gilbo

ida_kernelcachd_ng released github.com/gilboz/ida_ker… Getting -24,000 vmethod symbols on latest kernelcache! As mentioned it is still a WIP, if you encounter issues then submit them and ill fix on my free time! Contributions are welcome!!

@blacktop__ Apple decided to bump their versioning again? 😂

@Tymscar @khanhduytran0 That’s SBPL, used in *OS devices to define sandbox profiles of processes. It’s a DSL made by Apple, the syntax is LISP-y. On iOS these get compiled into a proprietary binary format and embedded inside the kernel cache. These blobs can get decompiled into this output.

@_gilboz @khanhduytran0 Whats this and why is it lisp?

iOS 26.6 SpringBoard sandbox profile 😂?

A new research blog deserves a proper first post. A SecureROM bug seemed appropriate. Allow us to introduce you to #usbliter8. ps.tc/pages/blog-usb…

It looks like apple added a wrong path into the sandbox profile in the beta release. Dopamine is a jailbreak for old iOS versions @opa334dev, procursus and rocket are also related to jailbreaking

@allthingsida Which of your projects do you refer to?

What’s the point of open sourcing these days if people just ask AI to refactor slightly, remove your copyright notice and call it theirs? Maybe in the age of AI, it is best to just distribute binaries. Freeware.

📍 @0x41con Napoli

@blacktop__ This entitlement is not new, Claude managed to figure that out well. it’s weird they apply it to a process that is already sandboxed without access to the AGXUserClient..?

Gave Claude my `ipsw` tool and my `ida-mcp-rs` and asked it what Apple adding `com.apple.developer.gpu-restricted` to `com.apple.WebKit.WebContent.EnhancedSecurity` does and here's the report it made. We are so cooked chat 🪦 gist.github.com/blacktop/f2606…

@hexacon_fr done! It’s always a pleasure to see everyone in person

Offensive con 2025 ended! Was a great experience 🔥

It was a great experience and amazing venue! I enjoyed giving my talk about kernelcache reversing, stay tuned for updates about the release of ida_kernelcache_ng! 🚀 Thanks @xerub and @justandrijana for organizing

@blacktop__ @0xjprx Great stuff as always. For me being able to generate a compilation database for clangd is a big deal Thanks

Thanks to another EPIC PR from @0xjprx we now have CodeQL databases and building XNU for macOS 14.6 AND 15.0 🎉 Get it while it’s HOT!🥵🔥 github.com/blacktop/darwi…

@cybercdh using vim as general purpose IDE is a bad idea. I used neovim (the new version) plus vimplug for plugin management and it was cool. but I found myself working on fixing my dotfiles most of the time rather than focusing on my work.Aside from 'ricing' you distro, you dont gain much

@cybercdh I used really most text editors, sublime is the best for general-purpose. second place is vscode. If you feel these are too 'heavy' reconsider upgrading your pc its 2021. when working remotely via ssh i'll use vim

You’re a malware analyst. What’s your favourite IDE and why?

@pxmme1337 @aessae @MalwareTechBlog A bit of sarcasm never hurt nobody

@aessae @MalwareTechBlog Why must there always be a dude like you?

@vysecurity Lol, defender is indeed stubborn, disabling it through gpedit.msc solved it for me

Why is my Defender deleting viruses even though I "TURNED IT OFF"? WTF