Technical Analysis of the Pegasus Exploits on iOS

Within OSUnserializeBinary, a while loop iterates through each encoded object within <strong>the</strong>
supplied data blob. The loop begins by determining <strong>the</strong> type <strong>of</strong> object (e.g.,
kOSSerializeDictionary, kOSSerializeArray, kOSSerializeNumber, and so on) and
its size.
len = (key & kOSSerializeDataMask);
...
switch (kOSSerializeTypeMask & key)
{
case kOSSerializeDictionary:
o = newDict = OSDictionary::withCapacity(len);
newCollect = (len != 0);
break;
case kOSSerializeArray:
o = newArray = OSArray::withCapacity(len);
newCollect = (len != 0);
break;
case kOSSerializeSet:
o = newSet = OSSet::withCapacity(len);
newCollect = (len != 0);
...
case kOSSerializeObject:
if (len >= objsIdx) break;
o = objsArray[len];
o->retain();
isRef = true;
break;
...
}
The switch statement dispatches <strong>the</strong> appropriate instructions for handling each type <strong>of</strong> object
found within <strong>the</strong> data blob. These instructions can generate new objects and set flags related to
<strong>the</strong> objects depending on what <strong>the</strong> particular object requires during <strong>the</strong> deserialization process.
The kOSSerializeObject object type is a special case that represents an already
deserialized object and, as such, sets a flag isRef to true indicating that <strong>the</strong> object is a
reference to an existing object already within <strong>the</strong> objsArray array.
If <strong>the</strong> isRef value is not set to true, <strong>the</strong> current object that just underwent deserialization is
added to <strong>the</strong> objsArray by means <strong>of</strong> setAtIndex:
if (!isRef)
{
setAtIndex(objs, objsIdx, o);
if (!ok) break;
objsIdx++;
}
setAtIndex is a macro that, among o<strong>the</strong>r things, adds an object (o) to <strong>the</strong> objsArray. While
more robust array objects exist within <strong>the</strong> iOS environment, such as OSArray (an array
container that will handle reference counting automatically), OSUnserializeBinary takes a
more manual route for array-object management <strong>of</strong> <strong>the</strong> objects it has deserialized. Once
Page 26