Kupreev Oleg & Putin Vladimir - Your very own driver for the custom NVMe device from the scratch: reading of the flash memory of iPhone 7

Transcript

1. View Slide

2. iPhone NVM NAND
   Vladimir Putin & Oleg Kupreev
   

   View Slide

3. Research plan
   1. PIN + SWD = Debug
   2. Native driver code
   3. iBoot and iOS drivers
   4. Own driver development. Donor wanted.
   5. OSX driver: C++ derived class. Super class. Driver dependency loading.
   6. Linux drvier: patch standard driver to allocate DMA buffer
   7. What is hacking and reverse engineering?
   8. Bonus – iBoot bug hunting success story
   

   View Slide

4. NAND PINOUT
   

   View Slide

5. Board @key2fr reverse
   

   View Slide

6. Board @key2fr bugfix
   BUGFIX
   

   View Slide

7. SWD DEBUG
   

   View Slide

8. OpenOCD (git version)
   

   View Slide

9. Thunderbolt time
   Sonnet echo board bought
   from underground
   store…
   … to run NVMe under OSX.
   Main idea: NVMe controller
   for MacBook NAND is the
   same.
   

   View Slide

10. Thunder NAND
    • Sonnet Echo
    • @Key2fr NAND board
    

    View Slide

11. Driver for scratch buffer allocation
    

    View Slide

12. Use C++ to deriver the class
    

    View Slide

13. Enforcing system to use our driver
    

    View Slide

14. Success!
    • sdfsfsdfs
    

    View Slide

15. Dump time
    

    View Slide

16. Strings…
    

    View Slide

17. Linux driver story
    Code for Macbook 7,1 support is already in the kernel
    

    View Slide

18. Linux driver story
    • Scratch buffer allocation
    

    View Slide

19. Linux driver story
    • Mem allocation failure 8(. Still some research to do…
    

    View Slide

20. Reverse Engineering = HardwaRE + SoftwaRE
    1.Hardware analysis
    2.SWD debug
    3.Existing driver code analysis
    4.Own driver development
    5.iBoot dump
    6.iBoot reverse
    7.Platform attack
    

    View Slide

21. iBoot source code recovery
    OpenSSL used for Linux compatibility
    

    View Slide

22. AFL to fuzz’em all
    

    View Slide

23. BUG triggered!
    

    View Slide

24. BUG up to source code
    Exists in iBoot up to iOS 8.xx
    NULL pointer dereference – non exploitable
    

    View Slide

25. …
    Questions?
    

    View Slide