Technical Analysis of the Pegasus Exploits on iOS

To determine whe<strong>the</strong>r <strong>the</strong> <strong>the</strong> device has already been jailbroken, Stage 2 attempts to acquire a
valid mach port (a handle) into <strong>the</strong> iOS kernel using a common jailbreak backdoor. This check is
performed simply by calling task_for_pid with <strong>the</strong> PID value set to 0. Patching
task_for_pid in this way is a common backdoor mechanism used by iOS jailbreaks that
provides direct kernel memory access to a user mode process. Calling task_for_pid with a
PID <strong>of</strong> 0 is not normally allowed by iOS. If task_for_pid returns a valid task port, <strong>the</strong>n <strong>the</strong>
Stage 2 process has elevated access to <strong>the</strong> kernel and can forgo <strong>the</strong> privilege escalation steps
described previously.
Stage 2 also checks for <strong>the</strong> presence <strong>of</strong> <strong>the</strong> binary /bin/sh. On a non-jailbroken phone, this
binary should never exist. When Stage 2 detects <strong>the</strong> presence <strong>of</strong> this binary, it assumes that <strong>the</strong>
existing jailbreak is ei<strong>the</strong>r incompatible with <strong>Pegasus</strong> or that all required kernel patches are
already in place and no fur<strong>the</strong>r action is needed. When /bin/sh is identified on a device, prior
to exploitation, Stage 2 simply exits cleanly.
Page 37