Information Disclosure in Apple OS State Transition

This repository is a proof-of-concept (PoC) iOS application demonstrating a kernel information leak present in iOS 11.2 on arm64 devices. The vulnerability arises from the __ARM_KERNEL_PROTECT__ feature, which inadvertently causes the kernel address of the function Lel0_synchronous_vector_64_long to be stored in register x18. This value is then accessible to userland via the thread_get_state() API, allowing an attacker to determine the kASLR slide and bypass kernel address space layout randomization protections. The repository is structured as a standard Xcode project for an iOS app. The main exploit logic resides in x18_leak.c and x18_leak.h, which implement the x18_leak() function. This function retrieves the current thread's state, extracts the value of register x18, and returns it if it matches the expected kernel address range. The AppDelegate.m file calls this function at application launch and prints the leaked kernel address to stdout before exiting. The rest of the files are standard iOS app scaffolding (storyboards, asset catalogs, etc.). No network or remote attack vector is present; the exploit must be run locally on a vulnerable device. The exploit does not provide code execution or privilege escalation, but it enables further exploitation by leaking a critical kernel address.