20 Samuel Gross No Clicks Required: Exploiting Memory Corruption Vulns in Messenger Apps

**Overview** Samuel Gross presents a no-click exploitation technique for memory corruption vulnerabilities in iOS messenger apps (iMessage) that defeats ASLR and achieves code execution through a multi-stage attack chain.

**The Vulnerability** The core vulnerability is a memory corruption issue in NSKeyedArchiver's handling of shared key dictionaries. A shared key dictionary contains linked shared key sets, each with a rank table and keys array. The critical invariant is that num_keys must equal the length of the keys array. By creating cyclic references during decoding—making a child key set point back to a parent—this invariant can be violated. When the application looks up keys in the malformed structure, the rank table can index out of bounds, enabling arbitrary address dereference.

**ASLR Bypass: Crash Oracle Side Channel** The speaker constructs a crash oracle function: given an address, it succeeds only if the address is mapped and contains a valid Objective-C pointer. iOS's automatic delivery receipts provide the communication channel—if processing crashes, no receipt is sent; if successful, a receipt arrives. This creates a one-bit information leak. The exploit profiles the dyld shared cache (a ~1 GB prelinked binary of system libraries) offline to create an address validity bitmap. During exploitation, a linear memory scan within the fixed shared cache range (0x180000000–0x287000000) finds a candidate base address. Binary search then narrows from approximately 30,000–40,000 candidates to a single answer in roughly 20 queries, each query potentially eliminating half the remaining candidates.

**Exploitation Stages** 1. **Heap Spraying**: Allocate 256 MB of data over iMessage to place fake Objective-C objects at predictable addresses. 2. **ASLR Bypass**: Use crash oracle queries and binary search to determine the shared cache base address, requiring ~10-second delays between crashes to avoid respawn penalties. 3. **Object Construction**: Build fake Objective-C objects pointing to real, legitimately-signed classes. 4. **Code Execution**: Call Objective-C methods to launch arbitrary applications.

On iOS 12.4, direct code execution is possible. On iPhone 10s and newer with pointer authentication codes (PAC), function pointers are signed and verified before use, preventing direct code pointer forgery. The bypass reuses existing classes with valid signed method pointers to achieve arbitrary Objective-C method invocation.

**Live Demonstration** The speaker demonstrates the attack on an iPhone running iOS 12.4, showing the linear scanning phase probing addresses in 256 MB increments, candidate reduction from 32,000 to roughly half with each query, heap spray setup, and eventual launch of the Calculator application.

**Limitations and Improvements** The current implementation requires approximately 25 messages to complete exploitation. The speaker notes better engineering could combine heap spray and exploit trigger into a single message, and identifies potential failure modes including incorrect handling of writable pages and allocation activity between messages disrupting heap layout.