Offensive iOS Internals – eLearning

Gain a deeper understanding of iOS security and learn how vulnerabilities, security mechanisms, and internal system components can be analyzed and investigated.

Order e-learning course here

The course focuses on the internal architecture and security mechanisms of iOS. You will explore topics such as XNU, inter-process communication, exploit mitigations and platform-specific security features, while developing practical reverse engineering skills.

The course covers both userland and kernel level and follows the various stages of the jailbreaking process. Real-world vulnerabilities and exploit examples are used to show how iOS security mechanisms can be analysed and bypassed.

What will you gain from the course?

  • Understand the fundamentals of ARM64 architecture
  • Explore the iOS kernel and its security mechanisms
  • Reverse engineer iOS applications and system files
  • Understand common vulnerability types in iOS
  • Learn how memory management works in userland and the kernel
  • Understand sandboxing and code signing
  • Gain a deeper understanding of jailbreaking
  • Analyse platform-specific security mechanisms
  • Work with IPC mechanisms such as Mach messaging and XPC
  • Use patch diffing to identify security-relevant changes

 Who is the course for?

The course is suitable for iOS security researchers, penetration testers, mobile developers and others who want a deeper understanding of the security ecosystem around iOS applications.

Prerequisites

You should have:

  • Basic knowledge of cybersecurity and penetration testing
  • Basic knowledge of iOS
  • Basic Linux skills and experience with the command line
  • An understanding of basic programming concepts in Objective-C, Swift, C, C++ or a similar language

Basic knowledge of ARM/AARCH64 assembly and exploit techniques is recommended, but not required.

Course content

  • Setting up an iOS environment and jailbreaking
  • The iOS operating system and file system
  • ARM64 assembly and basic exploit techniques
  • Debugging with LLDB
  • Reverse engineering with tools such as Hopper and Ghidra
  • The Mach-O format and analysis of iOS binaries
  • The XNU kernel, IPSW files and kernel analysis
  • Code signing, entitlements and trust mechanisms
  • Sandboxing and platform-specific security mechanisms
  • IPC, XPC, patch diffing and analysis of real-world vulnerabilities