ios-exploiting

Download the target IPSW from ipsw.me, unzip it, and decrypt the kernelcache using img4tool or jtool2. Load the result into Ghidra as ARM64/AARCH64 for function and symbol analysis, then use BinDiff to compare vulnerable and patched versions.

Corellium provides cloud-based iOS virtualization with kernel debugging, snapshots, and multi-version support, making it the highest-value research environment. Jailbroken devices via checkra1n work only on A11 and below and cannot debug kernel boot.

kalloc_type isolates allocations by both type and size, so attacker-sprayed objects like OSData can no longer sit adjacent to targets like ipc_port. Combined with XOR-encoded freelist pointers and per-CPU caches, classic heap feng shui and freelist poisoning no longer work directly.

User-space PAC bypasses reuse pre-signed pointers from the dyld shared cache, call dlsym to obtain A-key signed function pointers, or exploit ObjC runtime structures via SLOP (SeLector Oriented Programming). Kernel PAC bypass generally requires implementation bugs, as no generic method exists.

PPL (Page Protection Layer) protects page tables, trust caches, and entitlement data so that even kernel read/write cannot modify them. Known bypasses include TLB stale entry tricks or bugs in PPL code itself, with SPTM replacing PPL on newer chips.

A19 devices add EMTE/MIE memory tagging, which detects UAF, heap overflow, and out-of-bounds access synchronously with confidential tags. This raises exploitation difficulty to the highest level, requiring tag collision or leakage strategies that remain largely open research problems.