[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-94484":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":15,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":17,"rankGlobal":10,"rankLanguage":10,"license":10,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":10,"pushedAt":10,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":15,"starSnapshotCount":15,"syncStatus":25,"lastSyncTime":26,"discoverSource":27},94484,"Titan","alfiecg24\u002FTitan","alfiecg24","An SPTM bypass for iOS 16 - 17.3.1","",null,"C",143,20,1,0,25,43.47,false,"main",true,[],"2026-08-24 04:01:22","# Titan\n\nTitan is a PPL & SPTM bypass for iOS 16.1 - 17.4 beta 3, supporting A14 - A17. It is based on the Rocket exploit that was deployed in the [Coruna](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fcoruna-powerful-ios-exploit-kit) in-the-wild exploit kit. Titan first gains code execution on the AGX coprocessor in the form of a ROP chain and then uses this to stage the microPPL bypass. After the microPPL has been bypassed, it maps an AP kernel page table and creates a self-referencing page table entry, which provides a full defeat of PPL & SPTM.\n\n## Prerequisites\n\nTitan requires two secondary primitives:\n* `kalloc` - the ability to make **permanent** kernel memory allocations (they must never be deallocated)\n* `kmap` - the ability to map arbitrary physical pages into userspace (within the bounds of PPL\u002FSPTM)\n\nAside from these, Titan uses an IPC port stealing primitive implemented [here](src\u002Fipc_port.c#L118). This was taken from Coruna's kernel exploitation implant and later patched in iOS 26 by adding data PAC to `ipc_port->ip_nsrequest`.\n\n## ROP chain\n\nInitial code execution is obtained by overwriting the thread state pointer inside the AGX's `power` thread's structure. When this thread is subsequently awoken (which happens almost instantaneously), it will load and execute a completely controlled thread state.\n\nThe main ROP invocation gadget used is one that will load an entire register state from the stack, including both `X30` and `ELR_EL1`, and then perform an `ERET`. It's used, as denoted by the `ERET`, during exception handling.\n\n```\nADD X1, SP, #0x110\nLDP X2, X3, [X1,#-0x10]\nLDR X4, [X1],#8\nMSR CPACR_EL1, X4\nLDP X5, X6, [X1]\nMSR FPSR, X5\nMSR FPCR, X6\nLDP Q0, Q1, [X1,#0x10]\n...\nLDP Q30, Q31, [X1,#0x1F0]\nADD X1, X1, #0x210\nLDP X5, X6, [X1]\nLDR W7, [X1,#0x10]\nMSR ELR_EL1, X2\nMSR SPSR_EL1, X3\nMSR FAR_EL1, X5\nMSR PAR_EL1, X6\nMSR ESR_EL1, X7\nLDP X6, X7, [SP,#0x30]\nLDP X8, X9, [SP,#0x40]\nLDP X10, X11, [SP,#0x50]\nLDP X12, X13, [SP,#0x60]\nLDP X14, X15, [SP,#0x70]\nLDP X16, X17, [SP,#0x80]\nLDR X18, [SP,#0x90]\nLDP X29, X30, [SP,#0xE8]\nLDP X0, X1, [SP]\nLDP X2, X3, [SP,#0x10]\nLDP X4, X5, [SP,#0x20]\nADD SP, SP, #0x350\nERET\n```\n\nThis provides us with an easy way to execute a series of controlled register states as ROP frames. We place our desired jump address into `ELR_EL1`, so that the AGX will begin executing there on `ERET`. Then, we set `X30` to the address of the main ROP gadget so that it will return from our arbitrary call, increment the stack pointer and load the next ROP frame.\n\nThis primitive was patched in iOS 18.1 beta 4 via the introduction of instruction PAC to the AGX. Now, it will verify the thread state's signature using `PACGA` to ensure that important registers (`PC`, `LR`, `CPSR`, `X16` and `X17`) have not been modified, just like XNU.\n\n## microPPL bypass\n\nThe microPPL bypass is trivial to understand, and an extremely obvious oversight by Apple. When the AGX enters hibernation (i.e. on core reset), it will cache its register state in memory so that it can restore it on wake. Included in this register state are the values in `TTBR0_EL1` and `TTBR1_EL1`, which will be loaded from memory and restored into their respective registers when the AGX resumes execution after hibernation.\n\nWe use our initial AGX code execution to modify the hibernation context so that it will load a different `TTBR1_EL1` value that we supply (by setting up fake page tables on the AP). Then, we also modify the cached stack pointer so that it will begin executing a second ROP chain after hibernation (as it hits the ROP gadget we use above). The new page tables will map an XNU page table into the AGX's address space, and then the second ROP chain will write a controlled value to the new mapping. This will be a page table entry that maps the XNU page table to itself.\n\nThis bypass was patched in iOS 17.4 beta 4. Now, they don't even restore `TTBR0_EL1` at all, and they restore `TTBR1_EL1` to a hardcoded value.\n\n## PPL & SPTM bypass\n\nAt this point, on the AP, we can now write to a kernel page table with our existing kernel read\u002Fwrite primitives, allowing us to map and access any page of physical memory, including those protected by PPL & SPTM. From here it is relatively straightforward to implement into an existing jailbreak flow and setup stable PPLRW\u002FSPTM-RW primitives in your process too.\n\n## Credits\n\n* [littlelailo](https:\u002F\u002Fx.com\u002Flittlelailo) - for [his writeup](https:\u002F\u002Flittlelailo.github.io\u002Fwriteups\u002Fcoruna.html) on the Coruna chain which provided a fantastic base knowledge for my reimplementation efforts, as well as answering countless questions I had as I battled with the AGX during development!\n* [staturnz](https:\u002F\u002Fx.com\u002Fstaturnzdev) & [Clarity](https:\u002F\u002Fx.com\u002Fimnotclarity) - assisting me in reverse engineering and exploitation throughout the development of Titan.\n* Google Threat Intelligence Group & iVerify - for their disclosure, analysis and publications about the chain.\n* [wh1te4ever](https:\u002F\u002Fx.com\u002Fwh1te4ever) & [khanhduytran0](https:\u002F\u002Fx.com\u002Fkhanhduytran0) - for their assistance in obtaining an exploit sample for me to analyse.\n* The exploit kit developers - for some great bugs, and even better exploits. I won't provide attribution here, but it's not hard to find if you go looking online. 😉\n\n## Usage\n\nThis bypass will not work out-of-the-box. It is designed to be used with Dopamine's libjailbreak, and you can add its headers and `.tbd` file into `external\u002F` to compile. Using Dopamine's kernel read\u002Fwrite primitives provided in a jailbroken environment will cause the bypass to fail, because they only work on DRAM addresses that are within the range of `gPhysBase` and `gPhysBase + gPhysSize`, which is not the case for several AGX-related pages.\n\nTitan is available to use in Dopamine 3.0 and newer on supported devices.","Titan 是一个针对 iOS 16.1 至 17.4 beta 3 系统的 PPL（Protected Process List）与 SPTM（System Policy Trust Monitor）安全机制绕过工具，适用于 A14–A17 芯片设备。其核心基于 Rocket 漏洞利用链，通过劫持 AGX 协处理器的 power 线程状态实现 ROP 执行，进而完成 microPPL 绕过，并构建自引用页表条目以彻底解除 PPL\u002FSPTM 保护。项目依赖 kalloc\u002Fkmap 内核原语及 IPC port stealing 技术，需配合已有内核漏洞使用。适用于越狱研究、安全分析及底层系统防护机制验证等场景。",2,"2026-08-10 02:30:05","CREATED_QUERY"]