iOS Kernel Heap Armageddon - Hakim
iOS Kernel Heap Armageddon - Hakim
iOS Kernel Heap Armageddon - Hakim
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
How does the parser work? (VI)<br />
• next expected object is the dictionary value<br />
• in this case it is a string defined by the tag<br />
• because it is a string it is handled in the same way as a key<br />
• length + 1 bytes are allocated via kern_os_malloc() plus a header<br />
• string is copied into it<br />
<br />
<br />
IsThere<br />
one technique to rule them all?<br />
Answer<br />
<br />
Audience<br />
meet OSUnserializeXML()<br />
<br />
<br />
Stefan Esser • <strong>iOS</strong> <strong>Kernel</strong> <strong>Heap</strong> <strong>Armageddon</strong> REVISITED • July 2012 •<br />
83
Change language