Abstract

From primitive to chain. The third course of the iOS Security Research sequence, and the only one that is about exploitation.

Given a defect, a student who finishes this class determines what primitive it yields, obtains that primitive reliably against a pinned release, shapes the heap so the primitive lands where it must, converts a disclosure into the kernel’s load address, builds a read and then a write, and reasons correctly about the three defences that stand between a write and control of the system. The student can also read a published chain and say what each stage was for.

The course is organised in four parts. The first converts defects into primitives — lifetime and accounting defects into a typed reuse, corruption into a controlled write — and separates the two things the word primitive means, which is the commonest error in exploitation planning. The second is the heap: grooming and reclaim, and measuring the allocator rather than inferring it. The third builds the two primitives that matter, the kernel read and the kernel write, and then states what a write does not reach. The fourth is the modern wall: pointer authentication and the four avenues that remain around it, the monitor that owns the page tables, data-only attacks, and two complete published chains taken apart stage by stage.

Why This Is A Separate Course

Exploitation is a different skill from finding defects, with its own body of knowledge, and compressing it into the tail of iOS Security Research 2 damages both halves. The part that suffers in that compression is always the foundation, because it is the part a student cannot tell they are missing until much later.

A student may stop after course 2 and have a career. A student who takes this course without 1 and 2 will be able to follow a chain and unable to find one, which is the outcome this structure exists to prevent. The entry requirement is therefore enforced rather than advisory: a student who has not found and proven a defect cannot judge which of the techniques below applies to one.

The Defects Are Supplied

Each exercise starts from a defect the course provides, chosen because it is public, patched and documented — so that the student’s work is the exploitation, and the ethics are settled before the first hour.

Who Should Attend

Researchers who have found and proven a defect on the platform and now want to establish what it is worth. This course assumes the two before it and does not repeat them.

Key Learning Objectives

This class has the following goals:

  • Distinguish a platform primitive, which exists with no defect at all, from a derived primitive, which cannot exist before one.
  • Drive an accounting or lifetime defect to a controlled reuse of a typed allocation, and observe it.
  • Establish, for a corruption defect, exactly what you can write and where — which qword, and who reads it.
  • Explain the architecture of working exploit code: stages, the state each stage leaves, failure handling, cleanup, and why reliability is a design property rather than a tuning exercise.
  • Groom the heap: which types share a zone and therefore reclaim each other, and the catalogue of allocations an unprivileged application can drive on demand.
  • Measure the allocator on your own device rather than trusting a published constant, and compare it with the figure the binary suggests.
  • Convert a supplied disclosure into the kernel’s load address and verify it against a second, independent route.
  • Build an arbitrary kernel read, and use it to dump a structure you can verify independently.
  • Build a kernel write, and change one field whose effect you can observe from userland.
  • State what a write does not reach, how that refusal is implemented, and how often it is applied.
  • Explain what pointer authentication forecloses exactly, and the four avenues that remain — each with the public case that instantiates it.
  • Identify data-only targets in a current kernelcache and state, for each, what reads it and what would follow.
  • Take a published chain apart stage by stage and establish why each stage was necessary at all.

Prerequisite Knowledge

Students should have:

Lab Requirements

Students must prepare the following lab configuration:

  • A Mac with Apple Silicon (M series).
  • One iPhone, in its shipped state.
  • IDA Pro for ARM64 binaries.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

From a defect to a primitive

  • What a primitive is, and the two things the word means
  • Lifetime and accounting defects into a typed reuse
  • Corruption into a controlled write
  • How a real exploit is built

The heap

  • Grooming and reclaim
  • Measuring the allocator rather than inferring it
  • What the free path does, and what that costs you

The two primitives

  • The information disclosure, and what it is worth
  • Kernel read
  • Kernel write
  • What a write does not reach

The modern wall

  • Pointer authentication, and the four ways around it
  • The monitor, and the coprocessors
  • Data-only attacks
  • Public chains, walked
  • Final exercise: a primitive chain, built

The Final Exercise

From a supplied defect against a pinned release, the student delivers a working chain to a stated stopping point, with its reliability measured over repeated runs and its failure modes described.

It is marked on reliability and on honesty about limits, not on how far it reaches.

What This Course Does Not Cover

Persistence and the remaining work after control is obtained; the browser engine as an entry point; the secure enclave; the full set of published chain case studies.

Persistence is excluded on purpose and not for time: it is the stage where research work becomes indistinguishable from building an implant, and a course that teaches finding and proving defects should stop before it. The browser engine is a different speciality with a different language and a different object model, and it deserves its own course rather than an afternoon. The remaining published chains are followable by a graduate directly, because this course teaches the method for taking one apart — which is why two are walked in class rather than ten.

Note: Topics can be added, merged or removed without prior notice!