import Foundation /// Runtime-output translation. /// /// Chinese literals in engine and UI code are the source of truth and stay where they are. /// This table maps each one to its English rendering. In Chinese the input passes through /// untouched; in English an unmapped string also passes through, so an ASCII name such as /// "Documents" needs no entry. /// /// Keys are the exact literal text, including any leading/trailing spaces that were part /// of the original string. func tl(_ zh: String) -> String { guard Lang.resolved == .en else { return zh } return RuntimeText.map[zh] ?? zh } enum RuntimeText { // Filled by the localization pass. Every key is a Chinese literal that appears in the // source; every value is its English rendering. static let map: [String: String] = [ "\n\n种子 ": "\n\nseed ", "\n(达到资源预算，提前收敛 —— 这是刻意的，不是失败)": "\\n(resource budget reached, converged early — deliberate, not a failure)", "\n内核未返回任何错误码": "\nkernel returned no error codes", "\n属性: ": "\nattributes: ", "\n状态: ": "\nstatus: ", "\n若 27.0 未钳制，这些 0x41 来自越界读到的堆内容；27.2 会直接丢弃越界标记。": "\\nIf 27.0 does not clamp, these 0x41 bytes come from the out-of-bounds heap read; 27.2 discards the out-of-range marker outright.", "\n负载 ": "\npayload ", "\n通知注册被拒 ": "\nnotification registration refused ", " 直接读 errno=": " direct read errno=", " 落在当前容器内: ": " inside current container: ", " 候选: ": " candidates: ", " 分区 ": " partition ", " 命中: ": " hits: ", " 未读到内容 — ": " nothing read — ", " 直接读 errno=": " direct read errno=", " 直接读也成功 ": " direct read also succeeded ", " B · 4 个条目 · 名字域 36 单元 / 72 字节": " B · 4 entries · name field 36 units / 72 bytes", " B · 64 位=": " B · 64-bit=", " B · 900 切片": " B · 900 slices", " B · 解包 ": " B · unpacked ", " B — 该平台未对该路径施加沙盒，本项不构成证据": " B — no sandbox on this path on this platform, not evidence", " B — 该平台未施加沙盒": " B — no sandbox on this platform", " B — 边界已被跨越": " B — boundary crossed", " B → 产出 ": " B → output ", " B 的 decmpfs 属性": " B decmpfs attribute", " B（ZipWriter 产出，stored 条目）": " B (ZipWriter output, stored entries)", " B，block-id 1 × 6（容量 4）": " B, block-id 1 × 6 (capacity 4)", " B，单个 charstring 连续推入 300 个操作数后 endchar。\n": " B, one charstring pushing 300 consecutive operands then endchar.\\n", " B，可用 ": " B available ", " ms，对象数 ": " ms, objects ", " ms；中心像素 RGBA = ": " ms; centre pixel RGBA = ", " · 加密=": " · encrypted=", " · 受阻 ": " · blocked ", " · 尺寸 ": " · size ", " · 层 ID 0x3F": " · layer id 0x3F", " · 帧数 ": " · frames ", " · 库 ": " · lib ", " · 无沙盒 ": " · no sandbox ", " · 真实写探针=": " · real write probe=", " ← 两者不一致，说明 access() 不可信": " ← mismatch, so access() is not trustworthy", " 一致": " consistent", " 一致 / ": " consistent / ", " 不一致": " inconsistent", " 不存在": " absent", " 个二进制": " binaries", " 个内核指针候选": " kernel pointer candidates", " 个可写": " writable", " 个可读 · ": " readable · ", " 个字形": " glyphs", " 个属性": " attributes", " 个文件": " files", " 个文件 → ": " files → ", " 个文件逐字节一致": " files byte-identical", " 个文件，共 ": " files, ", " 个条目": " entries", " 个条目 · mode ": " entries · mode ", " 个目录读写正常": " directories read/write ok", " 个长度存活": " lengths survived", " 个（mode ": " (mode ", " 仍不可用: ": " still unusable: ", " 可开 · ": " openable · ", " 命中: ": " hits: ", " 处": " sites", " 处 @ ": " sites @ ", " 处 · 偏移一致=": " sites · offsets match=", " 处 · 旧模式残留 ": " sites · old mode residue ", " 处 → 新模式 ": " sites → new mode ", " 处: ": " sites: ", " 处并已保存（备份 ": " sites and saved (backup ", " 处（应为 0）": " sites (expected 0)", " 字节": " bytes", " 字节 0x41": " bytes 0x41", " 存在且": " present and ", " 存在但被拒 · ": " present but refused · ", " 存活 — ": " survived — ", " 已用 / 预算 ": " used / budget ", " 张表": " tables", " 是文件而不是目录 —— 跳过": " is a file, not a directory — skipped", " 条": " items", " 条 · type=": " items · type=", " 条目": " entries", " 条目 / ": " entries / ", " 条目 · ": " entries · ", " 核": " cores", " 次 —— 该平台不允许对自身端口注册通知，": " times — this platform does not allow notification registration on own ports, ", " 次操作，无异常返回": " operations, no abnormal returns", " 次端口分配与回收，": " port allocations and releases, ", " 段标记填充字节": " segment marker padding bytes", " 目录读写正常": " directory read/write ok", " 类错误码": " error classes", " 行": " rows", " 被拒绝 — ": " refused — ", " 解析出 ": " parsed ", " 连续 ": " consecutive ", " 页": " pages", " 项": " entries", " 项 · ": " entries · ", " 项 · 每项 ": " entries · each ", " 项（含 ../ 路径）→ 遏制必须由调用方负责": " entries (with ../ paths) → containment is the caller's job", "\"）": "\")", ") · 原始大小 ": ") · raw size ", ")，经链接读到 ": "), via link read ", "-12203 = 存在但被拒": "-12203 = present but refused", "-17913 = 不存在": "-17913 = absent", "0x 前缀写法: ": "0x prefix form: ", "1. 不存在的深层目录自动创建: ": "1. missing deep directory auto-created: ", "2. Container.write 自动建父目录: 通过（读回 \"": "2. Container.write auto-creates parents: passed (read back \"", "2. Container.write: 失败 ": "2. Container.write: failed ", "2000 层嵌套": "2000 nesting levels", "27.0 扫描边界 0x48 = 72 B": "27.0 scan bound 0x48 = 72 B", "27.0 期望：push 路径无计数检查，操作数栈越界。\n": "27.0 expectation: the push path has no count check, the operand stack overruns.\\n", "27.0 期望：分配截断 → 转换循环越界写。27.2 期望：_TIFFCheckMalloc_type 拒绝。": "27.0 expectation: allocation truncation → the conversion loop writes out of bounds. 27.2 expectation: _TIFFCheckMalloc_type refuses.", "27.0 期望：切片上限未检查 → 插件内越界。27.2 期望：\"too many slices!\"。": "27.0 expectation: the slice cap is unchecked → overrun inside the plugin. 27.2 expectation: \"too many slices!\".", "27.2 收紧到 0x24 = 36 B": "27.2 tightened to 0x24 = 36 B", "27.2 期望：Push/Pop 两道栈保护在解释前拒绝该字体。\n": "27.2 expectation: Push/Pop stack guards reject the font before interpretation.\\n", "3 次解码指纹": "3-decode fingerprint", "3. 旧 UUID 路径重挂: ": "3. old UUID path remount: ", "32 轮完成，进程存活": "32 rounds complete, process alive", "4. isWritableFile(容器根)=": "4. isWritableFile(container root)=", "64 × 4 KB 随机内容": "64 × 4 KB random content", ": 不可见": ": not visible", ": 解码失败": ": decode failed", ": 读取被拒绝（沙盒）": ": read refused (sandbox)", "ANE 用户态入口探测": "ANE user-space entry probe", "AVC 参数集路径已触发": "AVC parameter set path triggered", "AVD.videodecoder 插件": "AVD.videodecoder plugin", "AVD.videodecoder 插件（非 kext）": "AVD.videodecoder plugin (not a kext)", "Apple 未将其视为安全问题，无 CVE": "Apple does not treat it as a security issue, no CVE", "CGBitmapContext 创建失败": "CGBitmapContext create failed", "CGDataProvider 创建失败": "CGDataProvider create failed", "CGFont 拒绝该字体数据": "CGFont refused the font data", "CGImageDestination 创建失败": "CGImageDestination create failed", "CGImageSource 拒绝该数据": "CGImageSource refused the data", "CGPDFDocument 解析失败（文件被拒绝）": "CGPDFDocument parse failed (file refused)", "CHHapticEngine 初始化失败: ": "CHHapticEngine init failed: ", "CHHapticEngine 启动成功": "CHHapticEngine started", "CHHapticEngine 启动成功（沉浸式音频会话已建立）": "CHHapticEngine started (immersive audio session established)", "CHHapticEngine 未尝试": "CHHapticEngine not attempted", "CMGetDMVersionLevelFromRPU 未导出": "CMGetDMVersionLevelFromRPU not exported", "CTFontGetLigatureCaretPositions 返回 ": "CTFontGetLigatureCaretPositions returned ", "CoreMedia 符号不可用": "CoreMedia symbols unavailable", "CoreMedia 符号解析失败，或 XPC 连接无法创建": "CoreMedia symbol resolution failed, or the XPC connection cannot be created", "DRC 路径探测完成": "DRC path probe complete", "EACCES 沙盒拒绝访问": "EACCES sandbox access refusal", "EDQUOT 超出配额": "EDQUOT over quota", "EEXIST 已存在": "EEXIST already exists", "EISDIR 目标是目录": "EISDIR target is a directory", "ENAMETOOLONG 名称过长": "ENAMETOOLONG name too long", "ENOENT 父目录或文件不存在": "ENOENT parent or file absent", "ENOSPC 空间不足": "ENOSPC no space", "ENOTDIR 路径中间是文件": "ENOTDIR path component is a file", "EPERM — 沙盒拒绝": "EPERM — sandbox refusal", "EPERM 操作被拒绝": "EPERM operation refused", "EROFS 只读文件系统": "EROFS read-only filesystem", "EXDEV 跨卷（.atomic 写到了别的卷）": "EXDEV cross-volume (.atomic landed on another volume)", "FigXPCCreateBasicMessage('Curl') 失败": "FigXPCCreateBasicMessage('Curl') failed", "FontParser · charstring 解释器": "FontParser · charstring interpreter", "GPS 读取存活": "GPS read survived", "GPT 头: 条目表 LBA ": "GPT header: entry array LBA ", "GPT 镜像已构造并解析": "GPT image built and parsed", "HEVC 参数集 = ": "HEVC parameter set = ", "HEVC 层路径已触发": "HEVC layer path triggered", "HID 路径可达性": "HID path reachability", "IOHIDFamily · caps 表查找": "IOHIDFamily · caps table lookup", "IOKit 事件入口探测": "IOKit event entry probe", "IOPSCopyPowerSourcesInfo 不可用": "IOPSCopyPowerSourcesInfo unavailable", "IPA 产出": "IPA output", "IPA 手术链路可用": "IPA surgery pipeline available", "ImageIO · 图像解析": "ImageIO · image parsing", "ImageIO · 纹理与编码": "ImageIO · textures and codecs", "Info.plist 读取失败，跳过字段改写": "Info.plist read failed, skipping field rewrite", "LigCaret 查询完成": "LigCaret query complete", "MDLAsset 载入完成 ": "MDLAsset load complete ", "OOB 写": "OOB write", "OOB 读": "OOB read", "PDF 无第 ": "PDF has no page ", "PDF 解码路径已触发": "PDF decode path triggered", "Payload/ 下没有 .app": "no .app under Payload/", "RockRidge CL/PL 环：27.0 与 27.2 都未修（上游已修，Apple 未取）": "RockRidge CL/PL cycle: unfixed in both 27.0 and 27.2 (fixed upstream, Apple did not take it)", "RockRidge 路径已遍历": "RockRidge path traversed", "SBHomeScreenService 在进程内: ": "SBHomeScreenService in-process: ", "SQLite3 不可用": "SQLite3 unavailable", "SpringBoard 路径探测": "SpringBoard path probe", "Type-5 阴影的写入是值可控的，但短溢出会被相邻 VLA 吸收。逐级抬升 R，确定该构建上栈布局开始失效的维度。": "The Type-5 shading write is value-controlled, but a short overflow is absorbed by the adjacent VLA. Step R upward to find the dimension at which this build's stack layout starts to break.", "UDID (设备)": "UDID (device)", "XNU · ipc_port.c 请求表消费方": "XNU · ipc_port.c request-table consumers", "XNU 内核": "XNU kernel", "archive_read_new 失败": "archive_read_new failed", "audioCustom 事件已投递": "audioCustom event delivered", "caret 坐标: ": "caret positions: ", "charstring 推 300 个操作数": "charstring pushes 300 operands", "codespace 长度 128": "codespace length 128", "com.apple.decmpfs 是内核压缩文件系统用的属性。改它等于直接改内核解压的输入 —— CVE-2026-113910 就是这条路径上「解压产出少于预期」时内核把未写满的页缓冲交给用户态。这里可以手动设一个、读回来、再删掉。": "com.apple.decmpfs is the attribute the kernel's compressed filesystem uses. Changing it changes the input the kernel decompresses — CVE-2026-113910 is exactly this path: when decompression under-produces, the kernel hands the unwritten page buffer back to user space. Here you can set one by hand, read it back, then delete it.", "consume 后读取失败: ": "read after consume failed: ", "decmpfs 操作": "decmpfs operations", "dlopen 失败": "dlopen failed", "entitlements: 无法读取（SecTask 不可用或为空）": "entitlements: unreadable (SecTask unavailable or empty)", "fcTL 声明 26B 实到 4B": "fcTL declares 26B, 4B present", "getifaddrs 失败": "getifaddrs failed", "hosts 表": "hosts table", "iOS 27.2 起修复": "fixed since iOS 27.2", "issue_file 被拒: ": "issue_file refused: ", "libarchive 不可用": "libarchive unavailable", "libarchive 的 2 字节堆越界与 CoreMedia 的 28 字节结构体外写，是整套中仅有的两个「写穿过对象边界」的形状。前者精确但浅，后者深且落在保存寄存器区。同一 CVE 下的 CAB 站点与 GPT 分区名越界读一并标定。": "libarchive's 2-byte heap overrun and CoreMedia's 28-byte write past the struct are the only two \"write across an object boundary\" shapes in the whole set. The former is precise but shallow; the latter is deep and lands in the saved-register area. The CAB site under the same CVE and the GPT partition-name OOB read are calibrated alongside.", "libarchive 解包 ": "libarchive unpacked ", "libarchive 返回 ": "libarchive returned ", "libarchive.2.dylib 无法 dlopen（沙盒或路径受限）": "libarchive.2.dylib cannot dlopen (sandbox or path restricted)", "magic cmpf · 类型 ": "magic cmpf · type ", "mediaplaybackd.bytestream.xpc 对任何沙盒应用可达。守护进程以自身凭据打开客户端指定的绝对路径，并把活描述符放进回复的 ByteStreamDetails。描述符级 I/O 不受客户端沙盒的路径检查约束 —— 应用自身 open() 返回 EPERM 的文件，其内容可经该描述符完整读回。": "mediaplaybackd.bytestream.xpc is reachable from any sandboxed app. The daemon opens the client-specified absolute path with its own credentials and puts a live descriptor into the reply's ByteStreamDetails. Descriptor-level I/O is not subject to the client sandbox's path checks — a file whose open() returns EPERM for the app itself can be read back in full through that descriptor.", "mkdir 失败: ": "mkdir failed: ", "networkd 偏好": "networkd prefs", "opcode 已被封 (-16158)": "opcode sealed (-16158)", "plist 语法错误，未写入": "plist syntax error, not written", "registerAudioResource 失败: ": "registerAudioResource failed: ", "sandbox_extension 符号不可用": "sandbox_extension symbols unavailable", "sandbox_extension_issue_file / consume 无法解析": "sandbox_extension_issue_file / consume cannot be resolved", "sandbox_extension_issue_file 在签发时解析符号链接，但不强制 SANDBOX_EXTENSION_NOFOLLOW。签发返回的令牌绑定签发时刻解析出的目标，而内核对消费时刻所用路径不做复核。序列为：沙盒内建立链接 L 指向沙盒内文件 S → 对 L 签发扩展 → 将 L 重指向沙盒外目标 T → 消费令牌后经 L 读取。": "sandbox_extension_issue_file resolves the symlink at issue time but does not enforce SANDBOX_EXTENSION_NOFOLLOW. The token it returns is bound to the target resolved at issue time, and the kernel never re-verifies the path used at consume time. The sequence: create link L in the sandbox pointing at in-sandbox file S → issue the extension for L (the kernel records S) → repoint L at out-of-sandbox target T → consume the token and read through L.", "setxattr 失败 errno=": "setxattr failed errno=", "symlink(decoy) 失败: ": "symlink(decoy) failed: ", "symlink(target) 失败: ": "symlink(target) failed: ", "— 判定 —": "— verdict —", "— 基线 —": "— baseline —", "— 失效模式验证 —": "— failure mode verification —", "— 存在性预言机 —": "— existence oracle —", "— 对照 —": "— control —", "— 平台限制 —": "— platform limit —", "— 目录枚举 —": "— directory listing —", "— 读取 —": "— read —", "✓ AudioCodecs 可加载": "✓ AudioCodecs loadable", "✓ 书签 ": "✓ bookmarked ", "✓ 已创建 ": "✓ created ", "✓ 已加入书签": "✓ bookmarked", "✗ AudioCodecs 无法 dlopen": "✗ AudioCodecs cannot dlopen", "上下文创建失败": "context create failed", "不可用": "unavailable", "不可见": "not visible", "不可读": "unreadable", "不存在": "absent", "不存在 ": "absent ", "不存在 (-17913)": "absent (-17913)", "不存在（未修复）": "absent (unfixed)", "不是 Mach-O": "not a Mach-O", "不是 decmpfs（magic 0x": "not decmpfs (magic 0x", "两者均失败：直接读 errno ": "both failed: direct errno ", "两者都需要稳定的堆布局控制，而这正是上一阶段泄露所提供的。": "Both need stable heap-layout control, which is exactly what the previous stage's leaks provide.", "个原语": " primitives", "主二进制读取失败（可能已加密）": "main binary read failed (possibly encrypted)", "主密码文件（通常不可读）": "master password file (usually unreadable)", "主机名": "hostname", "事件投递失败: ": "event delivery failed: ", "二进制": "binary", "产出": "output", "产出 ": "output ", "会话建立失败": "session setup failed", "低电量模式": "low power mode", "信息泄露": "info leak", "值偏移 +65536": "value offset +65536", "值可控写": "value-controlled write", "值可控写与地址泄露相加，构成构造可控状态的全部要素；所缺的是将写转为执行的环节。": "Value-controlled write plus address disclosure is every element needed to build controlled state; what is missing is the step that turns the write into execution.", "元数据读取完成": "metadata read complete", "充电中": "charging", "先取得地址与内容。decmpfs 欠产出将内核页缓冲尾部交回用户态；TIFF 截断条带与 EXIF 短读将进程堆残留交回图像与元数据；CoreMedia bytestream 与 sandbox_extension 越过沙盒边界取回文件内容。": "Addresses and content come first. decmpfs under-production hands the kernel page-buffer tail back to user space; the truncated TIFF strip and the EXIF short read hand process-heap residue back as image and metadata; the CoreMedia bytestream and sandbox_extension cross the sandbox boundary and retrieve file contents.", "全局偏好": "global prefs", "全局偏好（/private 前缀）": "global prefs (/private prefix)", "全部 ": "all ", "全部读取": "read all", "关": "off", "内容": "content", "内容 (": "content (", "内核": "kernel", "内核面": "kernel surface", "写入失败: ": "write failed: ", "写入探测属性": "write probe attribute", "写入被拒 (-12878)": "write refused (-12878)", "分配/拆除路径可用，通知武装被平台拒绝": "allocate/teardown path available, notification arming refused by the platform", "分配路径已触发": "allocation path triggered", "创建 ": "created ", "判定依据：直接读被拒 且 经链接读成功": "verdict basis: direct read refused AND read via link succeeded", "十六进制": "hex", "十六进制查找: ": "hex search: ", "协议表": "protocol table", "压缩类型 3 = LZX": "compression type 3 = LZX", "发现 ": "found ", "取自本进程的 Mach-O：": "Mach-O taken from this process: ", "只支持 64 位 Mach-O": "only 64-bit Mach-O supported", "只读": "read-only", "只读（探针未通过）": "read-only (probe failed)", "可写": "writable", "可写根目录: ": "writable roots: ", "可开": "openable", "可开 ": "openable ", "可开（code 0）": "openable (code 0)", "可用空间: ": "free space: ", "可见": "visible", "可读": "readable", "可读域: ": "readable domain: ", "可达性探测": "reachability probe", "合计 ": "total ", "名称 → ": "name → ", "否": "no", "否（需 IOKit 平台 Expert 接口）": "no (needs the IOKit platform expert interface)", "启动 UUID": "boot UUID", "启动时间": "boot time", "命中 ": "hit ", "回复类型 ": "reply type ", "回复类型: ": "reply type: ", "回复里没有 fd": "no fd in reply", "因此握手收不到任何回复。真机上该服务常驻，握手应返回字典。": "So the handshake gets no reply. On a real device the service is resident and the handshake should return a dictionary.", "因此该原语在此平台上无法给出证据。真机上直接读应返回 EPERM，": "So the primitive cannot produce evidence on this platform. On a real device the direct read should return EPERM,", "在取得稳定泄露之后，才有条件讨论将溢出写成什么值；否则只能触发崩溃。": "Only after a stable leak is there any basis for choosing what the overflow writes; before that, it can only crash.", "在标定所得长度上，以 PDF 中选定的 double 位模式决定被覆盖的指针。崩溃地址即证据 —— 它证明写入内容由攻击者控制，而非仅证明发生了崩溃。": "At the calibrated length, the double bit pattern chosen in the PDF decides the pointer that gets overwritten. The fault address is the evidence — it proves the written content is attacker-controlled, not merely that a crash happened.", "坐标即追链读到的 16 位值": "the positions are the 16-bit values the chain read", "基线已采集": "baseline captured", "声明长度 65518": "declared length 65518", "处理中…": "working…", "备份": "backups", "备份往返 ": "backup round-trip ", "外设": "peripheral", "大小": "size", "失败": "failed", "失败 —— ../ 逃出了目标目录": "failed — ../ escaped the destination", "失败: ": "failed: ", "头部空隙不足：需要 ": "header gap insufficient: need ", "字体 / Model I/O": "fonts / Model I/O", "字体加载成功 name=": "font loaded name=", "字体在 CGFont 层被拒绝": "font refused at the CGFont layer", "字体在解析阶段被拒绝": "font refused at parse stage", "字体安装": "font install", "字体已加载并绘制": "font loaded and drawn", "字符串替换 ": "string replace ", "字符串替换 Cinder27 → Cind3r27：": "string replace Cinder27 → Cind3r27: ", "字符串替换失败：": "string replace failed: ", "存在": "present", "存在·被拒 ": "present·refused ", "存在但被拒 (-12203)": "present but refused (-12203)", "存在性预言机": "existence oracle", "存在（已修复）": "present (fixed)", "存活: ": "survived: ", "守护进程以自身凭据打开客户端指定的路径": "the daemon opens the client-specified path with its own credentials", "完成": "done", "容器占用: ": "container usage: ", "容器已处于正常状态，无需修复": "container already healthy, no repair needed", "容器根": "container root", "容器根: ": "container root: ", "对照 直接读 ": "control direct read ", "对照: 应用自身 open() 被 EPERM 拒绝": "control: the app's own open() refused with EPERM", "对自身端口注册通知返回 -300 (KERN_INVALID_CAPABILITY)。": "notification registration on own ports returns -300 (KERN_INVALID_CAPABILITY).", "将上述产物转为可用形式：IPA 改包、二进制注入、字节级替换、属性改写、数据库读取。本层不依赖任何漏洞，但它是「漏洞能力」最终交付到手上的形态。": "Turn those artifacts into usable form: IPA repacking, binary injection, byte-level replacement, attribute rewriting, database reads. This layer depends on no vulnerability, but it is the shape in which \"vulnerability capability\" is finally delivered into the hand.", "尺寸 ": "size ", "届时「直接读被拒 + 经链接读成功」即为越界成立的判定。": "At that point \"direct read refused + read via link succeeded\" is the verdict that the boundary was crossed.", "工作区": "Workspace", "工具会解包、改 Info.plist、往主二进制里插 LC_LOAD_DYLIB、做字节级字符串替换、去掉 LC_CODE_SIGNATURE，然后重新打成 zip。产出仍然是未签名的 —— 你用同一套证书签它。": "The tool unpacks, edits Info.plist, inserts LC_LOAD_DYLIB into the main binary, does byte-level string replacement, removes LC_CODE_SIGNATURE, then repacks into a zip. The output is still unsigned — you sign it with the same certificate.", "工具链自检": "toolchain self-test", "工具链落地": "toolchain landed", "已写入 ": "written ", "已创建但探针失败: ": "created but probe failed: ", "已取回": "retrieved", "已注册到用户字体域：": "registered into user font domain: ", "已移除": "removed", "已选择 ": "selected ", "市场名称": "marketing name", "帧数 ": "frames ", "广告标识符": "advertising identifier", "序列号可读": "serial readable", "序列开始: ": "sequence start: ", "序列结束: ": "sequence end: ", "应用与系统进程": "apps and system processes", "开": "on", "引擎启动失败: ": "engine start failed: ", "引擎已停止": "engine stopped", "归档 ": "archive ", "当前为模拟器：模拟器不对应用施加沙盒，直接读与经链接读都会成功，": "This is the simulator: it applies no sandbox to apps, so both the direct read and the read via the link succeed,", "当前为模拟器：模拟器内不运行 mediaplaybackd，该 Mach 服务无人监听，": "This is the simulator: mediaplaybackd does not run inside it, no one listens on that Mach service,", "成功": "ok", "所有标准目录已存在": "all standard directories exist", "手术失败：": "surgery failed: ", "手术完成：": "surgery complete: ", "手术未完成": "surgery incomplete", "打开失败": "open failed", "执行": "run", "扩展属性": "extended attributes", "扫描完成": "scan complete", "找不到主二进制名": "main binary name not found", "把字体文件注册进本进程的字体域。iOS 允许应用注册用户字体，注册后 CoreText 立刻可见 —— 这是改机里唯一一条完全不需要任何越权就能改「系统观感」的路径，代价是只在本进程生效。": "Register font files into this process's font domain. iOS lets apps register user fonts, visible to CoreText immediately — the one device-modification path that needs no privilege at all to change the \"system look\"; the price is that it only takes effect in this process.", "把容器内的偏好、文稿与工具产物打成 ZIP。归档走同一写入器，可被 libarchive 解回。": "Packs the container's preferences, documents and tool output into a ZIP. The archive goes through the same writer and reads back with libarchive.", "持有授权": "entitlement held", "探测": "probe", "探针 = 建文件 → 写 → fsync → 读回 → 比对 → 删除": "probe = create file → write → fsync → read back → compare → delete", "接受 · 尺寸 ": "accepted · size ", "握手建立: ": "handshake established: ", "握手未完成": "handshake incomplete", "握手被拒绝": "handshake refused", "搜索串为空": "search string empty", "搜索字符串": "search string", "操作数 300 > 栈容量 48": "300 operands > stack capacity 48", "数据库": "database", "数据过短": "data too short", "整数溢出": "integer overflow", "文本查找 Cinder27: ": "text search Cinder27: ", "文本，或 41 42 43 / 0x414243": "text, or 41 42 43 / 0x414243", "新名字": "new name", "无": "none", "无 GPT 签名": "no GPT signature", "无可用属性": "no attributes available", "无外部地址": "no external address", "无授权 — 只能走无线链路": "no entitlement — radio link only", "无数据": "no data", "无条目（解码器在块层就停了）": "no entries (decoder stopped at the block layer)", "无法 dlopen CoreMedia 或解析 FigXPC 入口": "cannot dlopen CoreMedia or resolve the FigXPC entry points", "无法创建 ": "cannot create ", "无法建立会话": "cannot establish session", "无法读取自身二进制": "cannot read own binary", "无线链路": "radio link", "无错误": "no error", "无需竞态窗口": "no race window needed", "无（符号被 strip 或不可见）": "none (symbol stripped or invisible)", "日历附件遏制路径探测": "Calendar attachment containment probe", "是": "yes", "显示名称": "display name", "更多": "more", "替换 ": "replaced ", "替换: ": "replace: ", "替换串不能比原串长 —— 这是原地改写，不改文件布局，所以不会破坏任何偏移。注入 LC_LOAD_DYLIB 需要头部有空隙，没有就会明确报出来。": "The replacement cannot be longer than the original — this is an in-place rewrite that keeps the file layout, so no offset is disturbed. Injecting LC_LOAD_DYLIB needs a header gap; if there is none it is reported explicitly.", "替换串不能比原串长（": "replacement cannot exceed original (", "替换为": "replace with", "替换失败: ": "replace failed: ", "替换并保存": "replace and save", "替换（可选，不能更长）": "replace (optional, not longer)", "最低系统": "minimum OS", "有效（../ 未逃出）": "effective (../ did not escape)", "有断言不成立": "assertion failed", "有断言失败": "assertion failed", "服务无人监听 —— 该构建可能已移除或重命名该 Mach 服务。": "no service listener — this build may have removed or renamed the Mach service.", "服务无人监听（本平台不适用）": "no listener for the service (not applicable here)", "服务有回复但握手被拒绝。": "service replied but the handshake was refused.", "服务有回复但非字典 —— 握手被拒绝。": "service replied but not with a dictionary — handshake refused.", "服务表": "service table", "未修复": "unfixed", "未发现内核指针": "no kernel pointers found", "未取到数据": "no data retrieved", "未命中": "miss", "未命中，未写入": "miss, not written", "未在产出里找到源标记的填充区": "no marker padding found in the output", "未知": "unknown", "未读到内容": "no content read", "未返回数据（沙盒或接口不可用）": "no data returned (sandbox or interface unavailable)", "本容器内 IconState: ": "IconState in this container: ", "本模块仍完成了 ": "this module still completed ", "本次新建: ": "created now: ", "本进程": "this process", "机型": "model", "权限受限": "entitlement-gated", "权限面已采集": "privilege surface captured", "权限面测绘": "privilege surface mapping", "条目 ": "entries ", "构建号": "build", "构造 ": "built ", "枚举目录": "enumerate", "查找": "find", "查找 / 替换": "find / replace", "查找替换全部断言通过": "all find/replace assertions passed", "查询（只读）": "query (read-only)", "校验方法不存在（27.0 未修复）": "validator absent (unfixed in 27.0)", "校验方法存在（27.2 已修复）": "validator present (fixed in 27.2)", "植入 ": "planted ", "沉浸式音频入口探测完成": "immersive audio entry probe complete", "沙盒 / 签名 / entitlements": "sandbox / signing / entitlements", "注入 LC_LOAD_DYLIB → ": "inject LC_LOAD_DYLIB → ", "注入 LC_LOAD_DYLIB：ncmds ": "inject LC_LOAD_DYLIB: ncmds ", "注入 dylib 路径": "dylib path to inject", "注入失败: ": "inject failed: ", "注入未成功（头部无空隙）：": "injection failed (no header gap): ", "注册失败（无错误信息）": "registration failed (no error)", "注册失败：": "registration failed: ", "活跃": "active", "消费 ": "consume ", "清理残留探针 ": "cleaning leftover probes ", "温度": "temperature", "渲染存活 — 该构建未受影响": "render survived — this build unaffected", "渲染存活（与源分析的负结果一致）": "render survived (matches the source-analysis negative)", "源 ": "source ", "源 IPA": "source IPA", "源 JPEG ": "source JPEG ", "源解码失败": "source decode failed", "源解码失败（标记先被拒绝了）": "source decode failed (marker refused first)", "溢出阈值标定": "overflow threshold calibration", "热状态": "thermal state", "版本": "version", "物理内存": "physical memory", "生成改机 IPA": "build modified IPA", "生效用户设置": "effective user settings", "用户态可触及的内核入口数量有限。ipc_port 请求表索引竞态无 entitlement 门槛；decmpfs 已在泄露层验证。本层度量的是「能否将用户态的错误转为内核侧的状态变化」。": "The kernel entries reachable from user space are few. The ipc_port request-table index race has no entitlement gate; decmpfs is already verified in the leak layer. This layer measures whether a user-space error can be turned into kernel-side state change.", "电源": "power", "电量": "battery", "目标": "target", "目标 ": "target ", "目标 ": "target ", "目标创建失败": "target create failed", "目标文件": "target file", "直接 open 成功（意外）": "direct open succeeded (unexpected)", "直接 open 被拒 errno=": "direct open refused errno=", "直接读也成功 ": "direct read also succeeded ", "直接读被拒 (errno ": "direct read refused (errno ", "真实但被拒的路径返回 -12203，不存在的路径返回 -17913。两个不同的服务端错误码在不授予访问的前提下披露文件是否存在。": "A real but refused path returns -12203, a nonexistent one -17913. Two distinct server-side error codes disclose whether a file exists without granting any access.", "码 ": "bytes ", "硬件型号": "hardware model", "确定该构建上的实际起点：进程持有哪些 entitlement、沙盒放行到哪一层、mach 命名空间如何组织。后续每一步的收益都要以该基线折算。": "Establish the real starting point on this build: which entitlements the process holds, how far the sandbox lets it through, how the mach namespace is organised. Every later stage's yield is measured against this baseline.", "种子 ": "seed ", "种子缺失": "seed missing", "种子缺失 deep_nest.usda": "seed missing deep_nest.usda", "种子缺失 joliet_path_oob.iso": "seed missing joliet_path_oob.iso", "种子缺失 ktx2_bad_dims.ktx2": "seed missing ktx2_bad_dims.ktx2", "种子缺失 stack_bomb.cff": "seed missing stack_bomb.cff", "移除": "removed", "移除 LC_CODE_SIGNATURE": "remove LC_CODE_SIGNATURE", "移除 LC_CODE_SIGNATURE ×": "remove LC_CODE_SIGNATURE ×", "移除 LC_CODE_SIGNATURE：": "remove LC_CODE_SIGNATURE: ", "移除失败: ": "remove failed: ", "移除损坏的 journal": "removing corrupt journal", "空闲": "idle", "竞态完成 ": "race done ", "竞态完成，内核返回 ": "race done, kernel returned ", "符号不可用": "symbol unavailable", "符号解析失败": "symbol resolution failed", "签发 ": "issue ", "签发时解析链接目标，消费时不复核路径": "resolves the link target at issue time and never re-verifies the path at consume time", "类型混淆": "type confusion", "系统可用字体（": "system fonts (", "系统组数据库": "system group database", "系统账户数据库": "system account database", "系统账户数据库（/private 前缀）": "system account database (/private prefix)", "系统进程": "system process", "累计路径 1024 B": "cumulative path 1024 B", "结果": "result", "缺失": "missing", "缺少该基线，无法区分「漏洞所得」与「签名所授」。": "Without that baseline there is no separating what a vulnerability earned from what the signature granted.", "网络": "network", "耗时异常 —— 递归路径可能没有终止条件": "abnormal duration — the recursive path may have no terminator", "联动": "chain", "自己写 ZIP → libarchive 读回": "own ZIP writer → libarchive read-back", "自检全绿意味着工具链本身可信 —— 此后出现的问题是选择问题，不是工具问题。": "All-green self-tests mean the toolchain itself is trustworthy — any problem after that is a targeting problem, not a tooling problem.", "自造 IPA：": "self-built IPA: ", "表: ": "table: ", "被拒绝本身即说明校验发生在解释器之前 —— 这是该构建上有效的观测。": "The refusal itself proves the validation happens before the interpreter — a valid observation on this build.", "视频编解码": "video codecs", "解包": "unpack", "解包 ": "unpacked ", "解包失败：": "unpack failed: ", "解析 ": "parsed ", "解析器面": "parser surface", "解析存活（已解码=": "parse survived (decoded=", "解析返回 ": "parse returned ", "解码 ": "decoded ", "解码器可达性探测完成": "decoder reachability probe complete", "解码器接受参数集 · 尺寸 ": "decoder accepted the parameter set · size ", "解码存活 ": "decode survived ", "解码存活 · 尺寸 ": "decode survived · size ", "解码存活 · 帧数 ": "decode survived · frames ", "解码存活（已解码=": "decode survived (decoded=", "解码返回错误: ": "decode returned error: ", "触觉事件已尝试": "haptic event attempted", "记录": "record", "该 Mach 服务无人监听 —— 本平台不适用（模拟器内不运行 mediaplaybackd）。真机上该服务常驻。": "no one listens on that Mach service — not applicable on this platform (mediaplaybackd does not run in the simulator). On a real device the service is resident.", "该平台不允许这条武装路径，故请求表索引竞态无法在此被驱动。": "This platform forbids that arming path, so the request-table index race cannot be driven here.", "该平台未施加沙盒 — 无证据": "no sandbox on this platform — no evidence", "该序列确定性成立，不需要竞态窗口。Apple 未将其视为安全问题，因此没有 CVE 编号。": "The sequence holds deterministically and needs no race window. Apple does not treat it as a security issue, so there is no CVE number.", "该构建上未越界": "not out of bounds on this build", "该阈值决定后续所有负载的长度预算。": "That threshold sets the length budget for every subsequent payload.", "详情": "detail", "请求表路径无法被武装。真机上应返回 KERN_SUCCESS。": "The request-table path cannot be armed. On a real device it should return KERN_SUCCESS.", "读写正常": "read/write ok", "读取 ": "read ", "读取 ": "read ", "读取 IPA 失败": "IPA read failed", "读取失败": "read failed", "读取失败 errno=": "read failed errno=", "读取失败: ": "read failed: ", "读回内容不一致": "read-back mismatch", "读回失败: ": "read-back failed: ", "资产载入存活": "asset load survived", "越过沙盒读取": "read past sandbox", "越过沙盒读取 ": "read past sandbox ", "跨沙盒": "cross-sandbox", "跨沙盒读取 ": "cross-sandbox read ", "跨越边界 ": "crossed boundary ", "路径": "path", "路径不存在 (-17913)": "path absent (-17913)", "路径中间不是目录": "path component is not a directory", "路径存在但拒绝访问 (-12203)": "path present but access refused (-12203)", "路径穿越遏制: ": "path traversal containment: ", "输出不稳定 — 未初始化内存迹象": "output unstable — uninitialised-memory signature", "输出干净": "output clean", "输出文件里出现 ": "output file contains ", "输出稳定": "output stable", "过程": "process", "运行时长": "uptime", "返回 0 —— 偏移被钳制或链未被跟随": "returned 0 — offset clamped or chain not followed", "返回错误: ": "returned error: ", "进程内": "in-process", "连接 com.apple.coremedia.mediaplaybackd.bytestream.xpc": "connecting to com.apple.coremedia.mediaplaybackd.bytestream.xpc", "连接对象已创建: ": "connection created: ", "选择 .sqlite / .db": "choose .sqlite / .db", "选择一个 .ipa": "choose an .ipa", "选择一个文件": "choose a file", "选择字体文件": "choose a font file", "选择文件": "choose file", "逐字节比对: ": "byte comparison: ", "通过": "passed", "遍历完成，": "traversal complete, ", "重复越界写 32 次": "repeat OOB write 32×", "重打包 ": "repacked ", "重编码成功=": "re-encode ok=", "错误: ": "error: ", "错误码 ": "error code ", "镜像 ": "image ", "镜像过短": "image too short", "需要 65536 B，实际 64 B": "needs 65536 B, 64 B present", "需达到可复现阈值；低于该阈值时，越狱路径不成立。": "A reproducible threshold is required; below it the jailbreak chain does not hold.", "音频栈": "audio stack", "音频资源 id=": "audio resource id=", "页面 4000×4000 · 需要 64 MB 缓冲": "page 4000×4000 · needs a 64 MB buffer", "页面渲染完成 ": "page rendered ", "项": "entries", "验证了名称空间的分配/拆除路径本身可用。": "verifies that the namespace allocate/teardown path itself works.", "（按设计不接受新建文件，不计入探针）": " (by design accepts no new files, excluded from probes)", "）": ")", "，含 LC_LOAD_DYLIB=": ", contains LC_LOAD_DYLIB=", "，命令数 ": ", load commands ", "，尺寸 ": ", size ", "，属性 ": ", attrs ", "，已绘制 ": ", drawn ", "，已解码 ": ", decoded ", "，经链接 ": ", via link ", "，经链接亦失败": ", via link also failed", "，经链接读到内容": ", via link read content", ] }