Главная
Study mode:
on
1
Intro
2
Kernel Zone Heap Allocator
3
Zone Allocator Usage
4
Zone Memory (Pages)
5
Dynamic Length Allocations?
6
Kernel Heap Allocation Debugging (1)
7
Zone Structure
8
Free Memory Blocks
9
How attackers abused the iOS 5 Zone Allocator
10
IOS & Heap Cookie Leak Protection
11
Zone Pagelist Feature
12
Zone Page Meta Data
13
Zone Pagelists
14
Allocation under Page Lists
15
Freeing under Page Lists
16
Was there a memory corruption? Yes? Continue!
17
Less Frequent Large Block Poisoning
18
Zone Page Metadata
19
Fored Zomestructure Array
20
new zone metadata region
21
page freelists
22
Metadata vs. Wrong Zone Frees
23
Wrappers and Metadata
Description:
Dive into the intricacies of iOS 10 kernel heap exploitation in this comprehensive conference talk from HITB GSEC 2016. Explore the evolution of the iOS Kernel Heap since iOS 4 and 5, examining Apple's hardening efforts against heap exploitation attacks. Gain detailed insights into the current state of iOS kernel heap exploitation, focusing on iOS 9 and iOS 10 beta versions. Learn about Apple's countermeasures against exploitation techniques used in the wild and discover how attackers can adapt. Get a sneak peek into new iOS 10 kernel exploitation mitigations visible in beta versions. Presented by Stefan Esser, a renowned PHP security expert and iOS security researcher, this 65-minute session covers topics such as the Kernel Zone Heap Allocator, Zone Memory, Dynamic Length Allocations, Kernel Heap Allocation Debugging, and various protection mechanisms implemented by Apple.

iOS 10 Kernel Heap Revisited

Hack In The Box Security Conference
Add to list