Hacker News Reader

Pretty sure they did that as root, so they could get past that and explore how the program worked when being run as a non-root user. The final exploit doesn't depend on this program, though; it uses the same RPC interfaces this program does, from a separate program, so the patching was just part of their exploration, not part of the exploit.

Just make a copy of the binary that's editable by the user. Or copy its code into a new program. There's nothing special about the specific root-owned systemsetup binary. (It's not setuid.)

I think this is not part of the exploit, it was simply a step to ensure that their intuition about the assembly code was correct.

Hint: the first sentence you quoted ends with a question mark.