john

@nyan_satan

20 | Male | F20.0 | Skeuomorphism | iOS 6 | Apple Internal

nyansatan.github.io
Vrijeme pridruživanja: listopad 2015.
231 fotografija ili videozapis Fotografije i videozapisi

Tweetovi

Blokirali ste korisnika/cu @nyan_satan

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @nyan_satan

  1. Prikvačeni tweet
    2. svi 2017.

    iOS Dualboot - (almost) complete guide

    41 reply 169 proslijeđenih tweetova 593 korisnika označavaju da im se sviđa
    Poništi
  2. prije 2 sata

    So finding that untethered iBoot-1145.3(.3) 0day is just not my fate And all the people who could help me with that are so fucking tired of my annoyance that no longer even talk to me

    1 reply 2 proslijeđena tweeta 4 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  3. prije 2 sata

    Anyway, I think I'm done with all this nonsense, completely this time. I struggle with F20.0 and people with F20.0 are usually dumber than healthy people - I feel that every day I live this frigging life

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  4. prije 2 sata

    On the other hand, someone told me I’m on “the right path”, when I told them about this discovery, so maybe it’s not that useless in the end?

    1 reply 1 proslijeđeni tweet 6 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  5. prije 2 sata

    Unfortunately, certificate data isn’t modified in any way while validation, so that bug doesn’t seem to be very useful. Maybe there’s a point to look inside of PKI code?

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  6. prije 2 sata

    For example, you can make CERT’s buffer length value a very big number, overlaping the Image3, load area, SRAM itself… By constructing malformed certificate I managed to trigger ARM prefetch abort exception (it tried to read somewhere far behind the SRAM bounds)

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  7. prije 2 sata

    So by setting shsh_tag->itBufferLength to a high enough value, but not that high to overflow sizeNoPack bounds, you can corrupt CERT tag header and data!

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  8. prije 2 sata

    Let’s return to SHSH’s buffer length validation. As you can see it’s only validated not to overlap Image3’s sizeNoPack (whole Image3’s meaningful data length minus header), but not to overlap CERT that lies right after SHSH!

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  9. prije 2 sata

    SHSH is stored encrypted on device, so before actual validation it needs to be decrypted. That’s where image3AESDecryptUsingLocalKey() comes to a rescue! It takes just 2 args: the address of buffer and its length:

    1 reply 1 proslijeđeni tweet 6 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  10. prije 2 sata

    3) CERT memory corruption The most interesting bug, discovered only 1.5 months ago Look at this flow:

    1 reply 2 proslijeđena tweeta 8 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  11. prije 2 sata

    A5’s malloc isn’t that fatalistic and just returns NULL. Some USB nonsense fails to be allocated and a device just disconnects

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  12. prije 2 sata

    On A6 it leads to a panic! But don’t worry, it’s just an assertion in malloc() (“malloc() must allocate at least one byte” or something like this) triggered when it cannot allocate anything

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  13. prije 2 sata

    But this buffer is just never freed. By sending correctly signed and yet unpersonalized (or with mismatching constraints) Image3s you can fill out the heap completely

    1 reply 1 proslijeđeni tweet 6 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  14. prije 2 sata

    The caller then passes it to image3InstantiateFromBuffer() with copyBuffer arg set to true. That arg makes it allocate a new buffer on the heap for the image and copy it to there

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  15. prije 2 sata

    When verify_signature_with_chain() validates a certificate, it also parses its extensions, and one of the extensions - a nested image - is returned to a caller (image3PKIVerifyHash() is a wrapper around verify_signature_with_chain())

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  16. prije 2 sata

    2) Nested image memory leak Inside of every Image3’s CERT there’s another little Image3 called “nested image” used for most of constraint validations (CPID, CEPO, PROD, OVRD and etc. go here)

    1 reply 2 proslijeđena tweeta 9 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  17. prije 2 sata

    But unfortunately checks around it are too good (are they actually?)

    1 reply 1 proslijeđeni tweet 6 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  18. prije 2 sata

    Although the expression is arithmetically same, there’s no summing anymore, only subtraction. Underflowing the right part of the expression would have been very convenient, as it will allow arbitrary number of bytes to be memsetted

    1 reply 1 proslijeđeni tweet 6 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  19. prije 2 sata

    On A6 (and most likely on any of A5) Apple mitigated that in the following way:

    1 reply 1 proslijeđeni tweet 7 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  20. prije 2 sata

    SHSH tag data is then erased using memset() even if signature check failed. That very high value of shsh_tag->itBufferLength is passed as length. Such action leads to a hang

    1 reply 2 proslijeđena tweeta 6 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  21. prije 2 sata

    This line validates buffer length of SHSH tag. But if we set shsh_tag->itBufferLength to a high enough value (near 0xFFFFFFFF), the sum will overflow and become a small number, so the check will be passed

    1 reply 1 proslijeđeni tweet 6 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi

@nyan_satan još nije objavio nijedan Tweet.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·