Mach-Trap-127

Mach Trap 127 patcher module patches Mach trap 127 and installs a small custom payload that exposes a clean interface for kernel interaction.

Tested devices:

• iPhone 6s Plus on iOS 14.3
• iPod Touch 7th Generation on iOS 15.7.6

---

Features

• Kernel slide retrieval
• Kernel read/write (kreadbuf / kwritebuf)
• Physical memory read/write (physreadbuf / physwritebuf)
• kcall (call arbitrary kernel functions with up to 10 arguments)
• current_task
• Task → pmap
• vtophys via pmap_find_phys
• Kernel strlen (makes reading strings from kernel memory easier)

---

Loading the module

load.py requires the device to be booted into a PongoOS shell with the KPF loaded.

Before running load.py, boot the device into PongoOS using:

• iOS 14 checkra1n -P
• iOS 15 palera1n -P

Then run python3 load.py

---

Usage

This patcher exposes a single custom syscall via Mach trap 127.
All interaction happens through issue_command, which routes requests to the kernel payload.

issue_command trap stub

_issue_command:
    mov x16, -127
    svc 0x80
    ret

uint64_t issue_command(uint64_t command, uint64_t arg1, uint64_t arg2, uint64_t arg3, uint64_t arg4, uint64_t arg5, uint64_t arg6);

int krw_available(void) {
    return issue_command(0x41, 0, 0, 0, 0, 0, 0) == 0x41424344;
}

uint64_t getKernelSlide(void) {
    return issue_command(0, 0, 0, 0, 0, 0, 0);
}

kern_return_t kreadbuf(uint64_t addr, void* data, size_t size) {
    return (kern_return_t)issue_command(1, addr, (uint64_t)data, size, 0, 0, 0);
}

kern_return_t kwritebuf(uint64_t addr, void* data, size_t size) {
    return (kern_return_t)issue_command(2, addr, (uint64_t)data, size, 0, 0, 0);
}

int physreadbuf(uint64_t pa, void* data, size_t size) {
    memset(data, 0, size); // fault in page
    return (int)issue_command(3, pa, (uint64_t)data, size, 0, 0, 0);
}

int physwritebuf(uint64_t pa, void* data, size_t size) {
    return (int)issue_command(4, pa, (uint64_t)data, size, 0, 0, 0);
}

uint64_t kcall(uint64_t addr, uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint64_t x4, uint64_t x5, uint64_t x6, uint64_t x7, uint64_t x8, uint64_t x9) {
    uint64_t ret = 0;
    issue_command(5, addr, (uint64_t)((uint64_t[]){x0, x1, x2, x3, x4, x5, x6, x7, x8, x9}), (uint64_t)&ret, 0, 0, 0);
    return ret;
}

uint64_t get_current_task(void) {
    uint64_t value = 0;
    issue_command(6, (uint64_t)&value, 0, 0, 0, 0, 0);
    return value;
}

uint64_t get_task_pmap(uint64_t task) {
    uint64_t value = 0;
    issue_command(7, task, (uint64_t)&value, 0, 0, 0, 0);
    return value;
}

uint64_t vtophys(uint64_t pmap, uint64_t va) {
    uint64_t value = 0;
    issue_command(8, pmap, va, (uint64_t)&value, 0, 0, 0);
    return value;
}

size_t kernel_strlen(uint64_t addr) {
    size_t value = 0;
    issue_command(9, addr, (uint64_t)&value, 0, 0, 0, 0);
    return value;
}

Credits

• Built on PongoOS by the checkra1n team
• This project is independent and not affiliated with checkra1n

---

Warning

⚠️ Use at your own risk.

This code:

• Patches the kernel
• Grants full kernel privileges
• Can panic or hang your device
• Is a work in progress

Intended for research and educational purposes only.

---