Apple Silicon – core-jmp

// Apple Silicon

3 posts

iBoot SMMU Bypass and Kernelcache Struct Forgery on Apple Silicon

Apple Silicon's chain of trust hands the XNU kernel an SMMU/IOMMU configuration that iBoot builds once and the OS never re-verifies. An…

oxfemale· Jun 29· 13 min ·124

usbliter8: A BootROM USB Heap Underflow on Apple A12/A13 SecureROM

Apple Silicon95

Apple Silicon Exploit Development

usbliter8: A BootROM USB Heap Underflow on Apple A12/A13 SecureROM

usbliter8 is a new BootROM exploit chain against Apple A12, S4/S5 and A13 SoCs. It chains a 12-byte buffer-underflow primitive in the…

oxfemale· Jun 23· 20 min ·95

Booting into Trust: Reverse Engineering macOS Secure Boot Internals

Apple Silicon56

Apple Silicon Boot ROM

Booting into Trust: Reverse Engineering macOS Secure Boot Internals

The article analyzes the macOS secure boot chain on Apple Silicon, showing how Boot ROM, cryptographic verification, Secure Enclave, and staged bootloaders…

oxfemale· Mar 20· 196 min ·56