Inside Apple's Lightning: JTAGging The IPhone For Fuzzing And Profit
summary
Reveals a working open source Lightning JTAG adapter built on a Raspberry Pi Pico and called Tamarind cable, implements SDQ/IDBUS in PIO, and drives SWD over Lightning to attach OpenOCD after an automated checkm8 demotion; the live demo successfully boots into Pongo, lists CPUs and reads boot ROM. Shows automated DFU/reset via undocumented Lightning commands and a Lightning fuzzer that finds crashes and a previously undocumented bulk data channel used by accessories; fuzzers and firmware are being published.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:28Lightning
- 4:07Lightning Communication
- 10:30DCSd Cable
- 11:12JTAG
- 13:09Debugging
- 16:08AutoCheckmate
- 23:16DFU Fuzzer
- 24:09Lightning Sniffer
- 25:43Lightning Fuzzer
- 26:09Apple Pencil
related talks
43mThe Tao of Hardware the Te of Implants
01h 46mTutorial: Introduction to Reverse Engineering
43mDebug for Bug: Crack and Hack Apple Core by Itself
40mIntroduction into Reverse Engineering and iOS Security
21mToothPicker: Apple Picking in the iOS Bluetooth Stack
44mBehind the scenes of iOS and Mac Security
33mDifferential Fuzzing on Lightning Network
35mAttacking iPhone XS Max