Skip to content
/ APRR Public

Apple hardware secrets

Notifications You must be signed in to change notification settings

Siguza/APRR

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

26 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

APRR

Some utilities to probe/explore Apple's APRR CPU feature.

Write-up here.

Building

You'll need vmacho from my misc repo. Once you have that, just:

make

Usage

Requires the ability to run shellcode in EL1 on A10 chips or newer.
You might want to tweak APRR0_MASK/APRR1_MASK in aprr.s before using.

Upload the aprr.bin to a physically contiguous region of memory, then make one CPU jump to it right after reset. When it ran through, dump 0x13000 bytes from offset 0x10 of that memory region, and transfer back to the host. Feed the saved bindump to the parse util together with the APRR0_MASK/APRR1_MASK you used. Four data sets are present, at offsets 0x0, 0x4c00, 0x9800 and 0xe400. Example invocation:

./parse result.bin 0x0    0xfffff3f3fffff3f3 0xfffff3f3fffff3f3 >results/0xfffff3f3fffff3f3-0xfffff3f3fffff3f3-PAN-WXN.txt
./parse result.bin 0x4c00 0xfffff3f3fffff3f3 0xfffff3f3fffff3f3 >results/0xfffff3f3fffff3f3-0xfffff3f3fffff3f3-NOPAN-WXN.txt
./parse result.bin 0x9800 0xfffff3f3fffff3f3 0xfffff3f3fffff3f3 >results/0xfffff3f3fffff3f3-0xfffff3f3fffff3f3-PAN-NOWXN.txt
./parse result.bin 0xe400 0xfffff3f3fffff3f3 0xfffff3f3fffff3f3 >results/0xfffff3f3fffff3f3-0xfffff3f3fffff3f3-NOPAN-NOWXN.txt

Results

/results contains a pre-parsed set of test results, run on an A10 device.

See that folder for a format description.

yolo.c

Contains a kernel info leak that gives you the address of __PPLDATA_CONST on A12. 0day at the time of writing, should work at least up to & including iOS 13.0 beta 6.

About

Apple hardware secrets

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published