lollipop/cinder27
1
0 Fork 0
forked from admin/cinder27
Code Pull Requests Activity

Cinder27 — iOS 17.0-27.1 vulnerability verification lab: 51 modules, 31 per-CVE POC folders, 11 no-CVE module folders, harness app source

Browse Source
This commit is contained in:
jbjf6666 committed 2026-10-29 02:11:12 +08:00
commit 1ea76ab005
89 files changed
+16485
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Sources/RuntimeText.swift
+657
View File
@@ -0,0 +1,657 @@
import Foundation
/// Runtime-output translation.
///
/// Chinese literals in engine and UI code are the source of truth and stay where they are.
/// This table maps each one to its English rendering. In Chinese the input passes through
/// untouched; in English an unmapped string also passes through, so an ASCII name such as
/// "Documents" needs no entry.
///
/// Keys are the exact literal text, including any leading/trailing spaces that were part
/// of the original string.
func tl(_ zh: String) -> String {
guard Lang.resolved == .en else { return zh }
return RuntimeText.map[zh] ?? zh
}
enum RuntimeText {
// Filled by the localization pass. Every key is a Chinese literal that appears in the
// source; every value is its English rendering.
static let map: [String: String] = [
"\n\n种子 ": "\n\nseed ",
"\n(达到资源预算，提前收敛 —— 这是刻意的，不是失败)": "\\n(resource budget reached, converged early — deliberate, not a failure)",
"\n内核未返回任何错误码": "\nkernel returned no error codes",
"\n属性: ": "\nattributes: ",
"\n状态: ": "\nstatus: ",
"\n若 27.0 未钳制，这些 0x41 来自越界读到的堆内容；27.2 会直接丢弃越界标记。": "\\nIf 27.0 does not clamp, these 0x41 bytes come from the out-of-bounds heap read; 27.2 discards the out-of-range marker outright.",
"\n负载 ": "\npayload ",
"\n通知注册被拒 ": "\nnotification registration refused ",
" 直接读 errno=": " direct read errno=",
" 落在当前容器内: ": " inside current container: ",
" 候选: ": " candidates: ",
" 分区 ": " partition ",
" 命中: ": " hits: ",
" 未读到内容 — ": " nothing read — ",
" 直接读 errno=": " direct read errno=",
" 直接读也成功 ": " direct read also succeeded ",
" B · 4 个条目 · 名字域 36 单元 / 72 字节": " B · 4 entries · name field 36 units / 72 bytes",
" B · 64 位=": " B · 64-bit=",
" B · 900 切片": " B · 900 slices",
" B · 解包 ": " B · unpacked ",
" B — 该平台未对该路径施加沙盒，本项不构成证据": " B — no sandbox on this path on this platform, not evidence",
" B — 该平台未施加沙盒": " B — no sandbox on this platform",
" B — 边界已被跨越": " B — boundary crossed",
" B → 产出 ": " B → output ",
" B 的 decmpfs 属性": " B decmpfs attribute",
" B（ZipWriter 产出，stored 条目）": " B (ZipWriter output, stored entries)",
" B，block-id 1 × 6（容量 4）": " B, block-id 1 × 6 (capacity 4)",
" B，单个 charstring 连续推入 300 个操作数后 endchar。\n": " B, one charstring pushing 300 consecutive operands then endchar.\\n",
" B，可用 ": " B available ",
" ms，对象数 ": " ms, objects ",
" ms；中心像素 RGBA = ": " ms; centre pixel RGBA = ",
" · 加密=": " · encrypted=",
" · 受阻 ": " · blocked ",
" · 尺寸 ": " · size ",
" · 层 ID 0x3F": " · layer id 0x3F",
" · 帧数 ": " · frames ",
" · 库 ": " · lib ",
" · 无沙盒 ": " · no sandbox ",
" · 真实写探针=": " · real write probe=",
" ← 两者不一致，说明 access() 不可信": " ← mismatch, so access() is not trustworthy",
" 一致": " consistent",
" 一致 / ": " consistent / ",
" 不一致": " inconsistent",
" 不存在": " absent",
" 个二进制": " binaries",
" 个内核指针候选": " kernel pointer candidates",
" 个可写": " writable",
" 个可读 · ": " readable · ",
" 个字形": " glyphs",
" 个属性": " attributes",
" 个文件": " files",
" 个文件 → ": " files → ",
" 个文件逐字节一致": " files byte-identical",
" 个文件，共 ": " files, ",
" 个条目": " entries",
" 个条目 · mode ": " entries · mode ",
" 个目录读写正常": " directories read/write ok",
" 个长度存活": " lengths survived",
" 个（mode ": " (mode ",
" 仍不可用: ": " still unusable: ",
" 可开 · ": " openable · ",
" 命中: ": " hits: ",
" 处": " sites",
" 处 @ ": " sites @ ",
" 处 · 偏移一致=": " sites · offsets match=",
" 处 · 旧模式残留 ": " sites · old mode residue ",
" 处 → 新模式 ": " sites → new mode ",
" 处: ": " sites: ",
" 处并已保存（备份 ": " sites and saved (backup ",
" 处（应为 0）": " sites (expected 0)",
" 字节": " bytes",
" 字节 0x41": " bytes 0x41",
" 存在且": " present and ",
" 存在但被拒 · ": " present but refused · ",
" 存活 — ": " survived — ",
" 已用 / 预算 ": " used / budget ",
" 张表": " tables",
" 是文件而不是目录 —— 跳过": " is a file, not a directory — skipped",
" 条": " items",
" 条 · type=": " items · type=",
" 条目": " entries",
" 条目 / ": " entries / ",
" 条目 · ": " entries · ",
" 核": " cores",
" 次 —— 该平台不允许对自身端口注册通知，": " times — this platform does not allow notification registration on own ports, ",
" 次操作，无异常返回": " operations, no abnormal returns",
" 次端口分配与回收，": " port allocations and releases, ",
" 段标记填充字节": " segment marker padding bytes",
" 目录读写正常": " directory read/write ok",
" 类错误码": " error classes",
" 行": " rows",
" 被拒绝 — ": " refused — ",
" 解析出 ": " parsed ",
" 连续 ": " consecutive ",
" 页": " pages",
" 项": " entries",
" 项 · ": " entries · ",
" 项 · 每项 ": " entries · each ",
" 项（含 ../ 路径）→ 遏制必须由调用方负责": " entries (with ../ paths) → containment is the caller's job",
"\"）": "\")",
") · 原始大小 ": ") · raw size ",
")，经链接读到 ": "), via link read ",
"-12203 = 存在但被拒": "-12203 = present but refused",
"-17913 = 不存在": "-17913 = absent",
"0x 前缀写法: ": "0x prefix form: ",
"1. 不存在的深层目录自动创建: ": "1. missing deep directory auto-created: ",
"2. Container.write 自动建父目录: 通过（读回 \"": "2. Container.write auto-creates parents: passed (read back \"",
"2. Container.write: 失败 ": "2. Container.write: failed ",
"2000 层嵌套": "2000 nesting levels",
"27.0 扫描边界 0x48 = 72 B": "27.0 scan bound 0x48 = 72 B",
"27.0 期望：push 路径无计数检查，操作数栈越界。\n": "27.0 expectation: the push path has no count check, the operand stack overruns.\\n",
"27.0 期望：分配截断 → 转换循环越界写。27.2 期望：_TIFFCheckMalloc_type 拒绝。": "27.0 expectation: allocation truncation → the conversion loop writes out of bounds. 27.2 expectation: _TIFFCheckMalloc_type refuses.",
"27.0 期望：切片上限未检查 → 插件内越界。27.2 期望：\"too many slices!\"。": "27.0 expectation: the slice cap is unchecked → overrun inside the plugin. 27.2 expectation: \"too many slices!\".",
"27.2 收紧到 0x24 = 36 B": "27.2 tightened to 0x24 = 36 B",
"27.2 期望：Push/Pop 两道栈保护在解释前拒绝该字体。\n": "27.2 expectation: Push/Pop stack guards reject the font before interpretation.\\n",
"3 次解码指纹": "3-decode fingerprint",
"3. 旧 UUID 路径重挂: ": "3. old UUID path remount: ",
"32 轮完成，进程存活": "32 rounds complete, process alive",
"4. isWritableFile(容器根)=": "4. isWritableFile(container root)=",
"64 × 4 KB 随机内容": "64 × 4 KB random content",
": 不可见": ": not visible",
": 解码失败": ": decode failed",
": 读取被拒绝（沙盒）": ": read refused (sandbox)",
"ANE 用户态入口探测": "ANE user-space entry probe",
"AVC 参数集路径已触发": "AVC parameter set path triggered",
"AVD.videodecoder 插件": "AVD.videodecoder plugin",
"AVD.videodecoder 插件（非 kext）": "AVD.videodecoder plugin (not a kext)",
"Apple 未将其视为安全问题，无 CVE": "Apple does not treat it as a security issue, no CVE",
"CGBitmapContext 创建失败": "CGBitmapContext create failed",
"CGDataProvider 创建失败": "CGDataProvider create failed",
"CGFont 拒绝该字体数据": "CGFont refused the font data",
"CGImageDestination 创建失败": "CGImageDestination create failed",
"CGImageSource 拒绝该数据": "CGImageSource refused the data",
"CGPDFDocument 解析失败（文件被拒绝）": "CGPDFDocument parse failed (file refused)",
"CHHapticEngine 初始化失败: ": "CHHapticEngine init failed: ",
"CHHapticEngine 启动成功": "CHHapticEngine started",
"CHHapticEngine 启动成功（沉浸式音频会话已建立）": "CHHapticEngine started (immersive audio session established)",
"CHHapticEngine 未尝试": "CHHapticEngine not attempted",
"CMGetDMVersionLevelFromRPU 未导出": "CMGetDMVersionLevelFromRPU not exported",
"CTFontGetLigatureCaretPositions 返回 ": "CTFontGetLigatureCaretPositions returned ",
"CoreMedia 符号不可用": "CoreMedia symbols unavailable",
"CoreMedia 符号解析失败，或 XPC 连接无法创建": "CoreMedia symbol resolution failed, or the XPC connection cannot be created",
"DRC 路径探测完成": "DRC path probe complete",
"EACCES 沙盒拒绝访问": "EACCES sandbox access refusal",
"EDQUOT 超出配额": "EDQUOT over quota",
"EEXIST 已存在": "EEXIST already exists",
"EISDIR 目标是目录": "EISDIR target is a directory",
"ENAMETOOLONG 名称过长": "ENAMETOOLONG name too long",
"ENOENT 父目录或文件不存在": "ENOENT parent or file absent",
"ENOSPC 空间不足": "ENOSPC no space",
"ENOTDIR 路径中间是文件": "ENOTDIR path component is a file",
"EPERM — 沙盒拒绝": "EPERM — sandbox refusal",
"EPERM 操作被拒绝": "EPERM operation refused",
"EROFS 只读文件系统": "EROFS read-only filesystem",
"EXDEV 跨卷（.atomic 写到了别的卷）": "EXDEV cross-volume (.atomic landed on another volume)",
"FigXPCCreateBasicMessage('Curl') 失败": "FigXPCCreateBasicMessage('Curl') failed",
"FontParser · charstring 解释器": "FontParser · charstring interpreter",
"GPS 读取存活": "GPS read survived",
"GPT 头: 条目表 LBA ": "GPT header: entry array LBA ",
"GPT 镜像已构造并解析": "GPT image built and parsed",
"HEVC 参数集 = ": "HEVC parameter set = ",
"HEVC 层路径已触发": "HEVC layer path triggered",
"HID 路径可达性": "HID path reachability",
"IOHIDFamily · caps 表查找": "IOHIDFamily · caps table lookup",
"IOKit 事件入口探测": "IOKit event entry probe",
"IOPSCopyPowerSourcesInfo 不可用": "IOPSCopyPowerSourcesInfo unavailable",
"IPA 产出": "IPA output",
"IPA 手术链路可用": "IPA surgery pipeline available",
"ImageIO · 图像解析": "ImageIO · image parsing",
"ImageIO · 纹理与编码": "ImageIO · textures and codecs",
"Info.plist 读取失败，跳过字段改写": "Info.plist read failed, skipping field rewrite",
"LigCaret 查询完成": "LigCaret query complete",
"MDLAsset 载入完成 ": "MDLAsset load complete ",
"OOB 写": "OOB write",
"OOB 读": "OOB read",
"PDF 无第 ": "PDF has no page ",
"PDF 解码路径已触发": "PDF decode path triggered",
"Payload/ 下没有 .app": "no .app under Payload/",
"RockRidge CL/PL 环：27.0 与 27.2 都未修（上游已修，Apple 未取）": "RockRidge CL/PL cycle: unfixed in both 27.0 and 27.2 (fixed upstream, Apple did not take it)",
"RockRidge 路径已遍历": "RockRidge path traversed",
"SBHomeScreenService 在进程内: ": "SBHomeScreenService in-process: ",
"SQLite3 不可用": "SQLite3 unavailable",
"SpringBoard 路径探测": "SpringBoard path probe",
"Type-5 阴影的写入是值可控的，但短溢出会被相邻 VLA 吸收。逐级抬升 R，确定该构建上栈布局开始失效的维度。": "The Type-5 shading write is value-controlled, but a short overflow is absorbed by the adjacent VLA. Step R upward to find the dimension at which this build's stack layout starts to break.",
"UDID (设备)": "UDID (device)",
"XNU · ipc_port.c 请求表消费方": "XNU · ipc_port.c request-table consumers",
"XNU 内核": "XNU kernel",
"archive_read_new 失败": "archive_read_new failed",
"audioCustom 事件已投递": "audioCustom event delivered",
"caret 坐标: ": "caret positions: ",
"charstring 推 300 个操作数": "charstring pushes 300 operands",
"codespace 长度 128": "codespace length 128",
"com.apple.decmpfs 是内核压缩文件系统用的属性。改它等于直接改内核解压的输入 —— CVE-2026-113910 就是这条路径上「解压产出少于预期」时内核把未写满的页缓冲交给用户态。这里可以手动设一个、读回来、再删掉。": "com.apple.decmpfs is the attribute the kernel's compressed filesystem uses. Changing it changes the input the kernel decompresses — CVE-2026-113910 is exactly this path: when decompression under-produces, the kernel hands the unwritten page buffer back to user space. Here you can set one by hand, read it back, then delete it.",
"consume 后读取失败: ": "read after consume failed: ",
"decmpfs 操作": "decmpfs operations",
"dlopen 失败": "dlopen failed",
"entitlements: 无法读取（SecTask 不可用或为空）": "entitlements: unreadable (SecTask unavailable or empty)",
"fcTL 声明 26B 实到 4B": "fcTL declares 26B, 4B present",
"getifaddrs 失败": "getifaddrs failed",
"hosts 表": "hosts table",
"iOS 27.2 起修复": "fixed since iOS 27.2",
"issue_file 被拒: ": "issue_file refused: ",
"libarchive 不可用": "libarchive unavailable",
"libarchive 的 2 字节堆越界与 CoreMedia 的 28 字节结构体外写，是整套中仅有的两个「写穿过对象边界」的形状。前者精确但浅，后者深且落在保存寄存器区。同一 CVE 下的 CAB 站点与 GPT 分区名越界读一并标定。": "libarchive's 2-byte heap overrun and CoreMedia's 28-byte write past the struct are the only two \"write across an object boundary\" shapes in the whole set. The former is precise but shallow; the latter is deep and lands in the saved-register area. The CAB site under the same CVE and the GPT partition-name OOB read are calibrated alongside.",
"libarchive 解包 ": "libarchive unpacked ",
"libarchive 返回 ": "libarchive returned ",
"libarchive.2.dylib 无法 dlopen（沙盒或路径受限）": "libarchive.2.dylib cannot dlopen (sandbox or path restricted)",
"magic cmpf · 类型 ": "magic cmpf · type ",
"mediaplaybackd.bytestream.xpc 对任何沙盒应用可达。守护进程以自身凭据打开客户端指定的绝对路径，并把活描述符放进回复的 ByteStreamDetails。描述符级 I/O 不受客户端沙盒的路径检查约束 —— 应用自身 open() 返回 EPERM 的文件，其内容可经该描述符完整读回。": "mediaplaybackd.bytestream.xpc is reachable from any sandboxed app. The daemon opens the client-specified absolute path with its own credentials and puts a live descriptor into the reply's ByteStreamDetails. Descriptor-level I/O is not subject to the client sandbox's path checks — a file whose open() returns EPERM for the app itself can be read back in full through that descriptor.",
"mkdir 失败: ": "mkdir failed: ",
"networkd 偏好": "networkd prefs",
"opcode 已被封 (-16158)": "opcode sealed (-16158)",
"plist 语法错误，未写入": "plist syntax error, not written",
"registerAudioResource 失败: ": "registerAudioResource failed: ",
"sandbox_extension 符号不可用": "sandbox_extension symbols unavailable",
"sandbox_extension_issue_file / consume 无法解析": "sandbox_extension_issue_file / consume cannot be resolved",
"sandbox_extension_issue_file 在签发时解析符号链接，但不强制 SANDBOX_EXTENSION_NOFOLLOW。签发返回的令牌绑定签发时刻解析出的目标，而内核对消费时刻所用路径不做复核。序列为：沙盒内建立链接 L 指向沙盒内文件 S → 对 L 签发扩展 → 将 L 重指向沙盒外目标 T → 消费令牌后经 L 读取。": "sandbox_extension_issue_file resolves the symlink at issue time but does not enforce SANDBOX_EXTENSION_NOFOLLOW. The token it returns is bound to the target resolved at issue time, and the kernel never re-verifies the path used at consume time. The sequence: create link L in the sandbox pointing at in-sandbox file S → issue the extension for L (the kernel records S) → repoint L at out-of-sandbox target T → consume the token and read through L.",
"setxattr 失败 errno=": "setxattr failed errno=",
"symlink(decoy) 失败: ": "symlink(decoy) failed: ",
"symlink(target) 失败: ": "symlink(target) failed: ",
"— 判定 —": "— verdict —",
"— 基线 —": "— baseline —",
"— 失效模式验证 —": "— failure mode verification —",
"— 存在性预言机 —": "— existence oracle —",
"— 对照 —": "— control —",
"— 平台限制 —": "— platform limit —",
"— 目录枚举 —": "— directory listing —",
"— 读取 —": "— read —",
"✓ AudioCodecs 可加载": "✓ AudioCodecs loadable",
"✓ 书签 ": "✓ bookmarked ",
"✓ 已创建 ": "✓ created ",
"✓ 已加入书签": "✓ bookmarked",
"✗ AudioCodecs 无法 dlopen": "✗ AudioCodecs cannot dlopen",
"上下文创建失败": "context create failed",
"不可用": "unavailable",
"不可见": "not visible",
"不可读": "unreadable",
"不存在": "absent",
"不存在 ": "absent ",
"不存在 (-17913)": "absent (-17913)",
"不存在（未修复）": "absent (unfixed)",
"不是 Mach-O": "not a Mach-O",
"不是 decmpfs（magic 0x": "not decmpfs (magic 0x",
"两者均失败：直接读 errno ": "both failed: direct errno ",
"两者都需要稳定的堆布局控制，而这正是上一阶段泄露所提供的。": "Both need stable heap-layout control, which is exactly what the previous stage's leaks provide.",
"个原语": " primitives",
"主二进制读取失败（可能已加密）": "main binary read failed (possibly encrypted)",
"主密码文件（通常不可读）": "master password file (usually unreadable)",
"主机名": "hostname",
"事件投递失败: ": "event delivery failed: ",
"二进制": "binary",
"产出": "output",
"产出 ": "output ",
"会话建立失败": "session setup failed",
"低电量模式": "low power mode",
"信息泄露": "info leak",
"值偏移 +65536": "value offset +65536",
"值可控写": "value-controlled write",
"值可控写与地址泄露相加，构成构造可控状态的全部要素；所缺的是将写转为执行的环节。": "Value-controlled write plus address disclosure is every element needed to build controlled state; what is missing is the step that turns the write into execution.",
"元数据读取完成": "metadata read complete",
"充电中": "charging",
"先取得地址与内容。decmpfs 欠产出将内核页缓冲尾部交回用户态；TIFF 截断条带与 EXIF 短读将进程堆残留交回图像与元数据；CoreMedia bytestream 与 sandbox_extension 越过沙盒边界取回文件内容。": "Addresses and content come first. decmpfs under-production hands the kernel page-buffer tail back to user space; the truncated TIFF strip and the EXIF short read hand process-heap residue back as image and metadata; the CoreMedia bytestream and sandbox_extension cross the sandbox boundary and retrieve file contents.",
"全局偏好": "global prefs",
"全局偏好（/private 前缀）": "global prefs (/private prefix)",
"全部 ": "all ",
"全部读取": "read all",
"关": "off",
"内容": "content",
"内容 (": "content (",
"内核": "kernel",
"内核面": "kernel surface",
"写入失败: ": "write failed: ",
"写入探测属性": "write probe attribute",
"写入被拒 (-12878)": "write refused (-12878)",
"分配/拆除路径可用，通知武装被平台拒绝": "allocate/teardown path available, notification arming refused by the platform",
"分配路径已触发": "allocation path triggered",
"创建 ": "created ",
"判定依据：直接读被拒 且 经链接读成功": "verdict basis: direct read refused AND read via link succeeded",
"十六进制": "hex",
"十六进制查找: ": "hex search: ",
"协议表": "protocol table",
"压缩类型 3 = LZX": "compression type 3 = LZX",
"发现 ": "found ",
"取自本进程的 Mach-O：": "Mach-O taken from this process: ",
"只支持 64 位 Mach-O": "only 64-bit Mach-O supported",
"只读": "read-only",
"只读（探针未通过）": "read-only (probe failed)",
"可写": "writable",
"可写根目录: ": "writable roots: ",
"可开": "openable",
"可开 ": "openable ",
"可开（code 0）": "openable (code 0)",
"可用空间: ": "free space: ",
"可见": "visible",
"可读": "readable",
"可读域: ": "readable domain: ",
"可达性探测": "reachability probe",
"合计 ": "total ",
"名称 → ": "name → ",
"否": "no",
"否（需 IOKit 平台 Expert 接口）": "no (needs the IOKit platform expert interface)",
"启动 UUID": "boot UUID",
"启动时间": "boot time",
"命中 ": "hit ",
"回复类型 ": "reply type ",
"回复类型: ": "reply type: ",
"回复里没有 fd": "no fd in reply",
"因此握手收不到任何回复。真机上该服务常驻，握手应返回字典。": "So the handshake gets no reply. On a real device the service is resident and the handshake should return a dictionary.",
"因此该原语在此平台上无法给出证据。真机上直接读应返回 EPERM，": "So the primitive cannot produce evidence on this platform. On a real device the direct read should return EPERM,",
"在取得稳定泄露之后，才有条件讨论将溢出写成什么值；否则只能触发崩溃。": "Only after a stable leak is there any basis for choosing what the overflow writes; before that, it can only crash.",
"在标定所得长度上，以 PDF 中选定的 double 位模式决定被覆盖的指针。崩溃地址即证据 —— 它证明写入内容由攻击者控制，而非仅证明发生了崩溃。": "At the calibrated length, the double bit pattern chosen in the PDF decides the pointer that gets overwritten. The fault address is the evidence — it proves the written content is attacker-controlled, not merely that a crash happened.",
"坐标即追链读到的 16 位值": "the positions are the 16-bit values the chain read",
"基线已采集": "baseline captured",
"声明长度 65518": "declared length 65518",
"处理中…": "working…",
"备份": "backups",
"备份往返 ": "backup round-trip ",
"外设": "peripheral",
"大小": "size",
"失败": "failed",
"失败 —— ../ 逃出了目标目录": "failed — ../ escaped the destination",
"失败: ": "failed: ",
"头部空隙不足：需要 ": "header gap insufficient: need ",
"字体 / Model I/O": "fonts / Model I/O",
"字体加载成功 name=": "font loaded name=",
"字体在 CGFont 层被拒绝": "font refused at the CGFont layer",
"字体在解析阶段被拒绝": "font refused at parse stage",
"字体安装": "font install",
"字体已加载并绘制": "font loaded and drawn",
"字符串替换 ": "string replace ",
"字符串替换 Cinder27 → Cind3r27：": "string replace Cinder27 → Cind3r27: ",
"字符串替换失败：": "string replace failed: ",
"存在": "present",
"存在·被拒 ": "present·refused ",
"存在但被拒 (-12203)": "present but refused (-12203)",
"存在性预言机": "existence oracle",
"存在（已修复）": "present (fixed)",
"存活: ": "survived: ",
"守护进程以自身凭据打开客户端指定的路径": "the daemon opens the client-specified path with its own credentials",
"完成": "done",
"容器占用: ": "container usage: ",
"容器已处于正常状态，无需修复": "container already healthy, no repair needed",
"容器根": "container root",
"容器根: ": "container root: ",
"对照 直接读 ": "control direct read ",
"对照: 应用自身 open() 被 EPERM 拒绝": "control: the app's own open() refused with EPERM",
"对自身端口注册通知返回 -300 (KERN_INVALID_CAPABILITY)。": "notification registration on own ports returns -300 (KERN_INVALID_CAPABILITY).",
"将上述产物转为可用形式：IPA 改包、二进制注入、字节级替换、属性改写、数据库读取。本层不依赖任何漏洞，但它是「漏洞能力」最终交付到手上的形态。": "Turn those artifacts into usable form: IPA repacking, binary injection, byte-level replacement, attribute rewriting, database reads. This layer depends on no vulnerability, but it is the shape in which \"vulnerability capability\" is finally delivered into the hand.",
"尺寸 ": "size ",
"届时「直接读被拒 + 经链接读成功」即为越界成立的判定。": "At that point \"direct read refused + read via link succeeded\" is the verdict that the boundary was crossed.",
"工作区": "Workspace",
"工具会解包、改 Info.plist、往主二进制里插 LC_LOAD_DYLIB、做字节级字符串替换、去掉 LC_CODE_SIGNATURE，然后重新打成 zip。产出仍然是未签名的 —— 你用同一套证书签它。": "The tool unpacks, edits Info.plist, inserts LC_LOAD_DYLIB into the main binary, does byte-level string replacement, removes LC_CODE_SIGNATURE, then repacks into a zip. The output is still unsigned — you sign it with the same certificate.",
"工具链自检": "toolchain self-test",
"工具链落地": "toolchain landed",
"已写入 ": "written ",
"已创建但探针失败: ": "created but probe failed: ",
"已取回": "retrieved",
"已注册到用户字体域：": "registered into user font domain: ",
"已移除": "removed",
"已选择 ": "selected ",
"市场名称": "marketing name",
"帧数 ": "frames ",
"广告标识符": "advertising identifier",
"序列号可读": "serial readable",
"序列开始: ": "sequence start: ",
"序列结束: ": "sequence end: ",
"应用与系统进程": "apps and system processes",
"开": "on",
"引擎启动失败: ": "engine start failed: ",
"引擎已停止": "engine stopped",
"归档 ": "archive ",
"当前为模拟器：模拟器不对应用施加沙盒，直接读与经链接读都会成功，": "This is the simulator: it applies no sandbox to apps, so both the direct read and the read via the link succeed,",
"当前为模拟器：模拟器内不运行 mediaplaybackd，该 Mach 服务无人监听，": "This is the simulator: mediaplaybackd does not run inside it, no one listens on that Mach service,",
"成功": "ok",
"所有标准目录已存在": "all standard directories exist",
"手术失败：": "surgery failed: ",
"手术完成：": "surgery complete: ",
"手术未完成": "surgery incomplete",
"打开失败": "open failed",
"执行": "run",
"扩展属性": "extended attributes",
"扫描完成": "scan complete",
"找不到主二进制名": "main binary name not found",
"把字体文件注册进本进程的字体域。iOS 允许应用注册用户字体，注册后 CoreText 立刻可见 —— 这是改机里唯一一条完全不需要任何越权就能改「系统观感」的路径，代价是只在本进程生效。": "Register font files into this process's font domain. iOS lets apps register user fonts, visible to CoreText immediately — the one device-modification path that needs no privilege at all to change the \"system look\"; the price is that it only takes effect in this process.",
"把容器内的偏好、文稿与工具产物打成 ZIP。归档走同一写入器，可被 libarchive 解回。": "Packs the container's preferences, documents and tool output into a ZIP. The archive goes through the same writer and reads back with libarchive.",
"持有授权": "entitlement held",
"探测": "probe",
"探针 = 建文件 → 写 → fsync → 读回 → 比对 → 删除": "probe = create file → write → fsync → read back → compare → delete",
"接受 · 尺寸 ": "accepted · size ",
"握手建立: ": "handshake established: ",
"握手未完成": "handshake incomplete",
"握手被拒绝": "handshake refused",
"搜索串为空": "search string empty",
"搜索字符串": "search string",
"操作数 300 > 栈容量 48": "300 operands > stack capacity 48",
"数据库": "database",
"数据过短": "data too short",
"整数溢出": "integer overflow",
"文本查找 Cinder27: ": "text search Cinder27: ",
"文本，或 41 42 43 / 0x414243": "text, or 41 42 43 / 0x414243",
"新名字": "new name",
"无": "none",
"无 GPT 签名": "no GPT signature",
"无可用属性": "no attributes available",
"无外部地址": "no external address",
"无授权 — 只能走无线链路": "no entitlement — radio link only",
"无数据": "no data",
"无条目（解码器在块层就停了）": "no entries (decoder stopped at the block layer)",
"无法 dlopen CoreMedia 或解析 FigXPC 入口": "cannot dlopen CoreMedia or resolve the FigXPC entry points",
"无法创建 ": "cannot create ",
"无法建立会话": "cannot establish session",
"无法读取自身二进制": "cannot read own binary",
"无线链路": "radio link",
"无错误": "no error",
"无需竞态窗口": "no race window needed",
"无（符号被 strip 或不可见）": "none (symbol stripped or invisible)",
"日历附件遏制路径探测": "Calendar attachment containment probe",
"是": "yes",
"显示名称": "display name",
"更多": "more",
"替换 ": "replaced ",
"替换: ": "replace: ",
"替换串不能比原串长 —— 这是原地改写，不改文件布局，所以不会破坏任何偏移。注入 LC_LOAD_DYLIB 需要头部有空隙，没有就会明确报出来。": "The replacement cannot be longer than the original — this is an in-place rewrite that keeps the file layout, so no offset is disturbed. Injecting LC_LOAD_DYLIB needs a header gap; if there is none it is reported explicitly.",
"替换串不能比原串长（": "replacement cannot exceed original (",
"替换为": "replace with",
"替换失败: ": "replace failed: ",
"替换并保存": "replace and save",
"替换（可选，不能更长）": "replace (optional, not longer)",
"最低系统": "minimum OS",
"有效（../ 未逃出）": "effective (../ did not escape)",
"有断言不成立": "assertion failed",
"有断言失败": "assertion failed",
"服务无人监听 —— 该构建可能已移除或重命名该 Mach 服务。": "no service listener — this build may have removed or renamed the Mach service.",
"服务无人监听（本平台不适用）": "no listener for the service (not applicable here)",
"服务有回复但握手被拒绝。": "service replied but the handshake was refused.",
"服务有回复但非字典 —— 握手被拒绝。": "service replied but not with a dictionary — handshake refused.",
"服务表": "service table",
"未修复": "unfixed",
"未发现内核指针": "no kernel pointers found",
"未取到数据": "no data retrieved",
"未命中": "miss",
"未命中，未写入": "miss, not written",
"未在产出里找到源标记的填充区": "no marker padding found in the output",
"未知": "unknown",
"未读到内容": "no content read",
"未返回数据（沙盒或接口不可用）": "no data returned (sandbox or interface unavailable)",
"本容器内 IconState: ": "IconState in this container: ",
"本模块仍完成了 ": "this module still completed ",
"本次新建: ": "created now: ",
"本进程": "this process",
"机型": "model",
"权限受限": "entitlement-gated",
"权限面已采集": "privilege surface captured",
"权限面测绘": "privilege surface mapping",
"条目 ": "entries ",
"构建号": "build",
"构造 ": "built ",
"枚举目录": "enumerate",
"查找": "find",
"查找 / 替换": "find / replace",
"查找替换全部断言通过": "all find/replace assertions passed",
"查询（只读）": "query (read-only)",
"校验方法不存在（27.0 未修复）": "validator absent (unfixed in 27.0)",
"校验方法存在（27.2 已修复）": "validator present (fixed in 27.2)",
"植入 ": "planted ",
"沉浸式音频入口探测完成": "immersive audio entry probe complete",
"沙盒 / 签名 / entitlements": "sandbox / signing / entitlements",
"注入 LC_LOAD_DYLIB → ": "inject LC_LOAD_DYLIB → ",
"注入 LC_LOAD_DYLIB：ncmds ": "inject LC_LOAD_DYLIB: ncmds ",
"注入 dylib 路径": "dylib path to inject",
"注入失败: ": "inject failed: ",
"注入未成功（头部无空隙）：": "injection failed (no header gap): ",
"注册失败（无错误信息）": "registration failed (no error)",
"注册失败：": "registration failed: ",
"活跃": "active",
"消费 ": "consume ",
"清理残留探针 ": "cleaning leftover probes ",
"温度": "temperature",
"渲染存活 — 该构建未受影响": "render survived — this build unaffected",
"渲染存活（与源分析的负结果一致）": "render survived (matches the source-analysis negative)",
"源 ": "source ",
"源 IPA": "source IPA",
"源 JPEG ": "source JPEG ",
"源解码失败": "source decode failed",
"源解码失败（标记先被拒绝了）": "source decode failed (marker refused first)",
"溢出阈值标定": "overflow threshold calibration",
"热状态": "thermal state",
"版本": "version",
"物理内存": "physical memory",
"生成改机 IPA": "build modified IPA",
"生效用户设置": "effective user settings",
"用户态可触及的内核入口数量有限。ipc_port 请求表索引竞态无 entitlement 门槛；decmpfs 已在泄露层验证。本层度量的是「能否将用户态的错误转为内核侧的状态变化」。": "The kernel entries reachable from user space are few. The ipc_port request-table index race has no entitlement gate; decmpfs is already verified in the leak layer. This layer measures whether a user-space error can be turned into kernel-side state change.",
"电源": "power",
"电量": "battery",
"目标": "target",
"目标 ": "target ",
"目标 ": "target ",
"目标创建失败": "target create failed",
"目标文件": "target file",
"直接 open 成功（意外）": "direct open succeeded (unexpected)",
"直接 open 被拒 errno=": "direct open refused errno=",
"直接读也成功 ": "direct read also succeeded ",
"直接读被拒 (errno ": "direct read refused (errno ",
"真实但被拒的路径返回 -12203，不存在的路径返回 -17913。两个不同的服务端错误码在不授予访问的前提下披露文件是否存在。": "A real but refused path returns -12203, a nonexistent one -17913. Two distinct server-side error codes disclose whether a file exists without granting any access.",
"码 ": "bytes ",
"硬件型号": "hardware model",
"确定该构建上的实际起点：进程持有哪些 entitlement、沙盒放行到哪一层、mach 命名空间如何组织。后续每一步的收益都要以该基线折算。": "Establish the real starting point on this build: which entitlements the process holds, how far the sandbox lets it through, how the mach namespace is organised. Every later stage's yield is measured against this baseline.",
"种子 ": "seed ",
"种子缺失": "seed missing",
"种子缺失 deep_nest.usda": "seed missing deep_nest.usda",
"种子缺失 joliet_path_oob.iso": "seed missing joliet_path_oob.iso",
"种子缺失 ktx2_bad_dims.ktx2": "seed missing ktx2_bad_dims.ktx2",
"种子缺失 stack_bomb.cff": "seed missing stack_bomb.cff",
"移除": "removed",
"移除 LC_CODE_SIGNATURE": "remove LC_CODE_SIGNATURE",
"移除 LC_CODE_SIGNATURE ×": "remove LC_CODE_SIGNATURE ×",
"移除 LC_CODE_SIGNATURE：": "remove LC_CODE_SIGNATURE: ",
"移除失败: ": "remove failed: ",
"移除损坏的 journal": "removing corrupt journal",
"空闲": "idle",
"竞态完成 ": "race done ",
"竞态完成，内核返回 ": "race done, kernel returned ",
"符号不可用": "symbol unavailable",
"符号解析失败": "symbol resolution failed",
"签发 ": "issue ",
"签发时解析链接目标，消费时不复核路径": "resolves the link target at issue time and never re-verifies the path at consume time",
"类型混淆": "type confusion",
"系统可用字体（": "system fonts (",
"系统组数据库": "system group database",
"系统账户数据库": "system account database",
"系统账户数据库（/private 前缀）": "system account database (/private prefix)",
"系统进程": "system process",
"累计路径 1024 B": "cumulative path 1024 B",
"结果": "result",
"缺失": "missing",
"缺少该基线，无法区分「漏洞所得」与「签名所授」。": "Without that baseline there is no separating what a vulnerability earned from what the signature granted.",
"网络": "network",
"耗时异常 —— 递归路径可能没有终止条件": "abnormal duration — the recursive path may have no terminator",
"联动": "chain",
"自己写 ZIP → libarchive 读回": "own ZIP writer → libarchive read-back",
"自检全绿意味着工具链本身可信 —— 此后出现的问题是选择问题，不是工具问题。": "All-green self-tests mean the toolchain itself is trustworthy — any problem after that is a targeting problem, not a tooling problem.",
"自造 IPA：": "self-built IPA: ",
"表: ": "table: ",
"被拒绝本身即说明校验发生在解释器之前 —— 这是该构建上有效的观测。": "The refusal itself proves the validation happens before the interpreter — a valid observation on this build.",
"视频编解码": "video codecs",
"解包": "unpack",
"解包 ": "unpacked ",
"解包失败：": "unpack failed: ",
"解析 ": "parsed ",
"解析器面": "parser surface",
"解析存活（已解码=": "parse survived (decoded=",
"解析返回 ": "parse returned ",
"解码 ": "decoded ",
"解码器可达性探测完成": "decoder reachability probe complete",
"解码器接受参数集 · 尺寸 ": "decoder accepted the parameter set · size ",
"解码存活 ": "decode survived ",
"解码存活 · 尺寸 ": "decode survived · size ",
"解码存活 · 帧数 ": "decode survived · frames ",
"解码存活（已解码=": "decode survived (decoded=",
"解码返回错误: ": "decode returned error: ",
"触觉事件已尝试": "haptic event attempted",
"记录": "record",
"该 Mach 服务无人监听 —— 本平台不适用（模拟器内不运行 mediaplaybackd）。真机上该服务常驻。": "no one listens on that Mach service — not applicable on this platform (mediaplaybackd does not run in the simulator). On a real device the service is resident.",
"该平台不允许这条武装路径，故请求表索引竞态无法在此被驱动。": "This platform forbids that arming path, so the request-table index race cannot be driven here.",
"该平台未施加沙盒 — 无证据": "no sandbox on this platform — no evidence",
"该序列确定性成立，不需要竞态窗口。Apple 未将其视为安全问题，因此没有 CVE 编号。": "The sequence holds deterministically and needs no race window. Apple does not treat it as a security issue, so there is no CVE number.",
"该构建上未越界": "not out of bounds on this build",
"该阈值决定后续所有负载的长度预算。": "That threshold sets the length budget for every subsequent payload.",
"详情": "detail",
"请求表路径无法被武装。真机上应返回 KERN_SUCCESS。": "The request-table path cannot be armed. On a real device it should return KERN_SUCCESS.",
"读写正常": "read/write ok",
"读取 ": "read ",
"读取 ": "read ",
"读取 IPA 失败": "IPA read failed",
"读取失败": "read failed",
"读取失败 errno=": "read failed errno=",
"读取失败: ": "read failed: ",
"读回内容不一致": "read-back mismatch",
"读回失败: ": "read-back failed: ",
"资产载入存活": "asset load survived",
"越过沙盒读取": "read past sandbox",
"越过沙盒读取 ": "read past sandbox ",
"跨沙盒": "cross-sandbox",
"跨沙盒读取 ": "cross-sandbox read ",
"跨越边界 ": "crossed boundary ",
"路径": "path",
"路径不存在 (-17913)": "path absent (-17913)",
"路径中间不是目录": "path component is not a directory",
"路径存在但拒绝访问 (-12203)": "path present but access refused (-12203)",
"路径穿越遏制: ": "path traversal containment: ",
"输出不稳定 — 未初始化内存迹象": "output unstable — uninitialised-memory signature",
"输出干净": "output clean",
"输出文件里出现 ": "output file contains ",
"输出稳定": "output stable",
"过程": "process",
"运行时长": "uptime",
"返回 0 —— 偏移被钳制或链未被跟随": "returned 0 — offset clamped or chain not followed",
"返回错误: ": "returned error: ",
"进程内": "in-process",
"连接 com.apple.coremedia.mediaplaybackd.bytestream.xpc": "connecting to com.apple.coremedia.mediaplaybackd.bytestream.xpc",
"连接对象已创建: ": "connection created: ",
"选择 .sqlite / .db": "choose .sqlite / .db",
"选择一个 .ipa": "choose an .ipa",
"选择一个文件": "choose a file",
"选择字体文件": "choose a font file",
"选择文件": "choose file",
"逐字节比对: ": "byte comparison: ",
"通过": "passed",
"遍历完成，": "traversal complete, ",
"重复越界写 32 次": "repeat OOB write 32×",
"重打包 ": "repacked ",
"重编码成功=": "re-encode ok=",
"错误: ": "error: ",
"错误码 ": "error code ",
"镜像 ": "image ",
"镜像过短": "image too short",
"需要 65536 B，实际 64 B": "needs 65536 B, 64 B present",
"需达到可复现阈值；低于该阈值时，越狱路径不成立。": "A reproducible threshold is required; below it the jailbreak chain does not hold.",
"音频栈": "audio stack",
"音频资源 id=": "audio resource id=",
"页面 4000×4000 · 需要 64 MB 缓冲": "page 4000×4000 · needs a 64 MB buffer",
"页面渲染完成 ": "page rendered ",
"项": "entries",
"验证了名称空间的分配/拆除路径本身可用。": "verifies that the namespace allocate/teardown path itself works.",
"（按设计不接受新建文件，不计入探针）": " (by design accepts no new files, excluded from probes)",
"）": ")",
"，含 LC_LOAD_DYLIB=": ", contains LC_LOAD_DYLIB=",
"，命令数 ": ", load commands ",
"，尺寸 ": ", size ",
"，属性 ": ", attrs ",
"，已绘制 ": ", drawn ",
"，已解码 ": ", decoded ",
"，经链接 ": ", via link ",
"，经链接亦失败": ", via link also failed",
"，经链接读到内容": ", via link read content",
]
}