Fugu15 - The Journey to Jailbreaking iOS 15.4.1

The talk starts from the problem that iOS 15 and later made jailbreaking much harder. Code signing checks, pointer authentication (PAC) and the page protection layer (PPL) mean a single kernel bug is no longer enough, so the speaker presents the full Fugu15 chain that works on iOS 15.4.1.

The chain is built from several separate weaknesses. A flaw in how CoreTrust reads certificate object identifiers lets an attacker claim an App Store signature without any signer check, which gives initial code execution. A second bug in installd's handling of fat binaries, where the team ID check is the only control, lets a second executable run under the trusted signature. A writable PCI driver kit memory mapping that lacks offset checks then yields arbitrary kernel read and write, with kernel addresses recovered by reasoning about memory layout rather than a leak. Later stages cover a PAC bypass through a thread recovery handler that returns without authentication, and a PPL bypass that abuses a stale translation cache entry in nested page tables to remap protected memory.

The talk closes with a live demonstration of installing the chain through a signed developer app and running commands on a phone. The main takeaway is that layered mitigations only hold when every check on every path is complete, since several of the bypasses exploited partial or incomplete fixes.