Skip to content
View hidra0x's full-sized avatar

Block or report hidra0x

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
hidra0x/README.md

hidra0x — iOS kernel research

Typing SVG

profile views followers status target

$ whoami

hidra0x terminal 

name: hidra0x
role: iOS kernel research
target: iPhone XR · A12 / T8020 · iOS 18.7.2
focus: AppleJPEGDriver CVE-2026-20687 → controlled free → double-free/write
strategy: data-only kernel control · no text patching · no fake PAC pointers
status: S0–S3 done · S4 in progress · no public build

I break things on a spare iPhone, read XNU at night, and write down every panic. The goal is not another crash — it is kernel control through data, not through a forged function pointer.

$ ls ~/projects

HIDRA

A12 / iOS 18.7.2 jailbreak research. Kernel entry via AppleJPEGDriver, then a data-only path to kernel r/w.

S0–S3 done · S4 in progress

MOON Probe

Open-source AppleJPEGDriver PoC: userclient, 0x58 ABI, deferred UAF, runnable IPA.

v0.1 · unsigned IPA

hidgate-poc

Kernel UAF research on 18.7.2/A12: IOHID crash-only, AppleJPEG controlled free, panic analysis, test matrix.

research · 18.7.2

Aurora TV

Lightweight Android TV launcher for Telefunken / Android 5–14. No ads, no trackers, no Google Play Services.

v1.4.0 · Kotlin

$ cat /now

  • RE: AppleJPEGDriver 7.6.9, IOUserClient2022, queue / power paths.
  • Hunting: a double-free or write primitive from the stale JpegRequest queue node (S4).
  • Strategy: data-only — proc, ucred, csflags, AMFI/MACF; no kernel text patching, no page tables unless required.
  • Next: KASLR leak after a write primitive; then PAC/PPL/KTRR-safe bootstrap.

$ ./stack

stack

arm64e XNU IOKit IOSurface

$ ./metrics

hidra0x metrics

stars forks last commit

$ ./snake

Contribution snake

$ contact

GitHub HIDRA MOON

«Паника — это не конец. Это доказательство, что мы уже в ядре.»

CRASH → CONTROL → JAILBREAK

Popular repositories Loading

  1. hidgate-poc hidgate-poc Public

    PoC on kernel panic ios 18.7.2 iphone xr

    Objective-C

  2. hidra hidra Public

    Hidra - A12 / iOS 18.7.2 jailbreak research. Kernel entry via AppleJPEGDriver CVE-2026-20687. No public build yet.

    Python 1

  3. aurora-tv aurora-tv Public

    Aurora TV — лёгкая приватная оболочка для Telefunken Android TV без рекламы и трекеров

    Kotlin

  4. hidra0x hidra0x Public

    hidra0x - iOS kernel research, HIDRA, MOON and Aurora TV

  5. missiya-proryv missiya-proryv Public

    Миссия «Прорыв»: поиск аномалий в гравитационно-волновых данных LIGO/Virgo. Цель — GW190814.

    Python