The vulnerability was explained in more detail in an article [0] submitted earlier this week [1] > Team Pangu demonstrated that they could exploit a bug in the

The vulnerability was explained in more detail in an article [0] submitted earlier this week [1] > Team Pangu demonstrated that they could exploit a bug in the memory controller that manipulates the TZ0 register memory. TZ0 refers to a register that controls the range of SEP memory usage. > @Windknown first introduces the architecture of Apple’s SEP hardware and system. The main processor and the co-processor are isolated and need to communicate through a shared memory mechanism. Subsequently, it explained in detail the process of SEPROM initialization, including the realization of the memory isolation mechanism. The memory isolation mechanism is implemented by the TZO mechanism. > The TZ0 register describes the range of SEP memory usage, and AMCC is used to prohibit the main processor from accessing the memory space of TZO. The epic vulnerability announced this time is in SEPROM. By combining the BOOTROM exploit of checkm8, the IO mapping register can be modified to bypass the memory isolation protection. Then cooperate with the race of the main processor to achieve the purpose of modifying any SEPOS and SEP APP. For example, through the restriction of password input in patch sks, to try to lock the screen password without restriction. > According to Axi0mX, the SEP chip bug can only be triggered if the hacker has physical access to the device and with a BOOTROM exploit like checkm8 or checkra1n. > He also added that this vulnerability cannot be used to jailbreak via a web browser (JailbreakMe) or with an application (unc0ver) because the value in the TZ0 registry cannot be changed after boot. So, unless someone gets his/her hands on your iPhone and puts it in DFU mode, you are safe. [0] https://androidrookies.com/team-pangu-demonstrates-unpatchable-secure-enclave-processor-sep-chip-vulnerability-in-ios/ https://androidrookies.com/team-pangu-demonstrates-unpatchab... [1] https://news.ycombinator.com/item?id=23976506 https://news.ycombinator.com/item?id=23976506