Hacker News new | ask | show | jobs
by dguido 3649 days ago
If Stefan says it will you believe me?

https://twitter.com/i0n1c/status/745922795977187329

You just used a kernel privesc that you probably already had to read it. NOT A BIG DEAL.

1 comments

That gets you a kernel dump, a decrypted kernelcache gives you very handy MachO headers. And as Will said, the well known kernel dumping methods do not dump Watchtower. I'm not sure if anyone has privately been able to dump Watchtower with a kernel privsec or if it has only been possible with the kernelcache keys.