iOS Kernel Heap Armageddon - Hakim
iOS Kernel Heap Armageddon - Hakim
iOS Kernel Heap Armageddon - Hakim
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Overwriting an OSObject in Memory<br />
• overwriting or corrupting the vtable ptr<br />
• everything the kernel will do with the object will trigger code exec<br />
0x00<br />
0x04<br />
vtable ptr + 8<br />
retainCount<br />
• overwriting the retain count<br />
0x08<br />
• might allow freeing the object early<br />
• and code execution through dangling references<br />
• use after free<br />
Stefan Esser • <strong>iOS</strong> <strong>Kernel</strong> <strong>Heap</strong> <strong>Armageddon</strong> REVISITED • July 2012 •<br />
69