Just to make things clear : you’re not denying the existence of the SPTM vulnerability even if you think Calif may have used a different method to achieve similar results without relying on that particular SPTM bypass RIGHT ?
Really glad to have had the chance to work on this with @0xjohnny, @D4RK7ET, and for @htrowii giving us her process injection technique, and for the input and advice from @Jakeashacks without whom there were points this wouldn't have been possible.
github.com/0xjohnnydev/crypt…
New post: how I got into Apple Security Bounty. My path, the articles and talks that helped, a hands-on XNU kernel lab and my setup + tooling.
varik.dev/blog/getting-into-…
Everything which claims to be for 26.x in this repo is fake. Even where an exploit could properly be used on the claimed supported version, they are not properly triggered. For instance the userland PAC bypass could work on 26.1, but in this repo the implementation is wrong.