checkm8 — Bootrom Exploit

Boot chain:
  SecureROM (bootrom) → iBoot Stage 1 → iBoot Stage 2 → Kernel

SecureROM:
  - First code executed when device powers on
  - Burned into silicon at factory (read-only)
  - Verifies signature of iBoot before loading
  - Contains USB DFU (Device Firmware Upgrade) mode
  - ~1MB code, very small attack surface

1. Host sends firmware data in USB transfers
2. Device receives data into buffer
3. Device verifies and applies firmware

USB request lifecycle trong DFU:
  1. Setup phase: allocate I/O request buffer
  2. Data phase: receive data into buffer
  3. Status phase: complete request, process data

Race condition:
  1. Host starts DFU upload → device allocates buffer (IO request)
  2. Host sends data → device receives into buffer
  3. Host sends USB RESET during status phase
     → Device deallocates IO request buffer (free)
  4. But: DMA engine still has reference to freed buffer
     → When DFU restarts: old buffer pointer reused
     → Use-After-Free!

Trigger sequence:
  USB_CTRL_REQUEST → allocate buffer
  USB_DATA → fill buffer with controlled data
  USB_RESET → free buffer (but pointer persists)
  USB_CTRL_REQUEST → reuse freed buffer → exploit!

1. Trigger UAF → freed buffer reallocated with attacker-controlled data
2. Overwrite USB request handler function pointer
3. Next USB operation → calls attacker's address → code execution in SecureROM context
4. SecureROM runs at highest privilege (before any software)
   → Full device control
   → Bypass Secure Boot chain
   → Load patched iBoot → patched kernel

1. Device enters DFU mode (hardware button combo)
2. checkra1n/palera1n sends checkm8 exploit via USB
3. Code execution in SecureROM → load pongoOS
4. pongoOS patches iBoot → loads patched kernel
5. Patched kernel → jailbreak environment
6. Install Sileo/Zebra + tweaks