Vulnerability-Research

The bootrom era was unpatchable but fully readable. The userland era inverted both properties: every bug had a fix, and most of the tool’s shipped life has no published source at all.

A source-first method for Apple kernel research: diff consecutive XNU tags, mine the regression tests that ship with the fixes, map sibling call sites, and rank candidates by how well they survive Memory Integrity Enforcement. Four evidence gates, a safe workflow, and the stop conditions that keep this work honest.