Content

Day 1

Introduction to reverse engineering on Apple platforms:

• Setup of the working environment (pre-installed Debian laptop with macOS VM)
• Experimenting with Correlium virtual devices
• Developing on Apple platforms (macOS and iOS)
• Using diagnostic tools
• Introduction to the Apple ecosystem
• Extraction of updates
• Important file formats and tools
• Discovering and experimenting with Objective-C internals

Day 2

Mach mechanisms:

• Introducing the XNU kernel
• Explanations and exercices on inter-process communication in userland
• Understanding how userland interacts with the kernel

Day 3

Reverse engineering Mach services:

• Using Frida to instrument userland services
• Theory and practice on the XPC and NSXPC inter-process communications abstractions

Day 4

XNU security:

• Overview of pointer authentication on Apple platforms
• Presentation of the MACF framework
• Overview of AMFI and sandbox policies
• Understanding defense in depth in the design of XNU
• Hardware-specific kernel security measures
• Kernel exploit mitigations.

Audience and prerequisites

iOS for Security Engineers is an intermediate level course, designed for security engineers wishing to perform research on this system :

• Pentesters
• iOS developers
• Security engineers

Good knowledge of C development and basic knowledge in reverse engineering are recommended. IDA Pro with the Hex-Rays ARM decompiler is nice to have.