Become an iOS Hacker - How to Write Your First Exploit using Return Oriented Programming (ARM)

แชร์
ฝัง
  • เผยแพร่เมื่อ 18 ธ.ค. 2024

ความคิดเห็น • 78

  • @idevicecentral
    @idevicecentral 7 ปีที่แล้ว +36

    Definitely, a good tutorial! Props :)

  • @greenstash
    @greenstash 15 วันที่ผ่านมา

    great refresh to brush up on

  • @BillyEllis
    @BillyEllis  7 ปีที่แล้ว +15

    Yes, this video is long. But hopefully it covers the basics of ROP exploits well enough for any beginner to understand. If you want additional explanations on certain things mentioned in this video, leave a comment or talk to me on Twitter @bellis1000. Thanks for watching!

    • @lemonshep2674
      @lemonshep2674 7 ปีที่แล้ว

      Billy Ellis cam there be a JB for iPhone 5/5c with the bug in iOS where you can execute arbitrary code on the wifi chip

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว

      Lemon Shep wasn't that already published by Project 0? ;)

    • @lemonshep2674
      @lemonshep2674 7 ปีที่แล้ว

      Billy Ellis oh I didn't know because I'm not really following the JB community until there's either a very powerful bootrom exploit or an iOS 10 JB for the i5

  • @abhijitlamsoge
    @abhijitlamsoge 5 ปีที่แล้ว

    Hey Billie - Great Video. I have one question - The ARch seems to be ARM/Little Endian, and at 20:09 , the RIP address is loaded in reverse order on stack ? I believe this is true for X86/Big Endian, that the address has to be pushed in reverse order, but not for Little Endian. I believe ARM6 onwards can work in both Big and Little Endian ?? Is your machine configured for Big Endian for Stack addresses. Please correct me if I am wrong. Thanks. Keep up the good work.

  • @RiktigMusik
    @RiktigMusik 6 ปีที่แล้ว +2

    Keep doing your thing bro, u just got a new subscriber!

  • @huyvuquang9074
    @huyvuquang9074 3 ปีที่แล้ว +1

    Seems like your website doesn't work now anymore. It always redirects me to another page

  • @fnsilly8983
    @fnsilly8983 ปีที่แล้ว

    Will ever update this course?

  • @shortvd6300
    @shortvd6300 4 ปีที่แล้ว

    This program can able to change the iPhone IMEI?

  • @ZaneHelton
    @ZaneHelton 7 ปีที่แล้ว +1

    Just to clarify, the `_gadget` function overwrote the PC Register to the memory address of "uname -a" and stored that inside of R0, and then returned to the `system()` function which executes the command inside of R0? I've been learning binary exploitation for a few months now and this is making me second guess everything I've learned. Thanks for the video regardless.

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว +3

      Zane Helton the gadget function is where execution is first redirected. This function takes the next 2 32bit values from the top of the stack and places them in R0 and PC respectively. So you set up the stack so that after the gadget address you have the address of the string (to go inside R0) and the address of system() (to go into PC). Thanks for watching :)

    • @ZaneHelton
      @ZaneHelton 7 ปีที่แล้ว +2

      Ohhh okay, I thought the POP instruction would copy PC into R0 for some reason, but that's clearly what MOV is for. That makes complete sense now. That's what I get for assuming. Thanks for the quick clarification. That would've definitely hindered my sleep for tonight!

  • @ayushvarshney4135
    @ayushvarshney4135 5 ปีที่แล้ว +1

    Hello billy someone has hcked my Iphone by compromising mobile device management. Plz tell me how to rectify that

    • @The_One_0_0
      @The_One_0_0 5 ปีที่แล้ว

      Data wipe your phone sometimes that might not even help if that doesn't work you might as well toss it

  • @MOTHERBOARDPH
    @MOTHERBOARDPH 3 ปีที่แล้ว

    Can I have the source code of this. I want to compile it in my arm device running linux.

  •  7 ปีที่แล้ว

    nice stuff

  • @olliemoss1648
    @olliemoss1648 7 ปีที่แล้ว +1

    this is great! keep up the good videos

  • @ibtdev
    @ibtdev 7 ปีที่แล้ว +3

    billy im getting a "bus error:10" error when putting ./exploit

    • @JPS13Laptop
      @JPS13Laptop 7 ปีที่แล้ว +1

      Can you please tell me what you're putting in the exploit file?

    • @JPS13Laptop
      @JPS13Laptop 7 ปีที่แล้ว +1

      The Ultimate Jailbreaker 1 That won't work. Executables are always run using the ./ This is only true for normal commands.

    • @JPS13Laptop
      @JPS13Laptop 7 ปีที่แล้ว +1

      The Ultimate Jailbreaker 1 Yes, its an executable file.

    • @JPS13Laptop
      @JPS13Laptop 7 ปีที่แล้ว +1

      The Ultimate Jailbreaker 1 Oh right... oops. lol

    • @ibtdev
      @ibtdev 7 ปีที่แล้ว +1

      dont worry guys lol i had too many null bytes

  • @nationalcrypto-center9115
    @nationalcrypto-center9115 6 ปีที่แล้ว

    Is this only for jailbreak ios devices

  • @TheSessionCA
    @TheSessionCA 7 ปีที่แล้ว

    Amazing bro. Good shit

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว +1

      The Session thanks for watching :))

  • @beautifulaffliction1742
    @beautifulaffliction1742 6 ปีที่แล้ว

    Omg I'm absolutely loving these videos. But I don't have a computer at the moment, you said in an earlier comment that this possible on iOS. Is this true? And if so, what applications do I need, I currently have Electra ios 11.3.1 jailbreak.
    Thank you so much and keep up the vids bro

    • @BillyEllis
      @BillyEllis  6 ปีที่แล้ว +1

      Ibrahim Najm hey! Yes, it’s possible to do directly on your iPhone. You’ll just need mobile terminal and iFile installed, and then have an SDK on device so you can compile code. Dm me on Twitter @bellis1000 if you want any more details/help with it :)

    • @beautifulaffliction1742
      @beautifulaffliction1742 6 ปีที่แล้ว

      Billy Ellis you're actually awesome, and a huge inspiration. And the fact that ur 16 blows my mind. I'll definitely be talking to u on twitter

  • @sdafasfF
    @sdafasfF 2 ปีที่แล้ว

    good video but explain a bit more like the address what is it? how would you find it? the way you explain it is you just find almost any address or "an address" its very vauge

  • @bxxts
    @bxxts 6 ปีที่แล้ว

    very hard bro but subscribe button worked

  • @user-fw3ej1hb2q
    @user-fw3ej1hb2q 6 ปีที่แล้ว

    Can this be done on windows?

  • @spector456
    @spector456 5 ปีที่แล้ว

    Will this work on windows?

  • @muhammadarsalandiponegoro317
    @muhammadarsalandiponegoro317 5 ปีที่แล้ว

    is it possible to defeat the nx protection by using mprotect() ??

    • @BillyEllis
      @BillyEllis  5 ปีที่แล้ว

      Tripoloski _ yea, you can actually call vm_protect() from the mach API and change a certain region’s permissions from RW- to R-X and vice versa. I believe depending on the jailbreak, you may also be able to change it to RWX

  • @raffaelesabato7195
    @raffaelesabato7195 4 ปีที่แล้ว

    Is your website not working anymore?

  • @ChaseFromm18
    @ChaseFromm18 7 ปีที่แล้ว +1

    Are they also for 32b?

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว +2

      Chase Fromm Xylex is an ARMv7 (32bit binary), yes.

    • @mighty596
      @mighty596 7 ปีที่แล้ว +1

      Billy Ellis if you know everything about exploit then why don't you release a jailbreak??

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว +1

      Shadow Light one day ;)

    • @ChaseFromm18
      @ChaseFromm18 7 ปีที่แล้ว +2

      Nice. I'm getting an iPhone 5C, 4S to test this on. And maybe eventually iPod 5G for the jailbreak I'm working on, not sure if FriedAppleTeam is even gonna do anything. They're pretty far behind on release.

  • @bfg10k13
    @bfg10k13 7 ปีที่แล้ว +1

    Awesome video

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว +1

      Андрей Стрельцов thanks for watching! :)

    • @bfg10k13
      @bfg10k13 7 ปีที่แล้ว +1

      Can you follow my Twitter "grozahn1"? I have some questions.

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว

      Андрей Стрельцов tweet me @bellis1000 and I'll DM you :)

  • @joewardrunga8130
    @joewardrunga8130 4 ปีที่แล้ว

    How do you get ARM on an ipad?

    • @BillyEllis
      @BillyEllis  4 ปีที่แล้ว

      Joe Ward Runga ARM is the CPU architecture found in all iPhones and iPads :)

  • @lucyway7510
    @lucyway7510 7 ปีที่แล้ว +1

    Good video 👌🏻👌🏻

  • @aaa-ns1ng
    @aaa-ns1ng 7 ปีที่แล้ว +2

    Can I have the source code?

    • @ibtdev
      @ibtdev 7 ปีที่แล้ว

      in description

  • @foozzycat8516
    @foozzycat8516 6 ปีที่แล้ว

    What age did you start doing these

    • @BillyEllis
      @BillyEllis  6 ปีที่แล้ว

      FOOZZY CAT 15

    • @BillyEllis
      @BillyEllis  6 ปีที่แล้ว

      FOOZZY CAT thanks for watching! :)

    • @foozzycat8516
      @foozzycat8516 6 ปีที่แล้ว

      @@BillyEllis 💜💜💜💜💜 fucking nice, there's hope.

  • @anonymousanonymous1481
    @anonymousanonymous1481 4 ปีที่แล้ว

    Can you run an exploit on an ISO device without it needing to be jailbroken?

  • @zemmenn
    @zemmenn 7 ปีที่แล้ว +1

    good bro

  • @Guuy
    @Guuy 7 ปีที่แล้ว +4

    I wish I had my own I mac so I could do this stuff but I have no money :'(

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว +1

      Mist you can do it all straight from your iOS device :) no need for a mac

    • @Guuy
      @Guuy 7 ปีที่แล้ว +2

      Billy Ellis ahhhhh.. but I would like a mac for going on TH-cam and stuff

  • @trafalgarlaw3707
    @trafalgarlaw3707 6 ปีที่แล้ว

    -sh: ./xylex: cannot execute binary file: Operation not permitted

  • @kevinwydler7305
    @kevinwydler7305 ปีที่แล้ว

    ❤️❤️

  • @lemonshep2674
    @lemonshep2674 7 ปีที่แล้ว +2

    9th like | 8th comment | 49th view

  • @k1ck1999
    @k1ck1999 7 ปีที่แล้ว +1

    First :D

  • @MyFingerIsCold
    @MyFingerIsCold 7 ปีที่แล้ว +1

    You can only do this on 32 but devices correct?

    • @BillyEllis
      @BillyEllis  7 ปีที่แล้ว +1

      Chastity Moore no, you can do it on 64bit too :)