Technical Analysis of the Pegasus Exploits on iOS

In order to find <strong>the</strong> kernel, Stage 2 begins by opening a port to <strong>the</strong> IOKit subsystem. Failing this,
Stage 2 calls <strong>the</strong> assert callback and exits. A call to IOServiceMatching for <strong>the</strong> service
named AppleKeyStore is made by Stage 2, and <strong>the</strong> results <strong>of</strong> <strong>the</strong> call are given to
IOServiceGetMatchingService in order to obtain a io_service_t object containing <strong>the</strong>
desired registered IOKit IOService (in this case, AppleKeyStore). With <strong>the</strong> IOService handle,
Stage 2 calls io_service_open_extended and passes a specially crafted properties field to
<strong>the</strong> service. The properties field is a (serialized) binary representation <strong>of</strong> XML data that
io_service_open_extended ultimately passes to <strong>the</strong> OSUnserializeBinary function
located in <strong>the</strong> kernel 2 . Within <strong>the</strong> OSUnserializeBinary function is a switch statement that
handles <strong>the</strong> various types <strong>of</strong> data structures found within a binary XML data structure. The data
type for kOSSerializeNumber blindly accepts <strong>the</strong> length <strong>of</strong> <strong>the</strong> data without performing any
type <strong>of</strong> reasonable bound checking, which ultimately gives <strong>the</strong> caller <strong>the</strong> ability to request more
memory than should be allowed. This condition occurs due to <strong>the</strong> following code fragments:
len = (key & kOSSerializeDataMask);
...
case kOSSerializeNumber:
bufferPos += size<strong>of</strong>(long long);
if (bufferPos > bufferSize) break;
value = next[1];
value