>You don't necessarily need to reverse engineer the whole thing. If you're just looking to bypass a particular check Yes you can just find the right memory add

>You don't necessarily need to reverse engineer the whole thing. If you're just looking to bypass a particular check Yes you can just find the right memory address, start grepping for those lines of ASM and have an RE tool find the related assembly functions. And you design a payload to by-pass these checks. Now how do you use this? Well if it's running you'd need a K-Space arbitrary execution vuln to inject your hostile code. If you want to build your own kernel binary, now you need to forge a cryptographic signature. Neither of these are non-trivial problems. They're actually EXTREMELY difficult problems. >Surely no one here has ever done anything of the sort. I'm not saying this isn't _ever_ done. It's within the realm of Nation-State adversaries. But if your threat-model includes the USA/Russian Federation/People Republic of China there's already a laundry list of reason you shouldn't be using iOS or really any smart phone period.