iOS Dual Booting Demystified
summary
Describes how to boot a custom iOS firmware image by loading a modified bootloader (uploaded over USB with iRecovery/minicom) that assembles a RAM disk, device tree, trust cache and kernel then issues boot x; uses kloader/coolbooter techniques and tools like kloader64 and a RAM-disk running dropbear server to get SSH. Demonstrates iOS 11.4.1 and 12.1 on iPhone 7, disables KASLR/KTRR and code-sign checks, shows writable kernel memory, and notes SEP incompatibilities and A12 hardening as limits.
AI-written summary · about
chapters (35)
- 0:00Introduction
- 0:51What is Dual Boot
- 2:56Apple Secure Boot
- 4:51Boot ROM
- 6:50Boot Loaders
- 8:27Hardware Mappings
- 9:01Kernel
- 9:48RAM Disk
- 12:02Reverse Engineer
- 12:31Common Handler
- 13:32Supported Commands
- 15:22Booting
- 15:52Kloader
- 17:28Kernel Patch Protector
- 20:51IBoot
- 22:12Debug
- 23:35Relocate KLR
- 23:51Go
- 24:46KTR
- 26:34KPP
- 26:48XNU
- 27:44Additional Mitigation
- 28:48Code Sign
- 28:59MCC
- 30:18Sleep Mode
- 30:57Static Maps
- 31:31Patching
- 32:26RAM Disk Patches
- 34:42Physical Storage
- 35:33Trust Cache
- 36:09Combining all components
- 36:40Booting the whole system
- 37:29Demo
- 46:00Discussion
- 49:40Thanks
related talks
41mBooting the iOS Kernel to an Interactive Bash Shell on QEMU
44mBehind the scenes of iOS and Mac Security
40mIntroduction into Reverse Engineering and iOS Security
45mInside the Apple T2
36mState Of IOS Jailbreaking In 2025
49mJailbreaking The Apple HomePod: Fun With Checkm8 And Smart Speakers
29miOS Runtime Manipulation (PWND)
52mBehind the Scenes of iOS Security