iOS Kernel Heap Armageddon - Hakim
iOS Kernel Heap Armageddon - Hakim
iOS Kernel Heap Armageddon - Hakim
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
OSObject Retain Count<br />
• reference counter for objects<br />
• 32 bit field - but only lower 16 bit are the reference counter<br />
• upper 16 bit used as collection reference counter<br />
• reference counting stops at 65534 -> memory leak<br />
0x00<br />
0x04<br />
vtable ptr + 8<br />
retainCount<br />
0x08<br />
Stefan Esser • <strong>iOS</strong> <strong>Kernel</strong> <strong>Heap</strong> <strong>Armageddon</strong> REVISITED • July 2012 •<br />
68