Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
The first parameter to <str<strong>on</strong>g>the</str<strong>on</strong>g> functi<strong>on</strong> (in R0) is used as a memory address that <str<strong>on</strong>g>the</str<strong>on</strong>g> functi<strong>on</strong> reads<br />
and returns in R0 before returning to <str<strong>on</strong>g>the</str<strong>on</strong>g> calling functi<strong>on</strong>. While <str<strong>on</strong>g>the</str<strong>on</strong>g> getattr functi<strong>on</strong>s use<br />
three parameters, given that <str<strong>on</strong>g>the</str<strong>on</strong>g> iPh<strong>on</strong>e’s ARM-based functi<strong>on</strong> calls use registers for <str<strong>on</strong>g>the</str<strong>on</strong>g> first<br />
four functi<strong>on</strong> arguments, <str<strong>on</strong>g>the</str<strong>on</strong>g> lack <str<strong>on</strong>g>of</str<strong>on</strong>g> a fully compliant functi<strong>on</strong> prototype is irrelevant.<br />
The replacement functi<strong>on</strong> for <str<strong>on</strong>g>the</str<strong>on</strong>g> real-time clock’s getattr functi<strong>on</strong> is a bit more complex. The<br />
OSSerializer::serialize functi<strong>on</strong> expects a OSSerializer object as a this<br />
pointer(i.e., an object that includes a virtual functi<strong>on</strong> table (vtable)). The address stored at <str<strong>on</strong>g>of</str<strong>on</strong>g>fset<br />
0x10 within <str<strong>on</strong>g>the</str<strong>on</strong>g> OSSerializer object is used as <str<strong>on</strong>g>the</str<strong>on</strong>g> functi<strong>on</strong> to pass c<strong>on</strong>trol to via <str<strong>on</strong>g>the</str<strong>on</strong>g> BX<br />
instructi<strong>on</strong> and uses <str<strong>on</strong>g>the</str<strong>on</strong>g> DWORDs at <str<strong>on</strong>g>of</str<strong>on</strong>g>fset 8 and 12 as parameters to <str<strong>on</strong>g>the</str<strong>on</strong>g> next functi<strong>on</strong>.<br />
_DWORD OSSerializer::serialize(OSSerialize *):<br />
LDR<br />
R3, [R0,#8]<br />
MOV<br />
R2, R1<br />
LDR<br />
R1, [R0,#0xC]<br />
LDR.W<br />
R12, [R0,#0x10]<br />
MOV<br />
R0, R3<br />
BX<br />
R12<br />
The result <str<strong>on</strong>g>of</str<strong>on</strong>g> replacing <str<strong>on</strong>g>the</str<strong>on</strong>g> getattr handler for <str<strong>on</strong>g>the</str<strong>on</strong>g> real-time clock is that now <str<strong>on</strong>g>the</str<strong>on</strong>g> caller to<br />
clock_get_attributes can execute arbitrary functi<strong>on</strong>s within <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel by supplying a<br />
specially designed data structure, a structure that will be explained in greater detail later in this<br />
report. What is important to remember at this point is that <str<strong>on</strong>g>the</str<strong>on</strong>g> clock modificati<strong>on</strong>s <strong>on</strong>ly occur at<br />
this phase if <str<strong>on</strong>g>the</str<strong>on</strong>g> victim’s kernel is already exposed in some manner. That is, <str<strong>on</strong>g>the</str<strong>on</strong>g>se clock<br />
modificati<strong>on</strong>s would not be possible <strong>on</strong> a n<strong>on</strong>-jailbroken ph<strong>on</strong>e.<br />
If 32Stage2 already has access to <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel port and has performed <str<strong>on</strong>g>the</str<strong>on</strong>g> above-menti<strong>on</strong>ed<br />
modificati<strong>on</strong>s to <str<strong>on</strong>g>the</str<strong>on</strong>g> various clocks, 32Stage2 will skip <str<strong>on</strong>g>the</str<strong>on</strong>g> next several steps that it would<br />
normally perform in order to gain such access, and pick up at <str<strong>on</strong>g>the</str<strong>on</strong>g> privilege escalati<strong>on</strong> phase. If<br />
<str<strong>on</strong>g>the</str<strong>on</strong>g> kernel modificati<strong>on</strong> was not made because <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel’s task port was currently inaccessible,<br />
32Stage2 creates and locks <str<strong>on</strong>g>the</str<strong>on</strong>g> lock file specified during <str<strong>on</strong>g>the</str<strong>on</strong>g> earlier initializati<strong>on</strong> phase. This file<br />
becomes important later as a piece <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> process that ultimately gains 32Stage2 <str<strong>on</strong>g>the</str<strong>on</strong>g> ability to<br />
modify <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel’s memory.<br />
The 64-bit versi<strong>on</strong> <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> Stage 2 binary does not attempt to take advantage <str<strong>on</strong>g>of</str<strong>on</strong>g> pre-existing<br />
backdoors in previously jailbroken devices.<br />
Thread Manipulati<strong>on</strong><br />
Stage 2 will eventually leverage a use-after-free (UAF) vulnerability in order to execute arbitrary<br />
code within <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel space. When using a UAF vulnerability, it is possible that a race c<strong>on</strong>diti<strong>on</strong><br />
may occur where <str<strong>on</strong>g>the</str<strong>on</strong>g> memory that was dereferenced (and which <str<strong>on</strong>g>the</str<strong>on</strong>g> exploit wishes to c<strong>on</strong>trol) is<br />
reallocated for ano<str<strong>on</strong>g>the</str<strong>on</strong>g>r thread before <str<strong>on</strong>g>the</str<strong>on</strong>g> exploit can execute. In order to reduce <str<strong>on</strong>g>the</str<strong>on</strong>g> probability<br />
<str<strong>on</strong>g>of</str<strong>on</strong>g> ano<str<strong>on</strong>g>the</str<strong>on</strong>g>r thread accidentally allocating into a critical deallocated chunk, Stage 2 will generate a<br />
Page 20