iOS Kernel Heap Armageddon

More documents

Recommendations

Info

OSObject Memory Layout 0x00 0x04 0x08 vtable ptr + 8 retainCount 802A1570 ; `vtable for'OSObject 802A1570 __ZTV8OSObject 802A1570 DCD 0 802A1574 DCD 0 802A1578 DCD sub_801E7C0C+1 802A157C DCD __ZN8OSObjectD0Ev+1 802A1580 DCD __ZNK8OSObject7releaseEi+1 802A1584 DCD __ZNK8OSObject14getRetainCountEv+1 802A1588 DCD __ZNK8OSObject6retainEv+1 802A158C DCD __ZNK8OSObject7releaseEv+1 802A1590 DCD __ZNK8OSObject9serializeEP11OSSerialize+1 802A1594 DCD __ZNK8OSObject12getMetaClassEv+1 802A1598 DCD __ZNK15OSMetaClassBase9isEqualToEPKS_+1 802A159C DCD __ZNK8OSObject12taggedRetainEPKv+1 802A15A0 DCD __ZNK8OSObject13taggedReleaseEPKv+1 802A15A4 DCD __ZNK8OSObject13taggedReleaseEPKvi+1 802A15A8 DCD __ZN8OSObject4initEv+1 802A15AC DCD __ZN8OSObject4freeEv+1 Stefan Esser • iOS Kernel Heap Armageddon • April 2012 • 64
OSObject Retain Count • reference counter for objects • 32 bit field - but only lower 16 bit are the reference counter • upper 16 bit used as collection reference counter • reference counting stops at 65534 -> memory leak 0x00 0x04 0x08 vtable ptr + 8 retainCount Stefan Esser • iOS Kernel Heap Armageddon • April 2012 • 65
Page 1 and 2:
iOS Kernel Heap Armageddon Stefan E
Page 3 and 4:
Recap... • public iOS kernel heap
Page 5 and 6:
Part I Zone Allocator Recap Stefan
Page 7 and 8:
iOS Kernel Zone Allocator 101 • k
Page 9 and 10:
iOS Kernel Zone Allocator 101 • z
Page 11 and 12:
iOS Kernel Zone Allocator 101 • w
Page 13 and 14: Part II Other Heap Managers and Wra
Page 15 and 16: Let‘s have a look at kalloc() Ste
Page 17 and 18: iOS 5 - kalloc() Zones $ zprint kal
Page 19 and 20: Let‘s have a look at _MALLOC() St
Page 21 and 22: _MALLOC() in iOS 4.x void *_MALLOC(
Page 23 and 24: Overwriting _MALLOC()ed Data • ch
Page 25 and 26: kern_os_malloc() • kern_os_malloc
Page 27 and 28: and kernel_memory_allocate ??? Stef
Page 29 and 30: Part III Cross Zone or Cross Memory
Page 31 and 32: Visualization of Zone Page Allocati
Page 57 and 58: Zone Page Allocation Distribution
Page 59 and 60: Zone Page Allocation Distribution
Page 61 and 62: Part IV Kernel Heap Application Dat
Page 63: iOS Kernel C++ Base Objects Stefan
Page 67 and 68: OSString Memory Layout and Overwrit
Page 69 and 70: Part V “Generic“ Technique to c
Page 71 and 72: Heap Spraying • allocate repeated
Page 73 and 74: Once Technique to rule them all...
Page 75 and 76: How does the parser work? (I) • p
Page 77 and 78: How does the parser work? (III) •
Page 79 and 80: How does the parser work? (V) • k
Page 81 and 82: How does the parser work? (VII) •
Page 83 and 84: Memory Sizes Cheat Sheet OSArray OS
Page 85 and 86: Allocate Repeatedly • there is no
Page 87 and 88: Allocate Attacker Controlled Data
Page 89 and 90: Heap Feng Shui / Heap Massage / ...
Page 95: Questions ? Stefan Esser • iOS Ke
show all

iOS Kernel Heap Armageddon

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?