rule ios_coruna_w2 {
    meta:
        description = "Detects decoded strings associated with Coruna's PAC bypass"
        author = "@Nadsec"
        severity = "critical"
        source = "https://www.nadsec.online/blog/coruna-technical-analysis"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/ios.coruna"
        malpedia_version = "20260319"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $jitcage1 = "jitCagePtr" ascii
        $jitcage2 = "_jitCagePtr" ascii
        $hashpins = "SecureARM64EHashPins" ascii
        $dyld_magic = "dyld_v1  arm64e" ascii
        $auth_const = "__AUTH_CONST" ascii
        $linkbuf = "LinkBuffer" ascii

    condition:
        filesize < 500KB and 3 of them
}