Darksword Kernel Exploit - Enhanced Edition

Reimplemented in Objective-C with stability improvements and A18 support.

Supported Versions

• iOS 15.0 - 26.0.1
• Offsets hardcoded for 15.x (requires updating for newer versions)
• A18 Devices (iPhone 16 series / iPhone17,*) - full support via pe_v2

Enhanced Edition Changes

New Features

• pe_v2() - full A18 device support implemented
• Stability Mode (STABILITY_MODE) - adaptive delays for better race condition synchronization
• Configurable Parameters - fine-tuning via #define
• Improved Logging - detailed exploitation process information
• Batch Processing - memory search in groups for stability
• Error Handling - graceful failure with resource cleanup
• Iteration Limit - infinite loop protection

Configurable Parameters

#define RACE_RETRY_MIN 100          // Min race attempts
#define RACE_RETRY_MAX 500          // Max race attempts
#define RACE_TIMEOUT_US 1000        // Timeout in microseconds
#define SOCKET_SPRAY_MIN 500        // Min sockets for spray
#define SOCKET_SPRAY_MAX 10000      // Max sockets
#define SEARCH_BATCH_SIZE 16        // Search batch size
#define STABILITY_MODE 1            // Enable stability mode

Build

cd darksword-kexploit-main
make
make sign  # sign with ldid

Requirements

• macOS with Xcode
• iOS SDK
• ldid for signing
• Target device: iOS 15.0+

Usage

1. Build on macOS:

   make clean && make
   make sign

2. Copy to device and run via SSH/terminal

3. Monitor progress:

   • Iterations show search progress
   • highestSuccessIdx - successful race attempt index
   • successReadCount - successful OOB read count

Exploitation Structure

┌─────────────────────────────────────────────────────────┐
│                    main()                               │
│         (pe_v1 / pe_v2 path selection)                  │
└─────────────────────────────────────────────────────────┘
                            │
            ┌───────────────┴───────────────┐
            │                               │
            ▼                               ▼
    ┌───────────────┐               ┌───────────────┐
    │    pe_v1()    │               │    pe_v2()    │
    │  (non-A18)    │               │   (A18 only)  │
    └───────────────┘               └───────────────┘
            │                               │
            └───────────────┬───────────────┘
                            │
                            ▼
              ┌─────────────────────────┐
              │   initialize_physical   │
              │   _read_write()         │
              └─────────────────────────┘
                            │
                            ▼
              ┌─────────────────────────┐
              │   socket spray          │
              │   (ICMPv6 PCB)          │
              └─────────────────────────┘
                            │
                            ▼
              ┌─────────────────────────┐
              │   race condition        │
              │   (mach_vm_map + IO)    │
              └─────────────────────────┘
                            │
                            ▼
              ┌─────────────────────────┐
              │   corrupt socket        │
              │   (icmp6filter)         │
              └─────────────────────────┘
                            │
                            ▼
              ┌─────────────────────────┐
              │   kernel R/W            │
              │   + base leak           │
              └─────────────────────────┘

Technical Details

Vulnerability Mechanism

1. Race condition between mach_vm_map and pwritev/preadv
2. OOB read/write through physically contiguous pages
3. IOSurface for physical memory mapping
4. ICMPv6 socket corruption for kernel R/W primitive

pe_v1 vs pe_v2 Differences

Parameter	pe_v1 (non-A18)	pe_v2 (A18)
Mapping Size	0x2000 * PAGE_SIZE	0x8000 (32KB)
Wired Memory	3GB	512MB
Batch Size	16	8
Max Iterations	50	100

Debugging

To enable debug information, uncomment:

#define PRINT_VAR(var) {printf(#var ": %#llx\n", var); fflush(stdout); sleep(2);}

Known Issues

• Offsets require updating for iOS > 15.x
• A18 implementation may need timing calibration
• More testing needed on different devices

License

Original Project: Darksword Kernel Exploit

Enhanced Edition: improved version with enhanced stability