OPTIMIZED FUZZING IOKIT IN IOS

Recommendations

Info

Information Extraction(II): IOExternalMethod Extract IOExternalMethod • IOExternalMethod Export by directly invoking getTargetAndMethodForIndex • Arbitrary kernel code execution Stefan Esser, “Tales from iOS 6 Exploitation and iOS 7”, HITB 2013
Information Extraction(II): IOExternalMethod Carrier • Mach Msg OOL Data • locating OOL Data address mach_port_space_info-> struct ipc_mqueue-> struct ipc_kmsg_queue messages-> struct ipc_kmsg *ikmq_base-> mach_msg_header_t *ikm_header-> msgh_remote_port(ool address)-> msgh_remote_port + 52
Page 1 and 2: OPTIMIZED FUZZING IOKIT IN IOS LEI
Page 3 and 4: Outlines • Introduction • Infor
Page 5 and 6: Introduction(I) IOKit App-0 App-1
Page 7 and 8: Introduction(I) Our Work • Not on
Page 9 and 10: Part II Information Extraction
Page 11 and 12: Information Extraction(II) Basic In
Page 13 and 14: Information Extraction(II): Basic I
Page 25 and 26: Information Extraction(II): IOUserC
Page 33 and 34: Information Extraction(II): IOExter
Page 39: Information Extraction(II): IOExter
Page 43 and 44: Part III Fuzzing
Page 45 and 46: Fuzzing(III):Fuzzing Preparation Fu
Page 47 and 48: Fuzzing(III):Fuzzing Preparation Un
Page 49 and 50: Fuzzing(III): Fuzz Thread Client-0
Page 51 and 52: Part IV Experimental Results
Page 53 and 54: Experimental Results(IV) Vulnerabil
Page 55 and 56: Experimental Results(IV) Vulnerabil
Page 57 and 58: Experimental Results(IV): Vulnerabi
Page 59 and 60: Last Black Hat Sound Bytes

OPTIMIZED FUZZING IOKIT IN IOS

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?