Hacking Mac OS X - Black Hat

More documents

Recommendations

Info

More exploit differences Regular expression had to be changed JavaScript code slightly different in memory (older version) 30b71c64> dd 00922400 00922400 | 00265848 00000000 00000000 00000000 00922410 | 00000000 00000000 00000000 00000000 00922420 | 00000000 00000000 00000000 00000000 00922430 | 00000000 00000000 00000000 00000000 30b71c64> dd 00265848 00265848 | 38b7f724 ffffff91 00000000 00000000 00265858 | 00000000 00000000 00000000 00264498 00265868 | 4463c001 00000000 00000000 00000000 00265878 | 00000000 00000000 38b80ec4 ffffff91
Feng shei iPhone style (Output from iphonedbg by Nicolas Economou) 30b7d030> BREAKPOINT r0=00975e00 r1=00000000 r2=000003e8 r3=38b7f218 r4=000003e8 r5=02e14038 r6=02c84e84 r7=02c84e5c r8=000003e8 r9=00817800 r10=38b7f218 r11=031a82b4 r12=00976e00 sp=02c84e54 lr=300043c0 pc=30b7d030 ctrl=00000010 JavaScriptCore!__ZN3KJS13ArrayInstanceC2EPNS_8JSObjectEj+58: pc=30b7d030 34 00 85 e5 str r0, [r5, #52] 30b7d030> BREAKPOINT r0=00976e00 r1=00000000 r2=000003e8 r3=38b7f218 r4=000003e8 r5=02e13fc8 r6=02c84e84 r7=02c84e5c r8=000003e8 r9=00817800 r10=38b7f218 r11=031a82b4 r12=00977e00 sp=02c84e54 lr=300043c0 pc=30b7d030 ctrl=00000010 JavaScriptCore!__ZN3KJS13ArrayInstanceC2EPNS_8JSObjectEj+58: pc=30b7d030 34 00 85 e5 str r0, [r5, #52] 30b7d030> BREAKPOINT r0=00977e00 r1=00000000 r2=000003e8 r3=38b7f218 r4=000003e8 r5=02e13f90 r6=02c84e84 r7=02c84e5c r8=000003e8 r9=00817800 r10=38b7f218 r11=031a82b4 r12=00978e00 sp=02c84e54 lr=300043c0 pc=30b7d030 ctrl=00000010 JavaScriptCore!__ZN3KJS13ArrayInstanceC2EPNS_8JSObjectEj+58: pc=30b7d030 34 00 85 e5 str r0, [r5, #52]
Page 1 and 2:
Owning the Fanboys: Hacking Mac OS
Page 3 and 4:
Outline Leopard security Tracing ex
Page 5 and 6:
Sandboxing Done via Seatbelt kext C
Page 7 and 8:
More sandboxing Some applications a
Page 9 and 10:
Leopard firewall Disabled by defaul
Page 11 and 12:
One final note on Leopard “Securi
Page 13 and 14:
Truss syscall:::entry /execname ==
Page 15 and 16:
Memory Tracer pid$target::malloc:en
Page 17 and 18:
iTunes hates you (gdb) attach 7551
Page 19 and 20:
Inside iTunes In gdb (0x1f = PT_DEN
Page 21 and 22:
Jump tables EIP relative data addre
Page 23 and 24:
Result of script
Page 25 and 26:
Typical disassembly of Obj-C
Page 27 and 28:
objc_msgSend Typically the first ar
Page 29 and 30: The code get_func_name(cpu.eip + di
Page 31 and 32: More results: xrefs!
Page 33 and 34: Changelog snooping Apple forks proj
Page 35 and 36: Apple’s pre-release vulnerabiliti
Page 37 and 38: Server Side mDNSResponder (sandboxe
Page 39 and 40: Safari Native support /Applications
Page 41 and 42: ReportCrash aka CrashReporter launc
Page 43 and 44: Monitoring script #!/bin/bash X=0;
Page 45 and 46: Exploiting Safari Massaging the hea
Page 47 and 48: Heap spray This unpredictability wa
Page 49 and 50: The plan Occurs in three steps Defr
Page 51 and 52: Create adjacent allocations Keep re
Page 53 and 54: JavaScript Safari JavaScript code i
Page 55 and 56: Therefore... In JavaScript var name
Page 57 and 58: Heap overflows Some protections on
Page 59 and 60: Win var name = new Array(1000); nam
Page 61 and 62: Pwn2Own - feng shei try{ for(i=0; i
Page 63 and 64: Heap defragmentation Breakpoint 3,
Page 65 and 66: Right in the hole! Breakpoint 3, 0x
Page 67 and 68: iPhone Apple’s phone Runs a strip
Page 69 and 70: Unlocking from carrier 3G Requires
Page 71 and 72: Processes # ps aux USER PID %CPU %M
Page 73 and 74: Interesting files /private/var/mobi
Page 75 and 76: Exploits then... When iPhone was re
Page 77 and 78: Smaller attack surface Mostly like
Page 79: Port of RegEx exploit NOOP sled and
Page 83 and 84: http://appleguytom.blogspot.com/200
show all

Hacking Mac OS X - Black Hat

Create successful ePaper yourself

Delete template?

Save as template?