why L1br4 ? because it's the my first time to find vul and use the vul to get root(not just know the vul and write exp), so i decided to use my constellation to name it

you can see the analyse from my blog

on MacOS 10.13 or 10.13.1

1. queryCompletioninAVEBridge
2. getDisplayPipeCapabilityinAppleIntelFramebufferAzul
3. ReadRegister32inAppleIntelFramebufferAzul

make

At last, use the command:

./pwn

And you will get root~ Having fun with this