Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an interest in jailbreaking and iOS vulnerabilities. I understand the memory aspects and iOS security architecture, but how do I debug a non-jailbroken device? You can run GDB
on a jailbroken device but not normal iOS device. I have read the iOS Hackers Handbook but most of the tools and tricks are outdated now. Also, I know you used to be able to wire a Pod-Gizmo board to get Serial output from an iOS device, is that possible any more? Thanks!
-
Start by learning assembly for arm. It will be the most handy tool ever.– Chris TsiakoulasApr 17, 2016 at 5:58
1 Answer
In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension
As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way
boot-arg and with this arg you will disable AppleMobileFileIntegrity so there will be no sandbox or signature checking
The amfi kext recognizes quite a few boot-args, including:
PE_i_can_has_debugger (see also patch)
amfi_unrestrict_task_for_pid - Allowing the above to proceed even without entitlement
amfi_allow_any_signature - Allowing any digital signature on code, not just Apple's
amfi_get_out_of_my_way - disable amfi
cs_enforcement_disable - Disable code signing enforcement
cs_debug - Debug code signing