Make XNU GREAT Little Again

The talk looks at how Apple has reworked the XNU kernel across iOS generations and Apple silicon to isolate its most security-sensitive components, pulling it back toward its microkernel origins. It opens with the history of jailbreaking, from early devices where gaining code execution often meant switching off the mandatory access control framework, through the kernel-patching era and the code signing bypasses that followed.

The middle section walks through the protections in order. KTRR uses a write-once silicon register to lock kernel text and read-only data during boot. The page protection layer builds on pointer authentication and a permission indirection scheme, first APRR and later SPRR, so that certain memory becomes writable only along trusted code paths. The speaker then covers memory tagging, the guarded execution feature that adds a parallel guarded level entered through a custom instruction, and the monitors that run there. The secure page table monitor takes over page table management from the kernel, and the trusted execution monitor handles code signing and entitlement decisions. Firmware images and disassembly examples show how these components are packaged and called.

The talk closes by arguing that these layers narrow the attack surface, so that an arbitrary kernel read or write is far less useful than it once was, while each new mitigation still tends to attract bypass research. Time ran short, so the exclaves material was not covered. The practical takeaway is a clearer picture of why modern iOS exploitation has shifted toward physical memory and logic flaws.