Fugu15 - The Journey to Jailbreaking iOS 15.4.1

The talk explains how the Fugu15 jailbreak got around the hardening Apple added in iOS 15, where a kernel bug alone is no longer enough. The speaker starts with how iOS code signing works and how CoreTrust validates signature blobs. The first flaw is that certificate object identifiers directly set trust flags, so a crafted certificate can claim App Store origin and skip signer checks. A second issue lets a fat binary carry a second executable past the installer's team ID comparison, which yields initial code execution.

The middle covers the kernel stage. A PCI driver kit method accepts an unchecked 64-bit offset, giving out-of-bounds access to memory. Because PCI memory addresses are predictable and the physical RAM layout is constrained, the exploit can locate the kernel's memory map and derive the slide without a separate leak, reaching arbitrary read and write. Later steps bypass pointer authentication by abusing a thread recovery handler that returns without authentication, then defeat PPL by exploiting a stale TLB entry left behind by nested shared-cache page tables.

The talk closes with a partly live demo on a device running iOS 15.4.1. The exploit repurposes a signed developer app to install the jailbreak, then shows kernel information and memory reads, and installs a package manager. The takeaway is that trust decisions made from attacker-supplied data and incomplete cache invalidation can undo layered mitigations.