Speedyfriend67

SideInstaller. An an app that installs Sidestore on iOS 27, fully on-device

Il2CppDumper. Unity il2cpp reverse engineer

cobalt. best way to save what you love

DarkSword. DarkSword exploit chain dump.

elfs. A collection of interesting ELF files for inspiration and testing

pois0nSword. A demonstration of read write using cve-2025-43529 on iOS 26.1

ish. Linux shell for iOS

usbliter8. An A12/A13 SecureROM exploit

pebble. The open-source alternative to Minecraft: Java Edition, a complete block-survival game in about 45,000 lines of Swift + Metal. Zero dependencies, fully deterministic, singleplayer for now. Not affiliated with Mojang or Microsoft.

lottie. Generate production-ready Lottie animations with Claude Code or Codex

corecrypto. Apple corecrypto

andrej-karpathy-skills. A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.

publications. Publications from Calif

FilzaJailedDS. Filza Jailed Darksword, support iOS 17.0-26.0.1. This repo open source the tweak inject into the Filza iPA (4.0.0 and back, 4.0.2 seems crash something)

lara. iOS Toolbox using the DarkSword kexploit. iOS 17.0 - iOS 18.7.1 & iOS 26.0.x, excluding M5 and A19.

pretext. Fast, accurate & comprehensive text measurement & layout

DarkSword-RCE. DarkSword webkit exploit captured ITW

misakaReborn. Swift

darksword-kexploit. iOS <=26.0.1 DarkSword Kernel Exploit reimplemented in Objective-C

HopperPyMCP. A Python-Based MCP Server for Hopper Disassembler

WebKit-NavigationAPI-SOP-Bypass. WebKit NavigateEvent.canIntercept SOP bypass via cross-port interception — iOS 26.3.1 BSI (CVE-2026-20643)

AssppWeb. TypeScript

freecut. FreeCut is a professional-grade video editor that runs entirely in your browser. Professional video editing, zero installation. Create stunning videos with multi-track editing, keyframe animations, real-time preview, and high-quality exports.

CVE_2025_24257----NOT-MINE. IOGPUFamily bitmap_mask underflow → kernel heap OOB write. First public PoC. Original discovery by Wang Yu of Cyberserval.

qemu-ios. A QEMU emulator for legacy Apple devices

Rikugan. A reverse-engineering agent for IDA Pro and Binary Ninja

SwiftUI-Agent-Skill. SwiftUI agent skill for Claude Code, Codex, and other AI tools.

ConstLoader. A plugin deobfuscate for IDA

Appstore-Review-Guidelines. A curated list of guideline which has to be taken care before submitting your application to Appstore.

sdl-mod. evil mod that makes gd sdl

kgsl. C

coruna. The leaked exploit toolkit for various iOS versions

coruna. deobfuscated JS and blobs from https://b27[.]icu, first attempt at using claude

ANE. Training neural networks on Apple Neural Engine via reverse-engineered private APIs

suspender. disable sandboxes of macOS processes

LBox. A native iOS repository manager and downloader offering seamless integration with LiveContainer. Browse public sources, download IPAs, and install/launch apps directly on your device.

apple-docs-mcp. MCP server for Apple Developer Documentation - Search iOS/macOS/SwiftUI/UIKit docs, WWDC videos, Swift/Objective-C APIs & code examples in Claude, Cursor & AI assistants

Mach-Trap-127. C

LLVM-On-iOS. LLVM, but easy to build and use in iOS projects

LCTaskForPIDTweak. A LiveContainer systemwide tweak allowing multitask apps to access task port and process info of each other

playit-agent. The playit program

radius2. radius2 is a fast binary emulation and symbolic execution framework using radare2

ml-sharp. Sharp Monocular View Synthesis in Less Than a Second

cve-2023-42824. cow bypass

decompiler. Ghidra decompiler plugin for LLDB

siftrank. Use LLMs to rank anything

FreeRDP. FreeRDP is a free remote desktop protocol library and clients

Golden-Best. A Geometry Dash that changes the percentage to gold when you are achieving a new best!

CVE-2025-43529. Root Cause Analysis for CVE-2025-43529, a UAF vulnerability due to incorrect DFG StoreBarrierInsertionPhase in JavaScriptCore.

iOS-Reverse-Engineering.

Malimite. iOS and macOS Decompiler

openclaw. Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

github-readme-activity-graph. A dynamically generated activity graph to show your GitHub activities of last 31 days.

compressO. Convert any video/image into a tiny size. 100% free & open-source. Available for Mac, Windows & Linux.

instagram-private-bypass. This repository discloses a server-side authorization bypass in Instagram, which allowed unauthenticated access to private timelines; it seems likely that Meta patched it silently without formal acknowledgment, based on evidence.

darkwrite. Notes as it should have been. Built for people who just want to write, without nonsense.

CVE-2023-41991.

Inferno. Apple Silicon device emulator.

x-algorithm. Algorithm powering the For You feed on X

NotPrivateAPIs. Totally Not Documenting Private Apis

fastrender. Experimental new browser engine

the-algorithm. Source code for the X Recommendation Algorithm

bitchat. bluetooth mesh chat, IRC vibes

Hell2025. C++

src. Read-only git conversion of OpenBSD's official CVS src repository. Pull requests not accepted - send diffs to the tech@ mailing list.

CVE-2025-43529. exploit for cve-2025-43529

VibeOS. A completely vibecoded operating system targeting Aarch64

SEP-Exhaustion-Kernel-Panic. SEP firmware panic via AppleKeyStore - iOS/macOS 26.x kernel vulnerability

CVE-2026-20637-AppleSEPKeyStore-UAF. CVE-2026-20637: AppleSEPKeyStore Use-After-Free — iOS/macOS kernel vulnerability (patched in 26.4)

WebKit-UAF-ANGLE-OOB-Analysis. Analysis of CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 (ANGLE OOB) exploit chain - iOS Safari

CVE-2025-43426. CVE-2025-43426 (video + report)

opencode. The open source coding agent.

container. A tool for creating and running Linux containers using lightweight virtual machines on a Mac. It is written in Swift, and optimized for Apple silicon.

swift-corelibs-foundation. The Foundation Project, providing core utilities, internationalization, and OS independence

aiohttp. Asynchronous HTTP client/server framework for asyncio and Python

chronomaly. Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable x86_64 Linux kernels v5.10.x.

libpng. LIBPNG: Portable Network Graphics support, official libpng repository

launchd. C

ivd38. Config files for my GitHub profile.

libppd. C

LiquidGlassKit. Backport of Apple’s Liquid Glass system for iOS 13–18 with native API parity. Includes a reimplementation for iOS 26+ that unlocks advanced customization beyond the native system's limits.

MacWSBootingGuide. Booting macOS's WindowServer on your jailbroken iDevice for real

MiscellaneousWWDC25. Objective-C++

grafana. The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.

libsodium. A modern, portable, easy to use crypto library.

poc-CVE-2025-38352. This is a proof of concept for CVE-2025-38352, a vulnerability in the Linux kernel's POSIX CPU timers implementation. The September 2025 Android Bulletin mentions that this vulnerability has been used in limited, targeted exploitation in the wild.

livewire. A full-stack framework for Laravel that takes the pain out of building dynamic UIs.

swift-nio. Event-driven network application framework for high performance protocol servers & clients, non-blocking.

dropbear. Dropbear SSH

libxslt. HTML

zsh. C

IOHIDFamily. C++

Libc. C

objc4. Objective-C++

PackageKit. A D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API.

hardened_malloc. Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.

Heimdal. C

v8. The official mirror of the V8 Git repository

removefile. C

CVE-2023-32428-a-macOS-LPE-via-MallocStackLogging. C

darwin-libpthread. Legacy mirror of Darwin PThread Library. Replaced by https://github.com/apple-oss-distributions/libpthread

CF. C

CFNetwork. C

ICU. C++

libmalloc. C

XPC. XPC and Friends (libxpc, launchd and soon xpc.framework)

mDNSResponder. C

WebKit. Home of the WebKit project, the browser engine used by Safari, Mail, App Store and many other applications on macOS, iOS and Linux.

InjectionIII. Re-write of Injection for Xcode in (mostly) Swift

injectionforxcode. Runtime Code Injection for Objective-C & Swift

TimeBomb2. Spinlock panic on demand!

ApolloCrashFix. Logos

NULLGuard. kext kills all 32bit binaries lacking __PAGEZERO (required for exploitation of kernel NULL derefs)

tpwn. xnu local privilege escalation via cve-2015-???? & cve-2015-???? for 10.10.5, 0day at the time | poc or gtfo

macOS-iOS-system-security. Here is some resources about macOS/iOS system security.

dnssd. This library implements Multicast DNS (mDNS) and DNS-Based Service Discovery (DNS-SD) for Zero Configuration Networking in Go.

Impactor. Feature rich iOS/tvOS sideloading application written in Rust.

Protokolle. The iOS/iPadOS equivalent to macOS's Console.app, for stock devices.

MacDirtyCow. Example of CVE-2022-46689 aka MacDirtyCow.

mach_portal. https://bugs.chromium.org/p/project-zero/issues/detail?id=965#c2

ddos_project. A Python-based DDoS testing script designed for authorized testing purposes. This tool allows users to evaluate the resilience of their systems by simulating distributed denial-of-service attacks. It includes customizable parameters to control the intensity and duration of the test, ensuring flexibility and effectiveness in various scenarios.

exploits. C

LiveOffsetPatcher. Live offset patcher for ios, use kittymemory for core

nss-packages. Qualcomm networking packages feed for OpenWrt

cve-2015-5477. PoC exploit for CVE-2015-5477 BIND9 TKEY assertion failure

CVE-2017-2370. on Mac 10.12.2

Iridium. An iOS app decrypter, full static using fouldecrypt.

Dopamine2-roothide. Dopamine is a semi-untethered jailbreak for iOS 15 and 16

CVE-2024-23208-test. Objective-C

React2Shell-CVE-2025-55182-original-poc. Original Proof-of-Concepts for React2Shell CVE-2025-55182

tiny11builder. Scripts to build a trimmed-down Windows 11 image.

fuzzing. Tutorials, examples, discussions, research proposals, and other resources related to fuzzing

SMHookMemory. iOS Easy Hooking Library

Dobby. a lightweight, multi-platform, multi-architecture hook framework.

CVE-2025-55182-research. CVE-2025-55182 POC

mldecrypt. iOS binary memory dump tool for iOS15+ (rootful, rootless)

CVE-2025-24271. Vulnerabilidad en AirPlay expone información sensible en dispositivos Apple

blueshrimp. Proof-of-concept for CVE-2025-48593

ios-nehelper-enum-apps-0day. iOS 15 0-day exploit (still works in 15.0.2)

libmacho. A small C library capable of parsing and altering Mach-O binaries

dynarmic. An ARM dynamic recompiler.

CVE-2024-24576-PoC. Example of CVE-2024-24576 use case.

APFSRW. Tool for working with APFS partitions.

keystone. Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings

swift-capstone. Swift bindings for Capstone Engine

swift-dyld-private. Swift

ClassDumpRuntime. Library to parse Objective-C classes at runtime

swift-hook. ⚓️ A Swift Library for hooking swift methods and functions.

swift-fishhook. 🪝Re-implementation of fishhook with Swift using MachOKit

PacmanAttack. Defeating Pointer Authentication on the Apple M1 with Hardware Attacks

async_awake-fun. async_awake with a bit of fun! - async_awake by Ian Beer (https://bugs.chromium.org/p/project-zero/issues/detail?id=1417#c3)

jit-customer-scripts. Collection of helpful scripts

ReflectiveLoader. A Reflective Loader for macOS

macho-loader. Position-independent Reflective Loader for macOS

litehook. Lightweight *OS hooking library with no dependencies except for libsystem

CFNetwork. C

X_Acc_Flags. iOS tweak to show X's accounts flags

CVE-2025-65018-Heap-buffer-overflow-in-libpng-ps4-ps5-. Python

swift-mobile-gestalt. 📲 `MobileGestalt` wrapper for Swift

SnatchMG. Swift

swift-confidential. Swift literals obfuscator to defend against static reverse engineering.

Steve. Cursor for Minecraft

shellcode-1. x86, AMD64, ARM, ARM64 shellcodes for Windows, Mac OSX, Linux, BSD and Solaris

iOS-System-Symbols. Share iOS system framework's symbol files. Useful for symbolicating iOS crash report.

bl_sbx. itunesstored & bookassetd sbx escape

gestalt_hax. Hactivation via MobileGestalt POC

bl_sbx. itunesstored & bookassetd sbx escape

apple-cve. apple cve list

geode-inject-ios. just so i can compile... will nuke after

security-pcc. Private Cloud Compute (PCC)

TaskPortHaxxApp. Attempt to manipulate platform process task port with CoreTrust bug alone

sys-call. Linux syscall implementations, calling conventions, and shellcode examples

ROPgadget. This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.

my-bugs. I will provide details and pocs for some bugs I found.

inject_and_interpose. like mach_inject

substitute. A free runtime modification library.

sbsutils. SpringBoardServices utilities - replaces some broken Erica utilities

ppp. C

CVE-2024-40815. POC for CVE-2024-40815 (Construction is in its final stage ==IOS 17.0)

objsee-ios. toy project for tracing objc_msgSend

simulator-trainer. Simulator tweak injection and helpers

CVE-2025-62168. PoC of CVE-2025-62168

WiFi-List. 📶 List networks on device and share them using QRs

CVE-2025-6514. mcp-remote exposed to OS command injection

MiniMax-M2. MiniMax-M2, a model built for Max coding & agentic workflows.

vagrant_imio_geonode. Build a vagrant virtual machine for testing and developping the IMIO customization project

obfusheader.h. Obfusheader.h is a portable header file for C++14 compile-time obfuscation.

GPUCompiler.jl. Reusable compiler infrastructure for Julia GPU backends.

FoolsTrailCutting. Geode mod that aims to replicate the trail cutting effect from versions 2.1 and older.

YoutubeShortsEdit. Geode mod to feel the energy of Phonk W Sigma TikTok Edits! 🗿🍷

Flare-On-12. Write-Ups for Flare-On 12 Challenges

compile-time-regular-expressions. Compile Time Regular Expression in C++

BatteryInfo. Geode Mod API for accessing device battery information

Depixelization_poc. Depix is a PoC for a technique to recover plaintext from pixelized screenshots.

ermsb-meme. C

kimi-cli. Kimi Code CLI is your next CLI agent.

ipsw. iOS/macOS Research Swiss Army Knife

angle. A conformant OpenGL ES implementation for Windows, Mac, Linux, iOS and Android.

xnu. C

uAssets. Filter lists for uBlock Origin & uBlock Origin Lite