Technical Analysis of the Pegasus Exploits on iOS

var body = ''
for (var k = 0; k < 0x600; k++) {
body += 'try {} catch(e) {};';
}
var to_overwrite = new Function('a', body);
for (var i = 0; i < 0x10000; i++) {
to_overwrite();
}
The address <strong>of</strong> this JSFunction object can <strong>the</strong>n be leaked and <strong>the</strong> various members can be
read to acquire <strong>the</strong> address <strong>of</strong> <strong>the</strong> RWX mapping. The JITed try/catch blocks are <strong>the</strong>n
overwritten with shellcode, and <strong>the</strong> to_overwrite() function can simply be called to achieve
arbitrary code execution.
1-888-988-5795 | lookout.com
Page 42
© 2016 Lookout, Inc. All rights reserved. Lookout, <strong>the</strong> Shield Logo, and Everything is OK are registered trademarks <strong>of</strong> Lookout, Inc. All o<strong>the</strong>r brand and product names
are trademarks or registered trademarks <strong>of</strong> <strong>the</strong>ir respective holders. 20161103-Lookout-USv1