Technical Analysis of the Pegasus Exploits on iOS

9.3 Beta
7
✅
9.3.1 ✅ ✅ ✅ ✅ ✅ ✅ ✅
9.3.2
Beta
9.3.2
Beta 2
9.3.2
Beta 3
9.3.2
Beta 4
✅ ✅ ✅ ✅ ✅ ✅ ✅
✅ ✅ ✅ ✅ ✅ ✅ ✅
✅ ✅ ✅ ✅ ✅ ✅ ✅
✅ ✅ ✅ ✅ ✅ ✅ ✅
9.3.2 ✅ ✅ ✅ ✅ ✅ ✅ ✅
9.3.3
Beta
9.3.3
Beta 2
9.3.3
Beta 3
9.3.3
Beta 4
✅ ✅ ✅ ✅ ✅ ✅ ✅
✅ ✅ ✅ ✅ ✅ ✅ ✅
✅ ✅ ✅ ✅ ✅ ✅ ✅
✅ ✅ ✅ ✅ ✅ ✅ ✅
9.3.3 ✅ ✅ ✅ ✅ ✅ ✅ ✅
Defeating KASLR
The majority <strong>of</strong> Stage 2’s functionality deals with manipulating <strong>the</strong> kernel in order to disable
security features on <strong>the</strong> victim’s device. In order to manipulate <strong>the</strong> kernel, Stage 2 must first
locate <strong>the</strong> kernel. Under normal circumstances <strong>the</strong> kernel will be mapped into a randomized
location due to <strong>the</strong> kernel address space layout randomization (KASLR) mechanism that iOS
employs. KASLR is designed to prevent processes from locating <strong>the</strong> kernel in memory by
mapping <strong>the</strong> kernel to a pseudorandom location in memory each time <strong>the</strong> device is powered on
by <strong>the</strong> user. In order to locate <strong>the</strong> kernel, Stage 2 must find a way to expose a memory address
within kernel memory space to a process in user space. Stage 2 uses <strong>the</strong> vulnerability CVE-
2016-4655 1 in order expose a memory address in kernel space.
1 http://www.securityfocus.com/bid/92651
Page 16