mac osx逆向工程
Mac OS X
| YEAR | NAME | AUTHOR(S) | CONFERENCE |
|---|---|---|---|
| 2003 | |||
| Dynamically Overriding Mac OS X | Jonathan Rentzsch | N/A | |
| A Debugger with Gui in OS X | Ivan Krizsan | N/A | |
| 2004 | |||
| Practical Mac OS X Insecurity | Angelo Laub | CCC | |
| 2005 | |||
| MacOS Kernel Insecurity | Ilja van Sprundel & Christian Klein |
N/A | |
| Infecting the Mach-O Object Format | Nemo | N/A | |
| Hacking Mac OS X Kernel for unsupported machines | Ryan Rempel | N/A | |
| FireWire: All your memory are belong to us | Michael Becher & Maximillian Dornseif & Christian N. Klein |
Cansecwest | |
| 2006 | |||
| Breaking Mac OS X | Nemo, Ilja van Sprundel | N/A | |
| Abusing Mach on Mac OS X | Nemo | N/A | |
| Hit by a Bus: Physical Access Attacks with Firewire | Adam Boileau | Ruxcon | |
| Hardware Virtualization Rootkits | Dino Dai Zovi | BlackHat | |
| Discovering Mac OS X Weaknesses | Jay Beale | Def Con 14 | |
| 2007 | |||
| Hacking Leopard | Charlie Miller & Jake Honoroff |
N/A | |
| Inside the Mac OS X Kernel | Lucy | 24C3 2007 | |
| 2008 | |||
| Hacking OS X | Charlie Miller | BH Japan 08 | |
| Dtrace The Reverse Engineer’s Unexpected Swiss Army Knife | Tiller Beauchamp & David Weston |
BH US 08 | |
| iRK – Crafting OS X Kernel Rootkits | Jesse D’Aguanno | BH US 08 | |
| RETrace – Applied Reverse Engineering on OS X | Tiller Beauchamp & David Weston |
Defcon 16 | |
| Under the iHood | Cameron Hotchkies | Recon 2008 | |
| Covering the tracks on Mac OS X Leopard | Charles Scott | N/A | |
| OS X Rootkits – the next level | Alfredo Pesoli | LaCon 2008 | |
| How the Leopard hides his spots | The Gruqq | HITB KL | |
| 2009 | |||
| Advanced Mac OSX Rootkits (paper) | Dino Dai Zovi | N/A | |
| Advanced Mac OS X Rootkits | Dino Dai Zovi | N/A | |
| Runtime Kernel Patching on OS X | Bosse Eriksson | Defcon 17 | |
| Mac OS Xploitation | Dino Dai Zovi | N/A | |
| Dynamic Tracing for Exploitation and Fuzzing | Tiller Beauchamp & David Weston |
Shakacon 2009 | |
| Mac OS X Malware Analysis | Joel Yonts | N/A | |
| Objective-c Internals | André Pang | N/A | |
| Hacking Macs for Fun and Profit | Dino Dai Zovi & Charlie Miller |
CSW 2009 | |
| Mac OS Xploitation | Dino Dai Zovi | Source 2009 | |
| Debugging Cocoa with DTrace | Colin Wheeler | N/A | |
| Let your Mach-O fly | Vincenzo Iozzo | BH DC 09 | |
| Dynamically Overriding Mac OS X – Down the Rabbit Hole | Jonathan Rentzsch | N/A | |
| Encryption Wrapper on OSX.pdf | Unknown | N/A | |
| 2010 | |||
| Function hooking for OSX and Linux | Joe Damato | N/A | |
| Mac Os X Hacking Snow Leopard edition | Charlie Miller | N/A | |
| Advanced Mac OS X Physical Memory Analysis | Matthieu Suiche | BH DC 2010 | |
| Advanced Mac OS X Physical Memory Analysis (paper) | Matthieu Suiche | BH DC 2010 | |
| Post exploitation techniques on OSX and Iphone | Vincenzo Iozzo | EUSecwest | |
| Programacion de rootkits en Mac OS X.pdf | Fernando López Hernández | N/A | |
| Hacking at Mach speed | Dino Dai Zovi | N/A | |
| Mac OS X Return Oriented Exploitation | Dino Dai Zovi | N/A | |
| Having Fun with Apples IOKit | Ilja van Sprundel | N/A | |
| 2011 | |||
| Defiling Mac OS X Kernel Rootkits | Snare | Ruxcon 2011 | |
| Hacking at Mach2 | Dino Dai Zovi | N/A | |
| The Apple Sandbox (paper) | Dionysus Blazakis | BH DC 2011 | |
| The Apple Sandbox | Dionysus Blazakis | BH DC 2011 | |
| Battery Firmware Hacking | Charlie Miller | N/A | |
| Macs in the Age of APT | iSEC Partners | BH USA 2011 | |
| Protecting the core – Kernel Exploitation mitigations | Patroklos Argyroudis & Dimitris Glynos |
BH EU 2011 | |
| Protecting the core – Kernel Exploitation mitigations (paper) | Patroklos Argyroudis & Dimitris Glynos |
BH EU 2011 | |
| 2012 | |||
| Syscan12 – DE MYSTERIIS DOM JOBSIVS: MAC EFI ROOTKITS | Snare | Syscan Singapore 12 | |
| Hack Mac OS X – Tips and tricks for Mac OS X hack | sud0man | GSDays 2012 | |
| Ruxcon – DE MYSTERIIS DOM JOBSIVS: MAC EFI ROOTKITS | Snare | Ruxcon | |
| How to re-engineer OSX to behave the way you want | Stephen Sykes | CodeBits 2012 | |
| Mac Memory Analysis with Volatility | Andrew Case | DFIR Summit | |
| OS/X Flashback | ESET | N/A | |
| When Macs Get Hacked | Sarah Edwards | DFIR Summit | |
| Analysis & Correlation of Mac Logs | Sarah Edwards | DFIR Summit | |
| Infiltrate the Vault – Security Analysis and Decryption of Lion Full Disk Encryption | Omar Choudary & Felix Grobert & Joachim Metz |
N/A | |
| FORENSIC MEMORY ANALYSIS FOR APPLE OS X | Andrew F. Hay | N/A | |
| EFI Rootkits | Andreas Galauner | SIGINT | |
| DE MYSTERIIS DOM JOBSIVS Mac EFI Rootkits (paper) | Snare | Black Hat | |
| DE MYSTERIIS DOM JOBSIVS Mac EFI Rootkits | Snare | Black Hat | |
| FLASHBACK OS X MALWARE (paper) | Broderick Ian Aquilino | VB2012 | |
| FLASHBACK OS X MALWARE | Broderick Ian Aquilino | VB2012 | |
| Backdoor.Flashback (Russian) | Dr Web | N/A | |
| Mac OS X Malware Overview (Russian) | Ivan Sorokin | ZeroNights | |
| XNU: A security evaluation | Daan Keuper | ||
| 2013 | |||
| Destructive DTrace | Nemo | Infiltrate13 | |
| Revisiting Mac OS X Kernel Rootkits | fG! | SyScan13 | |
| Mountain Lion and iOS Vulnerabilities Garage Sale | Stefan Esser | SyScan13 | |
| Mountain Lion and iOS Vulnerabilities Garage Sale (whitepaper) | Stefan Esser | SyScan13 | |
| OS X Hardening – Mountain Lion 10.8 | ERNW | N/A | |
| Ninjas and Harry Potter – “Spell”unking in Apple SMC land | Alex Ionescu | No Such Con | |
| 2014 | |||
| Reverse Engineering Mac Malware | Sarah Edwards | BsidesNoLA | |
| Methods of Malware Persistence on OS X Mavericks | Patrick Wardle | Shakacon | |
| Methods of Malware Persistence on OS X Mavericks | Patrick Wardle | VB2014 Seattle | |
| OS X Yosemite Artifacts – Call history and SMS analysis | nofate | N/A | |
| BadXNU – A rotten apple! | fG! | CODE BLUE | |
| In lieu of swap: Analyzing compressed RAM in Mac OS X and Linux | Andrew Case, Golden G. Richard III | DFRWS | |
| 2015 | |||
| Fuzzing OS X at Scale | Ben Nagy | Infiltrate | |
| Mac OS X Forensics | Joaquin Moreno Garijo | N/A | |
| Unauthorized Cross-App Resource Access on MAC OS X and iOS | Various Authors | N/A | |
| WRITING BAD @$$ MALWARE FOR OS X | Patrick Wardle | Infiltrate | |
| WRITING BAD @$$ MALWARE FOR OS X | Patrick Wardle | BlackHat US | |
| DYLIB HIJACKING ON OS X | Patrick Wardle | Virus Bulletin | |
| Exposing Gatekeeper | Patrick Wardle | VB2015 Prague | |
| Thunderstrike 2: Sith Strike (draft version, briefly available) | Trammmell Hudson, Corey Kallenberg & Xeno Kovah | BlackHat US | |
| Thunderstrike 2: Sith Strike (final version) | Trammmell Hudson, Corey Kallenberg & Xeno Kovah | BlackHat US | |
| Thunderstrike 2: Sith Strike – A MacBook firmware worm | Trammmell Hudson, Corey Kallenberg & Xeno Kovah | HITB GSEC | |
| Is there an EFI monster inside your apple? | fG! | 44CON | |
| Is there an EFI monster inside your apple? | fG! | SyScan360 Beijing | |
| Is there an EFI monster inside your apple? | fG! | CODE BLUE | |
| OS X Kernel is As Strong as its Weakest Part | Liang Chen and ShuaiTian Zhao | POC | |
| BadXNU – A rotten apple! | fG! | SyScan | |
| Is there an EFI monster inside your apple? | fG! | No cON Name | |
| BadXNU – A rotten apple! | fG! | No cON Name | |
| IPv6 Hardening Guide for OS-X | ERNW | N/A | |
| DTrace + OS X = Fun | Andrezj Dyjak | Confidence | |
| Advancing Mac OS X rootkit detection | Andrew Case, Golden G. Richard III | DFRWS | |
| Code Signing – Hashed Out | Jonathan Levin | RSA | |
| 2016 | |||
| Memory Corruption is for Wussies! | fG! | SyScan360 Singapore |
iOS
| YEAR | NAME | AUTHOR(S) | CONFERENCE |
|---|---|---|---|
| 2008 | |||
| Primer on Reversing Jailbroken iPhone Native Applications | Shub-Nigurrath | N/A | |
| 2009 | |||
| Fun and Games with Mac OS X and iPhone Payloads | Charlie Miller & Vicenzo Iozzo |
BH EU 2009 | |
| Patching Applications from Apple AppStore with additional protection | Reilly | N/A | |
| 2010 | |||
| iPhone Rootkit? There’s an App for that! | Eric Monti | ToorCon 2010 | |
| iPhone security model & vulnerabilities | Cedric Halbronn & Jean Sigwald |
HITB SecConf 2010 | |
| iPhone Privacy | Nicolas Seriot | BH DC 2010 | |
| Adding ASLR to jailbroken iPhones | Stefan Esser | POC 2010 | |
| 2011 | |||
| iNception – Planting and Extracting Sensitive Data From Your iPhone’s Subconscious | Laurent Oudot | HITB Amsterdam | |
| iPhone Data Protection in Depth | Jean-Baptiste Bédrune & Jean Sigwald |
N/A | |
| Auditing iPhone and iPad applications | Ilja van Sprundel | N/A | |
| Practical Consideration of iOS Device Encryption Security | Jens Heider & Matthias Boll |
N/A | |
| Apple iOS 4 Security Evaluation | Dino Dai Zovi | BH US 2011 | |
| Apple iOS 4 Security Evaluation (paper) | Dino Dai Zovi | BH US 2011 | |
| OVERCOMING iOS DATA PROTECTION TO RE-ENABLE iPHONE FORENSICS | Andrey Belenko | BH US 2011 | |
| OVERCOMING iOS DATA PROTECTION TO RE-ENABLE iPHONE FORENSICS (paper) | Andrey Belenko | BH US 2011 | |
| Exploiting the iOS Kernel | Stefan Esser | BH US 2011 | |
| Exploiting the iOS Kernel (paper) | Stefan Esser | BH US 2011 | |
| iPhone Exploitation – One ROPe to Bind Them All? | Stefan Esser | HITB Malaysia 2011 | |
| iPhone Espionage | Keith Lee | N/A | |
| Antid0te 2.0 – ASLR in iOS | Stefan Esser | HITB Amsterdam | |
| Targeting The IOS Kernel | Stefan Esser | SysScan11 Singapore | |
| Baseband Playground | Luis Miras | Ekoparty 7 | |
| Dont Hassle the Hoff : Breaking iOS code signing | Charlie Miller | Syscan11 Taipei | |
| iOS Kernel Exploitation, IOKit Edition | Stefan Esser | SyScan11 Taipei | |
| Secure Development on iOS | David Thiel | PacSec 2011 | |
| An analysis on iOS Jailbreak | Huang Heqing | N/A | |
| An analysis on iOS Jailbreak (presentation) | Huang Heqing | N/A | |
| Evolution of iOS Data Protection and iPhone Forensics: from iPhone OS to iOS 5 | Andrey Belenko & Dmitry Sklyarov |
BH Abu Dhabi 2011 | |
| iOS applications reverse engineering | Julien Bachmann | SCS 2011 | |
| Apple iPad In the Work Place | Russ Spooner | N/A | |
| Attacking and Defending Apple iOS Devices in the Enterprise | Tom Eston | N/A | |
| Writing secure iOS applications | Ilja van Sprundel | N/A | |
| 2012 | |||
| iOS5 An Exploitation Nightmare? | Stefan Esser | CanSecWest 2012 | |
| iOS Application (In)Security | Dominic Chell | OWASP Ireland | |
| iOS Application (In)Security (paper) | MDSec | N/A | |
| iOS Applications – Different Developers Same Mistakes | Paul Craig | Syscan12 Singapore | |
| iOS Kernel Heap Armageddon | Stefan Esser | Syscan12 Singapore | |
| Evaluating iOS Applications | MDSec | OWASP Manchester | |
| “Secure Password Managers” and “Military-Grade Encryption” on Smartphones: Oh, Really? | Andrey Belenko & Dmitry Sklyarov |
BH EU 2012 | |
| “Secure Password Managers” and “Military-Grade Encryption” on Smartphones: Oh, Really? (paper) | Andrey Belenko & Dmitry Sklyarov |
BH EU 2012 | |
| Corona Jailbreak for iOS 5.0 | Jailbreak Dream Team | HiTB Amsterdam | |
| Corona Jailbreak for iOS 5.0.1 | Jailbreak Dream Team | HiTB Amsterdam | |
| Absinthe Jailbreak for iOS 5.0.1 | Jailbreak Dream Team | HiTB Amsterdam | |
| iOS 6 Security: A Hacker’s Guide | Mark Dowd & Tarjei Mandt |
HiTB KL | |
| Find Your Own iOS Kernel Bug | Xu Hao & Xiabo Chen |
POC | |
| Practical iOS Apps hacking (paper) | Mathieu Renard | GreHack | |
| Defending Data on iOS | Securosis, LLC | N/A | |
| Jailbreaking Techniques | pod2g | WWJC | |
| Downgrading iOS: SHSH Blobs & APTickets | iH8sn0w | WWJC | |
| A Close-Up on Jailbreaking and Tweak Development | Nikias Bassen | WWJC | |
| iOS applications auditing | Julien Bachmann | AppSec Forum | |
| Pentesting iOS Apps: Runtime Analysis and Manipulation | Andreas Kurtz | DeepSec | |
| Practical iOS Apps hacking (slides) | Mathieu Renard | GreHack | |
| Hacking iOS Applications | Mathieu Renard | Hack.lu | |
| 2013 | |||
| Attacking the iOS Kernel: A Look at ‘evasi0n’ | Tarjei Mandt | NIS | |
| Swiping Through Modern Security Features | evad3rs | HiTB Amsterdam | |
| Blackbox analysis of iOS apps | Dmitry Evdokimov | Zero Nights | |
| 2014 | |||
| Identifying Back Doors, Attack Points, and Surveillance Mechanisms in iOS Devices | JONATHAN ZDZIARSKI | HOPE/X | |
| Reversing iOS Apps – a practical approach | Patrick Wardle | T2 | |
| Exploiting Unpatched iOS Vulnerabilities for Fun and Profit | Various Authors | N/A | |
| idb – iOS Blackbox Pentesting | Daniel A. Mayer | ShmooCon | |
| Exploring and Exploiting iOS Web Browsers | Lukasz Pilorz, Marek Zmyslowski | HITB Amsterdam | |
| 2015 | |||
| iOS 678 Security – Study in Fail | Stefan Esser | SyScan | |
| Optimized Fuzzing IOKIT in iOS | Lei Long | BlackHat US | |
| Optimized Fuzzing IOKIT in iOS (paper) | Lei Long | BlackHat US | |
| Review and Exploit Neglected Attack Surface in iOS 8 | Pangu Team | BlackHat US | |
| Hacking from iOS 8 to iOS 9 | Pangu Team | RUXCON/POC |
Firmware
| YEAR | NAME | AUTHOR(S) | CONFERENCE |
|---|---|---|---|
| 2012 | |||
| New Results for Timing-Based Attestation | Xeno Kovah, Corey Kallenberg, Chris Weathers, Amy Herzog, Matthew Albin, John Butterworth |
2012 IEEE Symposium on Security and Privacy |
|
| No More Hooks: Trustworthy Detection of Code Integrity Attacks | Xeno Kovah, Corey Kallenberg, Chris Weathers, Amy Herzog, Matthew Albin, John Butterworth |
DefCon 20 | |
| 2013 | |||
| BIOS Chronomancy: Fixing the Core Root of Trust for Measurement |
John Butterworth, Xeno Kovah, Corey Kallenberg | BlackHat US | |
| BIOS Chronomancy: Fixing the Core Root of Trust for Measurement (paper) |
John Butterworth, Xeno Kovah, Corey Kallenberg | BlackHat US | |
| 2014 | |||
| All Your Boot Are Belong To Us | Yuriy Bulygin, Andrew Furtak, Oleksandr Bazhaniuk, John Loucaides |
CanSecWest | |
| All Your Boot Are Belong To Us | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
CanSecWest | |
| Attacks on UEFI Security | Rafal Wojtczuk, Corey Kallenberg | 31c3 | |
| Attacking UEFI Boot Script | Rafal Wojtczuk, Corey Kallenberg | 31c3 | |
| Copernicus 2: SENTER the Dragon! | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
CanSecWest | |
| SENTER Sandman: Using Intel TXT to Attack BIOSes | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
HITB | |
| SENTER Sandman: Using Intel TXT to Attack BIOSes (paper) | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
HITB | |
| Defeating Signed BIOS Enforcement | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
N/A | |
| Analyzing UEFI BIOS from Attacker & Defender Viewpoints | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
BlackHat EU | |
| Into the Unknown: How to Detect BIOS-level attackers | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
VB 2014 | |
| Into the Unknown: Assessing your BIOS vulnerabilities | Corey Kallenberg, John Butterworth, Sam Cornwell, Bob Heinemann |
MIRcon | |
| Extreme Privilege Escalation on Windows 8/UEFI Systems | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
BlackHat US | |
| Extreme Privilege Escalation on Windows 8/UEFI Systems (paper) | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
BlackHat US | |
| Setup For Failure: Defeating Secure Boot | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
SyScan | |
| Setup For Failure: Defeating Secure Boot (paper) | Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell |
SyScan | |
| 2015 | |||
| BIOS Necromancy: Utilizing “Dead Code” for BIOS Attacks | Corey Kallenberg & Xeno Kovah | HITB GSEC | |
| Betting BIOS Bugs Won’t Bite Y’er Butt? | Corey Kallenberg & Xeno Kovah | ShmooCon | |
| How Many Million BIOSes Would you Like to infect? | Corey Kallenberg & Xeno Kovah | CanSecWest | |
| How Many Million BIOSes Would you Like to infect? (paper) | Corey Kallenberg & Xeno Kovah | CanSecWest | |
| Are you giving firmware attackers a free pass? | Corey Kallenberg & Xeno Kovah | RSA |