Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #13763861
Notes from iOS 8.4.1 Triage
Adderalling:
The result of running adderall did not pull the kernel. Python reported "unable to init". Checking out the iOS 9 branches for {}, I rebuilt it in Debug and ran while monitoring the syslog and found that the adderperm might be broken:
Jul 16 17:03:57 iPad aitd[240] <Emergency>: [1437080637 en.c:el_init:240] ncpu = 2
Jul 16 17:03:57 iPad aitd[240] <Emergency>: [1437080637 el_addrperm.c:el_get_mach_port_sright_kaddr_perm:41] Error: port name 0x207 not found in task space
Jul 16 17:03:57 iPad aitd[240] <Emergency>: [1437080637 el_addrperm.c:el_get_kernel_task_itk_self:95] Error: bad mach_host_sright_kaddr 0x0
Jul 16 17:03:57 iPad aitd[240] <Emergency>: [1437080637 en.c:el_init:250] Error: bad kernel_task_itk_self
This means that the for loop in el_adderperm.c (lines 33-39) implies the check (table[i].iin_name == port_name && table[i].iin_object != 0) never passed. This means I should print out the iin_name, port_name, and iin_object for everything in the table and got:
Jul 16 17:24:00 iPad aitd[242] <Emergency>: [1437081840 el_addrperm.c:el_get_mach_port_sright_kaddr_perm:34] DUBUGGING: checking table name 0xb against 0x6fd39038 and 0 and 0
Jul 16 17:24:00 iPad aitd[242] <Emergency>: [1437081840 el_addrperm.c:el_get_mach_port_sright_kaddr_perm:34] DUBUGGING: checking table name 0xb against 0x6fd39038 and 0 and 0
...
Jul 16 17:24:01 iPad aitd[242] <Emergency>: [1437081841 el_addrperm.c:el_get_mach_port_sright_kaddr_perm:34] DUBUGGING: checking table name 0xb against 0x6fd39038 and 0 and 0
Jul 16 17:24:01 iPad aitd[242] <Emergency>: [1437081841 el_addrperm.c:el_get_mach_port_sright_kaddr_perm:42] Error: port name 0x207 not found in task space
Jul 16 17:24:01 iPad aitd[242] <Emergency>: [1437081841 el_addrperm.c:el_get_kernel_task_itk_self:96] Error: bad mach_host_sright_kaddr 0x0
Maybe the table is not populated