Attacking the XNU Kernel For Fun And Profit – Part 1

This blog post is part of a series of posts in which I will discuss several techniques to own XNU, the kernel used by Apple’s OS X and iOS. My focus will be on heap-based attacks, such as heap overflows, double frees, use-after-frees and zone confusion.

This post will be describing the zalloc() allocator, and how kalloc() (which is used for a lot of stuff including the IOKit C++ “new” operator) uses it. I’ll assume a page is 4096 bytes in your machine.

You can use zinit() to create a zone, which is essentially a “sub-heap”, completely independent of other heaps. A zone will always allocate a fixed-size memory area, and it does so by allocating a page and dividing by N bytes. For example, the kalloc.512 zone, which allocates 512 byte allocations, will take a 4096 byte page and divide it up in 8 free chunks. Each chunk references the previous chunk in a linked list, and every time you call zalloc() on it, the last chunk will be returned and the zone will move up an item in the linked list. zfree() will pop the chunk back into the list, and the zone will return it in the next zalloc(), unless another chunk is freed first. You can use “sudo zprint” to see all zones that have been zinit()ed, along with useful infos on allocations.

kalloc resembles much more libc’s malloc() in it’s interface, requiring only your allocation’s size as argument, but unlike libc’s free(), kfree (kalloc’s free equivalent) requires both the pointer to the allocation AND the allocation size, since neither zalloc nor kalloc store any metadata in allocated chunks, so kfree can not know what zone your chunk has to be popped back in.

So, to recap, zalloc uses multiple heaps, each heap is called zone, each zone always allocates same-sized allocs, kalloc registers up various zones for 16, 32, 64, 128, etc. allocations and will take any reasonable size and return an allocation in the zone with smallest enough size to satisfy the allocation (kalloc(15) returns a 16 byte chunk, kalloc(17) returns a 32 byte chunk). Another important thing to remember is that each zone has a linked list that acts as a LIFO, and when no more free chunks are available in a zone, a new page is allocated, split up in chunks and each chunk is added to the free list (which is held inline).

Hopefully this gives you a simple explanation on how the XNU kernel handles the heap. I skipped a lot of stuff and tried to keep this as simple as possible, but if you have any question regarding this feel free to contact me on Twitter, on IRC if you see me idling around some channel you’re in, via email at [email protected] or on XMPP (w/ OTR)[email protected]

P.S. Free chunk metadata used to be an easy write-what-where in case of heap overflows, but nowadays the unlink operation is hardened, plus I don’t like free chunk meta data attacks anyway, so I won’t cover free chunk metadata attacks at all.

28 thoughts on “Attacking the XNU Kernel For Fun And Profit – Part 1

  1. This is a very gradual procedure and does take some pc and software isn’t a proposed approach to saving
    if you should be computer-illiterate or if you are not willing to spend some time understanding new software.

  2. I do agree with all the ideas you’ve offered to your post.
    They’re really convincing and will certainly work.
    Nonetheless, the posts are too quick for newbies.
    May you please prolong them a bit from next time?
    Thanks for the post.

  3. Thanks for another great article. Where else could anyone get that type of information in such an ideal way of
    writing? I’ve a presentation subsequent week, and I’m at
    the search for such info.

  4. I was precisely considering this fantastic thought a week earlier with a grandma.
    I was readily imagining just what exactly the perfect time frame was to email
    or call those that company this illness.

  5. Producenci udostępnili do dyspozycji program Roblox
    Studio, który umożliwia tworzenie własnych scenariuszy
    gry oraz wykorzystania skryptów Lua W Roblox dostępna jest
    wirtualna waluta zwana „robuxami”, umożliwiająca kupno dodatkowych przedmiotów 5 (w marcu 2016 ogłoszono rezygnację z waluty zwanej „ticketami” 6 ).
    Użytkownicy mogą też zapisać się do „Builders Club” poprzez wykupienie
    jednego z trzech typów abonamentu.

  6. It’s especially hard if you believe like you’re only teacher inside your school to attempt fitting technology to your
    planning and classroom delivery. Dye-sublimation printing is employed in medical imaging, polyester
    fabric printing, and graphic proofing. Silicon is regarded as the common of
    the materials employed to generate electrical current
    if it is encountered with sunlight.

  7. That is very fascinating, You’re an excessively professional
    blogger. I have joined your rss feed and sit up for looking for
    extra of your magnificent post. Also, I’ve shared your website
    in my social networks

  8. Some program to the program right away from Jordan’s number
    one manufacturers position-hopping adidas organisation ideas, aghast
    our running shoes. Wedding within some somebody:
    Marc Dolce (r, features life time grouping), Denis Dekovic (drawing,
    football game class), record Miner (left-hand running footwear range) study a lot ended
    up being well-known. Together with the trio behemoth hair stylist with regard to adidas
    together with product newly decreed world inspired home Saint Paul Gaudio required too much to do, it happens to be fully understood any adidas main office
    of one’s United States are usually in brooklyn inch 2015 set up an innovative new format sweet, willingly
    leave behind that time period never when abuse associated with procedures in regards to 2 year contract relevant to function-clicking fighting
    products and solutions. , clearly, even when there is always any defaulting goes on, believe that the newest pet owners will even invest in the merchandise.
    Just this action might help adidas interrelated equipment at some point,
    plus improved the introduction of our shoe practice?
    We shall only have to have patience and find out.

    Marc Dolce view: ball and in little league just about every sport animation type
    design boss agent deeds: 1/2 dime, zoom capacity cub, pound, 5,
    1, Barkley satellite trigger that emailposite,
    Lil anything the emailposite, and so forth. Scar Miner ranking:
    comfortable shoes range elder builder rep plant: discharge work ordering, 35, girls oxygen Pegasus for free XT QuickFit, therefore.
    Denis Dekovic status: home of the ball boots
    or shoes format class great: Magista, Flyknit Roman deity Superfly 4, HyperVenom, Roman deity, horas V,
    et cetera.

  9. Tɦe video function includes continmuous autofocus along with a video light, so vvideo clip
    iis օf a similarly high quality to stiill images. , help
    in making this type of ceⅼlular phⲟne a huɡe ѕuccess one of many business community.
    As Frаnk Chimero, designer and illustrator said “people ignore design that ignores people”.

  10. Hi there, constantly i used to check website posts here in the early hours in the daylight, because i enjoy
    to gain knowledge of more and more.

  11. Succeeding inside of a bodyweight bburning Program not
    simply will allow you to appear better,nonethelessit’ll also improve your
    health, and enhance your selff worth inside the procedure.
    It does exist, it isn’t really a lie, however it generally seems to work just on laboratory animals.
    Tracy Andderson has built a post pregnancy workout specifically to a trget those areas that
    new moms have to geet lessen and shape up.

Leave a Reply

Your email address will not be published. Required fields are marked *