4

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an interest in jailbreaking and iOS vulnerabilities. I understand the memory aspects and iOS security architecture, but how do I debug a non-jailbroken device? You can run GDB on a jailbroken device but not normal iOS device. I have read the iOS Hackers Handbook but most of the tools and tricks are outdated now. Also, I know you used to be able to wire a Pod-Gizmo board to get Serial output from an iOS device, is that possible any more? Thanks!

  • Start by learning assembly for arm. It will be the most handy tool ever. – Chris Tsiakoulas Apr 17 '16 at 5:58
2

In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension

As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg you will disable AppleMobileFileIntegrity so there will be no sandbox or signature checking

The amfi kext recognizes quite a few boot-args, including:

PE_i_can_has_debugger (see also patch)

amfi_unrestrict_task_for_pid - Allowing the above to proceed even without entitlement
amfi_allow_any_signature - Allowing any digital signature on code, not just Apple's
amfi_get_out_of_my_way - disable amfi
cs_enforcement_disable - Disable code signing enforcement
cs_debug - Debug code signing

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.