Targeting the iOS Kernel - Reverse Engineering Mac OS X
Targeting the iOS Kernel - Reverse Engineering Mac OS X Targeting the iOS Kernel - Reverse Engineering Mac OS X
Attacking through Devices • character and block devices added by the functions • cdevsw_add() • cdevsw_add_with_bdev() • bdevsw_add() • script scanning for xrefs can find all defined devices • interesting for vulnerability research are the ioctl handlers Stefan Esser • Targeting the iOS Kernel • April 2011 • 46
Attacking through Devices (II) com.apple.driver.AppleOnboardSerial ----------------------------------- _cdevsw_add() call at 8042842a -> ioctl handler at 804282e1 com.apple.driver.AppleReliableSerialLayer ----------------------------------------- _cdevsw_add() call at 8043373e -> ioctl handler at 80432525 com.apple.iokit.IO80211Family ----------------------------- _cdevsw_add() call at 8057252c -> ioctl handler at 80571ab9 com.apple.driver.AppleSerialMultiplexer --------------------------------------- _cdevsw_add() call at 80456e26 -> ioctl handler at 80455d2d _cdevsw_add() call at 8045cbd4 -> ioctl handler at 8018243d com.company.driver.modulename ----------------------------- _cdevsw_add() call at 80490a08 -> ioctl handler at 8049184d _cdevsw_add() call at 8049118c -> ioctl handler at 8049184d _bdevsw_add() call at 804909ee -> ioctl handler at 80492201 _bdevsw_add() call at 80491172 -> ioctl handler at 80492201 com.apple.iokit.IOCryptoAcceleratorFamily ----------------------------------------- _cdevsw_add() call at 805410d0 -> ioctl handler at 80540529 _cdevsw_add() call at 80542014 -> ioctl handler at 805419a9 Stefan Esser • Targeting the iOS Kernel • April 2011 • 47
- Page 1 and 2: Targeting the iOS Kernel Stefan Ess
- Page 3 and 4: Motivation • iPhone security heav
- Page 5 and 6: Part I Introduction Stefan Esser
- Page 7 and 8: Finding Vulnerabilities in the iOS
- Page 9 and 10: Interesting Kernel Bugs - OS X OS X
- Page 11 and 12: Part II The iOS Kernelcache Stefan
- Page 13 and 14: Getting the iOS Kernelcache (II)
- Page 15 and 16: Kernelcache is just a Mach-O Binary
- Page 17 and 18: iOS Kernelcache vs. IDA • IDA can
- Page 19 and 20: Helping IDA - Kernel Extensions •
- Page 21 and 22: Helping IDA - findAndMarkKEXT.py St
- Page 23 and 24: IOKit Driver Classes (I) • IOKit
- Page 25 and 26: IOKit Object Hierarchy - Full View
- Page 27 and 28: Part IV iOS Kernel Where Are your S
- Page 29 and 30: Kernel Symbols - Manual Symbolizati
- Page 31 and 32: Zynamic‘s BinDiff • Zynamic‘s
- Page 33 and 34: Zynamic‘s BinDiff - Demo (II) Ste
- Page 35 and 36: Using IOKit Class Hierarchy for Sym
- Page 37 and 38: Exporting Symbols • IDA cannot ex
- Page 39 and 40: iOS Kernel Attack Surface • simpl
- Page 41 and 42: Finding and Marking the Syscall Tab
- Page 43 and 44: Attacking through Network Protocols
- Page 45: Attacking through Network Protocols
- Page 49 and 50: Dumping List of Sysctl Handlers mai
- Page 51 and 52: Attacking from User-Land: IOKit Dri
- Page 53 and 54: iOS Kernel Debugging • no support
- Page 55 and 56: iPhone Dock Connector (Pin-Out) PIN
- Page 57 and 58: Ingredients (I) • 470 kΩ resisto
- Page 59 and 60: Ingredients (III) • FT232RL Break
- Page 61 and 62: Final USB and USB Serial Cable •
- Page 63 and 64: KDP over serial • KDP over serial
- Page 65 and 66: Using GDB... $ /Developer/Platforms
- Page 67: Links • xpwntool - https://github
Attacking through Devices<br />
• character and block devices added by <strong>the</strong> functions<br />
• cdevsw_add()<br />
• cdevsw_add_with_bdev()<br />
• bdevsw_add()<br />
• script scanning for xrefs can find all defined devices<br />
• interesting for vulnerability research are <strong>the</strong> ioctl handlers<br />
Stefan Esser • <strong>Targeting</strong> <strong>the</strong> <strong>i<strong>OS</strong></strong> <strong>Kernel</strong> • April 2011 •<br />
46
Change language