Unfortunately it looks like CVE-2025-43520 was patched in iOS 26.1b4, the exact build I happened to leave my test device on...
I might play around with it on my Mac or in one of the new iOS pccvre VMs though.
Reverse engineer, student
Currently contracting for Beeper
| Blog | https://jjtech.dev |
| GitHub | https://github.com/JJTech0130 |
| [email protected] |
DarkSword using JavaScriptCore.framework (presumably interpreter-only) to run an injected payload in arbitrary processes using just krkw is an interesting approach...
Reminds me of Frida's GumJS;
I wonder if one could get Frida proper working, without a full jailbreak.
Unfortunately it looks like CVE-2025-43520 was patched in iOS 26.1b4, the exact build I happened to leave my test device on...
I might play around with it on my Mac or in one of the new iOS pccvre VMs though.
Turns out it's not actually that hard, I implemented a simple synthetic HID device for macOS:
https://gist.github.com/JJTech0130/fae6b6ee6ae4232172a9188fb199d5d9
Does anyone have any experience using AppleUSBUserHCIPort/com.apple.usb.hostcontrollerinterface?
Apparently that seems to be what Virtualization.framework and VirtualHere use under-the-hood to create fake USB devices on macOS.
EDIT: Apparently it's documented API under IOUSBHostControllerInterface.h in IOUSBHost.framework

Binary obfuscation in 2026:
Just put ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FA... into your program 😎
Thanks to @mxey for the idea