New write-up: Detecting task_for_pid and pid_for_task via CS_INVALID_ALLOWED

TASK_EXTMOD_INFO only catches task_for_pid - the pid_for_task workaround walks right past it. Turns out XNU sets CS_INVALID_ALLOWED on the target process for both methods, and you can read it with a single csops() call from userspace.

Read: https://andrd3v.github.io/detecting-tfp
Source: https://github.com/andrd3v/tfp_and_pfd_detect