Reverse Engineering Apple Security Updates

Apple's monthly security advisories describe fixes in broad terms, but the actual binary changes sit inside large firmware images. This talk addresses that gap by turning advisory text into function-level evidence about what changed. It builds on an earlier manual patch-diffing workflow and moves the process into a repeatable pipeline.

The pipeline pairs deterministic tooling with language-model agents. Firmware packages are extracted and compared with binary diffing tools, and the output is narrowed to the modules that match a given CVE. Agents then classify the platform, score candidate binaries, and summarize the modified functions into a suspected root cause. The talk included live demonstrations and several case studies, including a font parser out-of-bounds write, a CoreAudio double-free, a pointer authentication change, and a Messages logic error. In these examples, thousands of changed binaries were reduced to a short candidate list, and draft analyses were produced within hours of release.

The talk was candid about limits. Results can be false positives, some fixes live outside the changed code, such as entitlement changes, and kernel extensions without symbols gave the model weaker context. Decompilation failures also reduce accuracy. Practitioners should treat the output as leads to verify by exercising the bug. The roadmap includes Windows support, more devices, kernel symbol handling, and deeper variant hunting.