5 ms·

Note that this is not a jail-broken iPhone. This is a regular iPhone with latest OS with code signing.

• DougBTX 17y ago
  I enjoy the idea of return oriented programming, piecing together an exploit from your host app's binary. Worth noting that they didn't break out of the sandbox, an app downloaded from the App Store could get access to the same data they did.
  • tptacek 17y ago
    Did they ROP the iPhone, or was is a straight-up ret2libc? Ret2libc is an ancient technique.
    • DougBTX 17y ago
      More details here http://blog.zynamics.com/ http://blog.zynamics.com/ tomorrow - doesn't sound like it is straight up, depends what they mean by "chained".
      • tptacek 17y ago
        Ok, it sounds like Halvar is just rejecting the term ROP, and you're right, that's what it is.