From ef7bfb7d2b6756aa8daca8af794feb1486c13128 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Balatoni?= <balcsida@gmail.com>
Date: Sat, 30 Mar 2024 21:41:37 +0100
Subject: [PATCH] Add Sonoma 14.4.1 offsets

---
 nac/offsets.go | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/nac/offsets.go b/nac/offsets.go
index 1f70219..bd564cc 100644
--- a/nac/offsets.go
+++ b/nac/offsets.go
@@ -199,6 +199,22 @@ var offsets_14_3 = imdOffsetTuple{
 		NACSignAddress:             0x47cff0,
 	},
 }
+var offsets_14_4_1 = imdOffsetTuple{
+	x86: imdOffsets{
+		ReferenceSymbol:            "IDSProtoKeyTransparencyTrustedServiceReadFrom",
+		ReferenceAddress:           0x0d6715,
+		NACInitAddress:             0x557cd0,
+		NACKeyEstablishmentAddress: 0x537d10,
+		NACSignAddress:             0x54b000,
+	},
+	arm64: imdOffsets{
+		ReferenceSymbol:            "IDSProtoKeyTransparencyTrustedServiceReadFrom",
+		ReferenceAddress:           0x0c0b84,
+		NACInitAddress:             0x4c2468,
+		NACKeyEstablishmentAddress: 0x4afccc,
+		NACSignAddress:             0x489ed8,
+	},
+}
 
 // offsets is a map from sha256 hash of identityservicesd to the function pointer offsets in that binary.
 var offsets = map[[32]byte]imdOffsetTuple{
@@ -250,6 +266,8 @@ var offsets = map[[32]byte]imdOffsetTuple{
 	hexToByte32("034fc179e1cce559931a8e46866f54154cb1c5413902319473537527a2702b64"): offsets_14_2,
 	// macOS 14.3
 	hexToByte32("d3c6986fefcbd2efea2a8a7c88104bf22d60d1f4f2bbf3615a1e3ce098aba765"): offsets_14_3,
+	// macOS 14.4.1
+	hexToByte32("b82c5c6c9010a42cb64397e3760dd31144cbd471126111de9bb27fa3d2d2639a"): offsets_14_4_1,
 }
 
 type imdOffsetTuple struct {