massgeneralbrigham.org
so did my work.。关于这个话题，新收录的资料提供了深入分析
Последние новости，更多细节参见新收录的资料
Looking at the ARM-specific branch, we first assemble the trampoline. Next, we change the protection flags of the memory region of the function we want to inject the trampoline in (foo() in our case). Note the VM_PROT_COPY, which is required to make this work on newer macOS versions. It likely does some nasty stuff I didn't look into too closely.，详情可参考新收录的资料