View source for ARM Exception Vector Info Leak

This vulnerability is used by [[evasi0n]] in order to defeat [[Kernel ASLR|KASLR]]. Since iOS6 the kernel base address is randomized at 2^9 possible locations. Actually it is not fully randomized due to the ARM vector table residing at a fixed address. The vector table is held at address zero and at runtime relocated to <code>0xffff0000</code> by setting the V-bit in CP15 c1. The following ARM vector table entries exist:
{| class="wikitable" style="text-align:center;"
|-
! Offset
! Handler
|-
| <code>00</code>
| style="text-align:left;" | Reset
|-
| <code>04</code>
| style="text-align:left;" | Undefined Instruction
|-
| <code>08</code>
| style="text-align:left;" | Supervisor Call (SVC)
|-
| <code>0C</code>
| style="text-align:left;" | Prefetch Abort
|-
| <code>10</code>
| style="text-align:left;" | Data Abort
|-
| <code>14</code>
| style="text-align:left;" | Reserved
|-
| <code>18</code>
| style="text-align:left;" | Interrupt (IRQ)
|-
| <code>1C</code>
| style="text-align:left;" | Fast Interrupt (FIQ)
|}

[[evasi0n]] calls the ''Data Abort'' exception from a separate thread and catches the exception. In the exception handler, <code>in_state->__pc</code> is saved to <code>global.exception_pc</code> and leaks the base address because this exception was called from <code>com.apple.iokit.IOUSBDeviceFamily</code>.

== References ==
* [http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html Analysis by kernelpool]

[[Category:Exploits]]