Главная
Study mode:
on
1
Introduction
2
Outline
3
About us
4
iOS
5
Jailbreak
6
Tradeoff
7
Dynamic Libraries
8
TeamID Validation
9
AnyAgent
10
iOS 83
11
Challenges
12
Userland
13
XP
14
API
15
Entitlement
16
Fortisbox
17
Pangu Agent
18
Jailbreak iOS 91
19
Jailbreak iOS 93
20
Kernel Patch
21
Sandbox Extension
22
Debugger
23
Attacks
24
Code Audit
25
Shared Cache
26
Kernel
27
Conclusion
Description:
Explore the inner workings of the Pangu 9 untethered jailbreak tool for iOS 9 in this 47-minute Black Hat conference talk. Delve into the sequence of vulnerabilities exploited in the iOS userland to achieve arbitrary code execution in the kernel and persistent code signing bypass. Discover the logical error in a system service that allows container apps to gain arbitrary file read/write privileges. Learn how Pangu 9 leverages the system debugging feature to execute code outside the sandbox. Examine the vulnerability in the dyld_shared_cache file loading process that enables persistent code signing bypass. Investigate the backup-restore process vulnerability that permits execution of apps signed by revoked enterprise certificates without user approval. Gain insights into iOS jailbreaking techniques, dynamic libraries, TeamID validation, and kernel patching through this comprehensive exploration of iOS security vulnerabilities and exploitation methods.

Pangu 9 Internals

Black Hat
Add to list