3 ms·
> Bypassing PT_DENY_ATTACH (Hard Mode) There's also the harderer mode, which I did on macOS a while back - patch the kernel to make PT_DENY_ATTACH do nothing.
by Retr0id 2y ago
> Bypassing PT_DENY_ATTACH (Hard Mode)
There's also the harderer mode, which I did on macOS a while back - patch the kernel to make PT_DENY_ATTACH do nothing. Macs actually make it fairly easy to run a patched kernel, but I guess on iOS it'd be a lot more trouble (KTRR etc.)
Although XNU is technically open-source, I found it easier to apply my patch with a hexeditor rather than recompiling.
- sjtgraham 2y agoYou can also use the kernel task port to flip the bit on the proc struct. You can also do the same to allow unsigned code pages and RWX to enable JIT-ing.