4

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an interest in jailbreaking and iOS vulnerabilities. I understand the memory aspects and iOS security architecture, but how do I debug a non-jailbroken device? You can run GDB on a jailbroken device but not normal iOS device. I have read the iOS Hackers Handbook but most of the tools and tricks are outdated now. Also, I know you used to be able to wire a Pod-Gizmo board to get Serial output from an iOS device, is that possible any more? Thanks!

Improve this question
1
  • Start by learning assembly for arm. It will be the most handy tool ever.
    – Chris Tsiakoulas
    Apr 17, 2016 at 5:58

1 Answer 1

Reset to default
2

In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension

As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg you will disable AppleMobileFileIntegrity so there will be no sandbox or signature checking

The amfi kext recognizes quite a few boot-args, including:

PE_i_can_has_debugger (see also patch)

amfi_unrestrict_task_for_pid - Allowing the above to proceed even without entitlement
amfi_allow_any_signature - Allowing any digital signature on code, not just Apple's
amfi_get_out_of_my_way - disable amfi
cs_enforcement_disable - Disable code signing enforcement
cs_debug - Debug code signing
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.