23 - Stacksmashing- Inside Apple’s Lightning: JTAGging the iPhone for Fuzzing and Profit

**Overview** Thomas Roth (known as Stacksmashing) presents research on Apple's Lightning connector and hardware-level debugging of iPhones. The talk focuses on the development of Tamarind, an open-source JTAG adapter built using a Raspberry Pi Pico, and tools enabling automated fuzzing and kernel debugging.

**Key Topics** The Lightning connector is a proprietary 8-pin (sometimes 16-pin) interface that handles charging, data transfer, audio, video, and more. Communication occurs via the SDQ/ID bus, a simple one-wire protocol using short/long pulse encoding. The iPhone's Tristar (or Hydra) chip multiplexes different functions based on authentication handshakes initiated when accessories are connected.

**Technical Details** Tamarind implements SDQ protocol on a Raspberry Pi Pico running at 3.3V using the PIO (Programmable I/O) feature. The cable costs roughly $10 to build and can be soldered to cut lightning extension cables. Key capabilities include automatic DFU mode entry (eliminating manual 8-second button holding), automated jailbreaking via Checkmate exploit, and live JTAG debugging of the iPhone boot ROM. Integration with the GRA debugger (version 10.3) enables time-travel debugging and emulation—stepping backward through execution history and testing hypothetical memory changes without rebooting hardware.

For Lightning accessory analysis, the Tear Sniffer tool captures SDQ traffic in real time and auto-converts recordings to C code for replay attacks. Most simple accessories (headphone adapters, charging cables) are replayable. A custom DFU fuzzer rediscovered the Checkmate vulnerability by mutating lightning commands; fuzzing identified a kernel crash in older iOS builds (not current devices), demonstrating the attack surface.

An accidental discovery occurred when testing the Apple Pencil: its 3.8 kilobyte charging sequence includes Bluetooth pairing data and complex bulk data transfers—undocumented in public sources. Unlike simple accessories, the Pencil's protocol is not replayable. Tamarind MTIM (Monkey In The Middle) was developed to intercept and mutate bulk data mid-transfer, enabling fuzzing of this previously unexplored protocol also used by smart keyboards and battery backpacks.

**Takeaways** Hardware interfaces represent rich attack surfaces often overlooked compared to software. Open-source tools like Tamarind democratize hardware security research. Automation via JTAG and custom tools is essential for effective fuzzing campaigns. Lesser-documented protocols—especially bulk data transfers—warrant investigation for undiscovered vulnerabilities.