pwning your kernelz| Blog
Exploiting a logic bug in IOKit to directly access physical memory from user space.| bazad.github.io
