alfiecg24/trigonDeterministic kernel exploit based on CVE-2023-32434.
Trigon is a deterministic kernel exploit and PPL bypass based on CVE-2023-32434. It supports A9 - A16 devices running iOS 13 - 16.5.1. Being deterministic means that this exploit will never panic during or after exploitation and is completely reliable.
Trigon exploits an integer overflow in the VM layer of XNU. The vulnerability allows us to build an arbitrary physical address mapping primitive. This gives us read/write primitives to almost any physical address, but the subsequent exploit strategy varies between different devices and versions.
If you're into technical iOS-related writeups, I would recommend you take a read of the Trigon series! I have tried to make it as understandable as possible so that those who are not iOS researchers can follow it too.
Note: arm64 devices are not currently supported on iOS 16, only arm64e devices (A12+) are.
arm64e support requires several hardcoded values, which should be put into unique_offsets.h. The majority can be found very easily, with some being structure offsets findable in Dopamine source code, and others being findable through running XPF. However, there are three offsets we cannot find prior to exploitation, and I will explain how to find them now.
UniqueValues.addresses.base is the physical base address of the malicious memory mapping for Trigon. An easy way to find this is to use the existing value as an estimated base address and then read a recognisable physical address like 0x41410000. You can then subtract the offset from the physical address in the panic log to determine the correct base address of the mapping.
pv_head_table and pp_attr_tableUniqueValues.offsets.pv_head_table and UniqueValues.offsets.pp_attr_table are relative offsets of the two kernel data structures from the kernel physical base. Because they are allocated so early on during kernel initialisation, they are always at the exact same offset from the kernel base in physical memory. To find these, you can use an existing kernel exploit (like kfd) to find and translate these structures into the correct physical address, and then calculate the offsets that way.
For devices jailbreakable via Dopamine, I have included an easy-to-use command line tool that will find all the required offsets for Trigon on arm64e here. You can use this to setup the exploit to work on your device and version combination.