Get the latest tech news
Trigon: Exploiting coprocessors for fun and for profit (part 2)
Where did we leave off? Background: KTRR IORVBAR Coprocessors Always-On Processor Investigation AXI? What’s that?! Mapping DRAM Code execution Improving the strategy What about A7 and A8(X)? Conclusion
After a suggestion from@Siguza, the coprocessor that we chose to target was the always-on processor, since the firmware’s base address was in the iboot-handoff region and as such we could easily locate it with the Trigon primitive. After overwriting the start of that function to set some recognisable register values and then try to load from an invalid address, the panic logs proved that we could indeed take control of the always-on processor! We initially thought it was some weird PTE format that used offsets instead of actual addresses, but after discussing this with Siguza, he suggested that it was probably a case of what Apple calls an AXI remapping.
Or read this on Hacker News