658 lines
46 KiB
Swift
658 lines
46 KiB
Swift
import Foundation
|
||
|
||
/// Runtime-output translation.
|
||
///
|
||
/// Chinese literals in engine and UI code are the source of truth and stay where they are.
|
||
/// This table maps each one to its English rendering. In Chinese the input passes through
|
||
/// untouched; in English an unmapped string also passes through, so an ASCII name such as
|
||
/// "Documents" needs no entry.
|
||
///
|
||
/// Keys are the exact literal text, including any leading/trailing spaces that were part
|
||
/// of the original string.
|
||
func tl(_ zh: String) -> String {
|
||
guard Lang.resolved == .en else { return zh }
|
||
return RuntimeText.map[zh] ?? zh
|
||
}
|
||
|
||
enum RuntimeText {
|
||
// Filled by the localization pass. Every key is a Chinese literal that appears in the
|
||
// source; every value is its English rendering.
|
||
static let map: [String: String] = [
|
||
"\n\n种子 ": "\n\nseed ",
|
||
"\n(达到资源预算，提前收敛 —— 这是刻意的，不是失败)": "\\n(resource budget reached, converged early — deliberate, not a failure)",
|
||
"\n内核未返回任何错误码": "\nkernel returned no error codes",
|
||
"\n属性: ": "\nattributes: ",
|
||
"\n状态: ": "\nstatus: ",
|
||
"\n若 27.0 未钳制，这些 0x41 来自越界读到的堆内容；27.2 会直接丢弃越界标记。": "\\nIf 27.0 does not clamp, these 0x41 bytes come from the out-of-bounds heap read; 27.2 discards the out-of-range marker outright.",
|
||
"\n负载 ": "\npayload ",
|
||
"\n通知注册被拒 ": "\nnotification registration refused ",
|
||
" 直接读 errno=": " direct read errno=",
|
||
" 落在当前容器内: ": " inside current container: ",
|
||
" 候选: ": " candidates: ",
|
||
" 分区 ": " partition ",
|
||
" 命中: ": " hits: ",
|
||
" 未读到内容 — ": " nothing read — ",
|
||
" 直接读 errno=": " direct read errno=",
|
||
" 直接读也成功 ": " direct read also succeeded ",
|
||
" B · 4 个条目 · 名字域 36 单元 / 72 字节": " B · 4 entries · name field 36 units / 72 bytes",
|
||
" B · 64 位=": " B · 64-bit=",
|
||
" B · 900 切片": " B · 900 slices",
|
||
" B · 解包 ": " B · unpacked ",
|
||
" B — 该平台未对该路径施加沙盒，本项不构成证据": " B — no sandbox on this path on this platform, not evidence",
|
||
" B — 该平台未施加沙盒": " B — no sandbox on this platform",
|
||
" B — 边界已被跨越": " B — boundary crossed",
|
||
" B → 产出 ": " B → output ",
|
||
" B 的 decmpfs 属性": " B decmpfs attribute",
|
||
" B（ZipWriter 产出，stored 条目）": " B (ZipWriter output, stored entries)",
|
||
" B，block-id 1 × 6（容量 4）": " B, block-id 1 × 6 (capacity 4)",
|
||
" B，单个 charstring 连续推入 300 个操作数后 endchar。\n": " B, one charstring pushing 300 consecutive operands then endchar.\\n",
|
||
" B，可用 ": " B available ",
|
||
" ms，对象数 ": " ms, objects ",
|
||
" ms；中心像素 RGBA = ": " ms; centre pixel RGBA = ",
|
||
" · 加密=": " · encrypted=",
|
||
" · 受阻 ": " · blocked ",
|
||
" · 尺寸 ": " · size ",
|
||
" · 层 ID 0x3F": " · layer id 0x3F",
|
||
" · 帧数 ": " · frames ",
|
||
" · 库 ": " · lib ",
|
||
" · 无沙盒 ": " · no sandbox ",
|
||
" · 真实写探针=": " · real write probe=",
|
||
" ← 两者不一致，说明 access() 不可信": " ← mismatch, so access() is not trustworthy",
|
||
" 一致": " consistent",
|
||
" 一致 / ": " consistent / ",
|
||
" 不一致": " inconsistent",
|
||
" 不存在": " absent",
|
||
" 个二进制": " binaries",
|
||
" 个内核指针候选": " kernel pointer candidates",
|
||
" 个可写": " writable",
|
||
" 个可读 · ": " readable · ",
|
||
" 个字形": " glyphs",
|
||
" 个属性": " attributes",
|
||
" 个文件": " files",
|
||
" 个文件 → ": " files → ",
|
||
" 个文件逐字节一致": " files byte-identical",
|
||
" 个文件，共 ": " files, ",
|
||
" 个条目": " entries",
|
||
" 个条目 · mode ": " entries · mode ",
|
||
" 个目录读写正常": " directories read/write ok",
|
||
" 个长度存活": " lengths survived",
|
||
" 个（mode ": " (mode ",
|
||
" 仍不可用: ": " still unusable: ",
|
||
" 可开 · ": " openable · ",
|
||
" 命中: ": " hits: ",
|
||
" 处": " sites",
|
||
" 处 @ ": " sites @ ",
|
||
" 处 · 偏移一致=": " sites · offsets match=",
|
||
" 处 · 旧模式残留 ": " sites · old mode residue ",
|
||
" 处 → 新模式 ": " sites → new mode ",
|
||
" 处: ": " sites: ",
|
||
" 处并已保存（备份 ": " sites and saved (backup ",
|
||
" 处（应为 0）": " sites (expected 0)",
|
||
" 字节": " bytes",
|
||
" 字节 0x41": " bytes 0x41",
|
||
" 存在且": " present and ",
|
||
" 存在但被拒 · ": " present but refused · ",
|
||
" 存活 — ": " survived — ",
|
||
" 已用 / 预算 ": " used / budget ",
|
||
" 张表": " tables",
|
||
" 是文件而不是目录 —— 跳过": " is a file, not a directory — skipped",
|
||
" 条": " items",
|
||
" 条 · type=": " items · type=",
|
||
" 条目": " entries",
|
||
" 条目 / ": " entries / ",
|
||
" 条目 · ": " entries · ",
|
||
" 核": " cores",
|
||
" 次 —— 该平台不允许对自身端口注册通知，": " times — this platform does not allow notification registration on own ports, ",
|
||
" 次操作，无异常返回": " operations, no abnormal returns",
|
||
" 次端口分配与回收，": " port allocations and releases, ",
|
||
" 段标记填充字节": " segment marker padding bytes",
|
||
" 目录读写正常": " directory read/write ok",
|
||
" 类错误码": " error classes",
|
||
" 行": " rows",
|
||
" 被拒绝 — ": " refused — ",
|
||
" 解析出 ": " parsed ",
|
||
" 连续 ": " consecutive ",
|
||
" 页": " pages",
|
||
" 项": " entries",
|
||
" 项 · ": " entries · ",
|
||
" 项 · 每项 ": " entries · each ",
|
||
" 项（含 ../ 路径）→ 遏制必须由调用方负责": " entries (with ../ paths) → containment is the caller's job",
|
||
"\"）": "\")",
|
||
") · 原始大小 ": ") · raw size ",
|
||
")，经链接读到 ": "), via link read ",
|
||
"-12203 = 存在但被拒": "-12203 = present but refused",
|
||
"-17913 = 不存在": "-17913 = absent",
|
||
"0x 前缀写法: ": "0x prefix form: ",
|
||
"1. 不存在的深层目录自动创建: ": "1. missing deep directory auto-created: ",
|
||
"2. Container.write 自动建父目录: 通过（读回 \"": "2. Container.write auto-creates parents: passed (read back \"",
|
||
"2. Container.write: 失败 ": "2. Container.write: failed ",
|
||
"2000 层嵌套": "2000 nesting levels",
|
||
"27.0 扫描边界 0x48 = 72 B": "27.0 scan bound 0x48 = 72 B",
|
||
"27.0 期望：push 路径无计数检查，操作数栈越界。\n": "27.0 expectation: the push path has no count check, the operand stack overruns.\\n",
|
||
"27.0 期望：分配截断 → 转换循环越界写。27.2 期望：_TIFFCheckMalloc_type 拒绝。": "27.0 expectation: allocation truncation → the conversion loop writes out of bounds. 27.2 expectation: _TIFFCheckMalloc_type refuses.",
|
||
"27.0 期望：切片上限未检查 → 插件内越界。27.2 期望：\"too many slices!\"。": "27.0 expectation: the slice cap is unchecked → overrun inside the plugin. 27.2 expectation: \"too many slices!\".",
|
||
"27.2 收紧到 0x24 = 36 B": "27.2 tightened to 0x24 = 36 B",
|
||
"27.2 期望：Push/Pop 两道栈保护在解释前拒绝该字体。\n": "27.2 expectation: Push/Pop stack guards reject the font before interpretation.\\n",
|
||
"3 次解码指纹": "3-decode fingerprint",
|
||
"3. 旧 UUID 路径重挂: ": "3. old UUID path remount: ",
|
||
"32 轮完成，进程存活": "32 rounds complete, process alive",
|
||
"4. isWritableFile(容器根)=": "4. isWritableFile(container root)=",
|
||
"64 × 4 KB 随机内容": "64 × 4 KB random content",
|
||
": 不可见": ": not visible",
|
||
": 解码失败": ": decode failed",
|
||
": 读取被拒绝（沙盒）": ": read refused (sandbox)",
|
||
"ANE 用户态入口探测": "ANE user-space entry probe",
|
||
"AVC 参数集路径已触发": "AVC parameter set path triggered",
|
||
"AVD.videodecoder 插件": "AVD.videodecoder plugin",
|
||
"AVD.videodecoder 插件（非 kext）": "AVD.videodecoder plugin (not a kext)",
|
||
"Apple 未将其视为安全问题，无 CVE": "Apple does not treat it as a security issue, no CVE",
|
||
"CGBitmapContext 创建失败": "CGBitmapContext create failed",
|
||
"CGDataProvider 创建失败": "CGDataProvider create failed",
|
||
"CGFont 拒绝该字体数据": "CGFont refused the font data",
|
||
"CGImageDestination 创建失败": "CGImageDestination create failed",
|
||
"CGImageSource 拒绝该数据": "CGImageSource refused the data",
|
||
"CGPDFDocument 解析失败（文件被拒绝）": "CGPDFDocument parse failed (file refused)",
|
||
"CHHapticEngine 初始化失败: ": "CHHapticEngine init failed: ",
|
||
"CHHapticEngine 启动成功": "CHHapticEngine started",
|
||
"CHHapticEngine 启动成功（沉浸式音频会话已建立）": "CHHapticEngine started (immersive audio session established)",
|
||
"CHHapticEngine 未尝试": "CHHapticEngine not attempted",
|
||
"CMGetDMVersionLevelFromRPU 未导出": "CMGetDMVersionLevelFromRPU not exported",
|
||
"CTFontGetLigatureCaretPositions 返回 ": "CTFontGetLigatureCaretPositions returned ",
|
||
"CoreMedia 符号不可用": "CoreMedia symbols unavailable",
|
||
"CoreMedia 符号解析失败，或 XPC 连接无法创建": "CoreMedia symbol resolution failed, or the XPC connection cannot be created",
|
||
"DRC 路径探测完成": "DRC path probe complete",
|
||
"EACCES 沙盒拒绝访问": "EACCES sandbox access refusal",
|
||
"EDQUOT 超出配额": "EDQUOT over quota",
|
||
"EEXIST 已存在": "EEXIST already exists",
|
||
"EISDIR 目标是目录": "EISDIR target is a directory",
|
||
"ENAMETOOLONG 名称过长": "ENAMETOOLONG name too long",
|
||
"ENOENT 父目录或文件不存在": "ENOENT parent or file absent",
|
||
"ENOSPC 空间不足": "ENOSPC no space",
|
||
"ENOTDIR 路径中间是文件": "ENOTDIR path component is a file",
|
||
"EPERM — 沙盒拒绝": "EPERM — sandbox refusal",
|
||
"EPERM 操作被拒绝": "EPERM operation refused",
|
||
"EROFS 只读文件系统": "EROFS read-only filesystem",
|
||
"EXDEV 跨卷（.atomic 写到了别的卷）": "EXDEV cross-volume (.atomic landed on another volume)",
|
||
"FigXPCCreateBasicMessage('Curl') 失败": "FigXPCCreateBasicMessage('Curl') failed",
|
||
"FontParser · charstring 解释器": "FontParser · charstring interpreter",
|
||
"GPS 读取存活": "GPS read survived",
|
||
"GPT 头: 条目表 LBA ": "GPT header: entry array LBA ",
|
||
"GPT 镜像已构造并解析": "GPT image built and parsed",
|
||
"HEVC 参数集 = ": "HEVC parameter set = ",
|
||
"HEVC 层路径已触发": "HEVC layer path triggered",
|
||
"HID 路径可达性": "HID path reachability",
|
||
"IOHIDFamily · caps 表查找": "IOHIDFamily · caps table lookup",
|
||
"IOKit 事件入口探测": "IOKit event entry probe",
|
||
"IOPSCopyPowerSourcesInfo 不可用": "IOPSCopyPowerSourcesInfo unavailable",
|
||
"IPA 产出": "IPA output",
|
||
"IPA 手术链路可用": "IPA surgery pipeline available",
|
||
"ImageIO · 图像解析": "ImageIO · image parsing",
|
||
"ImageIO · 纹理与编码": "ImageIO · textures and codecs",
|
||
"Info.plist 读取失败，跳过字段改写": "Info.plist read failed, skipping field rewrite",
|
||
"LigCaret 查询完成": "LigCaret query complete",
|
||
"MDLAsset 载入完成 ": "MDLAsset load complete ",
|
||
"OOB 写": "OOB write",
|
||
"OOB 读": "OOB read",
|
||
"PDF 无第 ": "PDF has no page ",
|
||
"PDF 解码路径已触发": "PDF decode path triggered",
|
||
"Payload/ 下没有 .app": "no .app under Payload/",
|
||
"RockRidge CL/PL 环：27.0 与 27.2 都未修（上游已修，Apple 未取）": "RockRidge CL/PL cycle: unfixed in both 27.0 and 27.2 (fixed upstream, Apple did not take it)",
|
||
"RockRidge 路径已遍历": "RockRidge path traversed",
|
||
"SBHomeScreenService 在进程内: ": "SBHomeScreenService in-process: ",
|
||
"SQLite3 不可用": "SQLite3 unavailable",
|
||
"SpringBoard 路径探测": "SpringBoard path probe",
|
||
"Type-5 阴影的写入是值可控的，但短溢出会被相邻 VLA 吸收。逐级抬升 R，确定该构建上栈布局开始失效的维度。": "The Type-5 shading write is value-controlled, but a short overflow is absorbed by the adjacent VLA. Step R upward to find the dimension at which this build's stack layout starts to break.",
|
||
"UDID (设备)": "UDID (device)",
|
||
"XNU · ipc_port.c 请求表消费方": "XNU · ipc_port.c request-table consumers",
|
||
"XNU 内核": "XNU kernel",
|
||
"archive_read_new 失败": "archive_read_new failed",
|
||
"audioCustom 事件已投递": "audioCustom event delivered",
|
||
"caret 坐标: ": "caret positions: ",
|
||
"charstring 推 300 个操作数": "charstring pushes 300 operands",
|
||
"codespace 长度 128": "codespace length 128",
|
||
"com.apple.decmpfs 是内核压缩文件系统用的属性。改它等于直接改内核解压的输入 —— CVE-2026-113910 就是这条路径上「解压产出少于预期」时内核把未写满的页缓冲交给用户态。这里可以手动设一个、读回来、再删掉。": "com.apple.decmpfs is the attribute the kernel's compressed filesystem uses. Changing it changes the input the kernel decompresses — CVE-2026-113910 is exactly this path: when decompression under-produces, the kernel hands the unwritten page buffer back to user space. Here you can set one by hand, read it back, then delete it.",
|
||
"consume 后读取失败: ": "read after consume failed: ",
|
||
"decmpfs 操作": "decmpfs operations",
|
||
"dlopen 失败": "dlopen failed",
|
||
"entitlements: 无法读取（SecTask 不可用或为空）": "entitlements: unreadable (SecTask unavailable or empty)",
|
||
"fcTL 声明 26B 实到 4B": "fcTL declares 26B, 4B present",
|
||
"getifaddrs 失败": "getifaddrs failed",
|
||
"hosts 表": "hosts table",
|
||
"iOS 27.2 起修复": "fixed since iOS 27.2",
|
||
"issue_file 被拒: ": "issue_file refused: ",
|
||
"libarchive 不可用": "libarchive unavailable",
|
||
"libarchive 的 2 字节堆越界与 CoreMedia 的 28 字节结构体外写，是整套中仅有的两个「写穿过对象边界」的形状。前者精确但浅，后者深且落在保存寄存器区。同一 CVE 下的 CAB 站点与 GPT 分区名越界读一并标定。": "libarchive's 2-byte heap overrun and CoreMedia's 28-byte write past the struct are the only two \"write across an object boundary\" shapes in the whole set. The former is precise but shallow; the latter is deep and lands in the saved-register area. The CAB site under the same CVE and the GPT partition-name OOB read are calibrated alongside.",
|
||
"libarchive 解包 ": "libarchive unpacked ",
|
||
"libarchive 返回 ": "libarchive returned ",
|
||
"libarchive.2.dylib 无法 dlopen（沙盒或路径受限）": "libarchive.2.dylib cannot dlopen (sandbox or path restricted)",
|
||
"magic cmpf · 类型 ": "magic cmpf · type ",
|
||
"mediaplaybackd.bytestream.xpc 对任何沙盒应用可达。守护进程以自身凭据打开客户端指定的绝对路径，并把活描述符放进回复的 ByteStreamDetails。描述符级 I/O 不受客户端沙盒的路径检查约束 —— 应用自身 open() 返回 EPERM 的文件，其内容可经该描述符完整读回。": "mediaplaybackd.bytestream.xpc is reachable from any sandboxed app. The daemon opens the client-specified absolute path with its own credentials and puts a live descriptor into the reply's ByteStreamDetails. Descriptor-level I/O is not subject to the client sandbox's path checks — a file whose open() returns EPERM for the app itself can be read back in full through that descriptor.",
|
||
"mkdir 失败: ": "mkdir failed: ",
|
||
"networkd 偏好": "networkd prefs",
|
||
"opcode 已被封 (-16158)": "opcode sealed (-16158)",
|
||
"plist 语法错误，未写入": "plist syntax error, not written",
|
||
"registerAudioResource 失败: ": "registerAudioResource failed: ",
|
||
"sandbox_extension 符号不可用": "sandbox_extension symbols unavailable",
|
||
"sandbox_extension_issue_file / consume 无法解析": "sandbox_extension_issue_file / consume cannot be resolved",
|
||
"sandbox_extension_issue_file 在签发时解析符号链接，但不强制 SANDBOX_EXTENSION_NOFOLLOW。签发返回的令牌绑定签发时刻解析出的目标，而内核对消费时刻所用路径不做复核。序列为：沙盒内建立链接 L 指向沙盒内文件 S → 对 L 签发扩展 → 将 L 重指向沙盒外目标 T → 消费令牌后经 L 读取。": "sandbox_extension_issue_file resolves the symlink at issue time but does not enforce SANDBOX_EXTENSION_NOFOLLOW. The token it returns is bound to the target resolved at issue time, and the kernel never re-verifies the path used at consume time. The sequence: create link L in the sandbox pointing at in-sandbox file S → issue the extension for L (the kernel records S) → repoint L at out-of-sandbox target T → consume the token and read through L.",
|
||
"setxattr 失败 errno=": "setxattr failed errno=",
|
||
"symlink(decoy) 失败: ": "symlink(decoy) failed: ",
|
||
"symlink(target) 失败: ": "symlink(target) failed: ",
|
||
"— 判定 —": "— verdict —",
|
||
"— 基线 —": "— baseline —",
|
||
"— 失效模式验证 —": "— failure mode verification —",
|
||
"— 存在性预言机 —": "— existence oracle —",
|
||
"— 对照 —": "— control —",
|
||
"— 平台限制 —": "— platform limit —",
|
||
"— 目录枚举 —": "— directory listing —",
|
||
"— 读取 —": "— read —",
|
||
"✓ AudioCodecs 可加载": "✓ AudioCodecs loadable",
|
||
"✓ 书签 ": "✓ bookmarked ",
|
||
"✓ 已创建 ": "✓ created ",
|
||
"✓ 已加入书签": "✓ bookmarked",
|
||
"✗ AudioCodecs 无法 dlopen": "✗ AudioCodecs cannot dlopen",
|
||
"上下文创建失败": "context create failed",
|
||
"不可用": "unavailable",
|
||
"不可见": "not visible",
|
||
"不可读": "unreadable",
|
||
"不存在": "absent",
|
||
"不存在 ": "absent ",
|
||
"不存在 (-17913)": "absent (-17913)",
|
||
"不存在（未修复）": "absent (unfixed)",
|
||
"不是 Mach-O": "not a Mach-O",
|
||
"不是 decmpfs（magic 0x": "not decmpfs (magic 0x",
|
||
"两者均失败：直接读 errno ": "both failed: direct errno ",
|
||
"两者都需要稳定的堆布局控制，而这正是上一阶段泄露所提供的。": "Both need stable heap-layout control, which is exactly what the previous stage's leaks provide.",
|
||
"个原语": " primitives",
|
||
"主二进制读取失败（可能已加密）": "main binary read failed (possibly encrypted)",
|
||
"主密码文件（通常不可读）": "master password file (usually unreadable)",
|
||
"主机名": "hostname",
|
||
"事件投递失败: ": "event delivery failed: ",
|
||
"二进制": "binary",
|
||
"产出": "output",
|
||
"产出 ": "output ",
|
||
"会话建立失败": "session setup failed",
|
||
"低电量模式": "low power mode",
|
||
"信息泄露": "info leak",
|
||
"值偏移 +65536": "value offset +65536",
|
||
"值可控写": "value-controlled write",
|
||
"值可控写与地址泄露相加，构成构造可控状态的全部要素；所缺的是将写转为执行的环节。": "Value-controlled write plus address disclosure is every element needed to build controlled state; what is missing is the step that turns the write into execution.",
|
||
"元数据读取完成": "metadata read complete",
|
||
"充电中": "charging",
|
||
"先取得地址与内容。decmpfs 欠产出将内核页缓冲尾部交回用户态；TIFF 截断条带与 EXIF 短读将进程堆残留交回图像与元数据；CoreMedia bytestream 与 sandbox_extension 越过沙盒边界取回文件内容。": "Addresses and content come first. decmpfs under-production hands the kernel page-buffer tail back to user space; the truncated TIFF strip and the EXIF short read hand process-heap residue back as image and metadata; the CoreMedia bytestream and sandbox_extension cross the sandbox boundary and retrieve file contents.",
|
||
"全局偏好": "global prefs",
|
||
"全局偏好（/private 前缀）": "global prefs (/private prefix)",
|
||
"全部 ": "all ",
|
||
"全部读取": "read all",
|
||
"关": "off",
|
||
"内容": "content",
|
||
"内容 (": "content (",
|
||
"内核": "kernel",
|
||
"内核面": "kernel surface",
|
||
"写入失败: ": "write failed: ",
|
||
"写入探测属性": "write probe attribute",
|
||
"写入被拒 (-12878)": "write refused (-12878)",
|
||
"分配/拆除路径可用，通知武装被平台拒绝": "allocate/teardown path available, notification arming refused by the platform",
|
||
"分配路径已触发": "allocation path triggered",
|
||
"创建 ": "created ",
|
||
"判定依据：直接读被拒 且 经链接读成功": "verdict basis: direct read refused AND read via link succeeded",
|
||
"十六进制": "hex",
|
||
"十六进制查找: ": "hex search: ",
|
||
"协议表": "protocol table",
|
||
"压缩类型 3 = LZX": "compression type 3 = LZX",
|
||
"发现 ": "found ",
|
||
"取自本进程的 Mach-O：": "Mach-O taken from this process: ",
|
||
"只支持 64 位 Mach-O": "only 64-bit Mach-O supported",
|
||
"只读": "read-only",
|
||
"只读（探针未通过）": "read-only (probe failed)",
|
||
"可写": "writable",
|
||
"可写根目录: ": "writable roots: ",
|
||
"可开": "openable",
|
||
"可开 ": "openable ",
|
||
"可开（code 0）": "openable (code 0)",
|
||
"可用空间: ": "free space: ",
|
||
"可见": "visible",
|
||
"可读": "readable",
|
||
"可读域: ": "readable domain: ",
|
||
"可达性探测": "reachability probe",
|
||
"合计 ": "total ",
|
||
"名称 → ": "name → ",
|
||
"否": "no",
|
||
"否（需 IOKit 平台 Expert 接口）": "no (needs the IOKit platform expert interface)",
|
||
"启动 UUID": "boot UUID",
|
||
"启动时间": "boot time",
|
||
"命中 ": "hit ",
|
||
"回复类型 ": "reply type ",
|
||
"回复类型: ": "reply type: ",
|
||
"回复里没有 fd": "no fd in reply",
|
||
"因此握手收不到任何回复。真机上该服务常驻，握手应返回字典。": "So the handshake gets no reply. On a real device the service is resident and the handshake should return a dictionary.",
|
||
"因此该原语在此平台上无法给出证据。真机上直接读应返回 EPERM，": "So the primitive cannot produce evidence on this platform. On a real device the direct read should return EPERM,",
|
||
"在取得稳定泄露之后，才有条件讨论将溢出写成什么值；否则只能触发崩溃。": "Only after a stable leak is there any basis for choosing what the overflow writes; before that, it can only crash.",
|
||
"在标定所得长度上，以 PDF 中选定的 double 位模式决定被覆盖的指针。崩溃地址即证据 —— 它证明写入内容由攻击者控制，而非仅证明发生了崩溃。": "At the calibrated length, the double bit pattern chosen in the PDF decides the pointer that gets overwritten. The fault address is the evidence — it proves the written content is attacker-controlled, not merely that a crash happened.",
|
||
"坐标即追链读到的 16 位值": "the positions are the 16-bit values the chain read",
|
||
"基线已采集": "baseline captured",
|
||
"声明长度 65518": "declared length 65518",
|
||
"处理中…": "working…",
|
||
"备份": "backups",
|
||
"备份往返 ": "backup round-trip ",
|
||
"外设": "peripheral",
|
||
"大小": "size",
|
||
"失败": "failed",
|
||
"失败 —— ../ 逃出了目标目录": "failed — ../ escaped the destination",
|
||
"失败: ": "failed: ",
|
||
"头部空隙不足：需要 ": "header gap insufficient: need ",
|
||
"字体 / Model I/O": "fonts / Model I/O",
|
||
"字体加载成功 name=": "font loaded name=",
|
||
"字体在 CGFont 层被拒绝": "font refused at the CGFont layer",
|
||
"字体在解析阶段被拒绝": "font refused at parse stage",
|
||
"字体安装": "font install",
|
||
"字体已加载并绘制": "font loaded and drawn",
|
||
"字符串替换 ": "string replace ",
|
||
"字符串替换 Cinder27 → Cind3r27：": "string replace Cinder27 → Cind3r27: ",
|
||
"字符串替换失败：": "string replace failed: ",
|
||
"存在": "present",
|
||
"存在·被拒 ": "present·refused ",
|
||
"存在但被拒 (-12203)": "present but refused (-12203)",
|
||
"存在性预言机": "existence oracle",
|
||
"存在（已修复）": "present (fixed)",
|
||
"存活: ": "survived: ",
|
||
"守护进程以自身凭据打开客户端指定的路径": "the daemon opens the client-specified path with its own credentials",
|
||
"完成": "done",
|
||
"容器占用: ": "container usage: ",
|
||
"容器已处于正常状态，无需修复": "container already healthy, no repair needed",
|
||
"容器根": "container root",
|
||
"容器根: ": "container root: ",
|
||
"对照 直接读 ": "control direct read ",
|
||
"对照: 应用自身 open() 被 EPERM 拒绝": "control: the app's own open() refused with EPERM",
|
||
"对自身端口注册通知返回 -300 (KERN_INVALID_CAPABILITY)。": "notification registration on own ports returns -300 (KERN_INVALID_CAPABILITY).",
|
||
"将上述产物转为可用形式：IPA 改包、二进制注入、字节级替换、属性改写、数据库读取。本层不依赖任何漏洞，但它是「漏洞能力」最终交付到手上的形态。": "Turn those artifacts into usable form: IPA repacking, binary injection, byte-level replacement, attribute rewriting, database reads. This layer depends on no vulnerability, but it is the shape in which \"vulnerability capability\" is finally delivered into the hand.",
|
||
"尺寸 ": "size ",
|
||
"届时「直接读被拒 + 经链接读成功」即为越界成立的判定。": "At that point \"direct read refused + read via link succeeded\" is the verdict that the boundary was crossed.",
|
||
"工作区": "Workspace",
|
||
"工具会解包、改 Info.plist、往主二进制里插 LC_LOAD_DYLIB、做字节级字符串替换、去掉 LC_CODE_SIGNATURE，然后重新打成 zip。产出仍然是未签名的 —— 你用同一套证书签它。": "The tool unpacks, edits Info.plist, inserts LC_LOAD_DYLIB into the main binary, does byte-level string replacement, removes LC_CODE_SIGNATURE, then repacks into a zip. The output is still unsigned — you sign it with the same certificate.",
|
||
"工具链自检": "toolchain self-test",
|
||
"工具链落地": "toolchain landed",
|
||
"已写入 ": "written ",
|
||
"已创建但探针失败: ": "created but probe failed: ",
|
||
"已取回": "retrieved",
|
||
"已注册到用户字体域：": "registered into user font domain: ",
|
||
"已移除": "removed",
|
||
"已选择 ": "selected ",
|
||
"市场名称": "marketing name",
|
||
"帧数 ": "frames ",
|
||
"广告标识符": "advertising identifier",
|
||
"序列号可读": "serial readable",
|
||
"序列开始: ": "sequence start: ",
|
||
"序列结束: ": "sequence end: ",
|
||
"应用与系统进程": "apps and system processes",
|
||
"开": "on",
|
||
"引擎启动失败: ": "engine start failed: ",
|
||
"引擎已停止": "engine stopped",
|
||
"归档 ": "archive ",
|
||
"当前为模拟器：模拟器不对应用施加沙盒，直接读与经链接读都会成功，": "This is the simulator: it applies no sandbox to apps, so both the direct read and the read via the link succeed,",
|
||
"当前为模拟器：模拟器内不运行 mediaplaybackd，该 Mach 服务无人监听，": "This is the simulator: mediaplaybackd does not run inside it, no one listens on that Mach service,",
|
||
"成功": "ok",
|
||
"所有标准目录已存在": "all standard directories exist",
|
||
"手术失败：": "surgery failed: ",
|
||
"手术完成：": "surgery complete: ",
|
||
"手术未完成": "surgery incomplete",
|
||
"打开失败": "open failed",
|
||
"执行": "run",
|
||
"扩展属性": "extended attributes",
|
||
"扫描完成": "scan complete",
|
||
"找不到主二进制名": "main binary name not found",
|
||
"把字体文件注册进本进程的字体域。iOS 允许应用注册用户字体，注册后 CoreText 立刻可见 —— 这是改机里唯一一条完全不需要任何越权就能改「系统观感」的路径，代价是只在本进程生效。": "Register font files into this process's font domain. iOS lets apps register user fonts, visible to CoreText immediately — the one device-modification path that needs no privilege at all to change the \"system look\"; the price is that it only takes effect in this process.",
|
||
"把容器内的偏好、文稿与工具产物打成 ZIP。归档走同一写入器，可被 libarchive 解回。": "Packs the container's preferences, documents and tool output into a ZIP. The archive goes through the same writer and reads back with libarchive.",
|
||
"持有授权": "entitlement held",
|
||
"探测": "probe",
|
||
"探针 = 建文件 → 写 → fsync → 读回 → 比对 → 删除": "probe = create file → write → fsync → read back → compare → delete",
|
||
"接受 · 尺寸 ": "accepted · size ",
|
||
"握手建立: ": "handshake established: ",
|
||
"握手未完成": "handshake incomplete",
|
||
"握手被拒绝": "handshake refused",
|
||
"搜索串为空": "search string empty",
|
||
"搜索字符串": "search string",
|
||
"操作数 300 > 栈容量 48": "300 operands > stack capacity 48",
|
||
"数据库": "database",
|
||
"数据过短": "data too short",
|
||
"整数溢出": "integer overflow",
|
||
"文本查找 Cinder27: ": "text search Cinder27: ",
|
||
"文本，或 41 42 43 / 0x414243": "text, or 41 42 43 / 0x414243",
|
||
"新名字": "new name",
|
||
"无": "none",
|
||
"无 GPT 签名": "no GPT signature",
|
||
"无可用属性": "no attributes available",
|
||
"无外部地址": "no external address",
|
||
"无授权 — 只能走无线链路": "no entitlement — radio link only",
|
||
"无数据": "no data",
|
||
"无条目（解码器在块层就停了）": "no entries (decoder stopped at the block layer)",
|
||
"无法 dlopen CoreMedia 或解析 FigXPC 入口": "cannot dlopen CoreMedia or resolve the FigXPC entry points",
|
||
"无法创建 ": "cannot create ",
|
||
"无法建立会话": "cannot establish session",
|
||
"无法读取自身二进制": "cannot read own binary",
|
||
"无线链路": "radio link",
|
||
"无错误": "no error",
|
||
"无需竞态窗口": "no race window needed",
|
||
"无（符号被 strip 或不可见）": "none (symbol stripped or invisible)",
|
||
"日历附件遏制路径探测": "Calendar attachment containment probe",
|
||
"是": "yes",
|
||
"显示名称": "display name",
|
||
"更多": "more",
|
||
"替换 ": "replaced ",
|
||
"替换: ": "replace: ",
|
||
"替换串不能比原串长 —— 这是原地改写，不改文件布局，所以不会破坏任何偏移。注入 LC_LOAD_DYLIB 需要头部有空隙，没有就会明确报出来。": "The replacement cannot be longer than the original — this is an in-place rewrite that keeps the file layout, so no offset is disturbed. Injecting LC_LOAD_DYLIB needs a header gap; if there is none it is reported explicitly.",
|
||
"替换串不能比原串长（": "replacement cannot exceed original (",
|
||
"替换为": "replace with",
|
||
"替换失败: ": "replace failed: ",
|
||
"替换并保存": "replace and save",
|
||
"替换（可选，不能更长）": "replace (optional, not longer)",
|
||
"最低系统": "minimum OS",
|
||
"有效（../ 未逃出）": "effective (../ did not escape)",
|
||
"有断言不成立": "assertion failed",
|
||
"有断言失败": "assertion failed",
|
||
"服务无人监听 —— 该构建可能已移除或重命名该 Mach 服务。": "no service listener — this build may have removed or renamed the Mach service.",
|
||
"服务无人监听（本平台不适用）": "no listener for the service (not applicable here)",
|
||
"服务有回复但握手被拒绝。": "service replied but the handshake was refused.",
|
||
"服务有回复但非字典 —— 握手被拒绝。": "service replied but not with a dictionary — handshake refused.",
|
||
"服务表": "service table",
|
||
"未修复": "unfixed",
|
||
"未发现内核指针": "no kernel pointers found",
|
||
"未取到数据": "no data retrieved",
|
||
"未命中": "miss",
|
||
"未命中，未写入": "miss, not written",
|
||
"未在产出里找到源标记的填充区": "no marker padding found in the output",
|
||
"未知": "unknown",
|
||
"未读到内容": "no content read",
|
||
"未返回数据（沙盒或接口不可用）": "no data returned (sandbox or interface unavailable)",
|
||
"本容器内 IconState: ": "IconState in this container: ",
|
||
"本模块仍完成了 ": "this module still completed ",
|
||
"本次新建: ": "created now: ",
|
||
"本进程": "this process",
|
||
"机型": "model",
|
||
"权限受限": "entitlement-gated",
|
||
"权限面已采集": "privilege surface captured",
|
||
"权限面测绘": "privilege surface mapping",
|
||
"条目 ": "entries ",
|
||
"构建号": "build",
|
||
"构造 ": "built ",
|
||
"枚举目录": "enumerate",
|
||
"查找": "find",
|
||
"查找 / 替换": "find / replace",
|
||
"查找替换全部断言通过": "all find/replace assertions passed",
|
||
"查询（只读）": "query (read-only)",
|
||
"校验方法不存在（27.0 未修复）": "validator absent (unfixed in 27.0)",
|
||
"校验方法存在（27.2 已修复）": "validator present (fixed in 27.2)",
|
||
"植入 ": "planted ",
|
||
"沉浸式音频入口探测完成": "immersive audio entry probe complete",
|
||
"沙盒 / 签名 / entitlements": "sandbox / signing / entitlements",
|
||
"注入 LC_LOAD_DYLIB → ": "inject LC_LOAD_DYLIB → ",
|
||
"注入 LC_LOAD_DYLIB：ncmds ": "inject LC_LOAD_DYLIB: ncmds ",
|
||
"注入 dylib 路径": "dylib path to inject",
|
||
"注入失败: ": "inject failed: ",
|
||
"注入未成功（头部无空隙）：": "injection failed (no header gap): ",
|
||
"注册失败（无错误信息）": "registration failed (no error)",
|
||
"注册失败：": "registration failed: ",
|
||
"活跃": "active",
|
||
"消费 ": "consume ",
|
||
"清理残留探针 ": "cleaning leftover probes ",
|
||
"温度": "temperature",
|
||
"渲染存活 — 该构建未受影响": "render survived — this build unaffected",
|
||
"渲染存活（与源分析的负结果一致）": "render survived (matches the source-analysis negative)",
|
||
"源 ": "source ",
|
||
"源 IPA": "source IPA",
|
||
"源 JPEG ": "source JPEG ",
|
||
"源解码失败": "source decode failed",
|
||
"源解码失败（标记先被拒绝了）": "source decode failed (marker refused first)",
|
||
"溢出阈值标定": "overflow threshold calibration",
|
||
"热状态": "thermal state",
|
||
"版本": "version",
|
||
"物理内存": "physical memory",
|
||
"生成改机 IPA": "build modified IPA",
|
||
"生效用户设置": "effective user settings",
|
||
"用户态可触及的内核入口数量有限。ipc_port 请求表索引竞态无 entitlement 门槛；decmpfs 已在泄露层验证。本层度量的是「能否将用户态的错误转为内核侧的状态变化」。": "The kernel entries reachable from user space are few. The ipc_port request-table index race has no entitlement gate; decmpfs is already verified in the leak layer. This layer measures whether a user-space error can be turned into kernel-side state change.",
|
||
"电源": "power",
|
||
"电量": "battery",
|
||
"目标": "target",
|
||
"目标 ": "target ",
|
||
"目标 ": "target ",
|
||
"目标创建失败": "target create failed",
|
||
"目标文件": "target file",
|
||
"直接 open 成功（意外）": "direct open succeeded (unexpected)",
|
||
"直接 open 被拒 errno=": "direct open refused errno=",
|
||
"直接读也成功 ": "direct read also succeeded ",
|
||
"直接读被拒 (errno ": "direct read refused (errno ",
|
||
"真实但被拒的路径返回 -12203，不存在的路径返回 -17913。两个不同的服务端错误码在不授予访问的前提下披露文件是否存在。": "A real but refused path returns -12203, a nonexistent one -17913. Two distinct server-side error codes disclose whether a file exists without granting any access.",
|
||
"码 ": "bytes ",
|
||
"硬件型号": "hardware model",
|
||
"确定该构建上的实际起点：进程持有哪些 entitlement、沙盒放行到哪一层、mach 命名空间如何组织。后续每一步的收益都要以该基线折算。": "Establish the real starting point on this build: which entitlements the process holds, how far the sandbox lets it through, how the mach namespace is organised. Every later stage's yield is measured against this baseline.",
|
||
"种子 ": "seed ",
|
||
"种子缺失": "seed missing",
|
||
"种子缺失 deep_nest.usda": "seed missing deep_nest.usda",
|
||
"种子缺失 joliet_path_oob.iso": "seed missing joliet_path_oob.iso",
|
||
"种子缺失 ktx2_bad_dims.ktx2": "seed missing ktx2_bad_dims.ktx2",
|
||
"种子缺失 stack_bomb.cff": "seed missing stack_bomb.cff",
|
||
"移除": "removed",
|
||
"移除 LC_CODE_SIGNATURE": "remove LC_CODE_SIGNATURE",
|
||
"移除 LC_CODE_SIGNATURE ×": "remove LC_CODE_SIGNATURE ×",
|
||
"移除 LC_CODE_SIGNATURE：": "remove LC_CODE_SIGNATURE: ",
|
||
"移除失败: ": "remove failed: ",
|
||
"移除损坏的 journal": "removing corrupt journal",
|
||
"空闲": "idle",
|
||
"竞态完成 ": "race done ",
|
||
"竞态完成，内核返回 ": "race done, kernel returned ",
|
||
"符号不可用": "symbol unavailable",
|
||
"符号解析失败": "symbol resolution failed",
|
||
"签发 ": "issue ",
|
||
"签发时解析链接目标，消费时不复核路径": "resolves the link target at issue time and never re-verifies the path at consume time",
|
||
"类型混淆": "type confusion",
|
||
"系统可用字体（": "system fonts (",
|
||
"系统组数据库": "system group database",
|
||
"系统账户数据库": "system account database",
|
||
"系统账户数据库（/private 前缀）": "system account database (/private prefix)",
|
||
"系统进程": "system process",
|
||
"累计路径 1024 B": "cumulative path 1024 B",
|
||
"结果": "result",
|
||
"缺失": "missing",
|
||
"缺少该基线，无法区分「漏洞所得」与「签名所授」。": "Without that baseline there is no separating what a vulnerability earned from what the signature granted.",
|
||
"网络": "network",
|
||
"耗时异常 —— 递归路径可能没有终止条件": "abnormal duration — the recursive path may have no terminator",
|
||
"联动": "chain",
|
||
"自己写 ZIP → libarchive 读回": "own ZIP writer → libarchive read-back",
|
||
"自检全绿意味着工具链本身可信 —— 此后出现的问题是选择问题，不是工具问题。": "All-green self-tests mean the toolchain itself is trustworthy — any problem after that is a targeting problem, not a tooling problem.",
|
||
"自造 IPA：": "self-built IPA: ",
|
||
"表: ": "table: ",
|
||
"被拒绝本身即说明校验发生在解释器之前 —— 这是该构建上有效的观测。": "The refusal itself proves the validation happens before the interpreter — a valid observation on this build.",
|
||
"视频编解码": "video codecs",
|
||
"解包": "unpack",
|
||
"解包 ": "unpacked ",
|
||
"解包失败：": "unpack failed: ",
|
||
"解析 ": "parsed ",
|
||
"解析器面": "parser surface",
|
||
"解析存活（已解码=": "parse survived (decoded=",
|
||
"解析返回 ": "parse returned ",
|
||
"解码 ": "decoded ",
|
||
"解码器可达性探测完成": "decoder reachability probe complete",
|
||
"解码器接受参数集 · 尺寸 ": "decoder accepted the parameter set · size ",
|
||
"解码存活 ": "decode survived ",
|
||
"解码存活 · 尺寸 ": "decode survived · size ",
|
||
"解码存活 · 帧数 ": "decode survived · frames ",
|
||
"解码存活（已解码=": "decode survived (decoded=",
|
||
"解码返回错误: ": "decode returned error: ",
|
||
"触觉事件已尝试": "haptic event attempted",
|
||
"记录": "record",
|
||
"该 Mach 服务无人监听 —— 本平台不适用（模拟器内不运行 mediaplaybackd）。真机上该服务常驻。": "no one listens on that Mach service — not applicable on this platform (mediaplaybackd does not run in the simulator). On a real device the service is resident.",
|
||
"该平台不允许这条武装路径，故请求表索引竞态无法在此被驱动。": "This platform forbids that arming path, so the request-table index race cannot be driven here.",
|
||
"该平台未施加沙盒 — 无证据": "no sandbox on this platform — no evidence",
|
||
"该序列确定性成立，不需要竞态窗口。Apple 未将其视为安全问题，因此没有 CVE 编号。": "The sequence holds deterministically and needs no race window. Apple does not treat it as a security issue, so there is no CVE number.",
|
||
"该构建上未越界": "not out of bounds on this build",
|
||
"该阈值决定后续所有负载的长度预算。": "That threshold sets the length budget for every subsequent payload.",
|
||
"详情": "detail",
|
||
"请求表路径无法被武装。真机上应返回 KERN_SUCCESS。": "The request-table path cannot be armed. On a real device it should return KERN_SUCCESS.",
|
||
"读写正常": "read/write ok",
|
||
"读取 ": "read ",
|
||
"读取 ": "read ",
|
||
"读取 IPA 失败": "IPA read failed",
|
||
"读取失败": "read failed",
|
||
"读取失败 errno=": "read failed errno=",
|
||
"读取失败: ": "read failed: ",
|
||
"读回内容不一致": "read-back mismatch",
|
||
"读回失败: ": "read-back failed: ",
|
||
"资产载入存活": "asset load survived",
|
||
"越过沙盒读取": "read past sandbox",
|
||
"越过沙盒读取 ": "read past sandbox ",
|
||
"跨沙盒": "cross-sandbox",
|
||
"跨沙盒读取 ": "cross-sandbox read ",
|
||
"跨越边界 ": "crossed boundary ",
|
||
"路径": "path",
|
||
"路径不存在 (-17913)": "path absent (-17913)",
|
||
"路径中间不是目录": "path component is not a directory",
|
||
"路径存在但拒绝访问 (-12203)": "path present but access refused (-12203)",
|
||
"路径穿越遏制: ": "path traversal containment: ",
|
||
"输出不稳定 — 未初始化内存迹象": "output unstable — uninitialised-memory signature",
|
||
"输出干净": "output clean",
|
||
"输出文件里出现 ": "output file contains ",
|
||
"输出稳定": "output stable",
|
||
"过程": "process",
|
||
"运行时长": "uptime",
|
||
"返回 0 —— 偏移被钳制或链未被跟随": "returned 0 — offset clamped or chain not followed",
|
||
"返回错误: ": "returned error: ",
|
||
"进程内": "in-process",
|
||
"连接 com.apple.coremedia.mediaplaybackd.bytestream.xpc": "connecting to com.apple.coremedia.mediaplaybackd.bytestream.xpc",
|
||
"连接对象已创建: ": "connection created: ",
|
||
"选择 .sqlite / .db": "choose .sqlite / .db",
|
||
"选择一个 .ipa": "choose an .ipa",
|
||
"选择一个文件": "choose a file",
|
||
"选择字体文件": "choose a font file",
|
||
"选择文件": "choose file",
|
||
"逐字节比对: ": "byte comparison: ",
|
||
"通过": "passed",
|
||
"遍历完成，": "traversal complete, ",
|
||
"重复越界写 32 次": "repeat OOB write 32×",
|
||
"重打包 ": "repacked ",
|
||
"重编码成功=": "re-encode ok=",
|
||
"错误: ": "error: ",
|
||
"错误码 ": "error code ",
|
||
"镜像 ": "image ",
|
||
"镜像过短": "image too short",
|
||
"需要 65536 B，实际 64 B": "needs 65536 B, 64 B present",
|
||
"需达到可复现阈值；低于该阈值时，越狱路径不成立。": "A reproducible threshold is required; below it the jailbreak chain does not hold.",
|
||
"音频栈": "audio stack",
|
||
"音频资源 id=": "audio resource id=",
|
||
"页面 4000×4000 · 需要 64 MB 缓冲": "page 4000×4000 · needs a 64 MB buffer",
|
||
"页面渲染完成 ": "page rendered ",
|
||
"项": "entries",
|
||
"验证了名称空间的分配/拆除路径本身可用。": "verifies that the namespace allocate/teardown path itself works.",
|
||
"（按设计不接受新建文件，不计入探针）": " (by design accepts no new files, excluded from probes)",
|
||
"）": ")",
|
||
"，含 LC_LOAD_DYLIB=": ", contains LC_LOAD_DYLIB=",
|
||
"，命令数 ": ", load commands ",
|
||
"，尺寸 ": ", size ",
|
||
"，属性 ": ", attrs ",
|
||
"，已绘制 ": ", drawn ",
|
||
"，已解码 ": ", decoded ",
|
||
"，经链接 ": ", via link ",
|
||
"，经链接亦失败": ", via link also failed",
|
||
"，经链接读到内容": ", via link read content",
|
||
]
|
||
}
|