SE + iOS 11.4.1 failed

[platinumstufff]

I have some questions about Spice. So there is no issues in that repo, and i cant found any contacts.

[platinumstufff]

1. I think offsets for SE 11.4.1 is wrong(40 minutes without any successful attempts)
2. On the last commit build is broken(make: write error).
3. When I build it, File Descriptor = 3. As far as I understand from sources it can be 5 or 6 not an 3.(After adding a fd3 folder with edited control, it builds successfully)
   Build System: Big Sur + xcode 13.2.1(with ios 11.4 sdk installed)

[UInt2048]

@platinumstufff Do you know which commit did I introduce the write error? It has to be recent but I would like to narrow it down so I can get rid of that issue

[UInt2048]

After adding a fd3 folder with edited control, it builds successfully

This should not happen. The fdscream control should be in effect here.

Are you saying adding an fd3 folder caused the write error to go away?

[platinumstufff]

Are you saying adding an fd3 folder caused the write error to go away?

Yes, but another error in this commit. It happens then i try to build with FD=3.

[platinumstufff]

It happens then i try to build with FD=3.

Log:

cp: src/untether/debian/fd3/control: No such file or directory make: *** [src/untether/generated/lol.spyware.spiceuntether_1.0.160_iphoneos-arm.deb] Error 1

[UInt2048]

@platinumstufff I see, you shouldn't be building with FD=3 unless you empirically verified using the scream test build that the descriptor actually is 3

[UInt2048]

If you are building the scream test, do not include a FD variable at all

[platinumstufff]

Do you know which commit did I introduce the write error?

Probably the last one. I checked and the last to be built is Add trailing newlines.

[platinumstufff]

you shouldn't be building with FD=3

I know but:

./stage1.h:17:2: warning: Scream test is enabled [-W#warnings]
#warning Scream test is enabled
 ^
./stage1.h:26:9: warning: Stage 1 file descriptor is: 3 [-W#pragma-messages]
#pragma message "Stage 1 file descriptor is: " QUOTE(DYLD_CACHE_FD)
        ^
2 warnings generated.
In file included from stage1.m:9:
./stage1.h:17:2: warning: Scream test is enabled [-W#warnings]
#warning Scream test is enabled
 ^
./stage1.h:26:9: warning: Stage 1 file descriptor is: 3 [-W#pragma-messages]
#pragma message "Stage 1 file descriptor is: " QUOTE(DYLD_CACHE_FD)
        ^
2 warnings generated.
In file included from stage2.m:11:
./stage1.h:17:2: warning: Scream test is enabled [-W#warnings]
#warning Scream test is enabled
 ^
./stage1.h:26:9: warning: Stage 1 file descriptor is: 3 [-W#pragma-messages]
#pragma message "Stage 1 file descriptor is: " QUOTE(DYLD_CACHE_FD)

[platinumstufff]

Also the main issue now is

I think offsets for SE 11.4.1 is wrong(40 minutes without any successful attempts)

[UInt2048]

@platinumstufff That's fine, it's just a warning so you don't build the scream test by accident

[UInt2048]

What's happening in the attempts? Is it just taking forever in stage 5 and then panic?

I'm actually trying to switch it over to the sock_port exploit for better reliability but I haven't figured out how to make that not be a guaranteed panic in postexploitation

[platinumstufff]

Yes, but sometimes it show error

Failed to run killall(1):85