Drill Apple Core: Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit
summary
A fuzzing platform adds code-coverage in XNU and kernel sanitizers (KASAN-like shadow memory, init-memory checks), implements a Mersenne-twister seedable mutation engine, and consumes ~530 API patterns for Mach/XPC messages to fuzz IPC. It produces deterministic crashes (seed replay), finds 54 unique crashes (mostly NULL/deref and type-confusion) and turns multiple flaws into a live macOS 10.13.6 root using 3 zero-days demonstrated end-to-end.
AI-written summary · about
chapters (6)
- 0:00Start
- 18:44Kernel Mode Sanitizers
- 19:55Sanitizer Coverage
- 20:05Callback Implementation
- 22:00Guard Pages & Shadow Memory
- 25:06Conclusion
related talks
43mDebug for Bug: Crack and Hack Apple Core by Itself
53mFuzzing At Mach Speed: Uncovering IPC Vulnerabilities On MacOS
40m(P)FACE into the Apple core and exploit to root
44mBreaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing
53mResearching New Attack Interfaces On iOS And OSX
42mCPU Fuzzing: Automatic Discovery of...
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions