Cross-Cutting Attack Patterns Analysis | iOS Exploit Starterpack

This document analyzes cross-cutting patterns used throughout exploits by Ian Beer, Siguza, Brandon Azad, and threat actors (Operation Triangulation, Coruna, DarkSword). Each pattern includes PoC pseudocode from actual exploit source code.

Pattern 1: Mach Port UAF → Fake Port → tfp0

Used by: v0rtex (Siguza), async_wake (Ian Beer), mach_portal (Ian Beer), SockPuppet, voucher_swap

The most common pattern in iOS exploitation (iOS 10-13). Later mitigated by zone_require (iOS 14), but still fundamental knowledge.

General Flow

Trigger vulnerability → mach port reference count decremented one too many
Port freed but userland still has a handle
Spray controlled data into the freed port memory
Use dangling handle → access fake port
Fake port configured as IKOT_TASK → points to fake task
fake task → map = kernel_map
mach_vm_read/write via fake port = kernel read/write

Pattern 2: Heap Spray & Grooming Techniques

Used by: Every kernel exploit

OOL Mach Message Spray

// Standard heap spray: send OOL messages to fill a kalloc zone
void spray_kalloc(uint32_t size, void *data, int count, mach_port_t *ports) {
    for (int i = 0; i < count; i++) {
        mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &ports[i]);
        struct {
            mach_msg_header_t hdr;
            mach_msg_body_t body;
            mach_msg_ool_descriptor_t ool;
        } msg = {};
        msg.hdr.msgh_bits = MACH_MSGH_BITS_COMPLEX |
            MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0);
        msg.hdr.msgh_size = sizeof(msg);
        msg.hdr.msgh_remote_port = ports[i];
        msg.body.msgh_descriptor_count = 1;
        msg.ool.address = data;
        msg.ool.size = size;
        msg.ool.type = MACH_MSG_OOL_DESCRIPTOR;
        msg.ool.deallocate = FALSE;
        msg.ool.copy = MACH_MSG_VIRTUAL_COPY;
        mach_msg(&msg.hdr, MACH_SEND_MSG, sizeof(msg), 0, 0, 0, 0);
    }
}

Pattern 3: vm_map_copy Type Confusion (One Byte)

Used by: oob_timestamp (Brandon Azad), derivatives

Especially elegant: 1-byte OOB write → full physical memory access.

// vm_map_copy is a union structure — the type field determines interpretation
// Little-endian: byte 0 of type field = 0x01 (ENTRY_LIST) or 0x03 (KERNEL_BUFFER)
// → 1 byte overflow changing 0x03 → 0x01 = type confusion!

Pattern 4: Physical UAF (PUAF) Techniques

Used by: kfd (felix-pb), Dopamine, Trigon, Coruna

Modern pattern replacing the fake port technique on iOS 15+.

VM bug → physical page freed but virtual mapping retained
→ Kernel reallocates physical page for another object
→ Userspace still reads/writes via old virtual mapping
→ If page becomes a page table → full physrw

Pattern 5: IOKit Race Condition Exploitation

Used by: IOHIDeous (Siguza), many IOKit CVEs, DarkSword

// Pattern: external method + clientClose race
// Thread 1: call external method (accesses internal object)
// Thread 2: call clientClose (frees internal object)
// → UAF if method accesses object after close frees it

Pattern 6: Parser Disagreement (Logic Bug)

Used by: psychicpaper (Siguza)

Parser behavior for <!---><!--> sequence:

CoreFoundation (amfid):
  → Returns EMPTY dict (no entitlements seen)
  → amfid says: "binary has no entitlements" → ALLOW

IOKit (kernel), XPC (sandbox):
  → Returns dict WITH private entitlements
  → Kernel/sandbox grants: no-sandbox, tfp, platform binary

Pattern 7: Radio/Remote Exploitation (AWDL)

Used by: Ian Beer AWDL exploit

AWDL Service Response Descriptors (SRDs) as remote heap spray – each SRD in an AWDL frame creates a kalloc allocation in the target device’s kernel, with controllable size and content.

Pattern 8: Coprocessor DMA Bypass (SPTM)

Used by: Coruna (Rocket exploit)

SPTM protects CPU memory access but DOES NOT protect DMA:

Normal CPU access:
  CPU → MMU → SPTM check → Physical memory
  ✗ SPTM blocks unauthorized access

Coprocessor DMA:
  GFX coprocessor → IOMMU → Physical memory
  ✓ IOMMU configuration has gaps → bypass SPTM!

Attack Pattern Matrix

Pattern	When to use	iOS range	Complexity	Reliability
Fake port → tfp0	Have port UAF	<= iOS 13	Medium	High
IOSurface kread/kwrite	Have heap corruption + IOSurface	iOS 11+	Medium	High
vm_map_copy type confusion	Have 1-byte OOB write	iOS 13	High	High
PUAF → physrw	Have VM bug	iOS 14-16	High	Medium-High
Parser disagreement	Have parser inconsistency	Any (logic bug)	Low	100% (deterministic)
Race condition	Have concurrent access bug	Any	Low-Medium	Low (probabilistic)
OOL msg spray	Heap grooming	Any	Low	High
Coprocessor DMA	SPTM bypass needed	iOS 17+	Very High	Unknown
Radio proximity	Remote/0-click needed	iOS 13	Very High	Medium

Evolution Timeline

mach_portal    → Fake port pattern established
async_wake     → IOSurface + OOL port spray refined
v0rtex         → OSUnserializeXML spray, multi-offset port
IOHIDeous      → IOKit race condition patterns
SockPuppet     → Socket UAF variant
oob_timestamp  → vm_map_copy type confusion, physrw without fake port
psychicpaper   → Pure logic bug, no memory corruption
AWDL           → Remote kernel exploitation via Wi-Fi
kfd            → PUAF techniques (smith, landa, physpuppet)
Op. Triangulation → Hardware MMIO PPL bypass
Trigon         → Deterministic exploitation
Coruna         → Coprocessor DMA SPTM bypass
DarkSword      → Multi-hop sandbox escape, VFS race → physrw