Xiaolong Bai - HackPac: Hacking Pointer Authentication in iOS User Space

iOS Pointer Authentication Attacks

Xiaolong Bai (Security Researcher, Alibaba) presents HackPac — research demonstrating practical attacks against ARM Pointer Authentication Codes (PAC), Apple's primary control-flow integrity mitigation in iOS 12+.

Pointer Authentication Background

ARM PAC uses cryptographic signatures embedded in the unused high bits of 64-bit pointers, verified before pointer dereference. Forging a valid PAC requires knowledge of a secret key stored in system registers, preventing ROP/JOP attacks by invalidating gadget chains that use unsigned pointers.

Userspace PAC Bypass Techniques

Bai demonstrates that PAC deployment in iOS userspace contains implementation weaknesses: many library functions sign and verify pointers using context values (discriminators) that are attacker-controllable, enabling PAC forgery without knowledge of the secret key.

Exploit Chain Demonstration

The research demonstrates a complete iOS 12 userspace PAC bypass that chains several weaknesses to forge valid PACs for arbitrary pointers, building a functional ROP chain despite PAC enforcement — enabling code execution from a memory corruption primitive.