[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-94633":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":16,"stars7d":17,"stars30d":18,"stars90d":16,"forks30d":16,"starsTrendScore":16,"compositeScore":19,"rankGlobal":10,"rankLanguage":10,"license":10,"archived":20,"fork":20,"defaultBranch":21,"hasWiki":20,"hasPages":20,"topics":22,"createdAt":10,"pushedAt":10,"updatedAt":23,"readmeContent":24,"aiSummary":25,"trendingCount":16,"starSnapshotCount":16,"syncStatus":14,"lastSyncTime":26,"discoverSource":27},94633,"bad_query","forcequitOS\u002Fbad_query","forcequitOS","Sandbox escape PoC for iOS 26 and 27.","",null,"C",181,41,2,1,0,3,55,48.87,false,"main",[],"2026-08-24 04:01:22","# bad_query\n\n### A sandbox escape for iOS 26.0 - 26.6.1 \u002F 27.0b4.\n\nThis is a proof-of-concept for developers and not anything meaningfully usable at the moment.\n\nbad_query can access the following paths:\n\n```\n\u002Fvar\u002Fcontainers\u002FData\u002FSystem (iOS 27)\n\u002Fvar\u002Fcontainers\u002FShared\u002FSystemGroup\u002F* (iOS 27)\n\u002Fvar\u002Fmobile\u002FContainers\u002FData\u002FApplication\u002F*\n\u002Fvar\u002Fmobile\u002FContainers\u002FData\u002FInternalDaemon\u002F*\n\u002Fvar\u002Fmobile\u002FContainers\u002FData\u002FPluginKitPlugin\u002F*\n\u002Fvar\u002Fmobile\u002FContainers\u002FShared\u002FAppGroup\u002F* (Requires App Group sacrifice on iOS 26)\n\u002Fvar\u002Fmobile\u002FContainers\u002FShared\u002FAppGroup (iOS 27)\n```\n\n\u003Csub>This might also work on iOS 18 but I haven't tested literally at all so ymmv\u003C\u002Fsub>\n","bad_query 是一个针对 iOS 26.0–26.6.1 及 iOS 27 beta 4 的沙箱逃逸概念验证（PoC）工具。它利用系统查询机制缺陷，绕过 Apple 的 sandbox 限制，实现对受保护路径（如 AppGroup、SystemGroup、Application 数据目录等）的越权读取访问。项目以 C 语言编写，不依赖外部框架，核心逻辑聚焦于内核\u002F用户态交互中的权限绕过路径。该 PoC 仅面向安全研究人员与系统开发者用于漏洞分析与防御研究，不具备实际攻击部署能力，也不适用于生产环境或越狱场景。","2026-08-13 02:30:05","CREATED_QUERY"]