3 ms·

You don't necessarily need to reverse engineer the whole thing. If you're just looking to bypass a particular check then sometimes it's enough to dig around unt

You don't necessarily need to reverse engineer the whole thing. If you're just looking to bypass a particular check then sometimes it's enough to dig around until you find something relevant, then find references to the memory location. There are tools that can make this easier. Or so I've heard. Surely no one here has ever done anything of the sort. Still, you're right about the scale of the problem. It's time consuming to find the relevant bit to start building on, even on relatively small binaries. I don't even want to think about how long it would take on an entire OS.

justaman 10y ago
You would never even keep up with the updates.
- derefr 10y ago
  A particular type of "bypassing a check" is the goal of jailbreaking—and it's just redone for every update. People with the right motivation can do crazy things.
  - valarauca1 10y ago
    This is a false comparison. Jail-breaking is just a privilege escalation. You were a $USER, now you are $ROOT. This is just tricking the kernel. Fundamentally the kernel is just doing what it was programmed to do, you were just clever. What the hack being suggested here would require is re-writing entire parts of the kernel from OUTSIDE of it. Injecting your new code INTO the kernel. Tricking your CPU into executing that code as Ring-0 (the kernel). Then having what ever you do INSIDE ring-0 not bring the whole house of cards crashing down in the process. As you fiddle with raw memory locations/address to grab what ever you were looking for.
    - sjtgraham 10y ago
      Jailbreaking does involve kernel patching and AppStore apps run as the mobile user, not root.
      - valarauca1 10y ago
        Ah very sorry. I shouldn't have commented on something out of my depth. TIL
valarauca1 10y ago
>You don't necessarily need to reverse engineer the whole thing. If you're just looking to bypass a particular check Yes you can just find the right memory address, start grepping for those lines of ASM and have an RE tool find the related assembly functions. And you design a payload to by-pass these checks. Now how do you use this? Well if it's running you'd need a K-Space arbitrary execution vuln to inject your hostile code. If you want to build your own kernel binary, now you need to forge a cryptographic signature. Neither of these are non-trivial problems. They're actually EXTREMELY difficult problems. >Surely no one here has ever done anything of the sort. I'm not saying this isn't _ever_ done. It's within the realm of Nation-State adversaries. But if your threat-model includes the USA/Russian Federation/People Republic of China there's already a laundry list of reason you shouldn't be using iOS or really any smart phone period.

justaman 10y ago

You would never even keep up with the updates.

derefr 10y ago
A particular type of "bypassing a check" is the goal of jailbreaking—and it's just redone for every update. People with the right motivation can do crazy things.
- valarauca1 10y ago
  This is a false comparison. Jail-breaking is just a privilege escalation. You were a $USER, now you are $ROOT. This is just tricking the kernel. Fundamentally the kernel is just doing what it was programmed to do, you were just clever. What the hack being suggested here would require is re-writing entire parts of the kernel from OUTSIDE of it. Injecting your new code INTO the kernel. Tricking your CPU into executing that code as Ring-0 (the kernel). Then having what ever you do INSIDE ring-0 not bring the whole house of cards crashing down in the process. As you fiddle with raw memory locations/address to grab what ever you were looking for.
  - sjtgraham 10y ago
    Jailbreaking does involve kernel patching and AppStore apps run as the mobile user, not root.
    - valarauca1 10y ago
      Ah very sorry. I shouldn't have commented on something out of my depth. TIL

valarauca1 10y ago

>You don't necessarily need to reverse engineer the whole thing. If you're just looking to bypass a particular check Yes you can just find the right memory address, start grepping for those lines of ASM and have an RE tool find the related assembly functions. And you design a payload to by-pass these checks. Now how do you use this? Well if it's running you'd need a K-Space arbitrary execution vuln to inject your hostile code. If you want to build your own kernel binary, now you need to forge a cryptographic signature. Neither of these are non-trivial problems. They're actually EXTREMELY difficult problems. >Surely no one here has ever done anything of the sort. I'm not saying this isn't _ever_ done. It's within the realm of Nation-State adversaries. But if your threat-model includes the USA/Russian Federation/People Republic of China there's already a laundry list of reason you shouldn't be using iOS or really any smart phone period.