Booting the iOS Kernel to an Interactive Bash Shell on QEMU
summary
Boots an unpatched iOS kernel (iOS 12.1 for iPhone 6s Plus) on QEMU, runs the secure monitor in EL3 and the kernel in EL1, and presents a working interactive bash shell over the emulated serial console with GDB kernel debugger attached. Implements unsigned-executable support by injecting a static trust cache (must be sorted), fixes kernel base/MAHO placement to avoid panics, enables serial input via a kernel boot-arg bit, and demonstrates a voucher_swap use-after-free live-debugged on the emulator. Current limits: single CPU, RAM-disk root, serial-only I/O.
AI-written summary · about
chapters (14)
- 0:00Introduction to iOS research
- 0:26Current iOS research methods
- 4:03Project goals and background
- 4:41Previous emulation work
- 5:41Project objectives
- 7:24Demo and current status
- 9:14Kernel booting challenges
- 12:38Secure monitor implementation
- 18:01Executing custom binaries
- 23:32Bash shell setup
- 28:24Enabling serial input
- 29:23Debugging vulnerabilities
- 36:03Future work and Q&A
- 38:26Conclusion and legal talk
related talks
51miOS Dual Booting Demystified
44mBehind the scenes of iOS and Mac Security
44mExploiting Unpatched iOS Vulnerabilities for Fun and Profit
50mForking QEMU to emulate and secure the Tillitis TKey
40mIntroduction into Reverse Engineering and iOS Security
32mClosing Keynote: The Joy and Excitement of Forbidden Computer
35mAttacking iPhone XS Max
36mState Of IOS Jailbreaking In 2025