Apple's Predicament: NSPredicate Exploitation on macOS and iOS
Austin Emmitt demonstrates bypassing Apple's iOS 16 NSPredicate restrictions, achieving 100% reliable PAC bypasses and code execution in SpringBoard.
Summary
The Evolution of NSPredicate Exploitation
Following the infamous FORCEDENTRY zero-click iMessage exploit, Apple introduced strict sandboxing restrictions to prevent NSPredicate from invoking arbitrary Objective-C methods.
Circumventing iOS 16 NSPredicateVisitor Protections
Austin Emmitt discovers syntax manipulation techniques in NSPredicate parsing that completely bypass Apple's AST visitor validations across iOS 16 and macOS.
Reliable Pointer Authentication Code (PAC) Bypasses
Using carefully constructed predicate trees, Emmitt scripts the Objective-C runtime to invoke arbitrary C functions with controlled arguments, achieving a 100% reliable PAC bypass.
Exploiting SpringBoard and System Services
Demonstrating live code injection into core system daemons (including SpringBoard and Preferences) illustrates stealing sensitive notifications, device telemetry, and location data.
Related talks
Main Stage·39 min
Thijs Alkemade
Thijs Alkemade reveals how a single process injection vulnerability in macOS broke code signing, sandboxing, and Transparency Consent and Control (TCC).
Main Stage·40 min
Zhipeng Huo · Yuebin Sun · Chuanda Ding
Tencent Security researchers reveal novel IPC logic bugs in Apple's XPC messaging architecture, achieving privilege escalation and sandbox escape on macOS and iOS.
Main Stage·38 min
Yoav Magid
Analyzes the architecture of Apple Intelligence and Private Cloud Compute, identifying privacy risks and data leakage vectors across on-device and cloud models.