Главная
Study mode:
on
1
Intro
2
Userland read-only memory mappings
3
Userland memory sharing in ios
4
Breaking the trust boundary
5
DMA overview
6
IOMMU(input/output memory management unit) and DART
7
Host-to-device DMA and device-to-host DMA
8
Long distance remote attack?
9
Indirect userland DMA
10
IOSurface and IOSurfaceAccelerator
11
Low level implementation of IOSurfaceAccelerator
12
IOSurfaceAccelerator TransferSurface Internals
13
Map IOSurface buffer via DMA
14
Obtain the IOSurface address in IOSpace
15
Start the scaler
16
IOMMU memory protection
17
Apple Graphics workflow
18
GPU notification architecture
19
Stamp address array
20
IOAccelEvent object
21
1. The DMA mapping vulnerability
22
2. The out-of-bound write vulnerability
23
Exploitability
24
Craft memory layout
25
Feasibility of memory layouting
26
Arbitrary read and write?
27
First attempt to exploit
28
KASLR bypass
29
Code execution
30
Overall exploit workflow
31
Post exploitation
32
Conclusion
Description:
Explore the intricacies of iOS jailbreaking and security vulnerabilities in this Black Hat conference talk. Delve into the potential dangers of userland read-only memory mappings in modern operating systems. Examine how these mappings, intended to prevent common security attacks, can be exploited. Learn about userland memory sharing in iOS, DMA (Direct Memory Access) concepts, and the role of IOMMU (Input/Output Memory Management Unit) in system security. Investigate the IOSurface and IOSurfaceAccelerator components, their low-level implementations, and how they can be leveraged for attacks. Discover vulnerabilities in DMA mapping and out-of-bound write operations, and understand their exploitability. Follow the speaker's journey through KASLR bypass, code execution, and overall exploit workflow. Gain insights into post-exploitation techniques and draw valuable conclusions about iOS security.

iOS Jailbreak Internals - Userland Read-Only Memory Can Be Dangerous

Black Hat
Add to list