simo @_simo36

Joined December 2013

Tweets

36
Followers

7K
Following

116
Likes

925

simo @_simo36

2 years ago

I've audited the Android kernel in late 2023, and reported 10+ kernel bugs to Google, along with 2 exploits. Today, I'm releasing the first exploit, targeting the Mali GPU on Pixel devices, accessible from an untrusted_app context. github.com/0x36/Pixel_GPU…

26 265 1K 113K 321

simo @_simo36

3 years ago

36 38 365 0 16

Download Image

simo @_simo36

3 years ago

I'm sharing two other iOS kernel vulnerabilities reachable from the default app sandbox that don’t require you to open a UserClient: 0x36.github.io/CVE-2022-32898/

16 118 469 0 69

simo @_simo36

3 years ago

CVE-2022-32932 is another vulnerability I discovered in the ANE kernel interface; this is a double fetch issue that resulted in an interesting OOB write. 0x36.github.io/CVE-2022-32932/

9 70 271 0 28

simo @_simo36

3 years ago

My #POC2022 slides + the iOS kernel r/w exploit can be found here :) github.com/0x36/weightBuf… Thanks @POC_Crew for a fantastic conference and truly honored to have been part of it.

24 198 604 0 65

simo @_simo36

3 years ago

+16 kernel bugs I reported to Apple have been fixed in iOS 16/16.1. I'll give a talk on how I chained some bugs to achieve kernel r/w at #POC2022 next month, and the kernel exploit for iOS 15 will be released along with a some other high impact vulns after the conference.

31 143 764 0 39

simo @_simo36

3 years ago

My favorite IDA 8.0 feature so far: artificial Obj-C method imports

4 3 31 0 3

Download Image

simo @_simo36

3 years ago

35 82 577 0 12

Download Image

simo @_simo36

3 years ago

In iOS 15.5 beta 3, Apple removed IOMallocAligned(KHEAP_DEFAULT,...) from IOSharedDataQueue/IODataQueue::initWithCapacity() ( now uses kernel_memory_allocate() with KMA_DATA flag). It was an elegant technique to groom the kernel default heap with user controlled data. RIP

8 38 280 0 10

simo @_simo36

4 years ago

Looks like Ghidra does not support LC_DYLD_CHAINED_FIXUPS for macOS M1 KEXTs, here is a dirty script to fix it . gist.github.com/0x36/5ea657f08…

1 4 23 0 6

simo @_simo36

5 years ago

I've updated oob_events exploit and it should work fine in on A12+ devices (with 60 % of success rate) and ~95% in devices with lower ram size i.e A10. Tested on iPhone 11 and iPhone 7.