gilbo

Security Researcher

[gilbo @_gilboz]

ida_kernelcachd_ng released

https://t.co/98KIT6O9gl

Getting -24,000 vmethod symbols on latest kernelcache!

As mentioned it is still a WIP, if you encounter issues then submit them and ill fix on my free time!

Contributions are welcome!!

[gilbo @_gilboz]

@blacktop__ Apple decided to bump their versioning again? 😂

[gilbo @_gilboz]

@Tymscar @khanhduytran0 That’s SBPL, used in *OS devices to define sandbox profiles of processes. It’s a DSL made by Apple, the syntax is LISP-y. On iOS these get compiled into a proprietary binary format and embedded inside the kernel cache. These blobs can get decompiled into this output.

[gilbo @_gilboz]

iOS 26.6 SpringBoard sandbox profile 😂?

[Paradigm Shift @prdgmshift]

A new research blog deserves a proper first post.

A SecureROM bug seemed appropriate.

Allow us to introduce you to #usbliter8.

https://t.co/m7si1XGhvU

[gilbo @_gilboz]

It looks like apple added a wrong path into the sandbox profile in the beta release. Dopamine is a jailbreak for old iOS versions @opa334dev, procursus and rocket are also related to jailbreaking

[gilbo @_gilboz]

@allthingsida Which of your projects do you refer to?

[gilbo @_gilboz]

📍 @0x41con Napoli

[gilbo @_gilboz]

@blacktop__ This entitlement is not new, Claude managed to figure that out well. it’s weird they apply it to a process that is already sandboxed without access to the AGXUserClient..?

[gilbo @_gilboz]

@hexacon_fr done! It’s always a pleasure to see everyone in person

[gilbo @_gilboz]

Offensive con 2025 ended! Was a great experience 🔥

[gilbo @_gilboz]

It was a great experience and amazing venue!

I enjoyed giving my talk about kernelcache reversing, stay tuned for updates about the release of ida_kernelcache_ng! 🚀

Thanks @xerub and @justandrijana for organizing

[0x41con @0x41con]

0x41con 2025 is over!

[gilbo @_gilboz]

@blacktop__ @0xjprx Great stuff as always. For me being able to generate a compilation database for clangd is a big deal

Thanks

[gilbo @_gilboz]

@cybercdh using vim as general purpose IDE is a bad idea. I used neovim (the new version) plus vimplug for plugin management and it was cool. but I found myself working on fixing my dotfiles most of the time rather than focusing on my work.Aside from 'ricing' you distro, you dont gain much

[gilbo @_gilboz]

@cybercdh I used really most text editors, sublime is the best for general-purpose. second place is vscode. If you feel these are too 'heavy' reconsider upgrading your pc its 2021.
when working remotely via ssh i'll use vim

[gilbo @_gilboz]

@pxmme1337 @aessae @MalwareTechBlog A bit of sarcasm never hurt nobody

[gilbo @_gilboz]

@vysecurity Lol, defender is indeed stubborn, disabling it through gpedit.msc solved it for me