Sabitlenmiş Tweet
Min(Spark) Zheng
277 posts
Min(Spark) Zheng
@SparkZheng
Android/iOS Senior Security Engineer @ Alibaba, CUHK PhD, a member of Blue-lotus and Insight-labs, worked in FireEye , Baidu and Tencent.
Katılım Aralık 2013
84 Takip Edilen23.4K Takipçiler
Min(Spark) Zheng retweetledi
We planned to open source checkra1n in 2020, but unfortunately we're not quite ready for a full release yet.
HOWEVER: We just open sourced the entirety of PongoOS, including our kernel patchfinder and SEP exploit! All available at: github.com/checkra1n/pong…
English
Min(Spark) Zheng retweetledi
An @objective_see tool, flagged what may be the first instance of malicious code that natively targets Apple Silicon (M1)! 🍎🐛
Read: "Arm'd & Dangerous"
objective-see.com/blog/blog_0x62…
English
Min(Spark) Zheng retweetledi
See No Eval: Runtime Dynamic Code Execution in Objective-C blog.chichou.me/2021/01/16/see…
It reveals more detail that I didn't have time to cover in my previous talk slides
English
Min(Spark) Zheng retweetledi
It's been a long time coming: we’re very excited to announce that virtual iOS-based devices are now available for individual accounts on our groundbreaking security research platform. corellium.com/blog/ios-for-i…
English
You can use frida or lldb to hook or debug iOS apps on MacBook with M1 chip. hits: disable SIP and resign apps.
English
Min(Spark) Zheng retweetledi
Here is a PoC kernel exploit, it demonstrates how to get kernel task port on iOS 13.7. I will update the PoC with a writeup later.
github.com/0x36/oob_events
English
Min(Spark) Zheng retweetledi
Cann’t believe that I also missed the bug. Motived by this blog, I also prepared a blog, sharing another bug in the same extension. blog.pangu.io/?p=221
Ben Hawkes@benhawkes
Our good friend @_bazad has a few things left over in the Project Zero publishing pipeline -- "it's really easy to miss bugs, even ones that you feel should have been obvious".
English
zone_require() mitigation (address verification for Mach port objects) was changed on iOS 13.6, looking forward to seeing a new bypass~
CoolStar@CStar_OW
Who needs a write-up when you can see the source code? tardy0n for iOS 13.0 - 13.5, co-developed by @tihmstar and me: github.com/TheOdysseyJB/O…
English
Min(Spark) Zheng retweetledi
📝 new (guest) blog post:
"CVE-2020–9934: Bypassing TCC
...for unauthorized access to sensitive user data"
🔗 objective-see.com/blog/blog_0x4C…
✍️ by: Matt Shockley (@mattshockl)
"...and then directly modify the TCC database to give myself every TCC entitlement" ...no code required 🤩
English
Min(Spark) Zheng retweetledi
One Byte to Rule Them All: An iOS 13 exploit technique that turns a one-byte kernel heap overflow into an arbitrary physical address mapping primitive, all while avoiding the kernel task port and sidestepping mitigations like PAC, KASLR, and zone_require.
googleprojectzero.blogspot.com/2020/07/one-by…
English
Nice summary
Brandon Azad@_bazad
I've compiled a summary of every original public iOS kernel exploit from app context since iOS 10, describing the high-level exploit flow to get stable kernel read/write. The trends of how these exploits have evolved over time are quite interesting: googleprojectzero.blogspot.com/2020/06/a-surv…
English
Min(Spark) Zheng retweetledi
KTRW now has proper support for kernel debugging iOS 13. It uses checkra1n to insert an XNU kernel extension into the kernelcache before boot.
English
The exp uses IOGraphicsAccelerator2 and IOSurfaceRoot to do heap fengshui in kalloc.16, but the bug is in XNU.
Min(Spark) Zheng@SparkZheng
Cool and good job! I am more interested in what 0day vulnerabilities are used, but the entire payload has been obfuscated and it will take some time to analyze. 😅
English
Cool and good job! I am more interested in what 0day vulnerabilities are used, but the entire payload has been obfuscated and it will take some time to analyze. 😅
@Pwn20wnd@Pwn20wnd
#unc0ver v5.0.1 is now out - unc0ver.dev.
English
Min(Spark) Zheng retweetledi
We are going to release #unc0ver 5.0.0 with support for every signed iOS version on every device using a 0day kernel vulnerability from @Pwn20wnd in sponsorship with phonerebel.com very soon. Update your devices to 13.5 and follow our progress on unc0ver.dev.
English