pwn0rz

/dts-v1/;

/ {
	#size-cells = <0x2000000>;
	device_type = "bootrom";
	model = "iPhone13,2";
	model-config = "syscfg/MdlC";
	clock-frequency = <0x00>;
	time-stamp = "Tue May 10 01:34:55 PDT 2022";
	model-number = "syscfg/Mod#/0x20,zeroes/0x20";

pwn0rz

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <mach/mach.h>
#include <CommonCrypto/CommonCrypto.h>
#include <ctype.h>

void hexdump(void *ptr, int buflen) {
  unsigned char *buf = (unsigned char*)ptr;
  int i, j;

pwn0rz

#include <IOKit/IOKitLib.h>
#include <mach/mach.h>
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <ctype.h>

void hexdump(void *ptr, int buflen) {
  unsigned char *buf = (unsigned char*)ptr;
  int i, j;

pwn0rz

#if 0
Reported : 19-Jan-2020
Fixed in iOS 13.4 with CVE-2020-9768
AppleJPEGDriverUserClient : mach port use-after-free/type-confusion via race condition 

AppleJPEGDriverUserClient external methods can be used synchronously or asynchronously, when used asynchronously, 
it brings the registered mach port (via registerNotificationPort()) and put it inside jpegRequest data structure,
and no reference count was taken for this operation. since registerNotificationPort() is not gated, it is 
possible to release the port (if the port got substituted)  during the processing of jpeg request and end up
with dangling pointer passed to _mach_msg_send_from_kernel_proper().

pwn0rz

Title : Revisiting Mac OS X Kernel Rootkits
Author : fG!
Date : April 18, 2014

|=----------------------------------------------------------------------------=|
|=----------------=[ Revisiting Mac OS X Kernel Rootkits ]=-------------------=|
|=----------------------------------------------------------------------------=|
|=------------------------=[ fG! <[email protected]> ]=---------------------------=|
|=----------------------------------------------------------------------------=|