JBJF
7949c7ce9f
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
40 lines
1.6 KiB
C
40 lines
1.6 KiB
C
// sb.stash · SpringBoard · SBHomeScreenService stashed layout · CVE-2026-112646
|
|
// Stashed layout name validation probe
|
|
// C twin of the Swift POC: looks up SBHomeScreenService in this process, checks for
|
|
// the 27.2 validation selector, and stats the container's IconState.plist.
|
|
// Build: clang -O2 -o cve-2026-112646 CVE-2026-112646.c -lobjc
|
|
// Run: ./cve-2026-112646
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
#include <sys/stat.h>
|
|
#include <objc/runtime.h>
|
|
|
|
int main(void) {
|
|
// class lookup: SpringBoard's own classes are only registered inside SpringBoard
|
|
Class cls = objc_getClass("SBHomeScreenService");
|
|
printf("SBHomeScreenService in this process: %s\n", cls ? "yes" : "no");
|
|
|
|
SEL validator = sel_registerName("_validationErrorForStashedLayoutName:");
|
|
if (cls && class_respondsToSelector(cls, validator)) {
|
|
printf(" validation method present (27.2 fixed)\n");
|
|
} else {
|
|
printf(" validation method absent (27.0 unfixed)\n");
|
|
}
|
|
|
|
// container probe: IconState.plist only exists inside SpringBoard's container
|
|
const char *home = getenv("HOME");
|
|
char path[1024];
|
|
snprintf(path, sizeof path, "%s/Library/SpringBoard/IconState.plist", home ? home : "/tmp");
|
|
struct stat st;
|
|
if (stat(path, &st) == 0) {
|
|
printf("IconState.plist in this container: present (%lld B)\n", (long long)st.st_size);
|
|
} else {
|
|
printf("IconState.plist in this container: absent\n");
|
|
}
|
|
printf("CVE-2026-112646 · stashed-layout surface is SpringBoard-only; other processes\n"
|
|
"reach it only through the XPC surface the 27.0 build left unvalidated\n");
|
|
return 0;
|
|
}
|