Virtual Memory & Page Tables | iOS Exploit Starterpack

Virtual memory subsystem quản lý translation giữa virtual addresses (mà code dùng) và physical addresses (RAM thật). Page tables là data structure chứa mapping này. Bugs trong VM subsystem dẫn đến physical read/write — primitive mạnh nhất.

Tại Sao Cần Hiểu VM

Physical UAF (PUAF) exploits khai thác bugs trong VM subsystem
Page table manipulation là cách bypass PPL/SPTM
physrw (physical read/write) đạt được qua dangling page table entries
KASLR dựa vào VM — hiểu VM = hiểu cách leak kernel base
pmap code là target cho nhiều kernel bugs

ARM64 Address Translation

Translation Table Walk

Virtual Address (48-bit):
┌────────┬────────┬────────┬────────┬──────────────┐
│ L1 idx │ L2 idx │ L3 idx │ Page   │ Page offset  │
│ [47:39]│ [38:30]│ [29:25]│ [24:14]│ [13:0]       │
│ 9 bits │ 9 bits │ 5 bits │ 11 bits│ 14 bits      │
└────────┴────────┴────────┴────────┴──────────────┘
   (iOS dùng 16KB pages → offset = 14 bits)

Translation:
  TTBR1_EL1 (kernel) hoặc TTBR0_EL1 (user)
       │
       ▼
  L1 Table ──[L1 idx]──→ L1 Entry → L2 Table base
                              │
                              ▼
                         L2 Table ──[L2 idx]──→ L2 Entry → L3 Table base
                                                    │
                                                    ▼
                                               L3 Table ──[L3 idx]──→ L3 Entry
                                                                         │
                                                                         ▼
                                                                   Physical Page
                                                                    + offset
                                                                         │
                                                                         ▼
                                                                   Physical Address

Page Table Entry (PTE) Format

L3 Page Table Entry (arm64, 16KB granule):
┌─────────────────────────────────────────────────────────────┐
│ 63    59│58  55│54  52│51          14│13  12│11  10│9  8│...│
│ ignored │ SW   │ res  │ Output Addr  │ res  │  AP  │ SH │...│
│ by HW   │ use  │      │ (phys page)  │      │      │    │   │
├─────────────────────────────────────────────────────────────┤
│ ...│7  6│5│4  2│1│0│
│    │ res│ │MAIR│ │V│
│    │    │ │idx │ │a│
│    │    │ │    │ │l│
│    │    │ │    │ │i│
│    │    │ │    │ │d│
└─────────────────────┘

Key fields:
  Bit 0 (Valid)     : 1 = entry valid, 0 = fault on access
  Bits 4:2 (AttrIdx): Memory attribute index (MAIR register)
  Bits 7:6 (AP)     : Access Permission
                       00 = EL1 R/W, EL0 no access
                       01 = EL1 R/W, EL0 R/W
                       10 = EL1 R/O, EL0 no access
                       11 = EL1 R/O, EL0 R/O
  Bits 9:8 (SH)     : Shareability (Inner/Outer/None)
  Bit 10 (AF)       : Access Flag (set by HW on first access)
  Bit 54 (XN)       : Execute Never (EL1)
  Bit 53 (PXN)      : Privileged Execute Never
  Bits 51:14        : Physical address of page (shifted)

Address Permissions Summary

AP[7:6]	EL1 (kernel)	EL0 (user)
00	Read/Write	No access
01	Read/Write	Read/Write
10	Read-only	No access
11	Read-only	Read-only

XNU Virtual Memory Subsystem

VM Map

// vm_map = address space representation
struct vm_map {
    struct vm_map_header    hdr;        // Sorted list of vm_map_entry
    pmap_t                  pmap;       // Machine-dependent page tables
    vm_map_size_t           size;       // Virtual size
    // ...
};

// vm_map_entry = one contiguous mapping
struct vm_map_entry {
    struct vm_map_entry *prev, *next;   // Doubly-linked list
    vm_map_offset_t     vme_start;      // Start virtual address
    vm_map_offset_t     vme_end;        // End virtual address
    vm_prot_t           protection;     // Current protection
    vm_prot_t           max_protection; // Maximum allowed protection
    // ...
    union {
        vm_object_t     vme_object;     // Backing object (file, anonymous)
    };
};

Pmap (Physical Map)

// pmap = machine-dependent page table management
struct pmap {
    tt_entry_t          *tte;           // Top-level page table pointer
    uint64_t            asid;           // Address Space ID (for TLB)
    // ...
};

Key pmap functions:

// Create mapping: virtual → physical
pmap_enter_options(pmap, va, pa, prot, fault_type, flags, options);

// Remove mapping
pmap_remove(pmap, start, end);

// Change protection
pmap_protect(pmap, start, end, prot);

// Query mapping
pmap_find_phys(pmap, va);  // Returns physical page number

TLB (Translation Lookaside Buffer)

TLB = cache cho page table entries. CPU không walk page tables mỗi memory access — nó check TLB trước.

CPU needs virtual → physical translation
  ├─→ Check TLB (fast path)
  │     ├─→ TLB hit: use cached translation
  │     └─→ TLB miss: walk page tables (slow path)
  │           └─→ Insert result into TLB
  └─→ Access physical memory

TLB invalidation (TLBI instruction) cần thiết khi:

Thay đổi page table entries
Context switch (ASID change)

Bug pattern: Kernel thay đổi PTE nhưng quên invalidate TLB → stale translation vẫn dùng → security violation.

Physical Use-After-Free (PUAF)

Concept

Process A maps virtual address VA → physical page P
Bug: kernel frees physical page P nhưng KHÔNG remove mapping từ process A's page tables
Kernel reallocates physical page P cho purpose khác (kernel object, page table, ...)
Process A vẫn đọc/ghi P thông qua VA → đọc/ghi kernel data!

PUAF → physrw Escalation

Nếu page P trở thành Level 3 page table:
  ├─→ Process A ghi vào P = modify page table entries
  ├─→ Tạo PTE mới trỏ đến BẤT KỲ physical address
  ├─→ Map toàn bộ DRAM vào address space
  └─→ Full physical read/write!

Nếu page P trở thành kernel object:
  ├─→ Process A ghi vào P = corrupt kernel object
  └─→ Escalate to kread/kwrite

Defenses (iOS 17+ SPTM)

SPTM ensures:
  - Physical pages track their "type" (user, kernel, page table, ...)
  - User pages CANNOT be reallocated as kernel pages until next boot
  - Page table modifications MUST go through SPTM (EL2)
  → PUAF from user → kernel is blocked
  → PUAF user → user still possible (less useful)

Page Lifecycle

Free page pool
  │
  ├─ vm_page_grab() → Allocate physical page
  │   └─ pmap_enter() → Map into address space
  │
  ├─ pmap_remove() → Remove mapping
  │   └─ vm_page_free() → Return to free pool
  │
  └─ PUAF bug: vm_page_free() WITHOUT pmap_remove()
       → Page returned to free pool but still mapped!

Kernel Memory Regions

┌─────────────────────────────────────────┐
│  Kernel Virtual Address Space           │
│                                         │
│  ┌─────────────────────┐               │
│  │ Kernelcache         │ Fixed mapping  │
│  │ (__TEXT, __DATA)     │ KASLR slide   │
│  └─────────────────────┘               │
│  ┌─────────────────────┐               │
│  │ Zone maps           │ Dynamic       │
│  │ (kalloc, ipc, ...)  │               │
│  └─────────────────────┘               │
│  ┌─────────────────────┐               │
│  │ Kernel map          │ General       │
│  │ (large allocations) │ purpose       │
│  └─────────────────────┘               │
│  ┌─────────────────────┐               │
│  │ MMIO regions        │ Device        │
│  │ (hardware registers)│ mappings      │
│  └─────────────────────┘               │
└─────────────────────────────────────────┘

Tài Nguyên

XNU source: osfmk/vm/vm_map.c, osfmk/arm64/pmap.c
Apple — Memory and Virtual Memory
Project Zero — The Core of Apple is PPL
Alfie CG — Kernel Exploit Guide (VM exploitation sections)
ARM Architecture Reference Manual — Chapter D5 (Address Translation)

Bài Tập

Manual page table walk: Cho virtual address, TTBR value, và page table dumps — compute physical address by hand
Read pmap.c: Trace pmap_enter_options() — hiểu mỗi parameter làm gì
Analyze PUAF exploit: Đọc kfd source code, trace PUAF primitive (smith/landa/physpuppet)
Draw memory map: Cho 1 running process, dùng vmmap (macOS) vẽ full address space layout
Compute PTE values: Cho physical address + desired permissions, construct PTE value by hand