BranchesTags

Repository files navigation

Pay me if you like this paper:) image

image

  1. What is it

    This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.

    Basically, it is a typical kernel driver which inline-hooked import API related to IOKit framework and kernel service.

    You could collect kernel dump and reproduce the vulnerability if kernel crash happens.

    You can follow my twitter: @Flyic (of moony li)to more info in detail.

    The source code is to be released after our presentation "Active fuzzing as complementary for passive fuzzing" on PacSec 2016 in Tokyo(10.26/10.27)

    https://pacsec.jp/speakers.html

    The passive fuzzing framework is based on “the_flying_circus” rootkit for OSX by fG! Special thanks to fG!

    (A Mountain Lion rootkit for Phrack #69! Copyright (c) fG!, 2012, 2013 - reverser@put.as - http://reverse.put.as All rights reserved.)

  2. Requirement for running

In principle, the passive fuzzing framework could support popular OSX version for Mac Pro,Air.

As our experience, there kernel revision from 10.11 to 10.11.6 cause little or non interference to passive fuzzing.

The framework has been tested on 10.11.6 MacPro with KDK_10.11.6_15G31.kdk.

  1. How to use

IMPORTANT TIPS:

Running the kernel driver would cause sudden kernel crash so as to lose all your data. Take your own risk to use this kernel driver.

3.1 Quick Start

If you want to try the passive fuzz just for fun, please quick try like this:
a. Load driver for quick passive fuzz
sh-3.2# chown -R root:wheel ./quick-pasive_kernel_fuzz.kext
sh-3.2# kextutil ./quick-pasive_kernel_fuzz.kext
b. quick-pasive_kernel_fuzz would appear in kernel module
sh-3.2# kextstat
You would see the driver appears in the kernel module list. However,

3.2 Full Start with ThunderBolt wire

This start guide is suitable for all Mac OSX machine(e.g. MacPro, MacAir, Mac Mini).
This solution require for another debugger OSX machine and extra ThunderBolt wire.
1. On target(or debugee) OSX machine:
a. Prepare KDK and nvram I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
II. Copy kernel.development to system folder and synchronise kernel cache
sh-3.2# cp -fr /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels/kernel.development* /System/Library/Kernels/
sh-3.2# kextcache -invalid /
sh-3.2# reboot
III. Set up boot-args for debugging sh-3.2# nvram boot-args="debug=0x566 kdp_match_name=firewire fwkdp=0x8000 pmuflags=1 kext-dev-mode=1 -v"
sh-3.2# reboot
b. Load driver for passive fuzz
sh-3.2# chown -R root:wheel ./pasive_kernel_fuzz.kext
sh-3.2# kextutil ./pasive_kernel_fuzz.kext
c. Proberbly your Mac Machine would kernel crash waiting for further deubugging
2. On debugger OSX machine:
IMPORTANT TIP:
Always keep the ThunderBolt connected with the two machine always because plug and play (recognize) is NOT supported for the crashed kernel.
a. Prepare KDK
I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
This step is not necessary but strongly recommented. When lldb in furthur following steps, lldb would match *.dSYM symbol file between debugee machine and debugger machine. Otherwise, symbol info would NOT be shown during your debugging.
b. Debug the crashed target machine
I. Launch fwkdp service
flyic-pro:pasive_kernel_fuzz.kext root1$ fwkdp
II. lldb debug
sh-3.2# cd /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels
sh-3.2# lldb ./kernel.development
(lldb) kdp-remote localhost
The debugger would wait until the target machine crashes, and then you can type any command for debugging including collect core dump file.

3.3 Full Start with Wire LAN

 Because only lagecy OSX machine support Wire LAN (e.g. Old MacMini), this kind of debugging is not popular.
To be done

  1. External Resource

    4.1. Crashes

    Ever collected core dump files, lldb debug logs, poc and so forth (keep updating, about 100GB).

    External link:

    http://pan.baidu.com/s/1dEJO3TJ

  2. Known issue:

    5.1 MacOS 10.12 MachO format parse error

    process_kernel_mach_header(void *kernel_header, struct kernel_info *kinfo)

    could not analyze the machO file format in 10.12 which may be different with 10.11 or before so as to cause kext load fail.

About

This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.

Resources

Readme
Activity

Stars

229 stars

Watchers

16 watching

Forks

61 forks
Report repository

Releases

Packages

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
BranchesTags
Repository files navigation
Pay me if you like this paper:)
image
image
  1. What is it
    This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
    Basically, it is a typical kernel driver which inline-hooked import API related to IOKit framework and kernel service.
    You could collect kernel dump and reproduce the vulnerability if kernel crash happens.
    You can follow my twitter: @Flyic (of moony li)to more info in detail.
    The source code is to be released after our presentation "Active fuzzing as complementary for passive fuzzing" on PacSec 2016 in Tokyo(10.26/10.27)
    https://pacsec.jp/speakers.html
    The passive fuzzing framework is based on “the_flying_circus” rootkit for OSX by fG! Special thanks to fG!
    (A Mountain Lion rootkit for Phrack #69! Copyright (c) fG!, 2012, 2013 - reverser@put.as - http://reverse.put.as All rights reserved.)
  2. Requirement for running
In principle, the passive fuzzing framework could support popular OSX version for Mac Pro,Air.
As our experience, there kernel revision from 10.11 to 10.11.6 cause little or non interference to passive fuzzing.
The framework has been tested on 10.11.6 MacPro with KDK_10.11.6_15G31.kdk.
  1. How to use
IMPORTANT TIPS:
Running the kernel driver would cause sudden kernel crash so as to lose all your data. Take your own risk to use this kernel driver.
3.1 Quick Start
If you want to try the passive fuzz just for fun, please quick try like this:
a. Load driver for quick passive fuzz
sh-3.2# chown -R root:wheel ./quick-pasive_kernel_fuzz.kext
sh-3.2# kextutil ./quick-pasive_kernel_fuzz.kext
b. quick-pasive_kernel_fuzz would appear in kernel module
sh-3.2# kextstat
You would see the driver appears in the kernel module list. However, 
3.2 Full Start with ThunderBolt wire
This start guide is suitable for all Mac OSX machine(e.g. MacPro, MacAir, Mac Mini).
This solution require for another debugger OSX machine and extra ThunderBolt wire.
1. On target(or debugee) OSX machine:
a. Prepare KDK and nvram I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
II. Copy kernel.development to system folder and synchronise kernel cache
sh-3.2# cp -fr /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels/kernel.development* /System/Library/Kernels/
sh-3.2# kextcache -invalid /
sh-3.2# reboot
III. Set up boot-args for debugging sh-3.2# nvram boot-args="debug=0x566 kdp_match_name=firewire fwkdp=0x8000 pmuflags=1 kext-dev-mode=1 -v"
sh-3.2# reboot
b. Load driver for passive fuzz
sh-3.2# chown -R root:wheel ./pasive_kernel_fuzz.kext
sh-3.2# kextutil ./pasive_kernel_fuzz.kext
c. Proberbly your Mac Machine would kernel crash waiting for further deubugging
2. On debugger OSX machine:
IMPORTANT TIP:
Always keep the ThunderBolt connected with the two machine always because plug and play (recognize) is NOT supported for the crashed kernel.
a. Prepare KDK
I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
This step is not necessary but strongly recommented. When lldb in furthur following steps, lldb would match *.dSYM symbol file between debugee machine and debugger machine. Otherwise, symbol info would NOT be shown during your debugging.
b. Debug the crashed target machine
I. Launch fwkdp service
flyic-pro:pasive_kernel_fuzz.kext root1$ fwkdp
II. lldb debug
sh-3.2# cd /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels
sh-3.2# lldb ./kernel.development
(lldb) kdp-remote localhost
The debugger would wait until the target machine crashes, and then you can type any command for debugging including collect core dump file.

3.3 Full Start with Wire LAN
 Because only lagecy OSX machine support Wire LAN (e.g. Old MacMini), this kind of debugging is not popular.
To be done

  1. External Resource
    4.1. Crashes
    Ever collected core dump files, lldb debug logs, poc and so forth (keep updating, about 100GB).
    External link:
    http://pan.baidu.com/s/1dEJO3TJ
  2. Known issue:
    5.1 MacOS 10.12 MachO format parse error
    process_kernel_mach_header(void *kernel_header, struct kernel_info *kinfo)
    could not analyze the machO file format in 10.12 which may be different with 10.11 or before so as to cause kext load fail.
About
This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
Resources
Readme
Activity
Stars
229 stars
Watchers
16 watching
Forks
61 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
Pay me if you like this paper:)
image
image
  1. What is it
    This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
    Basically, it is a typical kernel driver which inline-hooked import API related to IOKit framework and kernel service.
    You could collect kernel dump and reproduce the vulnerability if kernel crash happens.
    You can follow my twitter: @Flyic (of moony li)to more info in detail.
    The source code is to be released after our presentation "Active fuzzing as complementary for passive fuzzing" on PacSec 2016 in Tokyo(10.26/10.27)
    https://pacsec.jp/speakers.html
    The passive fuzzing framework is based on “the_flying_circus” rootkit for OSX by fG! Special thanks to fG!
    (A Mountain Lion rootkit for Phrack #69! Copyright (c) fG!, 2012, 2013 - reverser@put.as - http://reverse.put.as All rights reserved.)
  2. Requirement for running
In principle, the passive fuzzing framework could support popular OSX version for Mac Pro,Air.
As our experience, there kernel revision from 10.11 to 10.11.6 cause little or non interference to passive fuzzing.
The framework has been tested on 10.11.6 MacPro with KDK_10.11.6_15G31.kdk.
  1. How to use
IMPORTANT TIPS:
Running the kernel driver would cause sudden kernel crash so as to lose all your data. Take your own risk to use this kernel driver.
3.1 Quick Start
If you want to try the passive fuzz just for fun, please quick try like this:
a. Load driver for quick passive fuzz
sh-3.2# chown -R root:wheel ./quick-pasive_kernel_fuzz.kext
sh-3.2# kextutil ./quick-pasive_kernel_fuzz.kext
b. quick-pasive_kernel_fuzz would appear in kernel module
sh-3.2# kextstat
You would see the driver appears in the kernel module list. However, 
3.2 Full Start with ThunderBolt wire
This start guide is suitable for all Mac OSX machine(e.g. MacPro, MacAir, Mac Mini).
This solution require for another debugger OSX machine and extra ThunderBolt wire.
1. On target(or debugee) OSX machine:
a. Prepare KDK and nvram I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
II. Copy kernel.development to system folder and synchronise kernel cache
sh-3.2# cp -fr /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels/kernel.development* /System/Library/Kernels/
sh-3.2# kextcache -invalid /
sh-3.2# reboot
III. Set up boot-args for debugging sh-3.2# nvram boot-args="debug=0x566 kdp_match_name=firewire fwkdp=0x8000 pmuflags=1 kext-dev-mode=1 -v"
sh-3.2# reboot
b. Load driver for passive fuzz
sh-3.2# chown -R root:wheel ./pasive_kernel_fuzz.kext
sh-3.2# kextutil ./pasive_kernel_fuzz.kext
c. Proberbly your Mac Machine would kernel crash waiting for further deubugging
2. On debugger OSX machine:
IMPORTANT TIP:
Always keep the ThunderBolt connected with the two machine always because plug and play (recognize) is NOT supported for the crashed kernel.
a. Prepare KDK
I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
This step is not necessary but strongly recommented. When lldb in furthur following steps, lldb would match *.dSYM symbol file between debugee machine and debugger machine. Otherwise, symbol info would NOT be shown during your debugging.
b. Debug the crashed target machine
I. Launch fwkdp service
flyic-pro:pasive_kernel_fuzz.kext root1$ fwkdp
II. lldb debug
sh-3.2# cd /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels
sh-3.2# lldb ./kernel.development
(lldb) kdp-remote localhost
The debugger would wait until the target machine crashes, and then you can type any command for debugging including collect core dump file.

3.3 Full Start with Wire LAN
 Because only lagecy OSX machine support Wire LAN (e.g. Old MacMini), this kind of debugging is not popular.
To be done

  1. External Resource
    4.1. Crashes
    Ever collected core dump files, lldb debug logs, poc and so forth (keep updating, about 100GB).
    External link:
    http://pan.baidu.com/s/1dEJO3TJ
  2. Known issue:
    5.1 MacOS 10.12 MachO format parse error
    process_kernel_mach_header(void *kernel_header, struct kernel_info *kinfo)
    could not analyze the machO file format in 10.12 which may be different with 10.11 or before so as to cause kext load fail.
About
This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
Resources
Readme
Activity
Stars
229 stars
Watchers
16 watching
Forks
61 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
Pay me if you like this paper:)
image
image
  1. What is it
    This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
    Basically, it is a typical kernel driver which inline-hooked import API related to IOKit framework and kernel service.
    You could collect kernel dump and reproduce the vulnerability if kernel crash happens.
    You can follow my twitter: @Flyic (of moony li)to more info in detail.
    The source code is to be released after our presentation "Active fuzzing as complementary for passive fuzzing" on PacSec 2016 in Tokyo(10.26/10.27)
    https://pacsec.jp/speakers.html
    The passive fuzzing framework is based on “the_flying_circus” rootkit for OSX by fG! Special thanks to fG!
    (A Mountain Lion rootkit for Phrack #69! Copyright (c) fG!, 2012, 2013 - reverser@put.as - http://reverse.put.as All rights reserved.)
  2. Requirement for running
In principle, the passive fuzzing framework could support popular OSX version for Mac Pro,Air.
As our experience, there kernel revision from 10.11 to 10.11.6 cause little or non interference to passive fuzzing.
The framework has been tested on 10.11.6 MacPro with KDK_10.11.6_15G31.kdk.
  1. How to use
IMPORTANT TIPS:
Running the kernel driver would cause sudden kernel crash so as to lose all your data. Take your own risk to use this kernel driver.
3.1 Quick Start
If you want to try the passive fuzz just for fun, please quick try like this:
a. Load driver for quick passive fuzz
sh-3.2# chown -R root:wheel ./quick-pasive_kernel_fuzz.kext
sh-3.2# kextutil ./quick-pasive_kernel_fuzz.kext
b. quick-pasive_kernel_fuzz would appear in kernel module
sh-3.2# kextstat
You would see the driver appears in the kernel module list. However, 
3.2 Full Start with ThunderBolt wire
This start guide is suitable for all Mac OSX machine(e.g. MacPro, MacAir, Mac Mini).
This solution require for another debugger OSX machine and extra ThunderBolt wire.
1. On target(or debugee) OSX machine:
a. Prepare KDK and nvram I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
II. Copy kernel.development to system folder and synchronise kernel cache
sh-3.2# cp -fr /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels/kernel.development* /System/Library/Kernels/
sh-3.2# kextcache -invalid /
sh-3.2# reboot
III. Set up boot-args for debugging sh-3.2# nvram boot-args="debug=0x566 kdp_match_name=firewire fwkdp=0x8000 pmuflags=1 kext-dev-mode=1 -v"
sh-3.2# reboot
b. Load driver for passive fuzz
sh-3.2# chown -R root:wheel ./pasive_kernel_fuzz.kext
sh-3.2# kextutil ./pasive_kernel_fuzz.kext
c. Proberbly your Mac Machine would kernel crash waiting for further deubugging
2. On debugger OSX machine:
IMPORTANT TIP:
Always keep the ThunderBolt connected with the two machine always because plug and play (recognize) is NOT supported for the crashed kernel.
a. Prepare KDK
I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
This step is not necessary but strongly recommented. When lldb in furthur following steps, lldb would match *.dSYM symbol file between debugee machine and debugger machine. Otherwise, symbol info would NOT be shown during your debugging.
b. Debug the crashed target machine
I. Launch fwkdp service
flyic-pro:pasive_kernel_fuzz.kext root1$ fwkdp
II. lldb debug
sh-3.2# cd /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels
sh-3.2# lldb ./kernel.development
(lldb) kdp-remote localhost
The debugger would wait until the target machine crashes, and then you can type any command for debugging including collect core dump file.

3.3 Full Start with Wire LAN
 Because only lagecy OSX machine support Wire LAN (e.g. Old MacMini), this kind of debugging is not popular.
To be done

  1. External Resource
    4.1. Crashes
    Ever collected core dump files, lldb debug logs, poc and so forth (keep updating, about 100GB).
    External link:
    http://pan.baidu.com/s/1dEJO3TJ
  2. Known issue:
    5.1 MacOS 10.12 MachO format parse error
    process_kernel_mach_header(void *kernel_header, struct kernel_info *kinfo)
    could not analyze the machO file format in 10.12 which may be different with 10.11 or before so as to cause kext load fail.
About
This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
Resources
Readme
Activity
Stars
229 stars
Watchers
16 watching
Forks
61 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
BranchesTags
Repository files navigation
Pay me if you like this paper:)
image
image
  1. What is it
    This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
    Basically, it is a typical kernel driver which inline-hooked import API related to IOKit framework and kernel service.
    You could collect kernel dump and reproduce the vulnerability if kernel crash happens.
    You can follow my twitter: @Flyic (of moony li)to more info in detail.
    The source code is to be released after our presentation "Active fuzzing as complementary for passive fuzzing" on PacSec 2016 in Tokyo(10.26/10.27)
    https://pacsec.jp/speakers.html
    The passive fuzzing framework is based on “the_flying_circus” rootkit for OSX by fG! Special thanks to fG!
    (A Mountain Lion rootkit for Phrack #69! Copyright (c) fG!, 2012, 2013 - reverser@put.as - http://reverse.put.as All rights reserved.)
  2. Requirement for running
In principle, the passive fuzzing framework could support popular OSX version for Mac Pro,Air.
As our experience, there kernel revision from 10.11 to 10.11.6 cause little or non interference to passive fuzzing.
The framework has been tested on 10.11.6 MacPro with KDK_10.11.6_15G31.kdk.
  1. How to use
IMPORTANT TIPS:
Running the kernel driver would cause sudden kernel crash so as to lose all your data. Take your own risk to use this kernel driver.
3.1 Quick Start
If you want to try the passive fuzz just for fun, please quick try like this:
a. Load driver for quick passive fuzz
sh-3.2# chown -R root:wheel ./quick-pasive_kernel_fuzz.kext
sh-3.2# kextutil ./quick-pasive_kernel_fuzz.kext
b. quick-pasive_kernel_fuzz would appear in kernel module
sh-3.2# kextstat
You would see the driver appears in the kernel module list. However, 
3.2 Full Start with ThunderBolt wire
This start guide is suitable for all Mac OSX machine(e.g. MacPro, MacAir, Mac Mini).
This solution require for another debugger OSX machine and extra ThunderBolt wire.
1. On target(or debugee) OSX machine:
a. Prepare KDK and nvram I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
II. Copy kernel.development to system folder and synchronise kernel cache
sh-3.2# cp -fr /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels/kernel.development* /System/Library/Kernels/
sh-3.2# kextcache -invalid /
sh-3.2# reboot
III. Set up boot-args for debugging sh-3.2# nvram boot-args="debug=0x566 kdp_match_name=firewire fwkdp=0x8000 pmuflags=1 kext-dev-mode=1 -v"
sh-3.2# reboot
b. Load driver for passive fuzz
sh-3.2# chown -R root:wheel ./pasive_kernel_fuzz.kext
sh-3.2# kextutil ./pasive_kernel_fuzz.kext
c. Proberbly your Mac Machine would kernel crash waiting for further deubugging
2. On debugger OSX machine:
IMPORTANT TIP:
Always keep the ThunderBolt connected with the two machine always because plug and play (recognize) is NOT supported for the crashed kernel.
a. Prepare KDK
I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
This step is not necessary but strongly recommented. When lldb in furthur following steps, lldb would match *.dSYM symbol file between debugee machine and debugger machine. Otherwise, symbol info would NOT be shown during your debugging.
b. Debug the crashed target machine
I. Launch fwkdp service
flyic-pro:pasive_kernel_fuzz.kext root1$ fwkdp
II. lldb debug
sh-3.2# cd /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels
sh-3.2# lldb ./kernel.development
(lldb) kdp-remote localhost
The debugger would wait until the target machine crashes, and then you can type any command for debugging including collect core dump file.

3.3 Full Start with Wire LAN
 Because only lagecy OSX machine support Wire LAN (e.g. Old MacMini), this kind of debugging is not popular.
To be done

  1. External Resource
    4.1. Crashes
    Ever collected core dump files, lldb debug logs, poc and so forth (keep updating, about 100GB).
    External link:
    http://pan.baidu.com/s/1dEJO3TJ
  2. Known issue:
    5.1 MacOS 10.12 MachO format parse error
    process_kernel_mach_header(void *kernel_header, struct kernel_info *kinfo)
    could not analyze the machO file format in 10.12 which may be different with 10.11 or before so as to cause kext load fail.
About
This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
Resources
Readme
Activity
Stars
229 stars
Watchers
16 watching
Forks
61 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
Pay me if you like this paper:)
image
image
  1. What is it
    This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
    Basically, it is a typical kernel driver which inline-hooked import API related to IOKit framework and kernel service.
    You could collect kernel dump and reproduce the vulnerability if kernel crash happens.
    You can follow my twitter: @Flyic (of moony li)to more info in detail.
    The source code is to be released after our presentation "Active fuzzing as complementary for passive fuzzing" on PacSec 2016 in Tokyo(10.26/10.27)
    https://pacsec.jp/speakers.html
    The passive fuzzing framework is based on “the_flying_circus” rootkit for OSX by fG! Special thanks to fG!
    (A Mountain Lion rootkit for Phrack #69! Copyright (c) fG!, 2012, 2013 - reverser@put.as - http://reverse.put.as All rights reserved.)
  2. Requirement for running
In principle, the passive fuzzing framework could support popular OSX version for Mac Pro,Air.
As our experience, there kernel revision from 10.11 to 10.11.6 cause little or non interference to passive fuzzing.
The framework has been tested on 10.11.6 MacPro with KDK_10.11.6_15G31.kdk.
  1. How to use
IMPORTANT TIPS:
Running the kernel driver would cause sudden kernel crash so as to lose all your data. Take your own risk to use this kernel driver.
3.1 Quick Start
If you want to try the passive fuzz just for fun, please quick try like this:
a. Load driver for quick passive fuzz
sh-3.2# chown -R root:wheel ./quick-pasive_kernel_fuzz.kext
sh-3.2# kextutil ./quick-pasive_kernel_fuzz.kext
b. quick-pasive_kernel_fuzz would appear in kernel module
sh-3.2# kextstat
You would see the driver appears in the kernel module list. However, 
3.2 Full Start with ThunderBolt wire
This start guide is suitable for all Mac OSX machine(e.g. MacPro, MacAir, Mac Mini).
This solution require for another debugger OSX machine and extra ThunderBolt wire.
1. On target(or debugee) OSX machine:
a. Prepare KDK and nvram I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
II. Copy kernel.development to system folder and synchronise kernel cache
sh-3.2# cp -fr /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels/kernel.development* /System/Library/Kernels/
sh-3.2# kextcache -invalid /
sh-3.2# reboot
III. Set up boot-args for debugging sh-3.2# nvram boot-args="debug=0x566 kdp_match_name=firewire fwkdp=0x8000 pmuflags=1 kext-dev-mode=1 -v"
sh-3.2# reboot
b. Load driver for passive fuzz
sh-3.2# chown -R root:wheel ./pasive_kernel_fuzz.kext
sh-3.2# kextutil ./pasive_kernel_fuzz.kext
c. Proberbly your Mac Machine would kernel crash waiting for further deubugging
2. On debugger OSX machine:
IMPORTANT TIP:
Always keep the ThunderBolt connected with the two machine always because plug and play (recognize) is NOT supported for the crashed kernel.
a. Prepare KDK
I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
This step is not necessary but strongly recommented. When lldb in furthur following steps, lldb would match *.dSYM symbol file between debugee machine and debugger machine. Otherwise, symbol info would NOT be shown during your debugging.
b. Debug the crashed target machine
I. Launch fwkdp service
flyic-pro:pasive_kernel_fuzz.kext root1$ fwkdp
II. lldb debug
sh-3.2# cd /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels
sh-3.2# lldb ./kernel.development
(lldb) kdp-remote localhost
The debugger would wait until the target machine crashes, and then you can type any command for debugging including collect core dump file.

3.3 Full Start with Wire LAN
 Because only lagecy OSX machine support Wire LAN (e.g. Old MacMini), this kind of debugging is not popular.
To be done

  1. External Resource
    4.1. Crashes
    Ever collected core dump files, lldb debug logs, poc and so forth (keep updating, about 100GB).
    External link:
    http://pan.baidu.com/s/1dEJO3TJ
  2. Known issue:
    5.1 MacOS 10.12 MachO format parse error
    process_kernel_mach_header(void *kernel_header, struct kernel_info *kinfo)
    could not analyze the machO file format in 10.12 which may be different with 10.11 or before so as to cause kext load fail.
About
This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
Resources
Readme
Activity
Stars
229 stars
Watchers
16 watching
Forks
61 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
Pay me if you like this paper:)
image
image
  1. What is it
    This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
    Basically, it is a typical kernel driver which inline-hooked import API related to IOKit framework and kernel service.
    You could collect kernel dump and reproduce the vulnerability if kernel crash happens.
    You can follow my twitter: @Flyic (of moony li)to more info in detail.
    The source code is to be released after our presentation "Active fuzzing as complementary for passive fuzzing" on PacSec 2016 in Tokyo(10.26/10.27)
    https://pacsec.jp/speakers.html
    The passive fuzzing framework is based on “the_flying_circus” rootkit for OSX by fG! Special thanks to fG!
    (A Mountain Lion rootkit for Phrack #69! Copyright (c) fG!, 2012, 2013 - reverser@put.as - http://reverse.put.as All rights reserved.)
  2. Requirement for running
In principle, the passive fuzzing framework could support popular OSX version for Mac Pro,Air.
As our experience, there kernel revision from 10.11 to 10.11.6 cause little or non interference to passive fuzzing.
The framework has been tested on 10.11.6 MacPro with KDK_10.11.6_15G31.kdk.
  1. How to use
IMPORTANT TIPS:
Running the kernel driver would cause sudden kernel crash so as to lose all your data. Take your own risk to use this kernel driver.
3.1 Quick Start
If you want to try the passive fuzz just for fun, please quick try like this:
a. Load driver for quick passive fuzz
sh-3.2# chown -R root:wheel ./quick-pasive_kernel_fuzz.kext
sh-3.2# kextutil ./quick-pasive_kernel_fuzz.kext
b. quick-pasive_kernel_fuzz would appear in kernel module
sh-3.2# kextstat
You would see the driver appears in the kernel module list. However, 
3.2 Full Start with ThunderBolt wire
This start guide is suitable for all Mac OSX machine(e.g. MacPro, MacAir, Mac Mini).
This solution require for another debugger OSX machine and extra ThunderBolt wire.
1. On target(or debugee) OSX machine:
a. Prepare KDK and nvram I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
II. Copy kernel.development to system folder and synchronise kernel cache
sh-3.2# cp -fr /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels/kernel.development* /System/Library/Kernels/
sh-3.2# kextcache -invalid /
sh-3.2# reboot
III. Set up boot-args for debugging sh-3.2# nvram boot-args="debug=0x566 kdp_match_name=firewire fwkdp=0x8000 pmuflags=1 kext-dev-mode=1 -v"
sh-3.2# reboot
b. Load driver for passive fuzz
sh-3.2# chown -R root:wheel ./pasive_kernel_fuzz.kext
sh-3.2# kextutil ./pasive_kernel_fuzz.kext
c. Proberbly your Mac Machine would kernel crash waiting for further deubugging
2. On debugger OSX machine:
IMPORTANT TIP:
Always keep the ThunderBolt connected with the two machine always because plug and play (recognize) is NOT supported for the crashed kernel.
a. Prepare KDK
I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
This step is not necessary but strongly recommented. When lldb in furthur following steps, lldb would match *.dSYM symbol file between debugee machine and debugger machine. Otherwise, symbol info would NOT be shown during your debugging.
b. Debug the crashed target machine
I. Launch fwkdp service
flyic-pro:pasive_kernel_fuzz.kext root1$ fwkdp
II. lldb debug
sh-3.2# cd /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels
sh-3.2# lldb ./kernel.development
(lldb) kdp-remote localhost
The debugger would wait until the target machine crashes, and then you can type any command for debugging including collect core dump file.

3.3 Full Start with Wire LAN
 Because only lagecy OSX machine support Wire LAN (e.g. Old MacMini), this kind of debugging is not popular.
To be done

  1. External Resource
    4.1. Crashes
    Ever collected core dump files, lldb debug logs, poc and so forth (keep updating, about 100GB).
    External link:
    http://pan.baidu.com/s/1dEJO3TJ
  2. Known issue:
    5.1 MacOS 10.12 MachO format parse error
    process_kernel_mach_header(void *kernel_header, struct kernel_info *kinfo)
    could not analyze the machO file format in 10.12 which may be different with 10.11 or before so as to cause kext load fail.
About
This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
Resources
Readme
Activity
Stars
229 stars
Watchers
16 watching
Forks
61 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
BranchesTags
Repository files navigation
Pay me if you like this paper:)
image
image
  1. What is it
    This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
    Basically, it is a typical kernel driver which inline-hooked import API related to IOKit framework and kernel service.
    You could collect kernel dump and reproduce the vulnerability if kernel crash happens.
    You can follow my twitter: @Flyic (of moony li)to more info in detail.
    The source code is to be released after our presentation "Active fuzzing as complementary for passive fuzzing" on PacSec 2016 in Tokyo(10.26/10.27)
    https://pacsec.jp/speakers.html
    The passive fuzzing framework is based on “the_flying_circus” rootkit for OSX by fG! Special thanks to fG!
    (A Mountain Lion rootkit for Phrack #69! Copyright (c) fG!, 2012, 2013 - reverser@put.as - http://reverse.put.as All rights reserved.)
  2. Requirement for running
In principle, the passive fuzzing framework could support popular OSX version for Mac Pro,Air.
As our experience, there kernel revision from 10.11 to 10.11.6 cause little or non interference to passive fuzzing.
The framework has been tested on 10.11.6 MacPro with KDK_10.11.6_15G31.kdk.
  1. How to use
IMPORTANT TIPS:
Running the kernel driver would cause sudden kernel crash so as to lose all your data. Take your own risk to use this kernel driver.
3.1 Quick Start
If you want to try the passive fuzz just for fun, please quick try like this:
a. Load driver for quick passive fuzz
sh-3.2# chown -R root:wheel ./quick-pasive_kernel_fuzz.kext
sh-3.2# kextutil ./quick-pasive_kernel_fuzz.kext
b. quick-pasive_kernel_fuzz would appear in kernel module
sh-3.2# kextstat
You would see the driver appears in the kernel module list. However, 
3.2 Full Start with ThunderBolt wire
This start guide is suitable for all Mac OSX machine(e.g. MacPro, MacAir, Mac Mini).
This solution require for another debugger OSX machine and extra ThunderBolt wire.
1. On target(or debugee) OSX machine:
a. Prepare KDK and nvram I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
II. Copy kernel.development to system folder and synchronise kernel cache
sh-3.2# cp -fr /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels/kernel.development* /System/Library/Kernels/
sh-3.2# kextcache -invalid /
sh-3.2# reboot
III. Set up boot-args for debugging sh-3.2# nvram boot-args="debug=0x566 kdp_match_name=firewire fwkdp=0x8000 pmuflags=1 kext-dev-mode=1 -v"
sh-3.2# reboot
b. Load driver for passive fuzz
sh-3.2# chown -R root:wheel ./pasive_kernel_fuzz.kext
sh-3.2# kextutil ./pasive_kernel_fuzz.kext
c. Proberbly your Mac Machine would kernel crash waiting for further deubugging
2. On debugger OSX machine:
IMPORTANT TIP:
Always keep the ThunderBolt connected with the two machine always because plug and play (recognize) is NOT supported for the crashed kernel.
a. Prepare KDK
I. Download KDK_10.11.6_15G31.kdk (take this KDK for example) and install on your Mac machine
This step is not necessary but strongly recommented. When lldb in furthur following steps, lldb would match *.dSYM symbol file between debugee machine and debugger machine. Otherwise, symbol info would NOT be shown during your debugging.
b. Debug the crashed target machine
I. Launch fwkdp service
flyic-pro:pasive_kernel_fuzz.kext root1$ fwkdp
II. lldb debug
sh-3.2# cd /Library/Developer/KDKs/KDK_10.11.6_15G31.kdk/System/Library/Kernels
sh-3.2# lldb ./kernel.development
(lldb) kdp-remote localhost
The debugger would wait until the target machine crashes, and then you can type any command for debugging including collect core dump file.

3.3 Full Start with Wire LAN
 Because only lagecy OSX machine support Wire LAN (e.g. Old MacMini), this kind of debugging is not popular.
To be done

  1. External Resource
    4.1. Crashes
    Ever collected core dump files, lldb debug logs, poc and so forth (keep updating, about 100GB).
    External link:
    http://pan.baidu.com/s/1dEJO3TJ
  2. Known issue:
    5.1 MacOS 10.12 MachO format parse error
    process_kernel_mach_header(void *kernel_header, struct kernel_info *kinfo)
    could not analyze the machO file format in 10.12 which may be different with 10.11 or before so as to cause kext load fail.
About
This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
Resources
Readme
Activity
Stars
229 stars
Watchers
16 watching
Forks
61 forks
Report repository
Releases
Packages
Used by
Contributors
Languages