Summary

In this chapter, we have surely gone beyond expectations. We have taken an obscure, poorly documented architecture and, thanks to the efforts of many expert people and some of our expertise, we have set up a full-system fuzzer for Apple’s iOS.

The skill set we have learned in this chapter are the final steps toward creating a full-system emulation. These skills involve creating a way to send AFL input to an emulated system, using functions such as dup2() to establish communication channels. We also learned how to create a way to stop a VM and retrieve input using hypercalls and free interrupt handlers to capture relevant information. Additionally, we utilized an interface to enumerate all the system calls and tested them through a loop, employing techniques such as the __syscall assembly trick. Finally, we learned how to put everything together in an unknown and closed source architecture, integrating the various components and techniques to emulate the system effectively...