siguza/aprr

Apple hardware secrets

APRR

Some utilities to probe/explore Apple's APRR CPU feature.

Write-up here.

Building

You'll need vmacho from my misc repo. Once you have that, just:

make

Usage

Requires the ability to run shellcode in EL1 on A10 chips or newer.
You might want to tweak APRR0_MASK/APRR1_MASK in aprr.s before using.

Upload the aprr.bin to a physically contiguous region of memory, then make one CPU jump to it right after reset. When it ran through, dump 0x13000 bytes from offset 0x10 of that memory region, and transfer back to the host. Feed the saved bindump to the parse util together with the APRR0_MASK/APRR1_MASK you used. Four data sets are present, at offsets 0x0, 0x4c00, 0x9800 and 0xe400. Example invocation:

./parse result.bin 0x0    0xfffff3f3fffff3f3 0xfffff3f3fffff3f3 >results/0xfffff3f3fffff3f3-0xfffff3f3fffff3f3-PAN-WXN.txt
./parse result.bin 0x4c00 0xfffff3f3fffff3f3 0xfffff3f3fffff3f3 >results/0xfffff3f3fffff3f3-0xfffff3f3fffff3f3-NOPAN-WXN.txt
./parse result.bin 0x9800 0xfffff3f3fffff3f3 0xfffff3f3fffff3f3 >results/0xfffff3f3fffff3f3-0xfffff3f3fffff3f3-PAN-NOWXN.txt
./parse result.bin 0xe400 0xfffff3f3fffff3f3 0xfffff3f3fffff3f3 >results/0xfffff3f3fffff3f3-0xfffff3f3fffff3f3-NOPAN-NOWXN.txt

Results

/results contains a pre-parsed set of test results, run on an A10 device.

See that folder for a format description.

yolo.c

Contains a kernel info leak that gives you the address of __PPLDATA_CONST on A12. 0day at the time of writing, should work at least up to & including iOS 13.0 beta 6.