|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "IOSurface Kernel Exploit"
m |
m |
||
| Line 1: | Line 1: | ||
| − | This vulnerability, along with the [[ |
+ | This vulnerability, along with the [[Malformed CFF Vulnerability]], was used in [[Star]]/[[JailbreakMe]] 2.0. It is a buffer overflow in the handling of the [http://iphonedevwiki.net/index.php/IOCoreSurfaceRoot kernel-extension for managing pixel buffers] used to get root privileges. |
| + | == Credit == |
||
| + | [[User:Comex|comex]] |
||
| − | == |
+ | == Exploit == |
Selector 19 was Vulnerability to a buffer overflow that allow access to the root filesystem without making the kernel fail signature check |
Selector 19 was Vulnerability to a buffer overflow that allow access to the root filesystem without making the kernel fail signature check |
||
| Line 54: | Line 56: | ||
| 21 || removeSurfaceNotify || 24 bytes of stuff || - |
| 21 || removeSurfaceNotify || 24 bytes of stuff || - |
||
|} |
|} |
||
| − | |||
| − | == Credit == |
||
| − | [[User:Comex|comex]] |
||
Revision as of 00:43, 19 October 2010
This vulnerability, along with the Malformed CFF Vulnerability, was used in Star/JailbreakMe 2.0. It is a buffer overflow in the handling of the kernel-extension for managing pixel buffers used to get root privileges.
Credit
Exploit
Selector 19 was Vulnerability to a buffer overflow that allow access to the root filesystem without making the kernel fail signature check
| Selector | Action | Input | Output |
|---|---|---|---|
| 0 | lookupFromMachPort | - | 1,208 bytes of stuff |
| 1 | release | IOSurfaceID surfaceID | - |
| 2 | lock | struct IOSurfaceLockArg | 1,208 bytes of stuff |
| 3 | unlock | struct IOSurfaceLockArg | struct IOSurfaceLockSeedArg |
| 4 | lockPlane | struct IOSurfaceLockArg | 1,208 bytes of stuff |
| 5 | unlockPlane | struct IOSurfaceLockArg | struct IOSurfaceLockSeedArg |
| 6 | lookup | void* ??? | 1,208 bytes of stuff |
| 7 | setYCbCrMatrix | IOSurfaceID surfaceID, uint32_t YCbCrMatrix | - |
| 8 | wrapClientImage | 28 bytes of stuff | 1,208 bytes of stuff |
| 9 | wrapClientMemory | void* param0, void* param1 | 1,208 bytes of stuff |
| 10 | getYCbCrMatrix | IOSurfaceID surfaceID | uint32_t YCbCrMatrix |
| 11 | setValue | ? | - |
| 12 | getValueMethod | ? | ? |
| 13 | kIOSurfaceMethodRemoveValue | ? | - |
| 14 | bindAccel | IOSurfaceID surfaceID, void* unknown0, void* unknown4 | - |
| 15 | bindAccelOnPlane | IOSurfaceID surfaceID, void* param1, void* param2, size_t planeIndex | - |
| 16 | readLimits | - | 20 bytes of stuff. |
| 17 | kIOSurfaceMethodIncrementUseCount | IOSurfaceID surfaceID | - |
| 18 | kIOSurfaceMethodDecrementUseCount | IOSurfaceID surfaceID | - |
| 19 | ? | void* ??? | void* ??? |
| 20 | setSurfaceNotify | 24 bytes of stuff | - |
| 21 | removeSurfaceNotify | 24 bytes of stuff | - |
