this doesn't work. use duy's PoC.
no support will be provided
original README follows below
patched in iOS 26.2 beta 2 (23C5033h)
this tool is unstable and experimental. developer-oriented proof-of-concept!!
use at your own risk. this is probably the better PoC anyways.
what is this? arbitrary file overwrite exploit for iOS versions lower than 26.2 beta 2 (23C5033h)
how does it work? path escape involving some database files. this is mainly supposed to be just some exploit code, you can read a decent writeup on the vulnerability here.
how do i use this? clone this repo, and run bookrestore.py. enter the destination path and your input data and do what it says.
- Skadz for developing this exploit tool
- Duy Tran for the initial PoC code
- hanakim3945 for publishing the first public writeup which this exploit is based off
- exploit initially used in some iCloud bypass tools, actively sold and utilized in-the-wild