2026-08-29 21:14 UTC
After reflecting a bit, I want to share a bit more about how I feel about AI and Relaxin.
As much as I gave Relaxin shit, I want to clarify that this was only about the way they approached it, not about AI assisted development / research in general.
I think the fact they managed to make an LLM implement Rocket is generally impressive, but everything related to how it was integrated into Dopamine is not. I also think that at this point it's hard to deny the fact that AI definitely does find bugs and some of them may even lead to exploits.
I guess I should finally explain what went on in my head when I accused them of larping Dopamine SPTM support... Basically I was already mostly finished with implementing SPTM support on Corellium myself at the point of their announcement, but I was already targeting higher versions, since iOS 18 was already out when I started with these efforts. iOS 18+ in particular requires non trivial new logic to make forkfix work again because starting that version, it is required to modify the TXM address space. Other than that, SPTM support was actually not that difficult to figure out, the main problem was just finding the equivalent offsets and making a patchfinder for those. There of course was the page table allocator, but the LLM managed to sidestep properly fixing that by going purely though the VM layer, as I already explained earlier. So when they initially announced SPTM support, I thought that there was absolutely no chance an LLM figured the forkfix logic out, simply because I didn't yet realize it wasn't needed on iOS 17. This should hopefully explain my initial reaction of asking them for a screen recording of a binary being spawned in NewTerm.
Replies (1)
-
@MasterMike@procursus.social 2026-08-30 03:25
@opa334@infosec.exchange I agree with the foundational point you're making, but I feel like you're being a bit charitable in terms of the details of that tool specifically. Rocket was something that already had LLM reimplementations of it since about a week or two after it was found (entirely independent of the other people), and Dopamine was already designed to be mostly plug and play in a sense (obviously there's SPTM specific changes, but tbf most of that on 17.x is somewhat trivial to do in some way, such as the adhoc stuff)