34306/ios-exploit-starterpack

This repository is a personal study collection put together by its author on the topic of iOS security research. The README is openly informal: the owner explains that they made the pages for themselves so they can read the material from anywhere, and that they are not really expecting anyone else to be the main audience. The content is organised as a table of eight phases, going from beginner topics to more advanced ones. Phase 0 covers foundations like ARM64 assembly, the C programming language, and how to set up reverse-engineering tools. Phase 1 moves into Darwin basics, the layer of macOS and iOS that includes the Mach-O executable format, code signing, app entitlements, the sandbox, and the dynamic linker called dyld. Phase 2 looks at the XNU kernel itself, including how Mach inter-process communication works, how virtual memory is laid out, and how the heap is organised into zones. From Phase 3 onward, the material gets more focused on iOS security research. Phase 3 walks through the attack surface: IOKit drivers, system calls, and the broad categories of bugs that tend to appear in them. Phase 4 covers exploit primitives such as information leaks, kernel read and write, and what attackers do after they have those capabilities. Phase 5 catalogues the hardware mitigations Apple has added over the years (PAC, KTRR, CTRR, PPL, SPTM, TXM, and Exclaves). Phase 6 is a set of case studies based on publicly documented work like checkm8, unc0ver, Dopamine, Trigon, Operation Triangulation, Coruna, DarkSword, and write-ups by researchers Ian Beer and Siguza, with what the author describes as cross-cutting pattern analysis and proof-of-concept code. Phase 7 lists the tools and lab setup commonly used: IDA, Ghidra, lldb, Frida, plus notes on device setup and kernelcache analysis. Beyond the table of contents shown above, the README does not include installation steps, code samples, or usage instructions. The repository is mainly a set of web pages (the project language is reported as CSS), so the value sits in the rendered notes rather than in any executable code. No licence is mentioned in the README.