Thinking Outside the JIT Compiler
summary
Describes a generic, non-JIT method that bypasses WebKit’s StructureID Randomization to build addrOf/fakeObj primitives and achieve arbitrary Read/Write. Uses JavaScriptCore internals: fake simple objects with crafted structure IDs, manipulate butterfly pointers and prototype-to-string/describe code paths to leak structure table entries. Reports about ~1% success per attempt for blind trials and shows a working exploit chain that produces reliable primitives on macOS and an approach to bypass iOS mitigations.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 10:48General bypass
- 12:51Question
- 13:51Prototype
- 14:26TruthString
- 15:10Simple Prototype
- 15:35Converting
- 15:55Layout
- 16:05Attack
- 17:21Objector
- 19:28Potential Problem
- 20:56Summary
- 21:18References
related talks
45mAbusing Performance Optimization Weaknesses to Bypass ASLR
24mDeconstructing The Beast: A Deep Dive Into JIT Compilation Attacks In iOS
50mWrite Once, Pwn Anywhere
33mWebKit Everywhere: Secure or Not?
35mOn Securing Legacy Software Against Code-Reuse Attacks
47mKeynote: Code-Reuse Attacks and Beyond
27mWhat Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP...
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox