AppleMobileFileIntegrity - Revision history

Http: another link

2012-02-15T20:28:30Z

another link

Http: more links

2012-02-15T20:25:04Z

Http: add link

2012-02-15T19:56:32Z

add link

5urd at 23:29, 14 February 2012

2012-02-14T23:29:03Z

Morpheus at 17:24, 14 February 2012

2012-02-14T17:24:31Z

Morpheus: Created page with "AppleMobileFileIntegrity(.kext, by its full name com.apple.driver.AppleMobileFileIntegrity) is an iOS kernel extension which serves as the corner stone of iOS's code entitlements..."

2012-02-14T17:22:59Z

Created page with "AppleMobileFileIntegrity(.kext, by its full name com.apple.driver.AppleMobileFileIntegrity) is an iOS kernel extension which serves as the corner stone of iOS's code entitlements..."

New page

AppleMobileFileIntegrity(.kext, by its full name com.apple.driver.AppleMobileFileIntegrity) is an iOS kernel extension which serves as the corner stone of iOS's code entitlements model. It is one of the Sandbox's (com.apple.security.sandbox) dependencies, along with com.apple.kext.AppleMatch (which, like on OS X, is responsible for parsing the Sandbox language rules).

Affectionately known as amfi, this kext can be found in the iOS 5.0 iPod 4,1 kernel around 0x805E499C (start) and 0x805E3EE8 (Initialization function). The latter function registers a MAC policy (using the kernel exported mac_policy_register), which is used to hook various system operations and enforce Apple's tight security policy.

This kext recognizes the task_for_pid-allow entitlement (among others) and is responsible for hooking this Mach call, which retrieves the Mach task port associated with a BSD process identifier. Given this port, one can usurp control of the task/PID, reading and writing its memory, debugging, etc. It is therefore enabled only if the binary is digitally signed with a proper entitlement file, specifying task_for_pid-allow.

The amfi kext recognizes quite a few boot-args, including:

PE_i_can_has_debugger
amfi_unrestrict_task_for_pid - Allowing the above to proceed even without entitlement
amfi_allow_any_signature - Allowing any digital signature on code, not just Apple's
amfi_get_out_of_my_way - disable amfi
cs_enforcement_disable - Disable code signing enforcement
cs_debug - Debug code signing

← Older revision		Revision as of 20:28, 15 February 2012
Line 1:		Line 1:
−	[[AppleMobileFileIntegrity]](.kext), which can go by its full name com.apple.driver.AppleMobileFileIntegrity, is an [[iOS]] kernel extension which serves as the corner stone of iOS's code entitlements model. It is one of the Sandbox's (com.apple.security.sandbox) dependencies, along with com.apple.kext.AppleMatch (which, like on OS X, is responsible for parsing the Sandbox language rules).	+	[[AppleMobileFileIntegrity]](.kext), which can go by its full name com.apple.driver.AppleMobileFileIntegrity, is an [[iOS]] kernel extension which serves as the corner stone of iOS's code entitlements model. It is one of the [[Sandbox]]'s (com.apple.security.sandbox) dependencies, along with com.apple.kext.AppleMatch (which, like on OS X, is responsible for parsing the Sandbox language rules).

	Affectionately known as [[AppleMobileFileIntegrity\|AMFI]], this kext can be found in the iOS 5.0 iPod 4,1 kernel around 0x805E499C (start) and 0x805E3EE8 (Initialization function). The latter function registers a MAC policy (using the kernel exported mac_policy_register), which is used to hook various system operations and enforce Apple's tight security policy.		Affectionately known as [[AppleMobileFileIntegrity\|AMFI]], this kext can be found in the iOS 5.0 iPod 4,1 kernel around 0x805E499C (start) and 0x805E3EE8 (Initialization function). The latter function registers a MAC policy (using the kernel exported mac_policy_register), which is used to hook various system operations and enforce Apple's tight security policy.

@@ Line 1: / Line 1: @@
-'''AppleMobileFileIntegrity'''(.kext), which can go by its full name com.apple.driver.AppleMobileFileIntegrity, is an [[iOS]] kernel extension which serves as the corner stone of iOS's code entitlements model. It is one of the Sandbox's (com.apple.security.sandbox) dependencies, along with com.apple.kext.AppleMatch (which, like on OS X, is responsible for parsing the Sandbox language rules).
+[[AppleMobileFileIntegrity]](.kext), which can go by its full name com.apple.driver.AppleMobileFileIntegrity, is an [[iOS]] kernel extension which serves as the corner stone of iOS's code entitlements model. It is one of the Sandbox's (com.apple.security.sandbox) dependencies, along with com.apple.kext.AppleMatch (which, like on OS X, is responsible for parsing the Sandbox language rules).
-Affectionately known as amfi, this kext can be found in the iOS 5.0 iPod 4,1 kernel around 0x805E499C (start) and 0x805E3EE8 (Initialization function). The latter function registers a MAC policy (using the kernel exported mac_policy_register), which is used to hook various system operations and enforce Apple's tight security policy.
+Affectionately known as [[AppleMobileFileIntegrity|AMFI]], this kext can be found in the iOS 5.0 iPod 4,1 kernel around 0x805E499C (start) and 0x805E3EE8 (Initialization function). The latter function registers a MAC policy (using the kernel exported mac_policy_register), which is used to hook various system operations and enforce Apple's tight security policy.
 This kext recognizes the task_for_pid-allow entitlement (among others) and is responsible for hooking this Mach call, which retrieves the Mach task port associated with a BSD process identifier. Given this port, one can usurp control of the task/PID, reading and writing its memory, debugging, etc. It is therefore enabled only if the binary is digitally signed with a proper entitlement file, specifying task_for_pid-allow.
@@ Line 12: / Line 12: @@
 * '''cs_enforcement_disable''' - Disable code signing enforcement
 * '''cs_debug''' - Debug code signing

@@ Line 6: / Line 6: @@
 The amfi kext recognizes quite a few boot-args, including:
-* PE_i_can_has_debugger
+* PE_i_can_has_debugger (see also [[PE i can has debugger Patch|patch]])
 * '''amfi_unrestrict_task_for_pid''' - Allowing the above to proceed even without entitlement
 * '''amfi_allow_any_signature''' - Allowing any digital signature on code, not just Apple's

@@ Line 7: / Line 7: @@
 The amfi kext recognizes quite a few boot-args, including:
-PE_i_can_has_debugger
+<li>PE_i_can_has_debugger</li>
-amfi_unrestrict_task_for_pid - Allowing the above to proceed even without entitlement
+<li><b>amfi_unrestrict_task_for_pid</b> - Allowing the above to proceed even without entitlement</li>
-amfi_allow_any_signature - Allowing any digital signature on code, not just Apple's
+<li><b>amfi_allow_any_signature</b> - Allowing any digital signature on code, not just Apple's</li>
-amfi_get_out_of_my_way - disable amfi
+<li><b>amfi_get_out_of_my_way</b> - disable amfi</li>
-cs_enforcement_disable - Disable code signing enforcement
+<li><b>cs_enforcement_disable</b> - Disable code signing enforcement</li>
-cs_debug - Debug code signing
+<li><b>cs_debug</b> - Debug code signing</li>