bazad

iOS security research

Google Project Zero

Pinned Repositories

blanket
CVE-2018-4280: Mach port replacement vulnerability in launchd on iOS 11.2.6 leading to sandbox escape, privilege escalation, and codesigning bypass.
Language:C247 15 343
ida_kernelcache
An IDA Toolkit for analyzing iOS kernelcaches.
Language:Python285 23 573
ios-command-line-tool
Example showing how to build a standalone iOS executable using Xcode.
Language:Objective-C72 7 217
memctl
An iOS kernel introspection tool.
Language:C237 21 1029
physmem
Local privilege escalation through macOS 10.12.1 via CVE-2016-1825 or CVE-2016-7617.
Language:C64 6 513
presentations
Slides from my conference presentations.
79 15 012
rootsh
Local privilege escalation for OS X 10.10.5 via CVE-2016-1828.
Language:C84 11 028
threadexec
A library to execute code in the context of other processes on iOS 11.
Language:C80 8 112
x18-leak
CVE-2018-4185: iOS 11.2-11.2.6 kernel pointer disclosure introduced by Apple's Meltdown mitigation.
Language:C83 11 013
ktrw
An iOS kernel debugger based on a KTRR bypass for A11 iPhones; works with LLDB and IDA Pro.
Language:C666 50 12124

bazad's Repositories

bazad/ida_kernelcache
An IDA Toolkit for analyzing iOS kernelcaches.
Language:Python285 23 573
bazad/blanket
CVE-2018-4280: Mach port replacement vulnerability in launchd on iOS 11.2.6 leading to sandbox escape, privilege escalation, and codesigning bypass.
Language:C247 15 343
bazad/memctl
An iOS kernel introspection tool.
Language:C237 21 1029
bazad/x18-leak
CVE-2018-4185: iOS 11.2-11.2.6 kernel pointer disclosure introduced by Apple's Meltdown mitigation.
Language:C83 11 013
bazad/threadexec
A library to execute code in the context of other processes on iOS 11.
Language:C80 8 112
bazad/presentations
Slides from my conference presentations.
79 15 012
bazad/ios-command-line-tool
Example showing how to build a standalone iOS executable using Xcode.
Language:Objective-C72 7 217
bazad/launchd-portrep
CVE-2018-4280: Mach port replacement vulnerability in launchd on macOS 10.13.5 leading to local privilege escalation and SIP bypass.
Language:C58 7 06
bazad/devicetree-parse
A tool to parse Apple's binary device tree format.
Language:C55 6 06
bazad/xpc-string-leak
CVE-2018-4248: Out-of-bounds read in libxpc during string serialization.
Language:C52 5 05
bazad/macho_gadgets
A tool to find gadgets in the iOS kernelcache.
Language:C33 5 01
bazad/AppleJPEGDriver-memleak
Kernel memory leak/local DOS on iOS 11.
Language:C29 4 04
bazad/ctl_ctloutput-leak
CVE-2017-13868: Information leak of uninitialized kernel heap data in XNU.
Language:C28 6 07
bazad/gsscred-race
CVE-2018-4331: Exploit for a race condition in the GSSCred system service on iOS 11.2.
Language:C24 4 07
bazad/memctl-kext-core
A memctl core for macOS that uses a kernel extension.
Language:C++16 4 14
bazad/IOAccelerator-leak
Kernel heap pointer disclosure in IOGraphicsFamily.
Language:C12 4 03
bazad/memctl-tfp0-core
A memctl core for jailbroken iOS devices.
Language:C11 6 01
bazad/bazad.github.io
My security blog.
Language:CSS10 10 14
bazad/flow_divert-leak
Kernel heap read buffer overflow on macOS/iOS requiring root.
Language:C10 3 02
bazad/xpc-crash
An out-of-bounds read in libxpc that can be used to crash XPC services.
Language:C10 4 03
bazad/mincore-dos
Local denial of service exploit for iOS 11/macOS 10.13.
Language:Makefile9 3 02
bazad/kldstat-stack-disclosure
A kernel stack disclosure in FreeBSD.
Language:C8 4 01
bazad/memctl-physmem-core
A memctl core that uses the physmem exploit.
Language:C8 4 01
bazad/gsscred-move-uaf
CVE-2018-4343: Proof-of-concept for a use-after-free in the GSSCred daemon on macOS and iOS.
Language:C7 3 12
bazad/flow_divert-memleak
Memory leak in XNU requiring root privileges.
Language:C6 3 03
bazad/IOMFB-DOS-1
Local denial of service on iOS 11.2.
Language:C6 3 02
bazad/IOFireWireFamily-null-deref
CVE-2017-2388: Null-pointer dereference in IOFireWireFamily.
Language:C3 3 01
bazad/mach_portal_memctl
An example of how to use libmemctl with mach_portal.
Language:C3 4 0
bazad/sysctl_coalition_get_pid_list-dos
CVE-2017-7173: Local denial of service for iOS requiring root privileges.
Language:C3 4 01
bazad/IOFireWireFamily-overflow
CVE-2016-7608: Buffer overflow in IOFireWireFamily.
Language:C2 3 01