iOS 11.0-11.3.1 rootlessJB： Ian Beer的kernel exploit与Electra团队的封闭式开发

版权申诉

139 浏览量更新于2024-07-18 收藏 509KB PDF 举报

"这篇文档可能涉及的是iOS设备的越狱技术，特别是如何在不重新挂载文件系统为读写模式的情况下进行越狱。文档提到了 Ian Beer，一位知名的iOS安全研究员，他在2018年5月底发布了关于iOS 11.3.1的内核漏洞利用的消息，这为开发越狱工具提供了可能。他发布了两个漏洞利用，分别是 'multi_path' 和 'empty_list'。随后，Electra团队宣布了针对iOS 11.2-11.3.1版本的越狱工具，并开始研发，但这次的研发过程是封闭的，只限于一组开发者和团队内部，目的是防止恶意软件的出现。尽管如此，Electra团队还是发布了一些预告和截图，引发了关注和争议。" 在iOS越狱的世界里，"jailbreak"是指解除对苹果设备操作系统的限制，允许用户安装未经Apple官方App Store批准的应用程序，修改系统设置，以及访问系统文件。在这个过程中，通常需要找到并利用操作系统中的漏洞来获取设备的根权限。文件系统（filesystem）是存储和组织设备上所有文件的结构，"remount as rw"意味着将文件系统从只读模式改为读写模式，这是越狱过程中常见的步骤，以便能够修改系统文件。 Ian Beer的贡献在于他发现了针对iOS 11.3.1的内核漏洞，这些漏洞可以被用来创建越狱工具。他的两个漏洞利用，'multi_path' 和 'empty_list'，可能是利用了不同的系统弱点。内核漏洞利用通常是非常复杂的技术，涉及到对操作系统底层代码的深入理解。 Electra团队的行动则展示了越狱社区的动态。他们基于Ian Beer的漏洞开发了针对特定iOS版本的越狱工具，并选择了一个更为封闭的开发模式，这可能是因为他们想要更谨慎地处理这些敏感的安全信息，以保护用户免受潜在的恶意利用。然而，这种封闭性也引起了社区的一些不满和讨论，因为透明度和开放源代码通常是开源项目和越狱社区的核心价值。这个文档揭示了iOS越狱技术的发展，包括漏洞发现、利用和工具开发的过程，以及在安全性和社区期待之间的平衡。对于想要了解iOS越狱技术的人来说，这是一份有价值的信息来源。

Offsets

On the kernel we have to calculate the struct offsets manually. This can be done in many ways.

We can calculate them by hand, we can disassemble functions referencing to those struct

members, or we could also grab the headers from the XNU source code (need to thank Apple for

open sourcing that) and try our luck in including them into a compilable project, from there just

use the built-in function ‘offsetof(struct type, member)’.

# Disassembling

- Find a reference of the struct member you’re looking for in an open-source function from

XNU

- Get the kernelcache off your device using Apple File Conduit “2” or Cyberduck then

decompress it using lzssdec (Update: on iOS 12 you gotta get it off the ipsw/OTA

package; no more read access to kernelcache)

- Put it a disassembler such as Hopper

- Find the same open-source function (if you can’t ﬁnd it, well not everything is

symbolicated, lookup another one)

- Find the same reference of that, which in this case will not be like “struct.member” or

“struct->member” but like I showed on the previous example, using pointers, so like this

“*(struct + offset)”

# Finding offsets manually:

- First, navigate to the XNU source code by Apple

- Find the desired header

- Calculate the size of everything before our target

- If there’s a type you don’t really recognize, you need to ﬁnd where’s that type deﬁned,

usually just google “typedef unknown_type” and it works :P

- That’s your offset

# Including headers

- Create a header and copy the struct deﬁnition from the header on the XNU source code,

- Also add all type deﬁnitions that you can probably ﬁnd in other headers (-_-)

- Include header in project and do offsetof(struct, member)

Let’s start patching… ourselves

So, the most basic thing you can start with would be getting root. All of our process info gets

stored in the so-called “proc structs” (as seen in this XNU header). Getting root would be

considered a simple task, we just need to override our user id in kernel. Don’t get lost, p_uid

member is not important, the user id that actually gets used, is stored in another structure, the

ones storing our credentials, called “struct ucred” (header).

The ucred structure itself is a member of the proc structure (a pointer to “struct ucred” is also

named as “kauth_cred_t”).

So in short terms:

- Find our proc structure in kernel

- Calculate the ucred structure from there

- Calculate cr_uid (& all that stores a copy of our user id) in it (and optionally cr_gid; if you

want ‘wheel’ group id)

- Write 0 in all of them

In order to ﬁnd the proc structure in kernel we can either ﬁnd “allproc” using patchﬁnding or

kernproc using symbol ﬁnding (_kernproc symbol). From there start iterating and checking the

pid.

If we chose the ﬁrst way:

- Find allproc

- Read 8 bytes from it

- The result is the proc struct of the latest spawned process

- From there start iterating over all the structs. The ﬁrst member (which is at the same

address of the struct itself) of the proc struct will point to the previous spawned process

- If pid == getpid() then we found our proc struct. Pid can be found at offset 0x10 (16 bytes)

from the proc struct

If we choose the second way:

- Find _kernproc symbol (Update: Some devices got 0 symbols on iOS 12 so that might not

be an option on the future)

- Read 8 bytes from it

- The result is the kernel proc struct, which is the very ﬁrst process

- From there start iterating over all the structs. The second member (since a 64bit pointer is

8 bytes, the second member is at the address of the struct + size of ﬁrst member; so

address + 8 bytes) of the proc struct will point to the next process

- If pid == getpid() then we found our proc struct

剩余32页未读，继续阅读

小黑猫成仙

粉丝: 70
资源: 102

iOS 11.0-11.3.1 rootlessJB： Ian Beer的kernel exploit与Electra团队的封闭...

最新资源

iOS 11.0-11.3.1 rootlessJB： Ian Beer的kernel exploit与Electra团队的封闭...

kindle-k4-jailbreak-1.7.N.zip

update_jailbreak_0.4版本

【demx96】美容美甲类网站手机模板.zip

【图像去噪】基于matlab小波域双重局部维纳滤波图像去噪（含PSNR）【含Matlab源码 1642期】.md

【图像去噪】基于matlab自适应双边滤波SAR灰色图像去噪（含PNSR）【含Matlab源码 4232期】.md

小波变换遥感影像（高光谱和多波段）融合（含熵值 相关系数 光谱扭曲度 峰值信噪比）【含Matlab源码 4433期】.md

【图像复原】基于matlab维纳滤波图像复原（含PSNR MSE）【含Matlab源码 4519期】.md

【demx184】器材器械企业通用单独手机模板.zip

heatmap-2.2.1-cp37-cp37m-win_amd64.whl

【图像加密解密】基于matlab混沌+Arnold置乱图像加密解密（含直方图）【含Matlab源码 4479期】.md

最新资源

小波变换遥感影像（高光谱和多波段）融合（含熵值相关系数光谱扭曲度峰值信噪比）【含Matlab源码 4433期】.md