You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
9.3 Beta<br />
7<br />
✅<br />
9.3.1 ✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
9.3.2<br />
Beta<br />
9.3.2<br />
Beta 2<br />
9.3.2<br />
Beta 3<br />
9.3.2<br />
Beta 4<br />
✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
9.3.2 ✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
9.3.3<br />
Beta<br />
9.3.3<br />
Beta 2<br />
9.3.3<br />
Beta 3<br />
9.3.3<br />
Beta 4<br />
✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
9.3.3 ✅ ✅ ✅ ✅ ✅ ✅ ✅<br />
Defeating KASLR<br />
The majority <str<strong>on</strong>g>of</str<strong>on</strong>g> Stage 2’s functi<strong>on</strong>ality deals with manipulating <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel in order to disable<br />
security features <strong>on</strong> <str<strong>on</strong>g>the</str<strong>on</strong>g> victim’s device. In order to manipulate <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel, Stage 2 must first<br />
locate <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel. Under normal circumstances <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel will be mapped into a randomized<br />
locati<strong>on</strong> due to <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel address space layout randomizati<strong>on</strong> (KASLR) mechanism that <strong>iOS</strong><br />
employs. KASLR is designed to prevent processes from locating <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel in memory by<br />
mapping <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel to a pseudorandom locati<strong>on</strong> in memory each time <str<strong>on</strong>g>the</str<strong>on</strong>g> device is powered <strong>on</strong><br />
by <str<strong>on</strong>g>the</str<strong>on</strong>g> user. In order to locate <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel, Stage 2 must find a way to expose a memory address<br />
within kernel memory space to a process in user space. Stage 2 uses <str<strong>on</strong>g>the</str<strong>on</strong>g> vulnerability CVE-<br />
2016-4655 1 in order expose a memory address in kernel space.<br />
1 http://www.securityfocus.com/bid/92651<br />
Page 16