Congratulations on your impressive upcoming jailbreak release. Dream achieved! Seeing the dedication behind work like this is always inspiring.
(@pattern_F_ requested a little privacy, so he gets a cute sticker instead. 😄)
proc_entitlement_is_bool_true("com.apple.private.security.container-manager") is changed to AppleMobileFileIntegrity::AMFIEntitlementGetBool in iOS 16.4. So the hack adding entitlements to the backend OSDictionary of OSEntitlements is not working.
iOS 15.x demo. Run 3 cmds: ls, id, sw_vers.
There is a lot of trouble in ios15. Still a long way from a real jailbreak.
iPhone XS, iOS 15.0: using cve-2021-30883 (written months ago)
iPhone 13 Pro, iOS 15.1: using cve-2021-30955 (thanks @realBrightiup )
I don't promise anything
Had succeeded in using my kernel read/write primitive to achieve privilege elevation on macOS 12.1 prior to the release of macOS 12.2. The exploit code can work in many sandboxed context
(apps, WebContent, etc.), but the vuln doesn't exist on iOS.
Write an iOS 14.6 (iPhoneXR, A12) jailbreak demo for CVE-2021-30883 (fixed in iOS 15.0.2, by @AmarSaar).
Use a trick from oob-timestamp (by @_bazad).
Run two commands: "id" and "ls /"
CVE-2021-30914
I used this one to complete my first iOS LPE exploit demo, on 2021-02-09, . Unfortunately, it is not easy to exploit it in iOS 14.2 and above.