Browsable iOS 27 firmware diff shards

External-model router for Codex with guided Kimi OAuth/API, DeepSeek, safe migration, and rollback.

Sandbox escape PoC for iOS 26 and 27.

Edit MobileGestalt on iOS 27.0 beta 1 - 4!

Minimal Objective-C PoC for the cfprefsd AnyUser zero-file create chain

Minimal Objective-C PoC for the InstallCoordination persisted-state and final-symlink chain

Minimal Objective-C PoC for the MobileHouseArrest ContainerManager identity-trust bug

FilzaJailedDS fork with container access for iOS 18, iOS 26, and iOS 27 beta 1–4. See README for per-bug status.

An iOS developer framework for unified hooking methods.

CVE-2026-43499 PoC for S26 .𖥔 ݁ ˖

The binary you run is not the program you wrote.

An SPTM bypass for iOS 16 - 17.3.1

A12/A13 PPL Bypass

Tether downgrade tool for some checkm8/usbliter8 64bit devices. Some restores may utilize seprmvr64 by Mineek.

A native macOS app for managing virtual iPhones - browse, create, and boot iOS research VMs from a single window.

Binary Ninja diffing tool

Controller app for the l41ka firmware that handles automation

experimental pongoOS-loading RP2350 firmware and bootkit for legacy A12/13 devices, aimed at security research

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

An A12/A13 SecureROM exploit

RCE PoC for Redis 6.2.22, 7.4.9, 8.6.4, 8.8.0, 8.8.1

`ipsw` symbolication signatures

Encrypted P2P file transfer in the browser, on the desktop, and in the CLI. No accounts, no uploads, no file storage.

A collection of my Semgrep rules to facilitate vulnerability research.

CVE-2026-43724 - Apple's published enough advisories about the issue, I'm not getting paid for any of my kernel bugs.