Siguza/ios-resources

# iOS Hacking 资源 ## 基础 官方参考： - [ARMv8 指令集概述](https://www.element14.com/community/servlet/JiveServlet/previewBody/41836-102-1-229511/ARM.Reference_Manual.pdf)（较短，目前有些过时） - [ARMv8 架构参考手册](https://developer.arm.com/docs/ddi0487/latest)（较长） - [ARM A-Profile 探索工具](https://developer.arm.com/products/architecture/cpu-architecture/a-profile/exploration-tools)（同上，但为机器可读格式） - [ARM 系统架构软件标准](https://developer.arm.com/architectures/system-architectures/software-standards)（ABI、扩展等） - [Clang 指针认证 ABI](https://github.com/apple/llvm-project/blob/apple/main/clang/docs/PointerAuthentication.rst) 我个人编写的： - [arm64 汇编速成课](https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md) ## 内部原理 **Mach-O** - m4b - [Mach-O 二进制文件](http://www.m4b.io/reverse/engineering/mach/binaries/2015/03/29/mach-binaries.html) - Jonathan Levin - [DYLD DetaYLeD](http://www.newosxbook.com/articles/DYLD.html) - Jonathan Levin - [代码签名](http://www.newosxbook.com/articles/CodeSigning.pdf) **沙盒** - Jonathan Levin - Apple 沙盒（[视频](https://youtu.be/mG715HcDgO8)和[幻灯片](http://newosxbook.com/files/HITSB.pdf)） - iBSparkes - [破坏 Entitlements](https://sparkes.zone/blog/ios/2018/04/06/diving-into-the-kernel-entitlements.html) - stek29 - [Shenanigans, Shenanigans!](https://stek29.rocks/2018/12/11/shenanigans.html) - argp - [对抗 com.apple.security.sandbox](https://census-labs.com/media/sandbox-argp-csw2019-public.pdf) **IPC** - Apple - Mach（[概述](https://developer.apple.com/library/content/documentation/Darwin/Conceptual/KernelProgramming/Mach/Mach.html)和 API 文档（位于[XNU 源码](https://github.com/apple-oss-distributions/xnu)的 `osfmk/man/index.html` 中）） - nemo - [Mach 和 MIG](https://www.exploit-db.com/papers/13176/)（示例已过时且适用于 PPC/Intel，但描述仍然准确） - Ian Beer - Apple IPC（[视频](https://vimeo.com/127859750)和[幻灯片](https://thecyberwire.com/events/docs/IanBeer_JSS_Slides.pdf)） **文件系统** - Apple - [APFS 参考](https://developer.apple.com/support/apple-file-system/Apple-File-System-Reference.pdf) - stek29 - [LightweightVolumeManager::\_mapForIO](https://stek29.rocks/2018/01/22/lwvm-mapforio.html) - bxl1989 - [理解与攻击 Apple 文件系统](https://bxl1989.github.io/2019/01/17/apfs-remount.html) **内核** - Apple - [内核编程指南](https://developer.apple.com/library/content/documentation/Darwin/Conceptual/KernelProgramming) - Apple - [IOKit 基础](https://developer.apple.com/library/content/documentation/DeviceDrivers/Conceptual/IOKitFundamentals) - Apple - [关于虚拟内存系统](https://developer.apple.com/library/content/documentation/Performance/Conceptual/ManagingMemory/Articles/AboutMemory.html) - qwertyoruiopz - 攻击 XNU（第[一部分](https://web.archive.org/web/20160131061526/http://blog.qwertyoruiop.com/?p=38)和[第二部分](https://web.archive.org/web/20160131061526/http://blog.qwertyoruiop.com/?p=48)） - Stefan Esser - [内核堆](https://web.archive.org/web/20220819043107/https://gsec.hitb.org/materials/sg2016/D2%20-%20Stefan%20Esser%20-%20iOS%2010%20Kernel%20Heap%20Revisited.pdf) - stek29 - [NVRAM 锁定/解锁](https://stek29.rocks/2018/06/26/nvram.html) **内核完整性** - xerub - [Tick Tock](https://xerub.github.io/ios/kpp/2017/04/13/tick-tock.html) - Siguza - [KTRR](https://blog.siguza.net/KTRR/) - Jonathan Levin - [Casa de PPL](http://newosxbook.com/articles/CasaDePPL.html) - Brandon Azad - KTRW：打造可调试 iPhone 的之旅（[博客文章](https://googleprojectzero.blogspot.com/2019/10/ktrw-journey-to-build-debuggable-iphone.html)和[视频](https://media.ccc.de/v/36c3-10806-ktrw_the_journey_to_build_a_debuggable_iphone)） **控制流完整性** - Brandon Azad - [探究 iPhone XS 上的指针认证](https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html) - Qualcomm 产品安全 - [ARMv8.3 上的指针认证](https://www.qualcomm.com/media/documents/files/whitepaper-pointer-authentication-on-armv8-3.pdf) - Roberto Avanzi - QARMA 分组密码家族（[论文](https://eprint.iacr.org/2016/444.pdf)和[演示文稿](https://www.nuee.nagoya-u.ac.jp/labs/tiwata/fse2017/slides/05-02.pdf)） - Roberto Avanzi - [轻量级接受的 Crypto](https://web.archive.org/web/20201216030432/http://tce.webee.eedev.technion.ac.il/wp-content/uploads/sites/8/2016/05/light-crypto-public-2016.04.20.pdf) - Rui Zong 和 Xiaoyang Dong - [对 QARMA 分组密码的中间相遇攻击](https://eprint.iacr.org/2016/1160.pdf) **硬件缓解措施** - Siguza - [APRR](https://blog.siguza.net/APRR/) - Siguza - [PAN](https://blog.siguza.net/PAN/) - Sven Peter - [SPRR & GXF](https://blog.svenpeter.dev/posts/m1_sprr_gxf/) - VoidiStaff - [JITCage](https://web.archive.org/web/20230210051217/https://voidistaff.github.io/safari/2023/01/01/about-jitcage-on-ios.html) **软件缓解措施** - blacktop - [解剖 Lockdown Mode](https://github.com/blacktop/presentations/blob/main/0x41con_2023/PDF/AnatomyOfLockdownMode.pdf) - Csaba Fitzl - [Launch 与 Environment 约束深度剖析](https://theevilbit.github.io/posts/launch_constraints_deep_dive/) **Web** - Samuel Groß & Amy Burnett - 2022 年攻击 JavaScript 引擎（[视频](https://www.youtube.com/watch?v=FK2-1FAbbXA)和[幻灯片](https://saelo.github.io/presentations/offensivecon_22_attacking_javascript_engines.pdf)） **远程目标** - Natalie Silvanovich - [iPhone 的完全远程攻击面](https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html) **硬件** - Ramtin Amin - [Lightning 接口](https://web.archive.org/web/20220107101537/http://ramtin-amin.fr/tristar.html) - Ramtin Amin - [NVMe NAND 存储](https://web.archive.org/web/20200217151015/http://ramtin-amin.fr/nvmepcie.html) - Ramtin Amin - [iPhone PCIe（dump 6s BootROM）](https://web.archive.org/web/20200217151824/http://ramtin-amin.fr/nvmedma.html) - Nyan Satan - [Apple Lightning](https://nyansatan.github.io/lightning/) **SEP** - Tarjei Mandt, Mathew Solnik, David Wang - [揭秘 Secure Enclave Processor](https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-Demystifying-The-Secure-Enclave-Processor.pdf) - David Wang, Chris Wade - [SEPOS：一次引路之旅](https://data.hackinn.com/ppt/2018%E8%85%BE%E8%AE%AF%E5%AE%89%E5%85%A8%E5%9B%BD%E9%99%85%E6%8A%80%E6%9C%AF%E5%B3%B0%E4%BC%9A/SEPOS%EF%BC%9AA%20Guided%20Tour.pdf) **Bootloader** - Jonathan Levin - [iBoot](http://newosxbook.com/bonus/iBoot.pdf) **内存安全** - Saar Amar - [一把 CHERI](https://msrc-blog.microsoft.com/2022/01/20/an_armful_of_cheris/) - Saar Amar - 通过示例进行 MTE 安全分析（[视频](https://www.youtube.com/watch?v=LV8BK1ns1Ow)和[幻灯片](https://github.com/saaramar/security_analysis_mte/blob/main/Security%20Analysis%20of%20MTE%20Through%20Examples.pdf)) - Saar Amar - Firebloom（[介绍](https://saaramar.github.io/iBoot_firebloom/), [类型描述符](https://saaramar.github.io/iBoot_firebloom_type_desc/)） ## 分析文章 - geohot - [evasi0n7](http://geohot.com/e7writeup.html) - Jonathan Levin - TaiG 8.0 - 8.1.2（第[一部分](http://www.newosxbook.com/articles/TaiG.html)和[第二部分](http://www.newosxbook.com/articles/TaiG2.html)） - Jonathan Levin - TaiG 8.1.3 - 8.4（第[一部分](http://www.newosxbook.com/articles/28DaysLater.html)和[第二部分](http://www.newosxbook.com/articles/HIDeAndSeek.html)） - Jonathan Levin - [谁还需要 task_for_pid 呢？](http://newosxbook.com/articles/PST2.html) - qwertyoruiopz - [关于 “tpwn” 本地权限提升](https://web.archive.org/web/20160131055957/http://blog.qwertyoruiop.com/?p=69) - Ian Beer - [task_t 的潜在危害](https://googleprojectzero.blogspot.ch/2016/10/taskt-considered-harmful.html) - jndok - [在 OS X 上利用 Pegasus](https://jndok.github.io/2016/10/04/pegasus-writeup/) - Siguza - [在 iOS 上利用 Pegasus](https://blog.siguza.net/cl0ver/) - Ian Beer - mach_portal（[分析文章](https://project-zero.issues.chromium.org/issues/42452496#comment3)和[演示幻灯片](https://project-zero.issues.chromium.org/action/issues/42452496/attachments/59037116?download=false)) - Ian Beer - [iOS 上面向异常的利用](https://googleprojectzero.blogspot.ch/2017/04/exception-oriented-exploitation-on-ios.html) - Jonathan Levin - [Phœnix](http://newosxbook.com/files/PhJB.pdf) - Gal Beniamini - Over The Air（第[一部分](https://googleprojectzero.blogspot.ch/2017/09/over-air-vol-2-pt-1-exploiting-wi-fi.html), [第二部分](https://googleprojectzero.blogspot.ch/2017/10/over-air-vol-2-pt-2-exploiting-wi-fi.html)和[第三部分](https://googleprojectzero.blogspot.ch/2017/10/over-air-vol-2-pt-3-exploiting-wi-fi.html)） - Siguza - [v0rtex](https://blog.siguza.net/v0rtex/) - Ian Beer - [async_wake_ios](https://project-zero.issues.chromium.org/issues/42450458#comment4) - Siguza - [IOHIDeous](https://blog.siguza.net/IOHIDeous/) - Jonathan Levin - QiLin（[PDF](http://newosxbook.com/QiLin/qilin.pdf)和[API](http://newosxbook.com/QiLin/)) - Brandon Azad - [一个有趣的 XNU 信息泄露](https://bazad.github.io/2018/03/a-fun-xnu-infoleak/) - jeffball - [nepc_client_action 中的堆溢出](https://github.com/grimm-co/NotQuite0DayFriday/blob/bcd6a4f21fb12ac058e67a0b93e5f2a3640fc253/2018.04.06-macos/notes.txt) - xerub - [De Rebus Antiquis](https://xerub.github.io/ios/iboot/2018/05/10/de-rebus-antiquis.html) - Ian Beer - [multi_path](https://project-zero.issues.chromium.org/issues/42450613#comment4) - Brandon Azad - [blanket](https://github.com/bazad/blanket) - Brandon Azad - [voucher_swap](https://googleprojectzero.blogspot.com/2019/01/voucherswap-exploiting-mig-reference.html) - iBSparkes - [MachSwap](https://sparkes.zone/blog/ios/2019/04/30/machswap-ios-12-kernel-exploit.html) - Ian Beer - [在 XNU 中分裂原子](https://googleprojectzero.blogspot.com/2019/04/splitting-atoms-in-xnu.html) - Natalie Silvanovich - [CVE-2019-8646 的诸多可能性](https://googleprojectzero.blogspot.com/2019/08/the-many-possibilities-of-cve-2019-8646.html) - Google Project Zero - [深度剖析在野发现的 iOS 漏洞利用链](https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html) - Ian Beer - 第[一部分](https://googleprojectzero.blogspot.com/2019/08/in-wild-ios-exploit-chain-1.html), [二部分](https://googleprojectzero.blogspot.com/2019/08/in-wild-ios-exploit-chain-2.html), [三部分](https://googleprojectzero.blogspot.com/2019/08/in-wild-ios-exploit-chain-3.html), [四部分](https://googleprojectzero.blogspot.com/2019/08/in-wild-ios-exploit-chain-4.html), [五部分](https://googleprojectzero.blogspot.com/2019/08/in-wild-ios-exploit-chain-5.html)和[植入物拆解](https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html) - Samuel Groß - [JSC 漏洞利用](https://googleprojectzero.blogspot.com/2019/08/jsc-exploits.html) - a1exdandy - [checkm8 漏洞利用技术分析](https://habr.com/en/company/dsec/blog/472762/) - Ned Williamson - [SockPuppet](https://googleprojectzero.blogspot.com/2019/12/sockpuppet-walkthrough-of-kernel.html) - littlelailo - 旧事传说：untethering iOS 11（[视频](https://media.ccc.de/v/36c3-11034-tales_of_old_untethering_ios_11)和[基本概述](https://github.com/JakeBlair420/Spice/blob/master/README.md)） - Samuel Groß - 远程 iPhone 漏洞利用（第[一部分](https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-1.html), [二部分](https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-2.html)和[三部分](https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-part-3.html)） - Siguza - [cuck00](https://blog.siguza.net/cuck00/) - Justin Sherman - [used_sock](https://jsherman212.github.io/2020/02/06/used_sock.html) - Samuel Groß - [Fuzzing ImageIO](https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html) - Siguza - [Psychic Paper](https://blog.siguza.net/psychicpaper/) - Brandon Azad - [一个 Byte 统治一切](https://googleprojectzero.blogspot.com/2020/07/one-byte-to-rule-them-all.html) - Brandon Azad - [Apple 的核心是 PPL：破坏 XNU 内核的内核](https://googleprojectzero.blogspot.com/2020/07/the-core-of-apple-is-ppl-breaking-xnu.html) - windknown - [攻击 SEP 的安全启动](https://github.com/windknown/presentations/blob/master/Attack_Secure_Boot_of_SEP.pdf) - Ian Beer - [iOS 零点击无线电近距漏洞利用的漫长旅程](https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html) - Alex Plaskett - [Apple macOS 6LowPAN 漏洞](https://alexplaskett.github.io/CVE-2020-9967/) - Luca Moro - [iOS 内核漏洞 CVE-2021-1782 的分析与利用](https://www.synacktiv.com/publications/analysis-and-exploitation-of-the-ios-kernel-vulnerability-cve-2021-1782) - Alex Plaskett - [XNU 内核内存泄露](https://alexplaskett.github.io/CVE-2021-30660/) - Jack Dates - [JavaScriptCore WebAssembly 漏洞利用](https://blog.ret2.io/2021/06/02/pwn2own-2021-jsc-exploit/) - Mickey Jin - [macOS 和 iOS 中的 CVMServer 漏洞](https://www.trendmicro.com/en_us/research/21/f/CVE-2021-30724_CVMServer_Vulnerability_in_macOS_and_iOS.html) - K³ - [从零开始编写 iOS 内核漏洞利用](https://secfault-security.com/blog/chain3.html) - CodeColorist - [Mistuned 第一部分：客户端 XSS 到计算器及更多](https://blog.chichou.me/2021/08/04/mistuned-part-i/) - CodeColorist - [Mistuned 第二部分：蝴蝶效应](https://blog.chichou.me/2021/08/05/mistuned-part-ii/) - Justin Sherman - [CVE-2021-30656 内核信息泄露](https://jsherman212.github.io/2021/08/19/CVE-2021-30656.html) - Samuel Groß - [攻击 JavaScript 引擎](http://www.phrack.org/issues/70/3.html#article) - Samuel Groß - [编译你自己的类型混淆](http://www.phrack.org/issues/70/9.html#article) - Adam Donenfeld - [（解）码一个 iOS 内核漏洞](http://www.phrack.org/issues/70/8.html#article) - xerub - [竞技场中的熊](http://www.phrack.org/issues/70/12.html#article) - Linus Henze - [Fugu14](https://raw.githubusercontent.com/LinusHenze/Fugu14/master/Writeup.pdf) - Justin Sherman - [使用 IOMFB 攻陷 iOS <=14.7](https://jsherman212.github.io/2021/11/28/popping_ios14_with_iomfb.html) - Ian Beer & Samuel Groß - [深入剖析 NSO 的 iMessage 零点击漏洞利用](https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html) - Ian Beer & Samuel Groß - [FORCEDENTRY：沙盒逃逸](https://googleprojectzero.blogspot.com/2022/03/forcedentry-sandbox-escape.html) - Ian Beer - [CVE-2021-30737，@xerub 的 2021 iOS ASN.1 漏洞](https://googleprojectzero.blogspot.com/2022/04/cve-2021-30737-xerubs-2021-ios-asn1.html) - Ian Beer - [CVE-2021-1782，voucher 中的一个 iOS 在野漏洞](https://googleprojectzero.blogspot.com/2022/04/cve-2021-1782-ios-in-wild-vulnerability.html) - Ivan Fratric - [DER Entitlements：Psychic Paper 的（简短）回归](https://googleprojectzero.blogspot.com/2023/01/der-entitlements-brief-return-of.html) - Félix Poulin-Bélanger - [kfd](https://github.com/felix-pb/kfd#where-to-find-detailed-write-ups-for-the-exploits) - Asahi Lina - [AGX 漏洞利用](https://asahilina.net/agx-exploit/) - Gergely Kalman - [librarian - Music 和 TV 中的 macOS TCC 绕过](https://gergelykalman.com/CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV.html) - Ian Beer - [对一个在野 iOS Safari WebContent 到 GPU 进程漏洞利用的分析](https://googleprojectzero.blogspot.com/2023/10/an-analysis-of-an-in-the-wild-ios-safari-sandbox-escape.html) - DFSEC - [太 FAR-out 了，伙计](https://blog.dfsec.com/ios/2023/11/19/thats-far-out-man/) - Mickey Jin - [xpcroleaccountd Root 权限提升](https://jhftss.github.io/CVE-2023-42942-xpcroleaccountd-Root-Privilege-Escalation/) - Alfie CG - [Tr：为 iOS 开发确定性内核漏洞利用](https://alfiecg.uk/2025/03/01/Trigon.html) - Alfie CG & opa334 - [2025 年 iOS 越狱现状](https://raw.githubusercontent.com/alfiecg24/Presentations/main/The%20State%20of%20iOS%20Jailbreaking%20in%202025.pdf) - Siguza - [tachy0n](https://blog.siguza.net/tachy0n/) ## 其他列表 - qwertyoruiopz - iOS 逆向工程（[Wiki](https://github.com/kpwn/iOSRE/tree/master/wiki)和[论文](https://github.com/kpwn/iOSRE/tree/master/resources/papers)) - Google Project Zero - [Ian Beer 消灭的所有 Bug](https://project-zero.issues.chromium.org/issues?q=reporter:(ianbeer@google.com)&s=created_time:desc) - Google Project Zero - [所有 Apple Bug](https://project-zero.issues.chromium.org/issues?q=customfield1352808:Apple&s=created_time:desc) - Google Project Zero - [近期 iOS 内核漏洞利用综述](https://googleprojectzero.blogspot.com/2020/06/a-survey-of-recent-ios-kernel-exploits.html) ## 社区 “Hack Different” 是一个 Discord 服务器，主要讨论与 Apple 平台相关或周边的破解、逆向工程和开发话题。 这里的氛围很轻松，是与其他研究者和爱好者交流互动的好地方。 [](https://discord.gg/NAxRYvysuc)

标签：ARM64, CVE监控, iOS, UML, 云资产清单, 系统内核, 逆向工程