Memory Corruption in IOHIDFamily (Apple OS X)

This repository contains a local privilege escalation exploit and physical memory inspection tool for macOS, targeting CVE-2016-1825 and CVE-2016-7617. The exploit leverages logic bugs in IOKit services (IOHIDevice and AppleBroadcomBluetoothHostController) to set arbitrary IORegistry properties, specifically IOUserClientClass, allowing the attacker to open a privileged IOPCIDiagnosticsClient. This client enables arbitrary physical memory read/write, which is then used to manipulate kernel memory, install a syscall hook, and escalate privileges to root. The codebase is well-structured, with clear separation between error handling (fail.c), kernel image parsing (kernel_image.c), kernel slide calculation (kernel_slide.c), physical memory access (physmem.c), privilege escalation (privilege_escalation.c), and syscall hooking (syscall_hook.c/.s). The main entry point (main.c) provides three commands: 'read' (read physical memory), 'write' (write physical memory), and 'root' (spawn a root shell or execute a specified program as root). Key fingerprintable endpoints include the kernel image path (/System/Library/Kernels/kernel), IOKit service names (IOHIDevice, AppleBroadcomBluetoothHostController), the IOUserClientClass registry property, and the kern.bootsessionuuid sysctl node. The exploit is operational and reliable on unpatched systems up to macOS 10.12.1, providing both memory access and privilege escalation capabilities.