Exploiting Reversing (ER) series: article 10 | iOS Security Research (part 01)

Today the tenth article in the Exploiting Reversing Series (ERS) is available. This new article has 205 pages, and it is free, like every article in the series.

Read it here, published on:

https://exploitreversing.com/wp-content/uploads/2026/10/exploit_reversing_10.pdf

This is the first article in the series aimed at iOS itself, and it opens a multi-part sequence on iOS security research.

Most writing on iOS exploitation assumes the reader already has a paired device, a relaxed Mac host and a symbolicated kernelcache. This article deliberately starts earlier than that, because the environment you build at the beginning filters everything that follows.

It covers:

[+] The protection stack a kernel chain must cross in sequence: KASLR, Pointer Authentication, kalloc_type segregation with zone_require assertions, PPL and its successors SPTM at GL2 and TXM at GL0, Exclaves, and trust-cache code signing — and why each layer pushes modern exploitation further toward data-only technique.

[+] Reachability, the question that decides whether a bug is worth anything: Of roughly 140 IOKit services on a current device, only eighteen can be opened from inside the application sandbox. The article works through sandbox_check probing, what entitlements enforce that a sandbox profile cannot, and an empirical sweep of which user clients actually open and which selector types they accept.

[+] The four roles of a working 2026 research lab: an orchestrating workstation, an Apple Silicon Mac host with SIP disabled and AMFI relaxed, a vPhone guest running a jailbroken image under Apple’s Virtualization.framework, and physical iPhones where a finding gets its last word.

[+] A reproducible kernelcache pipeline: symbolication with ipsw and the Cellebrite IDA plugins, export of the IDB into SQLite so the kernel becomes queryable across builds, and four approaches to diffing two kernelcaches or two IPSWs.

The primary source for new articles is https://www.blackstormsecurity.com/research/, but articles will continue to be published here with a week of delay.

I would like to thank Ilfak Guilfanov (@ilfak) and Hex-Rays SA (@HexRaysSA) for the continuous support.

Enjoy the reading and have an excellent day.

Alexandre Borges

(October 06, 2026)

#iOS #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #KernelSecurity

Exploiting Reversing (ER) series: article 09 | Exploitation Techniques: CVE-2024-30085 (part 03)

Today I am releasing the nineth article in the Exploiting Reversing Series (ERS). In “Exploitation Techniques | CVE-2024-30085 (Part 03)” I provide a 106-page deep dive and a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/wp-content/uploads/2026/04/exploit_reversing_09.pdf

Key features of this edition:

[+] Dual Exploit Strategies: Two distinct exploit editions built on the cldflt.sys heap overflow.
[+] PreviousMode Edition: Exploit cldflt.sys via WNF OOB + Pipe Attributes + ALPC + _KTHREAD.PreviousMode flip – elevation of privilege of a regular user to SYSTEM.
[+] PPL Bypass Edition: Exploit cldflt.sys WNF OOB + PreviousMode flip + _EPROCESS.Protection strip + MiniDumpWriteDump function – elevation of regular user to SYSTEM AND full LSASS credential extraction (NT hashes, Kerberos tickets, DPAPI keys).
[+] Solid Reliability: Two complete, stable exploits, including a multi-step cleanup phase that restores the corrupted pipe attribute Flink and _KTHREAD.PreviousMode before process exit, preventing crash on cleanup.

This article guides you through two additional techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow. While demonstrated here, these methods can be adapted as exploitation techniques for many other kernel targets.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which has been vital in helping me produce this series.

The following articles will continue the miniseries about iOS and Chrome, which are my areas of research.

Enjoy the reading and have an excellent day.

Alexandre Borges
(April 28, 2026)

PS: The videos demonstrating the exploits are below:

Exploiting Reversing (ER) series: article 08 | Exploitation Techniques: CVE-2024-30085 (part 02)

Today I am releasing the eighth article in the Exploiting Reversing Series (ERS). In “Exploitation Techniques | CVE-2024-30085 (Part 02)” I provide a 91-page deep dive and a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/wp-content/uploads/2026/03/exploit_reversing_08.pdf

Key features of this edition:

[+] Dual Exploit Strategies: Two distinct exploit versions leveraging the I/O Ring technique.
[+] Exploit ALPC + WNF OOB + Pipe Attributes + I/O Ring: elevation of privilege of a regular user to SYSTEM.
[+] Replaced ALPC one-shot write with Pipe Attribute spray for I/O Ring RegBuffers corruption: more reliable adjacency control.
[+] Exploit WNF OOB + I/O Ring Read/Write: elevation of privilege of a regular user to SYSTEM.
[+] Pure I/O Ring primitive: eliminated ALPC dependency entirely. WNF overflow directly corrupts I/O Ring RegBuffers for arbitrary kernel read/write.
[+] Solid Reliability: Two complete, stable exploits, including an improved cleanup stage.

This article guides you through two additional techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow. While demonstrated here, these methods can be adapted as exploitation techniques for many other kernel targets.

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which has been vital in helping me produce this series.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy the read and have an excellent day.

Alexandre Borges
(March 31, 2026)

PS: The videos demonstrating the exploit are below:

Exploiting Reversing (ER) series: article 07 | Exploitation Techniques: CVE-2024-30085 (part 01)

I am excited to release the seventh article in the Exploiting Reversing Series (ERS). Titled “Exploitation Techniques | CVE-2024-30085 (part 01)” this 119-page technical guide offers a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/wp-content/uploads/2026/03/exploit_reversing_07-1.pdf

Key features of this edition:

[+] Dual Exploit Strategies: Two distinct exploit versions using Token Stealing and I/O Ring techniques.
[+] Exploit ALPC + PreviousMode Flip + Token Stealing: elevation of privilege of a regular user to SYSTEM.
[+] Exploit ALPC + Pipes + I/O Ring: elevation of privilege of a regular user to SYSTEM.
[+] Solid Reliability: Two complete working and stable exploits, including an improved cleanup stage.
[+] Optimized Exploit Logic: Significant refinements to the codebase and technical execution for better stability and predictability.

The article guides you through the two distinct techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow vulnerability.

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which has helped me write these articles over time.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy your reading and have an excellent day.

Alexandre Borges
(March 04, 2026)

PS: The videos demonstrating the exploit are below:

Exploiting Reversing (ER) series: article 06 | A Deep Dive Into Exploiting a Minifilter Driver (N-day)

I am excited to release the extended version of the sixth article in the Exploiting Reversing Series (ERS). Titled “A Deep Dive Into Exploiting a Minifilter Driver (N-day)” this 296-page deep dive (rev. C1) offers a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/wp-content/uploads/2026/03/exploit_reversing_06_extended_rev_c.pdf

Key updates in this extended edition:

[+] Dual Exploit Strategies: Two distinct exploit versions.
[+] Exploit ALPC Write Primitive Edition: elevation of privilege of a regular user to SYSTEM.
[+] Exploit Parent Process ID Spoofing Edition: elevation of privilege of an administrator to SYSTEM.
[+] Solid Reliability: A completely stable and working ALPC write primitive.
[+] Optimized Exploit Logic: Significant refinements to the codebase and technical execution for better stability and predictability.

For those who have read the original release, whose exploit was working, my strong recommendation is that you adopt this extended edition as definitive.

This revision C.1 features a refined ALPC exploit with a new stage and an extended cleaner stage, ensuring a stable exit and preventing system crashes.

The article guides you through the entire lifecycle of an exploit: from initial reverse engineering and vulnerability analysis to multiple PoC developments and full exploitation.

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which has helped me write these articles over time.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy your reading and have an excellent day.

Alexandre Borges.

March 24, 2026.

Exploiting Reversing (ER) series: article 05 | Hyper-V (part 01)

The fifth article (57 pages) of the Exploiting Reversing Series (ERS), a step-by-step research series on Windows, macOS, hypervisors and browsers, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2025/03/exploit_reversing_05.pdf

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which have helped me write these articles over time.

The best thing in life is people.

I hope you enjoy reading it and have an excellent day.

Alexandre Borges.

(MARCH/12/2025)

Exploiting Reversing (ER) series: article 04 | macOS/iOS (part 01)

The fourth article (126 pages) of the Exploiting Reversing Series (ERS), a step-by-step research series on Windows, macOS, hypervisors and browsers, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2025/02/exploit_reversing_04.pdf

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which have helped me write these articles.

The best thing in life is people.

I hope you enjoy reading it and have an excellent day.

Alexandre Borges.

(FEBRUARY/04/2025)

Exploiting Reversing (ER) series: article 03 | Chrome (part 01)

The third article (62 pages) of the Exploiting Reversing Series (ERS), a step-by-step research series on Windows, macOS, hypervisors and browsers, is available for reading on:

(PDF): h ttps://exploitreversing.com/wp-content/uploads/2025/01/exploit_reversing_03.pdf

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which have helped me write these articles.

The best thing in life is people.

I hope you enjoy reading and have an excellent day.

Alexandre Borges.

(JANUARY/22/2025)

Malware Analysis Series (MAS): article 10 | Linux

The tenth article (35 pages) of the Malware Analysis Series (MAS), a step-by-step malware analysis and reverse engineering series, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2025/01/mas_10.pdf

I hope this last article of MAS helps professionals from cybersecurity communities around the world. The series is now complete.

Have an excellent and keep reversing!

Alexandre Borges

(JANUARY/15/2025)

Malware Analysis Series (MAS): article 09 | Shellcode

The nineth article (38 pages) of the Malware Analysis Series (MAS), a step-by-step malware analysis and reverse engineering series, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2025/01/mas_09-1.pdf

I hope this article helps professionals from cybersecurity communities around the world.

Have an excellent and keep reversing!

Alexandre Borges

(JANUARY/08/2025)

PS: there is a typo on page 07 at the last bullet. Where you read “0x00000095” you must change it to “0x00000099“, as stated at the previous bullet.