 JBJF
|
09a02858f6
|
SPTM/MIE deep dive: sptm.t8160 820.22 -> 820.40.24 (+64 KiB)
- docs/SPTM-MIE-27.2.md: separate SPTM firmware changed (kernel __DATA_SPTM
is not the monitor); new DART GAPF race, GMMU TLBI verification, iommu
refcount, Dekker locks, hibernation handoff/latch checks; TXM build-only;
Exclave +229 KB; MIE SK tag-page check unchanged (210 insns, relocated)
- candidate directions: DART unganged-GAPF race, hibernation handoff page
count, SK tag-page aliasing, dangling tag storage; no working bypass
- correct the earlier claim that SPTM was unchanged
- tools: fw_diff, string_xref, func_string_diff
|
2026-10-31 17:14:56 +08:00 |
|
|
JBJF
|
3ac5108928
|
iOS 27.2 kernel differential + NTL fix-boundary sweep
- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7
|
2026-10-31 17:09:48 +08:00 |
|