Finally Here: iOS Full System Fuzzing

So far, we have explored QEMU internals, understood the basics of instrumenting the emulator, made it talk with American Fuzzy Lop (AFL), added a CPU (normally used in basebands) and some peripherals to an unknown firmware, and walked through project FirmWire, an emulator for Samsung and Mediatek basebands. Also, we have coped with OpenWrt, a very famous open source alternative firmware for routers.

Now, we have reached the most convoluted facet of IoT devices, smartphones. These devices have a very complex software stack and a plethora of sensors – GPS, accelerometers, gyroscopes, and compasses, to name a few.

The upcoming chapters may be particularly difficult if you are not familiar with products by Apple or Google.

As a security researcher that, over the years, has worked with many platforms, I can tell from my experience that Apple software seems extremely intimidating because it requires an understanding of a significant amount...