D1T1 - How to Analyze and Find Bugs in MacOS and iOS Kernel Drivers
summary
Open-source tool Ryuk recovers C++ classes, vtables and function names from closed Apple kernel drivers to enable static and manual analysis. The work finds two zero-days in IOFireWireFamily — an info‑leak of a kernel pointer and a race‑condition use‑after‑free — and builds an exploit that achieves root on macOS 10.13.2; Apple issues CVEs and fixes them in 10.13.4. The exploit uses heap/ROP primitives and newly identified stack‑pivot gadgets to run a kernel ROP chain.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:23Driver architecture overview
- 5:09User space interaction
- 10:46Vulnerability research
- 15:50Exploitation strategies
- 20:14Patch analysis
- 23:12Challenges in analysis
- 27:34Introducing Reek tool
- 43:54Conclusion
related talks
53mResearching New Attack Interfaces On iOS And OSX
35mRacing the Dark: A New TOCTTOU Story From Apple's Core
43mDebug for Bug: Crack and Hack Apple Core by Itself
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
50mFinding Vulnerabilities In iOS/MacOS Networking Code
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
40m(P)FACE into the Apple core and exploit to root
41mA Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)