get tfp0, root, and sandbox escape, support for iOS 9.0 - 9.3.5

Files.xcodeproj/project.pbxproj

@@ -27,6 +27,13 @@
 		B08605441D0C5D0E00BA87E5 /* FBFilesTableViewController.m in Sources */ = {isa = PBXBuildFile; fileRef = B08605401D0C5D0E00BA87E5 /* FBFilesTableViewController.m */; };
 		B08605451D0C5D0E00BA87E5 /* FBCustomPreviewController.m in Sources */ = {isa = PBXBuildFile; fileRef = B08605411D0C5D0E00BA87E5 /* FBCustomPreviewController.m */; };
 		B08605481D0C6A4800BA87E5 /* FBColumnNavigationController.m in Sources */ = {isa = PBXBuildFile; fileRef = B08605471D0C6A4800BA87E5 /* FBColumnNavigationController.m */; };
+		D007B7F920E78FD7008DFCC5 /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D007B7F820E78FD7008DFCC5 /* IOKit.framework */; };
+		D007B80320E79126008DFCC5 /* exploit64.m in Sources */ = {isa = PBXBuildFile; fileRef = D007B7FC20E79125008DFCC5 /* exploit64.m */; };
+		D007B80420E79126008DFCC5 /* load_payload.m in Sources */ = {isa = PBXBuildFile; fileRef = D007B7FE20E79125008DFCC5 /* load_payload.m */; };
+		D007B80620E79136008DFCC5 /* find.m in Sources */ = {isa = PBXBuildFile; fileRef = D007B80520E79136008DFCC5 /* find.m */; };
+		D010131620ECEBB40004DD3E /* offsets.m in Sources */ = {isa = PBXBuildFile; fileRef = D010131420ECEBB40004DD3E /* offsets.m */; };
+		D010131720ECEBB40004DD3E /* v0rtex.m in Sources */ = {isa = PBXBuildFile; fileRef = D010131520ECEBB40004DD3E /* v0rtex.m */; };
+		D0935AAF20E87903005936DD /* device.c in Sources */ = {isa = PBXBuildFile; fileRef = D0935AAE20E87902005936DD /* device.c */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -90,6 +97,22 @@
 		B08605431D0C5D0E00BA87E5 /* FBCustomPreviewController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FBCustomPreviewController.h; sourceTree = "<group>"; };
 		B08605461D0C6A4800BA87E5 /* FBColumnNavigationController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FBColumnNavigationController.h; sourceTree = "<group>"; };
 		B08605471D0C6A4800BA87E5 /* FBColumnNavigationController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = FBColumnNavigationController.m; sourceTree = "<group>"; };
+		D007B7F820E78FD7008DFCC5 /* IOKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = IOKit.framework; sourceTree = "<group>"; };
+		D007B7FC20E79125008DFCC5 /* exploit64.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = exploit64.m; sourceTree = "<group>"; };
+		D007B7FD20E79125008DFCC5 /* find.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = find.h; sourceTree = "<group>"; };
+		D007B7FE20E79125008DFCC5 /* load_payload.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = load_payload.m; sourceTree = "<group>"; };
+		D007B7FF20E79125008DFCC5 /* exploit64.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = exploit64.h; sourceTree = "<group>"; };
+		D007B80020E79125008DFCC5 /* load_payload.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = load_payload.h; sourceTree = "<group>"; };
+		D007B80120E79126008DFCC5 /* mach-o.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "mach-o.h"; sourceTree = "<group>"; };
+		D007B80220E79126008DFCC5 /* arch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = arch.h; sourceTree = "<group>"; };
+		D007B80520E79136008DFCC5 /* find.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = find.m; sourceTree = "<group>"; };
+		D010131420ECEBB40004DD3E /* offsets.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = offsets.m; sourceTree = "<group>"; };
+		D010131520ECEBB40004DD3E /* v0rtex.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = v0rtex.m; sourceTree = "<group>"; };
+		D010131920ECEDC20004DD3E /* v0rtex.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = v0rtex.h; sourceTree = "<group>"; };
+		D010131A20ECEDD60004DD3E /* offsets.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = offsets.h; sourceTree = "<group>"; };
+		D010131D20ECF25C0004DD3E /* common.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = common.h; sourceTree = "<group>"; };
+		D0935AAD20E87902005936DD /* device.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = device.h; sourceTree = "<group>"; };
+		D0935AAE20E87902005936DD /* device.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = device.c; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -111,6 +134,7 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				D007B7F920E78FD7008DFCC5 /* IOKit.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -163,6 +187,7 @@
 				B002AD531D0CC6A100A8616E /* FilesDocumentProvider */,
 				B002AD621D0CC6A200A8616E /* FilesDocumentProviderFileProvider */,
 				B08605241D0C587D00BA87E5 /* Products */,
+				D007B7F720E78FD6008DFCC5 /* Frameworks */,
 			);
 			sourceTree = "<group>";
 		};
@@ -179,6 +204,8 @@
 		B08605251D0C587D00BA87E5 /* Files */ = {
 			isa = PBXGroup;
 			children = (
+				D010131220ECEBA50004DD3E /* v0rtex */,
+				D007B7FB20E79102008DFCC5 /* exploit */,
 				B08605291D0C587D00BA87E5 /* AppDelegate.h */,
 				B086052A1D0C587D00BA87E5 /* AppDelegate.m */,
 				B086053D1D0C58CA00BA87E5 /* FBColumnViewController.h */,
@@ -207,6 +234,43 @@
 			name = "Supporting Files";
 			sourceTree = "<group>";
 		};
+		D007B7F720E78FD6008DFCC5 /* Frameworks */ = {
+			isa = PBXGroup;
+			children = (
+				D007B7F820E78FD7008DFCC5 /* IOKit.framework */,
+			);
+			name = Frameworks;
+			sourceTree = "<group>";
+		};
+		D007B7FB20E79102008DFCC5 /* exploit */ = {
+			isa = PBXGroup;
+			children = (
+				D0935AAE20E87902005936DD /* device.c */,
+				D0935AAD20E87902005936DD /* device.h */,
+				D007B80220E79126008DFCC5 /* arch.h */,
+				D007B7FF20E79125008DFCC5 /* exploit64.h */,
+				D007B7FC20E79125008DFCC5 /* exploit64.m */,
+				D007B80520E79136008DFCC5 /* find.m */,
+				D007B7FD20E79125008DFCC5 /* find.h */,
+				D007B80020E79125008DFCC5 /* load_payload.h */,
+				D007B7FE20E79125008DFCC5 /* load_payload.m */,
+				D007B80120E79126008DFCC5 /* mach-o.h */,
+			);
+			path = exploit;
+			sourceTree = "<group>";
+		};
+		D010131220ECEBA50004DD3E /* v0rtex */ = {
+			isa = PBXGroup;
+			children = (
+				D010131D20ECF25C0004DD3E /* common.h */,
+				D010131A20ECEDD60004DD3E /* offsets.h */,
+				D010131420ECEBB40004DD3E /* offsets.m */,
+				D010131920ECEDC20004DD3E /* v0rtex.h */,
+				D010131520ECEBB40004DD3E /* v0rtex.m */,
+			);
+			path = v0rtex;
+			sourceTree = "<group>";
+		};
 /* End PBXGroup section */
 
 /* Begin PBXNativeTarget section */
@@ -275,15 +339,30 @@
 				TargetAttributes = {
 					B002AD511D0CC6A100A8616E = {
 						CreatedOnToolsVersion = 7.3.1;
-						DevelopmentTeam = 2ZDN69KUUV;
+						DevelopmentTeam = Z7UYVKVHE5;
+						SystemCapabilities = {
+							com.apple.ApplicationGroups.iOS = {
+								enabled = 1;
+							};
+						};
 					};
 					B002AD601D0CC6A200A8616E = {
 						CreatedOnToolsVersion = 7.3.1;
-						DevelopmentTeam = 2ZDN69KUUV;
+						DevelopmentTeam = Z7UYVKVHE5;
+						SystemCapabilities = {
+							com.apple.ApplicationGroups.iOS = {
+								enabled = 1;
+							};
+						};
 					};
 					B08605221D0C587D00BA87E5 = {
 						CreatedOnToolsVersion = 7.3.1;
-						DevelopmentTeam = 2ZDN69KUUV;
+						DevelopmentTeam = Z7UYVKVHE5;
+						SystemCapabilities = {
+							com.apple.ApplicationGroups.iOS = {
+								enabled = 0;
+							};
+						};
 					};
 				};
 			};
@@ -361,12 +440,18 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				D007B80620E79136008DFCC5 /* find.m in Sources */,
 				B086053F1D0C58CA00BA87E5 /* FBColumnViewController.m in Sources */,
+				D007B80420E79126008DFCC5 /* load_payload.m in Sources */,
 				B08605441D0C5D0E00BA87E5 /* FBFilesTableViewController.m in Sources */,
 				B08605451D0C5D0E00BA87E5 /* FBCustomPreviewController.m in Sources */,
 				B002AD7D1D0CE7F600A8616E /* FBQLPreviewController.m in Sources */,
 				B08605481D0C6A4800BA87E5 /* FBColumnNavigationController.m in Sources */,
+				D007B80320E79126008DFCC5 /* exploit64.m in Sources */,
 				B086052B1D0C587D00BA87E5 /* AppDelegate.m in Sources */,
+				D010131720ECEBB40004DD3E /* v0rtex.m in Sources */,
+				D0935AAF20E87903005936DD /* device.c in Sources */,
+				D010131620ECEBB40004DD3E /* offsets.m in Sources */,
 				B08605281D0C587D00BA87E5 /* main.m in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -411,10 +496,11 @@
 			buildSettings = {
 				CODE_SIGN_ENTITLEMENTS = FilesDocumentProvider/FilesDocumentProvider.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Developer";
+				DEVELOPMENT_TEAM = Z7UYVKVHE5;
 				INFOPLIST_FILE = FilesDocumentProvider/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/Frameworks @executable_path/../../Frameworks";
 				OTHER_CFLAGS = "-DAPP_EXTENSION";
-				PRODUCT_BUNDLE_IDENTIFIER = com.highcaffeinecontent.Files.FilesDocumentProvider;
+				PRODUCT_BUNDLE_IDENTIFIER = cn.njcit.files.hongs.999999999991;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
 			};
@@ -425,10 +511,11 @@
 			buildSettings = {
 				CODE_SIGN_ENTITLEMENTS = FilesDocumentProvider/FilesDocumentProvider.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Developer";
+				DEVELOPMENT_TEAM = Z7UYVKVHE5;
 				INFOPLIST_FILE = FilesDocumentProvider/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/Frameworks @executable_path/../../Frameworks";
 				OTHER_CFLAGS = "-DAPP_EXTENSION";
-				PRODUCT_BUNDLE_IDENTIFIER = com.highcaffeinecontent.Files.FilesDocumentProvider;
+				PRODUCT_BUNDLE_IDENTIFIER = cn.njcit.files.hongs.999999999991;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
 			};
@@ -440,9 +527,10 @@
 				CODE_SIGN_ENTITLEMENTS = FilesDocumentProviderFileProvider/FilesDocumentProviderFileProvider.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Developer";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
+				DEVELOPMENT_TEAM = Z7UYVKVHE5;
 				INFOPLIST_FILE = FilesDocumentProviderFileProvider/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/Frameworks @executable_path/../../Frameworks";
-				PRODUCT_BUNDLE_IDENTIFIER = com.highcaffeinecontent.Files.FilesDocumentProviderFileProvider;
+				PRODUCT_BUNDLE_IDENTIFIER = cn.njcit.files.hongs.888888888888882;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE = "";
 				SKIP_INSTALL = YES;
@@ -455,9 +543,10 @@
 				CODE_SIGN_ENTITLEMENTS = FilesDocumentProviderFileProvider/FilesDocumentProviderFileProvider.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Developer";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
+				DEVELOPMENT_TEAM = Z7UYVKVHE5;
 				INFOPLIST_FILE = FilesDocumentProviderFileProvider/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/Frameworks @executable_path/../../Frameworks";
-				PRODUCT_BUNDLE_IDENTIFIER = com.highcaffeinecontent.Files.FilesDocumentProviderFileProvider;
+				PRODUCT_BUNDLE_IDENTIFIER = cn.njcit.files.hongs.888888888888882;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE = "";
 				SKIP_INSTALL = YES;
@@ -495,7 +584,7 @@
 					"DEBUG=1",
 					"$(inherited)",
 				);
-				GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+				GCC_TREAT_WARNINGS_AS_ERRORS = NO;
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
 				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
 				GCC_WARN_PEDANTIC = YES;
@@ -536,7 +625,7 @@
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu99;
 				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+				GCC_TREAT_WARNINGS_AS_ERRORS = NO;
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
 				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
 				GCC_WARN_PEDANTIC = YES;
@@ -557,9 +646,15 @@
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_IDENTITY = "iPhone Developer";
+				DEVELOPMENT_TEAM = Z7UYVKVHE5;
+				FRAMEWORK_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(PROJECT_DIR)",
+				);
+				HEADER_SEARCH_PATHS = "$(PROJECT_DIR)";
 				INFOPLIST_FILE = Files/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/Frameworks";
-				PRODUCT_BUNDLE_IDENTIFIER = com.highcaffeinecontent.Files;
+				PRODUCT_BUNDLE_IDENTIFIER = cn.njcit.files.hongs;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 			};
 			name = Debug;
@@ -569,9 +664,15 @@
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_IDENTITY = "iPhone Developer";
+				DEVELOPMENT_TEAM = Z7UYVKVHE5;
+				FRAMEWORK_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(PROJECT_DIR)",
+				);
+				HEADER_SEARCH_PATHS = "$(PROJECT_DIR)";
 				INFOPLIST_FILE = Files/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = "$(inherited) @executable_path/Frameworks";
-				PRODUCT_BUNDLE_IDENTIFIER = com.highcaffeinecontent.Files;
+				PRODUCT_BUNDLE_IDENTIFIER = cn.njcit.files.hongs;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 			};
 			name = Release;

Files.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>IDEDidComputeMac32BitWarning</key>
+	<true/>
+</dict>
+</plist>

Files.xcodeproj/xcuserdata/hongs.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Bucket
+   type = "1"
+   version = "2.0">
+</Bucket>

Files.xcodeproj/xcuserdata/hongs.xcuserdatad/xcschemes/Files.xcscheme

@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0820"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "B08605221D0C587D00BA87E5"
+               BuildableName = "Files.app"
+               BlueprintName = "Files"
+               ReferencedContainer = "container:Files.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "B08605221D0C587D00BA87E5"
+            BuildableName = "Files.app"
+            BlueprintName = "Files"
+            ReferencedContainer = "container:Files.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "B08605221D0C587D00BA87E5"
+            BuildableName = "Files.app"
+            BlueprintName = "Files"
+            ReferencedContainer = "container:Files.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "B08605221D0C587D00BA87E5"
+            BuildableName = "Files.app"
+            BlueprintName = "Files"
+            ReferencedContainer = "container:Files.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>