{"id":47412,"date":"2025-04-15T13:26:34","date_gmt":"2025-04-15T17:26:34","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=47412"},"modified":"2025-04-15T13:26:34","modified_gmt":"2025-04-15T17:26:34","slug":"dlsym-considered-harmful-on-ios-18-4","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/04\/15\/dlsym-considered-harmful-on-ios-18-4\/","title":{"rendered":"dlsym Considered Harmful on iOS 18.4"},"content":{"rendered":"<p><a href=\"https:\/\/www.synacktiv.com\/en\/publications\/ios-184-dlsym-considered-harmful\">Fabien Perigaud<\/a> (<a href=\"https:\/\/x.com\/Synacktiv\/status\/1910322452715946224\">tweet<\/a>):<\/p>\n\n<blockquote cite=\"https:\/\/www.synacktiv.com\/en\/publications\/ios-184-dlsym-considered-harmful\">\n<p>This time, we will dynamically resolve and use <code>strcmp()<\/code>.<\/p>\n<p>[&#8230;]<\/p>\n<p>Instead of a nice log indicating that the two strings are not the same, our application crashed...<\/p>\n<p>[&#8230;]<\/p>\n<p>What just happened? Why is the pointer incorrectly signed? Why do I have a kernel pointer in <code>PC<\/code>?<\/p>\n<p>[&#8230;]<\/p>\n<p>A <code>XPACI<\/code> instruction is clearly missing here, we can see the return value (<code>X0<\/code>) from the <code>BLRAAZ<\/code> being directly converted to an offset by the <code>SUB<\/code> instruction. In iOS 18.3.2, the <code>XPACI<\/code> instruction is present.<\/p>\n<p>[&#8230;]<\/p>\n<p>Repeated tests showed that in contrast to the specification, the\npointer was considered as a kernel one (during a signature operation) if the bit 63 is set!<\/p>\n<\/blockquote>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2025\/03\/31\/ios-18-4-and-ipados-18-4\/\">iOS 18.4 and iPadOS 18.4<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2023\/04\/27\/zero-click-exploits-against-ios-16\/\">Zero-Click Exploits Against iOS 16<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/01\/10\/project-zero-remote-iphone-exploitation\/\">Project Zero Remote iPhone Exploitation<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Fabien Perigaud (tweet): This time, we will dynamically resolve and use strcmp(). [&#8230;] Instead of a nice log indicating that the two strings are not the same, our application crashed... [&#8230;] What just happened? Why is the pointer incorrectly signed? Why do I have a kernel pointer in PC? [&#8230;] A XPACI instruction is clearly [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2025-04-15T17:26:37Z","apple_news_api_id":"8374055a-cf59-4b15-a0ab-be26e7e740d4","apple_news_api_modified_at":"2025-04-15T17:26:37Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/Ag3QFWs9ZSxWgq74m5-dA1A","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[4],"tags":[770,131,205,31,2586,71],"class_list":["post-47412","post","type-post","status-publish","format-standard","hentry","category-programming-category","tag-assembly-language","tag-bug","tag-dyld","tag-ios","tag-ios-18","tag-programming"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/47412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=47412"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/47412\/revisions"}],"predecessor-version":[{"id":47413,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/47412\/revisions\/47413"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=47412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=47412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=47412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}