iOS 14/15 Kernel Exploitation

Topics

The list of topics covered in the training. Please notice that this list is copied from an earlier version of the course and therefore there might be slight changes.

• Introduction
  • How to set up your Mac and Device for Vuln Research/Exploit Development
  • How to load own kernel modules into the iOS kernel
  • How to write Code for your iDevice
  • Damn Vulnerable iOS Kernel Extension
• Low Level ARM / ARM64
  • Differences between ARM and ARM64
  • Exception Handling
  • Hardware Page Tables
  • Special Registers used by iOS
  • PAN and PAC (Pointer Authentication)
  • ...
• iOS Kernel Source Code
  • Structure of the Kernel Source Code
  • Where to look for Vulnerabilities
  • Implementation of Mitigations
  • MAC Policy Hooks, Sandbox, Entitlements, Code Signing
  • ...
• iOS Kernel Reversing
  • Structure of the Kernel Binary
  • Finding Important Structures
  • Porting Symbols
  • Closed Source Kernel Parts and How to analyze them
  • ...
• iOS Kernel Debugging
  • Panic Dumps
  • Debugging with own Patches
  • Kernel Heap Debugging/Visualization (new software package for new devices)
• iOS Kernel Heap
  • In-Depth Explanation of How the Kernel Heap works (up to date for iOS 14.6)
  • Different techniques to control the kernel heap layout (including non-public ones)
  • Discuss weaknesses in current heap implementation
• iOS Kernel Exploit Mitigations
  • Discussion of all the iOS Kernel Exploit Mitigations introduced
  • Includes software and hardware based mitigations like (KTRR, KPP, PAC, PAN, APRR)
  • Including newest mitigations already known in latest kernels
  • Discussion of various weaknesses in these protections
• iOS Kernel Vulnerabilities and their Exploitation
  • Full walkthrough through exploitation of multiple prior known iOS memory corruption vulnerabilities
  • Analysis of public exploits and discussion how to improve them
  • Overview over different vulnerability types commonly found in iOS kernel and exploit strategies
  • Part of the training will be to reimplement bits and pieces of iOS 14 kernel exploits
• iOS Kernel Jailbreaking
  • Discussion of how recent iOS jailbreaks work
• Handling of New Devices
  • Discussion of necessary steps to port exploits from old to new devices

Training Takeaways

• The whole training material (multiple hundred slides) will be handed to the students in digital form.
• For up to 5 days after the training students can rewatch video recordings of all sessions.
• Trainees will get a license for the Antid0te software and scripts that are used during the training that allows usage but not redistribution of said software.

Training Requirements

• Student Requirements
  • Basic understanding of exploitation
  • C and Python Programming knowledge
  • Knowledge of ARM64 assembly
• Hardware Requirements
  • Apple Mac Notebook
  • iOS device compatible with checkra1n for iOS 14
  • Access to Apple ARM64 MacBook could be helpful to replace lack of iOS device (we will have some available via remote access)
• Software Requirements
  • IDA Pro 7.x license (ARM64 support required)
  • Ghidra (Fully supported now)
  • Hexrays for ARM64 helpful, but not required
  • BinDiff for IDA helpful, but not required
  • MacOS, with latest XCode and iOS 14.x SDK (or newer)
  • Additional Software will be made available during the training

Virtual Venue

The training sessions will be held via Zoom video conferencing. Training sessions will be around 5 hours per training day. In addition to that trainees will get access to a few hours worth of introductory videos.

Furthermore trainees get access to a Discord server that will be used to post information regarding the training and will be used to discuss exercises and their solution, unless those will be covered via Zoom.

All training sessions will be recorded and made available as videos until 5 days after the training. During that time trainees can rewatch sessions as often as they want.

Timezones

We offer this training in an EU/North America edition and in an APAC timezone edition. For other timezones please enquire. Unlike in person training courses when all attendees are present and share the same timezone the execution of online training courses requires some adjustments to be made to allow attendees accross different timezones to attent.

Pricing

Payment will be possible via international bank transfer or via credit card featured by STRIPE. Please note that we will usually charge EU customers in EUR and the rest of the world in SGD. On request we can charge in USD.

Register

If you have further questions or want to register for this training please contact us by e-mail training@antid0te.com. Please notice that signup, billing and execution of the training is handled by Antid0te SG Pte. Ltd..

In-House Training / Conferences / Additional Trainings

If you are interested in this training, but want us to perform the training for your people, want to feature our training at your online conference or would just like to know if we provide the training again at a later time please contact us by e-mail training@antid0te.com.