iOS Jailbreak Internals - Userland Read-Only Memory Can Be Dangerous
Explore the intricacies of iOS jailbreaking and security vulnerabilities in this Black Hat conference talk. Delve into the potential dangers of userland read-only memory mappings in modern operating systems. Examine how these mappings, intended to prevent common security attacks, can be exploited. Learn about userland memory sharing in iOS, DMA (Direct Memory Access) concepts, and the role of IOMMU (Input/Output Memory Management Unit) in system security. Investigate the IOSurface and IOSurfaceAccelerator components, their low-level implementations, and how they can be leveraged for attacks. Discover vulnerabilities in DMA mapping and out-of-bound write operations, and understand their exploitability. Follow the speaker's journey through KASLR bypass, code execution, and overall exploit workflow. Gain insights into post-exploitation techniques and draw valuable conclusions about iOS security.