Exploit Development
PTMX Kernel Exploit
Feb 2014 - Out of Bounds Array
The PTMX facility failed to properly check if the minor device node number was
within bounds of
the array specified, leading to arbitrary code execution. This exploit was used in the Evasion 7
jailbreak.
PTrace Process Hijack Sandbox Exploit
Feb 2012 - Sandbox Escape, iOS firmware 5.0.1
Bypassed limitations and access restricted portions of the filesystem by
allowing processes running
in protected sandbox making possible to abuse debugging calls in order to attach to outside
processes not running in a sandbox and hijack process execution.
Discovered vulnerability and performed analysis of XNU kernel to understand
limitations of the system call.
Assisted in implementing exploit using only ROP gadgets to enable
chaining of vulnerability from within other exploits.
HFS Legacy Stack Buffer Overflow Kernel Exploit
Jan 2011 - Kernel Stack Buffer Overflow, iOS firmware 4.2.1
Implemented insufficient boundary checks making possible to overflow the
functions
stack when
decoding HFS volume name to Unicode.
Assisted in reverse engineering HFS portions of kernel binary for stack analysis.
Worked on encoding volume string so Unicode decoding would be free of NULLs and characters over
0x7F could be successfully decoded onto the stack.
'SHAtter' BootROM Exploit
Aug 2010 - Memset Overflow, Apple A4 SoC
Sent specific USB packets in a certain order allowing to trick the BootROM image
validation routine
into thinking the size of the uploaded image is larger than it actually was. After image
validation
failed the routine would attempt to zero out the data, causing the device to overwrite it’s own
BSS
and heap data with zeros.
Discovered vulnerability and reverse engineered USB sections to discover cause
of the crash.
Performed extensive static analysis of USB and image loading routines to provide
various possible exploitation scenarios. Assisted in development of exploit payload to load
unsigned
images.
0x21,2 USB MSG iBoot Exploit
Oct 2009 - NULL Pointer Dereference, iPhone3G[s] and iPod Touch 3rd Gen
Uploaded specially crafted data and sent a specific USB packet conducting to
overwrite
the
ARM
exception vectors and to gain the control of execution.
Assisted in exploitation techniques involving overwriting ARM interrupt vectors
to redirect control of instruction pointer.
Developed payload to automatically find AES decryption
routines for decryption of firmware keys and writing it to the devices framebuffer
‘24kpwn’ BootROM Exploit
Mar 2009 - Segment Overflow, iPod Touch 2nd Gen & early iPhone 3G[s]
Flashed over-sized firmware images to the device enabling to overwrite certain
sections
of
the
device’s BootROM BSS and to heap data with arbitrary data.
Supported with reverse engineering various portions of BootROM and providing
exploitation ideas.
Modified firmware images and performed manual brute force to locate stack
offset of return address used to gain control of instruction pointer.