Official references:
My own doing:
Mach-O
- Jonathan Levin - DYLD DetaYLeD
- Jonathan Levin - Code Signing
Sandbox
IPC
- Apple - Mach (Overview and API documentation (inside the XNU source in
osfmk/man/index.html
)) - nemo - Mach and MIG (examples are outdated and for PPC/Intel, but descriptions are still accurate)
- Ian Beer - Apple IPC (Video and Slides)
File Systems
- Apple - APFS Reference
Kernel
- Apple - Kernel Programming Guide
- Apple - IOKit Fundamentals (available as Website or PDF)
- Apple - About the Virtual Memory System
- qwertyoruiopz - Attacking XNU (Part One and Two)
- Stefan Esser - Kernel Heap (I hope I don't get sued)
Kernel Integrity
Hardware
- Ramtin Amin - Lightning Connector
- Ramtin Amin - NVMe NAND Storage
- Ramtin Amin - iPhone PCIe (dumping the 6s BootROM)
- geohot - evasi0n7
- Jonathan Levin - TaiG 8.0 - 8.1.2 (Part One and Two)
- Jonathan Levin - TaiG 8.1.3 - 8.4 (Part One and Two)
- Jonathan Levin - Who needs task_for_pid anyway?
- qwertyoruiopz - About the “tpwn” Local Privilege Escalation
- Ian Beer - task_t considered harmful
- jndok - Exploiting Pegasus on OS X
- Siguza - Exploiting Pegasus on iOS
- Ian Beer - mach_portal (write-up and presentation slides)
- Ian Beer - Exception-oriented exploitation on iOS
- Jonathan Levin - Phœnix
- Gal Beniamini - Over The Air (Parts One, Two and Three)
- Siguza - v0rtex
- Ian Beer - async_wake_ios
- Siguza - IOHIDeous
- Jonathan Levin - QiLin (PDF and API)
- Brandon Azad - A fun XNU infoleak
- jeffball - Heap overflow in necp_client_action
- xerub - De Rebus Antiquis
- Ian Beer - multi_path
- Brandon Azad - blanket
- qwertyoruiopz - iOS Reverse Engineering (Wiki and Papers)
- Google Project Zero - All the bugs Ian Beer has killed