GenericCoding

@thejailbreakhub iPhone 13

@thejailbreakhub Summoning the resident AI expert, the vibe king as some would say. @0xjohnny

@thejailbreakhub Twitter space eta wen?

My assumption is that dopamine will still likely be the more stable option here—especially because this is AI coded

Github commit: github.com/GenericCoding/…

Around 25% success rate sadly, and could only consistently reproduce on vphone configuration - I believe this is due to virtualization vs physical hardware timing and the aforementioned race condition, will be on GitHub shortly. I'm still working on the success rate problem.

Fixed the gadget offsets, and added fcall primitives to prove iOS 26.1 PAC bypass.

Overwriting the NSBundle lock which worked on iOS 18 stopped working in iOS 26 hence the pivot to softlink loading

Sadly there seems to be an issue with the PAC gadgets, interposing with dyld and worker wake / parking / lock all work consistently, we used a different loading method that didn’t rely on nsbundle locking and thus rely on different components completely for interposing.

I’m working on a fix I’ve also ported over fcall so when it is fixed the test call to fcall will serve as verification.

GitHub repo has been updated, incredible thanks to @D4RK7ET without whom this wouldn’t have been possible. Currently the success rate is fairly low and am working on improving it.

Dyld interposing PAC bypass on iOS 26.1.

@thejailbreakhub Arm64e depends on a PPL bypass whereas dopamine was updated for Arm64 using darksword kernel exploit because PPL is not an issue for those devices. Darksword didn’t have any PPL bypass.

@thejailbreakhub AFAIK it’s a closed conference so I don’t believe it will be live streamed but usually with conferences the slides are released by devs. Might be different here, but the question is less so if we will get a PoC and more so will he release the conference slides.

@thejailbreakhub @0xjohnny might be very useful if vphone doesn’t work with iOS 27 for lldb debugging

@thejailbreakhub What was super cool about the sandbox escape by @0xjohnny was he found it less than a week with GPT 5.6

@thejailbreakhub Pattern F is going to be doing a talk on his PPL bypass so the date will likely be after that talk.

Thank you to @D4RK7ET for the commit, pois0nSword no longer crashes at all in my testing. The hardcoded offset for GC disabling had been incorrect. Added to credits in readme.

Happy to announce I fixed the vtable bug! The issue was the dedicated web worker ScriptExecutionContext hadn’t been loaded, despite the contexts length being equal to if it had been loaded. Can soon start work on the PAC bypass. Update live on GitHub.

Update: ghidra crashed

Searching for a memory address in dyld cache >5900632064 addresses