Debug for Bug: Crack and Hack Apple Core by Itself
summary
Fuzzing plus an LLDB scripting harness finds dozens of kernel bugs and discloses 10 disclosed vulnerabilities including double free and out‑of‑bounds read/write in graphics drivers (MD accelerator/GL paths). Method ties a remote KDP over Ethernet debugger to a mutation executor that injects bit‑flips, increments and scoped mutations into shared‑memory command streams, captures panics, replays inputs and auto‑reboots targets. Implementation details include a custom network driver to enable KDP, probe/executor architecture, and reproduced kernel panics with logged crash dumps.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 4:03Debug Loop
- 6:10DBFast
- 11:50Probus
- 12:39Control Logic
- 13:28Fast Mutation
- 15:00Data Generation
- 15:42Rebooting
- 16:27Graphic Equations
- 18:16Memory Operations
- 22:43Connection Types
- 23:54Demo
- 30:17TestTo
- 34:01Titi
- 35:15Value
- 41:52Conclusion
related talks
49mDrill Apple Core: Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit
45mD1T1 - How to Analyze and Find Bugs in MacOS and iOS Kernel Drivers
53mResearching New Attack Interfaces On iOS And OSX
40m(P)FACE into the Apple core and exploit to root
35mRacing the Dark: A New TOCTTOU Story From Apple's Core
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
53mFuzzing At Mach Speed: Uncovering IPC Vulnerabilities On MacOS
50mFinding Vulnerabilities In iOS/MacOS Networking Code