M1チップの脆弱性M1raclesを読み解く / About the vulnerability on M1 chip called M1racles

by Elvis Shi

Slide 1

Slide 1 text

.νοϓͷ੬ऑੑ .SBDMFTΛಡΈղ͘ f o r J 0 4 % $ +" 1" /

Slide 2

Slide 2 text

..BDΛ࢖ͬͯΔํ!

Slide 3

Slide 3 text

N ?Ч? ϓΪϟʔ͆͆͆

Slide 4

Slide 4 text

೥݄೔

Slide 5

Slide 5 text

ɹमਖ਼ෆՄೳͳ੬ऑੑ͕ൃ֮ʂ ͋ͷ νοϓʹ

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

$16 ϝϞϦ ετϨʔδ ϓϩηε" ϓϩηε# σʔλ

Slide 9

Slide 9 text

$16 ϝϞϦ ετϨʔδ ϓϩηε" ϓϩηε# σʔλ

Slide 10

Slide 10 text

$16 ϝϞϦ ετϨʔδ Ϩδελ ϓϩηε" ϓϩηε# σʔλ "

Slide 11

Slide 11 text

ϓϩηεΛىಈͯ͠ ඪ४ೖྗ͔Βೖྗ଴ͪʹ

Slide 12

Slide 12 text

ผͷಉ໊ʢ࿈ಈʣϓϩηε͔Β ϑΝΠϧͷσʔλΛಡΈࠐΜͰ Ϩδελʹૹ৴

Slide 13

Slide 13 text

ݩͷϓϩηε͕Ϩδελ͔Β ೖྗ͞ΕͨσʔλΛड৴͠

Slide 14

Slide 14 text

ݩͷϓϩηε͕ ಈըΛ࠶ੜ࢝͠ΊΔ

Slide 15

Slide 15 text

IUUQTXXXOJDPWJEFPKQXBUDITN

Slide 16

Slide 16 text

IUUQTEVDLEVDLHPDPN RNSBDMFTUPTYJBXFC

Slide 17

Slide 17 text

IUUQTNSBDMFTDPN

Slide 18

Slide 18 text

'"2 IUUQTNSBDMFTDPN

Slide 19

Slide 19 text

ҎԼɺ'"2ൈਮ

Slide 20

Slide 20 text

2ɿ୭͕ӨڹΛड͚Δͷ͔ શͯͷ.ϢʔβɻͲΜͳ04Ͱ΋௚઀ಈ͍ͯΔݶ ΓӨڹड͚·͢ɻ

Slide 21

Slide 21 text

2ɿ΄͔ͷ"QQMFͷ$16΋ಉ͡੬ऑੑ͕͋Δ ͔ ͸͍ɺগͳ͘ͱ΋ݱࡏ"͸֬ೝࡁΈͰ͢ɻ

Slide 22

Slide 22 text

2ɿ"QQMFҎ֎ͷ$16͸ಉ͡੬ऑੑ͕͋Δ͔ ͍͍͑ɻ

Slide 23

Slide 23 text

2ɿͲ͏΍ͬͯࣗ෼΋कΕ͹͍͍͔ །Ұͷղܾ๏͸7.Ͱ04Λ࣮ߦͤ͞Δ͜ͱͰ͢ɻ

Slide 24

Slide 24 text

2ɿͦͷղܾ๏͸ύϑΥʔϚϯεʹӨڹ͋Δ͔ ͸͍ɺ7.͔ͩΒ૬౰ͳύϑΥʔϚϯε໰୊͕ग़· ͢ɻ

Slide 25

Slide 25 text

2ɿͦΕ͸΍͹ͦ͏ͩͶ ͦ͏Ͱ͢Ͷɺ͔ͩΒ7.Ͱ04ಈ͔͢ͷ΍Ί·͠ΐ ͏͔ɻ

Slide 26

Slide 26 text

2ɿ͜ͷ੬ऑੑ͸࣍ͷ"QQMF4JMMJDPOͰमਖ਼͞ ΕΔ͔ Ξοϓ ϧͷϓϥϯʹ͍ͭͯ͸஌Γ·ͤΜ͕ɺҰൠత ͳ$16։ൃλΠϜϥΠϯ͔Βਪଌ͢Δʹ͸গͳ͘ͱ ΋࣍ͷੈ୅ͷ"QQMF4JMMJDPO΋͜ͷ໰୊͕͋ΔՄೳ ੑ͕ߴ͍Ͱ͢ɺͨͩͦͷ͞Βʹ࣍ͷ$16ͳΒଟ෼म ਖ਼͞ΕͯΔ͔΋͠Ε·ͤΜɻ

Slide 27

Slide 27 text

2ɿϚϧ΢ΣΞ͸͜ͷ੬ऑੑΛར༻ͯ͠ࢲͷ 1$Λ৐ͬऔΔՄೳੑ͸͋Δ͔ ͍͍͑ɻ

Slide 28

Slide 28 text

2ɿϚϧ΢ΣΞ͸͜ͷ੬ऑੑΛར༻ͯ͠ࢲͷݸ ਓ৘ใΛ౪ΊΔ͔ ͍͍͑ɻ

Slide 29

Slide 29 text

2ɿϚϧ΢ΣΞ͸͜ͷ੬ऑੑΛར༻ͯ͠ࢲʹ 3JDLSPMMͱ͍͏ِϦϯΫΛ౿·ͤΔ͔ ͸͍ɺͱݴ͏ΑΓͦΕ͸ผʹ͜ͷ੬ऑੑΛ࢖Θͳ͘ ͯ΋؆୯ʹͰ͖ͪΌ͍·͢ɻ

Slide 30

Slide 30 text

2ɿ͜ͷ੬ऑੑʹΑͬͯ#BE#*04ʹײછ͞Ε ΔՄೳੑ͕͋Δ͔ ͍͍͑ɻ

Slide 31

Slide 31 text

2ɿ͑ʁ͜Εຊ౰ʹ࣮ࡏ͢Δ੬ऑੑͳͷʁ ͸͍ɻ

Slide 32

Slide 32 text

2ɿ͡Ό͋Կ͕໰୊ͳͷʁ ͋ͳͨͷ1$ʹطʹϚϧ΢ΣΞ͕જΜͩ৔߹ɺ͜ͷϚ ϧ΢ΣΞ͸ଞͷϚϧ΢ΣΞͱ૝ఆ֎ͷ௨৴͕ՄೳͰ ͢ɻ

Slide 33

Slide 33 text

2ɿͳΜͩ͜ΕͳΜ͔ͦΜͳʹେͨ͠໰୊͡Ό ͳͦ͞͏͡ΌΜ ͿͬͪΌ͚͜Ε޿ࠂձ͕ࣾ͜ͷ੬ऑੑΛ࢖ͬͯΞϓ ϦؒͷτϥοΩϯάΛ͢Δํ͕ଟ෼൜ࡑʹ࢖͏ΑΓ ༗ҙ͔ٛͱࢥ͍·͢͠ɺͦΕʹ"QQ4UPSFͰ഑৴͞ ΕͯΔΞϓϦͳΒ"QQMF͸΍Ζ͏ͱ͢Ε͹͜Μͳѱ ߦΩϟονͰ͖·͢Αɻ

Slide 34

Slide 34 text

2ɿ͡Ό͋"15߈ܸ͸ʁ "15߈ܸ͸΋ͬͱผͷ࢖͍΍͍͢खஈ͕͋Δ͔Β͜ Μͳ੬ऑੑͳΜͯ൴Βʹͱͬͯҙຯͳ͍Ͱ͢Ͷɻ

Slide 35

Slide 35 text

2ɿ͑ʁͭ·ΓԶ͸͜ͷ໰୊Λؾʹ͢΂͖Ͱ͸ ͳ͍ͱݴͬͯΔʁ ͸͍ɻ

Slide 36

Slide 36 text

2ɿͩͬͨΒ͜ͷ8FCϖʔδͷϙΠϯτ͸ Կʁ ࠷ۙͷ17Ք͗ͷͨΊͷ੬ऑੑใࠂ͕ͲΜͳʹഅࣛ അ͍͔ࣛ͠Λᅑস͏ͨΊͰ͢ɻ͜Μͳʹཱ೿ͳ8FC ϖʔδ͕͋ͬͨΓ͋ͬͪͬͪ͜ͰχϡʔεʹͳͬͯΔ ͔Βͱ͍ͬͯɺͦΕΛຊؾͰؾʹ͢΂͖ͱ͸ݶΓ· ͤΜɻ

Slide 37

Slide 37 text

2ɿͱ͋ΔχϡʔεαΠτ͔Βདྷ͚ͨͲ͜͜· Ͱͷ͜ͱʹ͍ͭͯԿ΋ڭ͑ͯ͘Εͳ͔ͬͨͧʂ Ͱͨ͠Βଟ෼ࠓޙ͸ͦͷχϡʔεαΠτΛಡΉͷ΍Ί Δ΂͖Ͱ͢Ͷɺ൴Β͕͜ͷ8FCϖʔδͷ࠷ॳͷ ஈམ͚ͩಡΜͰ΍Ίͨͷͱಉ͡Α͏ʹɻ

Slide 38

Slide 38 text

2ɿχϡʔεαΠτ͕શ෦μϝͳͷ͔ ͦ͏Ͱ΋ͳ͍Ͱ͢ɺҰ෦ͷϝσΟΞ͸هࣄॻ͘લʹ ͪΌΜͱࢲͱ࿈བྷͯ͠ϑΝΫτνΣοΫΛ͠·ͨ͠ͷ ͰΑ͘Ͱ͖ͯ·ͨ͠Αɻ

Slide 39

Slide 39 text

ੈͷதʹ͸ɺ17Ք͗ͷͨΊʹ ͍͔ʹ΋΍͹ͦ͏ͳλΠτϧ΍಺༰Ͱ ௼ΓهࣄΛॻ͘هऀ΍Ϩϙʔλʔ͕ ͨ͘͞Μ͍·͢ɻ

Slide 40

Slide 40 text

No content

Slide 41

Slide 41 text

} var employedBy = "YUMEMI Inc." var job = "iOS Tech Lead" var favoriteLanguage = "Swift" var twitter = "@lovee" var qiita = "lovee" var github = "el-hoshino" var additionalInfo = """ 5෼ͷLTͳͷʹεϥΠυ͕50ຕۙ͋͘ΔΜͩͥʁ """ final class Me: Developable, Talkable {

Slide 42

Slide 42 text

͜ΕͰऴΘΓͱࢥͬͨʁ

Slide 43

Slide 43 text

·ͩ࣌ؒ͋Δ͔Β ऴΘΓͳΘ͚ͳ͍͡ΌΜ

Slide 44

Slide 44 text

2 IUUQTNSBDMFTDPN

Slide 45

Slide 45 text

2ɿ΋͜͠ͷόά͕ຊ౰ʹແ֐ͳΒɺͳΜͰ͜ Μͳ໘౗ͳ͜ͱͯ͠·Ͱ΢ΣϒϖʔδΛ࡞ͬͨ ΓσϞಈըΛ্͛ͨΓ͢Δͷʁ ਖ਼௚͍͏ͱࢲ͸୯७ʹ.ͷ੬ऑੑΛར༻ͯ͠#BE "QQMFΛ࠶ੜ͔͚ͨͬͨͩ͠Ͱ͢ɺ͜Ε͕ͲΜͳʹ Ϋʔϧͳ͜ͱ͕୭΋͕ೝΊΔͰ͠ΐ͏ɻ