I made an ImHex pattern file for the ftab file format used for Apple C1 firmware and Apple accessories gist.github.com/matteyeux/d1...
Today is December 1st, and it's your yearly reminder that Stefan Esser, made a "macOS and iOS Security Internals" Advent calendar playlist on Youtube www.youtube.com/playlist?lis...
macOS and iOS Security Internals Advent Calendar 2022 - YouTube
youtube.com
Next gen Apple Silicon (A19/M5) should have MTE Internally there is a boot-arg to disable it : -disable_mte
Is it common to see tests added by SEAR Red Team in XNU source code (rel/xnu-11215)
how do you design a privacy-preserving ML inference system? Peeking Inside Apple's Private Cloud Compute, with art by @restlessrice.bsky.social research.meekolab.com/peeking-insi...
Peeking Inside Apple's Private Cloud Compute
An unprecedented look into Apple Intelligence's internal server tools and security features
research.meekolab.com
How does the new iOS inactivity reboot work? What does it protect from? I reverse engineered the kernel extension and the secure enclave processor, where this feature is implemented. naehrdine.blogspot.com/2024/11/reve...
Reverse Engineering iOS 18 Inactivity Reboot
Wireless and firmware hacking, PhD life, Technology
naehrdine.blogspot.com
ARMv7m core, started when the sep-firmware is loaded. It's firmware can be dumped but you need a special device...
matteyeux@matteyeux.bsky.social · 2y agoI have not seen yet any research the Secure Enclave Boot Monitor
I have not seen yet any research the Secure Enclave Boot Monitor
I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable.
Filippo Valsorda@filippo.abyssdomain.expert · 2y agoThis might be the best executed supply chain attack we've seen described in the open, and it's a nightmare scenario: malicious, competent, authorized upstream in a widely used library. Looks like this got caught by chance. Wonder how long it would have taken otherwise.
Old plugin I made for Binary Ninja to have the function doc of a native Windows function
Linux ARM64 Kernel debugging in Binary Ninja. The target runs in qemu.
Some info about DFU mode on iPhone 15 Pro : DFU with buttons goes into "Port DFU" (USB-C Controller DFU) If you use macvdmtool you can boot in DFU "Debug USB" then get OG USB string with a kis compatible tool like irecovery x.com/ghidraninja/...
3 bugs, including a codesign bypass 😵💫 support.apple.com/en-us/HT213926