Pangu 9 Internals
summary
Pangu 9 details a chain: an XPC path traversal in an assetd service lets any container app move arbitrary files as mobile for file read/write; mounting an old developer disk image plus the debug server lets an old VPA agent load an unsigned library and escalate to code execution outside the sandbox; a flaw in dyld_shared_cache loading lets a crafted cache map fake handler data to achieve persistent code signing bypass; a backup/restore bug runs apps signed by revoked enterprise certs without user approval.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:30Outline
- 2:35About us
- 3:16iOS
- 4:40Jailbreak
- 5:38Tradeoff
- 7:12Dynamic Libraries
- 8:16TeamID Validation
- 9:42AnyAgent
- 10:50iOS 83
- 11:44Challenges
- 12:20Userland
- 12:55XP
- 13:15API
- 17:03Entitlement
- 19:28Fortisbox
- 20:16Pangu Agent
- 26:09Jailbreak iOS 91
- 27:49Jailbreak iOS 93
- 30:20Kernel Patch
- 32:47Sandbox Extension
- 35:18Debugger
- 37:40Attacks
- 39:12Code Audit
- 40:45Shared Cache
- 42:00Kernel
- 45:29Conclusion
related talks
35mAttacking iPhone XS Max
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
44mExploiting Unpatched iOS Vulnerabilities for Fun and Profit
42mBypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio
29miOS Runtime Manipulation (PWND)
40m(P)FACE into the Apple core and exploit to root
57mExploring Yosemite: Abusing Mac OS X 10.10
49mContain Yourself: Building Secure Containers for Mobile Devices