3 ms·

If Stefan says it will you believe me? https://twitter.com/i0n1c/status/745922795977187329 https://twitter.com/i0n1c/status/745922795977187329 You just used a

by dguido 10y ago

If Stefan says it will you believe me? https://twitter.com/i0n1c/status/745922795977187329 https://twitter.com/i0n1c/status/745922795977187329 You just used a kernel privesc that you probably already had to read it. NOT A BIG DEAL.

jevinskie 10y ago
That gets you a kernel dump, a decrypted kernelcache gives you very handy MachO headers. And as Will said, the well known kernel dumping methods do not dump Watchtower. I'm not sure if anyone has privately been able to dump Watchtower with a kernel privsec or if it has only been possible with the kernelcache keys.