Yalu102: Offset for decrypting cache

[MatrixSenpai]

If you can provide me with an offset, or a hex line to look for, to decrypt the kernel cache for iOS 10.2, I can provide the necessary offsets for Yalu and report back with any errors. I'll also open a PR for anything I find and/or can fix

[uwu2234]

https://bugs.chromium.org/p/project-zero/issues/detail?id=965#c2

[MatrixSenpai]

I need the decryption offset (like for lzssdec), and I am providing the offsets described in the project. I cannot find the offset 0xFEEDFACF (big or little)

[uwu2234]

@mathmatrix828 Ever tried 0x1b4? Also:

$ hexdump -C kernelcache.release.n51 | head
00000000  30 83 b5 9b 0d 16 04 49  4d 34 50 16 04 6b 72 6e  |0......IM4P..krn|
00000010  6c 16 1c 4b 65 72 6e 65  6c 43 61 63 68 65 42 75  |l..KernelCacheBu|
00000020  69 6c 64 65 72 2d 31 31  36 32 2e 32 30 2e 31 04  |ilder-1162.20.1.|
00000030  83 b5 9a de 63 6f 6d 70  6c 7a 73 73 83 13 7d ae  |....complzss..}.|
00000040  01 64 80 00 00 b5 29 5e  00 00 00 01 00 00 00 00  |.d....)^........|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001b0  00 00 00 00 ff cf fa ed  fe 0c 00 00 01 d5 00 f6  |................|
000001c0  f0 02 f6 f0 14 f6 f0 38  0e 9a f3 f1 20 f6 f1 00  |.......8.... ...|
000001d0  19 ff f1 f5 f0 5f 9f 5f  54 45 58 54 09 02 1c 03  |....._._TEXT....|

That is straight from the page I linked to you. Shows you how to find 0xFFCFFAED which is at 0x1b4.

[Mila432]

@FNCxPro stop feeding the troll

[MatrixSenpai]

As you can see, there's nothing matching 0xFFCFFAED at 0x1B4
This dump is from
hexdump -C kernelcache.release.d101 | more
Either I'm using the wrong file (possible?) or there's something else that I'm missing.
One more comment, @Mila432, I am not trolling. I've contributed to several iOS projects, as you can see from my profile, and am genuinely trying to help. I own iPhone9,3 and am able to do my own testing

[Mila432]

All offsets are already covered

[uwu2234]

@mathmatrix828 the iPhone9,3 is an iPhone 7 which is useless in the current state of this jailbreak as it does not support the iPhone 7/+.