4 ms·
Not really, by my understanding. Corellium is effectively providing a hosted virtual machine, presumably running on their own custom hypervisor, with their own
by g_p 6y ago
Not really, by my understanding. Corellium is effectively providing a hosted virtual machine, presumably running on their own custom hypervisor, with their own management stack to give a convenient user experience.
You "spin up" VM-based instances of emulated devices (i.e. booting an emulator from a filesystem image), and can then research vulnerabilities and explore, and downgrade/upgrade iOS versions rapidly, like you can with VMs. Real devices are fused to prevent downgrades.
Side-stepping brute force lockouts on passcode would be irrelevant, since that's enforced on physical devices via the Secure Enclave - even if you dumped the flash from a real device, you'd not be any further forward as you would need the enclave's contents to derive the correct keys to do anything.
- CamJN 6y ago> Real devices are fused to prevent downgrades. Not quite, to install a version of iOS it must be signed by Apple, and Apple stops signing old versions soon after releasing a new one. Further you need to put the phone in recovery mode to install a lower version because the UI simply won't do it. You may be thinking of game consoles, which use fuses to prevent downgrades.
- g_p 6y agoThanks, I was thinking of the server-side AP Token system (i.e. the signed per-device authentication tags that confirm the firmware is up to date and able to be installed), but then ended up describing the Nintendo Switch fuse system. Indeed, in the past I believe people have used SHSH blobs to successfully downgrade, and also if Apple misconfigured their signing server to approve older versions, people have successfully downgraded during the window created due to the misconfiguration.
- saagarjha 6y agoApple's devices have fuses, too, but they ensure that you boot something signed by them.