@zhuowei@notnow.dev everything "lands" in the physmap. It's a linear mapping of all DRAM managed by XNU/SPTM. So you should be able to pick any target, the difficulty is just that a whole bunch of page types (page tables, SPTM/TXM/Exclave memory, zalloc_ro, any page with executable code) are gonna have their permissions flipped to readonly, so you'd need a way to reliably avoid those or you'd be likely to panic. In addition, getting into a position where you can spawn a binary on iOS... that's a tall order. And it's possible that, under a release iOS kernel, dyld ignores a bunch of env variables that you need in order to pull this off... but I don't know for sure if this is the case, grep for amfiFlags in dyld src.