The ARMs race for kernel protection
summary
Compares Apple KPP and Samsung TIMA/KRP side‑by‑side, showing TrustZone/ARM ELx mechanics, the SMC 17 interface used by iOS, and how KPP loads a small MAHO binary from the kernelcache; KPP locks pages, computes BLAKE2 hashes of kernel text (32‑byte digests) and detects edits in a 1–20 minute window then panics. Demonstrates reversing TZ images with disarm and jtool, extracts SMC opcodes and vendor codes (800/801), and shows Samsung’s TZ OS performs realtime checks but remains vulnerable when vendors pass raw pointers into TZ.
AI-written summary · about
chapters (16)
- 0:00Introduction and background
- 1:11ARM trustzone concepts
- 3:09Low-level architecture
- 5:28Security challenges
- 8:59Android implementations
- 13:07Advanced Android features
- 15:43iOS implementation
- 17:04Secure monitor mechanism
- 20:49ARM exception levels
- 25:32TrustZone booting process
- 28:25Analyzing iOS KPP
- 34:15iOS KPP interface
- 37:42KPP checks and weaknesses
- 41:43Android TrustZone details
- 43:54Reverse engineering techniques
- 47:11TrustZone security analysis
related talks
44mBehind the scenes of iOS and Mac Security
43mBreaking Samsung's ARM TrustZone
19mDisARMed: Attacking ARM TrustZone from Userspace with Memory Aliasing
25mA DRM solution using TZMP
48mOP-TEE: Using the ARM Trust-Zone to Control Tamper Resistant Processors
45mInside the Apple T2
41mUsing Microarchitectural Design to Break KASLR and More
30mKernel Hardening With Protection Keys