -39,4 +24,3 @@ enum B {
}