Fuzzing At Mach Speed: Uncovering IPC Vulnerabilities On MacOS
summary
A year of work produces a fast, practical macOS IPC fuzzer that directly calls Mig RPC handlers (avoiding kernel roundtrips) and uses a custom Mach message dumper to build a corpus from live traffic. The toolchain combines Jackalope + tinyinst + Lighthouse for mutation, instrumentation and coverage; a custom macho symbol parser lets the harness call nonexported handlers. Targeting CoreAudio yields thousands of crashes, with several memory‑corruption hits and one crash possibly exploitable; the harness and corpus generator are queued for open source release.
AI-written summary · about
chapters (23)
- 0:00Introduction to fuzzing
- 2:17Understanding IPC mechanisms
- 3:40Fuzzing strategies
- 7:39Exploring Mach ports
- 8:03Connection establishment
- 10:36Message structure analysis
- 11:09The attack cycle
- 13:16Targeting high-impact processes
- 13:52Reverse engineering targets
- 23:16Shared cache extraction
- 24:12Mig interface discovery
- 26:58Analyzing Mig servers
- 28:12Building a corpus
- 29:42Developing a fuzzing harness
- 32:21Fuzzer integration
- 34:17Code coverage basics
- 35:17Advanced instrumentation
- 35:51Instrumentation implementation
- 38:03Running the fuzzer
- 38:59Triage and reproducibility
- 40:20Conclusion and Q&A
- 48:31Addressing memory safety
- 51:30Final remarks
related talks
44mBreaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing
49mDrill Apple Core: Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit
40m(P)FACE into the Apple core and exploit to root
53mResearching New Attack Interfaces On iOS And OSX
43mDebug for Bug: Crack and Hack Apple Core by Itself
50mFinding Vulnerabilities In iOS/MacOS Networking Code
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
42mCPU Fuzzing: Automatic Discovery of...