iOS Kernel Heap Armageddon
iOS Kernel Heap Armageddon
iOS Kernel Heap Armageddon
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Poking Holes into Allocated Data<br />
• deallocation of arbitrary sized memory is possible with <br />
• reusing the same dictionary key will delete the previously inserted value<br />
• in this example the middle value ZZZ...ZZZ is freed<br />
<br />
<br />
AAAA<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<br />
BBBB<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<br />
CCCC<br />
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ<br />
DDDD<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<br />
EEEE<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<br />
CCCC<br />
<br />
<br />
<br />
Stefan Esser • <strong>iOS</strong> <strong>Kernel</strong> <strong>Heap</strong> <strong>Armageddon</strong> • April 2012 •<br />
92