Eternal War in XNU Kernel Objects
summary
Claims that Apple mitigations are bypassable by corrupting IPC objects and formalizes the attack as ipc_port Kernel Object-Oriented Programming; uses XNU source and kernel cache analysis to enumerate primitives, reproduces real-world exploits and shows full control on recent XNU builds. Builds an on-host protector as an XQP kernel extension that trampolines key syscalls and enforces checks (type, address, clearing-rate and task-map) via four examiners, blocks four tested exploits deterministically but admits clearing side channels and arbitrary kernel execution remain hard without hardware support.
AI-written summary · about
chapters (25)
- 0:00Intro
- 1:11Apple Devices & Jailbreaking
- 2:29Mitigation - DEP/KASLR
- 3:57Mitigation - Freelist Randomization
- 5:07black hat Mitigation - Wrong Zone Free Protection
- 7:05blackhat New Target - Mach Port in User Space
- 8:25black hat New Target - Struct ipc port in Kernel Space
- 9:11blackhat (Mach) Port-oriented Programming (POP)
- 10:24MIG in Kernel Cache
- 11:43blackhat General Purpose Primitives for Host
- 12:35General Purpose Primitives for VM
- 13:44Querying Primitives
- 15:30Memory Interoperation Primitives
- 17:57Arbitrary Code Execution Primitives
- 19:47Practical Case Study: Yalu Exp
- 23:17iOS 11 Kernel Task Mitigation
- 23:40blackhat Mitigation bypass in Async_wake Exp
- 24:10Enterprise Computer Security
- 25:06XNU Kernel Object Protector
- 25:47Inline Hooking
- 27:21Examiners
- 30:17Evaluation
- 32:26Discussion
- 34:06Conclusion
- 35:12Reference
related talks
37mAttacking The XNU Kernel In El Capitain
35mAttacking iPhone XS Max
50mFinding Vulnerabilities In iOS/MacOS Networking Code
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
57mExploring Yosemite: Abusing Mac OS X 10.10
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
37mAttacking NPUs of Multiple Platforms
16mThe Cost of Performance: Breaking ThreadX with Kernel Object Masquerading...