Attacking the XNU Kernel For Fun And Profit – Part 1

This blog post is part of a series of posts in which I will discuss several techniques to own XNU, the kernel used by Apple’s OS X and iOS. My focus will be on heap-based attacks, such as heap overflows, double frees, use-after-frees and zone confusion.

This post will be describing the zalloc() allocator, and how kalloc() (which is used for a lot of stuff including the IOKit C++ “new” operator) uses it. I’ll assume a page is 4096 bytes in your machine.

You can use zinit() to create a zone, which is essentially a “sub-heap”, completely independent of other heaps. A zone will always allocate a fixed-size memory area, and it does so by allocating a page and dividing by N bytes. For example, the kalloc.512 zone, which allocates 512 byte allocations, will take a 4096 byte page and divide it up in 8 free chunks. Each chunk references the previous chunk in a linked list, and every time you call zalloc() on it, the last chunk will be returned and the zone will move up an item in the linked list. zfree() will pop the chunk back into the list, and the zone will return it in the next zalloc(), unless another chunk is freed first. You can use “sudo zprint” to see all zones that have been zinit()ed, along with useful infos on allocations.

kalloc resembles much more libc’s malloc() in it’s interface, requiring only your allocation’s size as argument, but unlike libc’s free(), kfree (kalloc’s free equivalent) requires both the pointer to the allocation AND the allocation size, since neither zalloc nor kalloc store any metadata in allocated chunks, so kfree can not know what zone your chunk has to be popped back in.

So, to recap, zalloc uses multiple heaps, each heap is called zone, each zone always allocates same-sized allocs, kalloc registers up various zones for 16, 32, 64, 128, etc. allocations and will take any reasonable size and return an allocation in the zone with smallest enough size to satisfy the allocation (kalloc(15) returns a 16 byte chunk, kalloc(17) returns a 32 byte chunk). Another important thing to remember is that each zone has a linked list that acts as a LIFO, and when no more free chunks are available in a zone, a new page is allocated, split up in chunks and each chunk is added to the free list (which is held inline).

Hopefully this gives you a simple explanation on how the XNU kernel handles the heap. I skipped a lot of stuff and tried to keep this as simple as possible, but if you have any question regarding this feel free to contact me on Twitter, on IRC if you see me idling around some channel you’re in, via email at [email protected] or on XMPP (w/ OTR)[email protected]

P.S. Free chunk metadata used to be an easy write-what-where in case of heap overflows, but nowadays the unlink operation is hardened, plus I don’t like free chunk meta data attacks anyway, so I won’t cover free chunk metadata attacks at all.

50 thoughts on “Attacking the XNU Kernel For Fun And Profit – Part 1

  1. This is a very gradual procedure and does take some pc and software isn’t a proposed approach to saving
    if you should be computer-illiterate or if you are not willing to spend some time understanding new software.

  2. I do agree with all the ideas you’ve offered to your post.
    They’re really convincing and will certainly work.
    Nonetheless, the posts are too quick for newbies.
    May you please prolong them a bit from next time?
    Thanks for the post.

  3. Thanks for another great article. Where else could anyone get that type of information in such an ideal way of
    writing? I’ve a presentation subsequent week, and I’m at
    the search for such info.

  4. I was precisely considering this fantastic thought a week earlier with a grandma.
    I was readily imagining just what exactly the perfect time frame was to email
    or call those that company this illness.

  5. Producenci udostępnili do dyspozycji program Roblox
    Studio, który umożliwia tworzenie własnych scenariuszy
    gry oraz wykorzystania skryptów Lua W Roblox dostępna jest
    wirtualna waluta zwana „robuxami”, umożliwiająca kupno dodatkowych przedmiotów 5 (w marcu 2016 ogłoszono rezygnację z waluty zwanej „ticketami” 6 ).
    Użytkownicy mogą też zapisać się do „Builders Club” poprzez wykupienie
    jednego z trzech typów abonamentu.

  6. It’s especially hard if you believe like you’re only teacher inside your school to attempt fitting technology to your
    planning and classroom delivery. Dye-sublimation printing is employed in medical imaging, polyester
    fabric printing, and graphic proofing. Silicon is regarded as the common of
    the materials employed to generate electrical current
    if it is encountered with sunlight.

  7. That is very fascinating, You’re an excessively professional
    blogger. I have joined your rss feed and sit up for looking for
    extra of your magnificent post. Also, I’ve shared your website
    in my social networks

  8. Some program to the program right away from Jordan’s number
    one manufacturers position-hopping adidas organisation ideas, aghast
    our running shoes. Wedding within some somebody:
    Marc Dolce (r, features life time grouping), Denis Dekovic (drawing,
    football game class), record Miner (left-hand running footwear range) study a lot ended
    up being well-known. Together with the trio behemoth hair stylist with regard to adidas
    together with product newly decreed world inspired home Saint Paul Gaudio required too much to do, it happens to be fully understood any adidas main office
    of one’s United States are usually in brooklyn inch 2015 set up an innovative new format sweet, willingly
    leave behind that time period never when abuse associated with procedures in regards to 2 year contract relevant to function-clicking fighting
    products and solutions. , clearly, even when there is always any defaulting goes on, believe that the newest pet owners will even invest in the merchandise.
    Just this action might help adidas interrelated equipment at some point,
    plus improved the introduction of our shoe practice?
    We shall only have to have patience and find out.

    Marc Dolce view: ball and in little league just about every sport animation type
    design boss agent deeds: 1/2 dime, zoom capacity cub, pound, 5,
    1, Barkley satellite trigger that emailposite,
    Lil anything the emailposite, and so forth. Scar Miner ranking:
    comfortable shoes range elder builder rep plant: discharge work ordering, 35, girls oxygen Pegasus for free XT QuickFit, therefore.
    Denis Dekovic status: home of the ball boots
    or shoes format class great: Magista, Flyknit Roman deity Superfly 4, HyperVenom, Roman deity, horas V,
    et cetera.

  9. Tɦe video function includes continmuous autofocus along with a video light, so vvideo clip
    iis օf a similarly high quality to stiill images. , help
    in making this type of ceⅼlular phⲟne a huɡe ѕuccess one of many business community.
    As Frаnk Chimero, designer and illustrator said “people ignore design that ignores people”.

  10. Hi there, constantly i used to check website posts here in the early hours in the daylight, because i enjoy
    to gain knowledge of more and more.

  11. Succeeding inside of a bodyweight bburning Program not
    simply will allow you to appear better,nonethelessit’ll also improve your
    health, and enhance your selff worth inside the procedure.
    It does exist, it isn’t really a lie, however it generally seems to work just on laboratory animals.
    Tracy Andderson has built a post pregnancy workout specifically to a trget those areas that
    new moms have to geet lessen and shape up.

  12. May I simply say what a comfort to find somebody that really
    knows what they’re discussing on the internet. You definitely know how to bring a problem to light and make it important.
    More and more people need to check this out and understand this side of your story.
    I was surprised that you are not more popular because you certainly possess the gift.

  13. どうも、新着記事を見させていただきました。当方にとって大変役立ちになりました。

  14. Hi there I am so grateful I found your website, I really found you by
    accident, while I was researching on Digg for something else,
    Anyhow I am here now and would just like to say many thanks for a
    marvelous post and a all round thrilling blog (I also love the theme/design), I don’t have time to go through it all
    at the minute but I have book-marked it and also added your
    RSS feeds, so when I have time I will be back to read a great deal more, Please do keep up the fantastic job.

  15. UV-C light is both a competent and effective technique of controlling germs in domestic and commercial environments.
    Determining expected growth rate of revenue and profitrs is meaningless when the success of your start-up is
    not confirmed. Just roughly 10 % of resident orthopedists are female, and around one-fifth of orthopedic residenmts
    belong to a minority group.

  16. Sorching summer season, should have some of calming and delightful house slippers naturally
    is excellent, if extremely popular just last year Lebron slither during this same year set
    in motion an alternative account of typically the Jordan aerial Lebron 2
    ease elect, inside until enduring that outsole blueprint makes use of Lebron ten elements of design, regarding the colour
    in addition more mellow, it seems that Epistle of James friends it’s important first a couple of come
    july 1st.

  17. I loved as much as you’ll receive carried out right here.
    The sketch is attractive, your authored material stylish.
    nonetheless, you command get got an nervousness over
    that you wish be delivering the following.
    unwell unquestionably come more formerly again as exactly the same nearly very often inside case you shield this hike.

Leave a Reply

Your email address will not be published. Required fields are marked *