Skip to content

0x011011110/xnu-qemu-arm64

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

iOS on QEMU

This project is a fork of the official QEMU repository. Please refer to this README for information about the QEMU project.

The goal of this project is to boot a fully functional iOS system on QEMU.

The project is under active development, follow @alephsecurity and @JonathanAfek for updates.

For technical information about the research, follow our blog:

Help is wanted!

If you are passionate about iOS and kernel exploitation and want to help us push this project forward, please refer to the open issues in this repo :)


  • Current project's functionality:

    • launchd services
    • Interactive bash
    • R/W secondary disk device
    • Execution of binaries (also ones that are not signed by Apple)
    • SSH through TCP tunneling
    • Textual FrameBuffer
    • ASLR for usermode apps is disabled
    • ASLR for DYLD shared cache is disabled
    • GDB scripts for kernel debugging
    • KVM support
    • TFP0 from user mode applications
  • To run iOS 12.1 on QEMU follow this tutorial.

  • This project works on QEMU with KVM! Check this blog post for more information.

  • We have implemented multiple GDB scripts that will help you to debug the kernel:

    • List current/user/all tasks in XNU kernel.
    • List current/user/all threads in XNU kernel.
    • Print the information about specific task/thread.
    • Many more :).
  • To disable ASLR in DYLD shared cache follow this tutorial.

  • Follow here to learn about how we've implemented the TCP tunneling.

  • Follow the code to see all the patches we've made to the iOS kernel for this project:

    • Disable the Secure Monitor.
    • Bypass iOS's CoreTrust mechanism.
    • Disable ASLR for user mode apps.
    • Enable custom code execution in the kernel to load our own IOKit iOS drivers.
    • Enable KVM support.
    • Support getting TFP0 in usermode applications.

About

No description, website, or topics provided.

Resources

License

Unknown and 2 other licenses found

Licenses found

Unknown
LICENSE
GPL-2.0
COPYING
LGPL-2.1
COPYING.LIB

Security policy

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C 91.8%
  • Python 2.9%
  • C++ 2.0%
  • Shell 1.7%
  • Assembly 0.5%
  • Haxe 0.4%
  • Other 0.7%