No details have been released. One potential method would involve getting low level code execution on the SEP, but seeing as this is the iPhone 5s, it is also p

No details have been released. One potential method would involve getting low level code execution on the SEP, but seeing as this is the iPhone 5s, it is also possible they have low level code execution on the main AP and are able to access SEP address space to feed it the encrypted keybag in order to decrypt (On iOS devices, you cannot extract the GID key from devices, so you instead need to access the crypto coprocessor(s) and feed it content which you'd like to decrypt)