Nick Botticelli

vma2pwn. Scripts + patches to pwn vma2 (Virtualization.framework) macOS virtual machines

usbpatchd. Patch iOS USB restriction for SSH over USB on the lock screen on checkm8-compatible devices

super-tart. tart, but with custom AVPBooter ROM, serial I/O, DFU mode, GDB debugging (port 8000), and panic halting. See help menus for `tart create` and `tart run` for more info. Requires SIP/AMFI to be disabled for required entitlement.

XNU-syscall-hiding-PoC. PoC showing a method to hide syscalls on XNU (arm64 macOS and iOS) from static analysis

idevicerestore. idevicerestore, but with support for virtual devices

ghidra-iboot. Ghidra loader for decrypted iBoot, LLB, iBEC, iBSS, SecureROM, and AVPBooter images

JNIAnnotationTest. Playground for testing FastNative and CriticalNative annotations for Android

YSpotify. A Spotify modding project experimenting with trampoline hooks and Windows process injection.

keybag-crawler. Fetch Apple firmware keybags for a device automatically (and decrypt them)

MetalShaderTools. Tools and samples for understanding Apple's Metal shading language and its LLVM Bitcode shader files

SpotifyUpgradeFinder. Find download links for specific versions of Spotify (Windows)

S3Ripper. Download and parse an S3 bucket

chatroom-c. A multi-threaded CLI-based chat application in a mesh network design using plain C with pthreads + sockets.

opensn0w. Modern opensn0w?

xdeobf. A deobfuscation plugin for IDA

liboffsetfinder64. A 64bit offsetfinder. It finds offsets, patches, parses Mach-O and even supports IMG4. Playground for vma2 iBoot.

vma2pwn-tools. Binary tools (unfortunately) needed for vma2pwn. Fork this and add your own binaries if so desired.

bytecode-viewer. A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

super-micro-tss. micro-tss fork (https://gitlab.com/turbocooler/micro-tss)

AndroidHiddenApiBypass. Java

android_twrp_zte_draco. TWRP recovery for ZTE Maven 3 (Z835/draco) based on Android 7.1.2

android_kernel_zte_draco. Full kernel source for ZTE Maven 3 (Z835) + modifications

Virtual-iBoot-Fun. Another Virtualization.framework demo project, with focus to iBoot (WIP)

c-ray-tracer. A very fast ray tracer written in C originally done for a school project.

sshrd. suckless ramdisk tool for iOS8+ (now with build management!)

libirecovery. Library and utility to talk to iBoot/iBSS via USB on Mac OS X, Windows, and Linux; now supporting virtual devices

lzrw3a-decompress. A simple front-end decompressor for the LZRW3-a format.

VirtualBuddy. VirtualBuddy... but with Development mode + GDB stub. Requires SIP/AMFI to be turned off.

bytecode-viewer-gradle-old. Old fork of bytecode-viewer converted to Gradle (the better build automation tool)