Difference between revisions of "Kernel"

Revision as of 22:04, 18 July 2016

The kernel of iOS is the XNU kernel. To learn about what "kernel" means in general, see the Wikipedia article.

Pre-2.0, it was vulnerable to the Ramdisk Hack and may still be, but iBoot doesn't allow boot-args to be passed anymore. It is mapped to memory at 0x80000000, forcing a 2/2GB address separation, similar to Windows 32-bit model. On older iOS versions the separation was 3/1 (mapping the kernel at 0xC0000000), closer to the Linux model.

Note, that this is NOT like 32-bit OS X, wherein the kernel resides in its own address space, but more like OS X 64-bit, wherein CR3 is shared (albeit an address space larger by several orders of magnitude). See the appropriate section.

ASLR

Main article: Kernel ASLR

As of iOS 6, the kernel is subject to ASLR, much akin to Mountain Lion (OS X 10.8). This makes exploitation harder as the location of kernel code cannot be known.

On production and development devices, the kernel is always stored as a statically linked cache stored at /System/Library/Caches/com.apple.kernelcaches/kernelcache that is decompressed and run on startup.

Stack

The kernel maintains thread specific stacks by calling kernel_memory_allocate, this allocates stacks in the specified kalloc zone. The bootstrap thread has its own specific static kernel stack, which is specified by _intstack. IRQ and FIQ handlers will also have their own execution stack which is specified by _irqstack.

Boot-Args

Like its OS X counterpart, iOS's XNU accepts command line arguments (though the actual passing of arguments is done by iBoot, which as of late refuses to do so). Arguments may be directed at the kernel proper, or any one of the many KExts (discussed below). The arguments of the kernel are largely the same as those of OS X.

Kexts use boot-args as well, as can be seen when disassembly by calls to PE_parse_boot_argn (usually exported, _PE_parse_boot_argn 8027A8EC on the iOS 6.1.3 kernel, discovered by Haifisch). Finding references (using IDA) reveals hundreds places in the code wherein arguments are parsed in modules, pertaining to Flash, HDMI, and AMFI.

The list of boot-args can be extracted from any kernel dump once the address of _PE_parse_boot_argn is determined (which is usually automatically). A list from iOS 8.4 is shown below:

# perform a full disassembly, isolate decompiled lines (^;) with PE_parse.. and isolate string between quotes, sorted uniquely:
# morpheus@Zephyr (~)$ jtool -d __TEXT.__text kernel.8.4.dump | grep PE_parse |grep '^; '| cut -d\" -f2 | cut -d\" -f1 | sort -u
-b
-disable_atm
-factory_debug
-l
-multiq-deep-drain
-no-zp
-no64exec
-novfscache
-oldmezname
-panic_on_exception_triage
-progress
-qos-policy-allow
-s
-vm16k
-vnode_cache_defeat
-x
-zc
-zinfop
-zp
aks_default_class
assert
bg_preempt
boot-uuid
colors
cpumon_ustackshots_trigger_pct
darkwake
dart
dcc
debug
diag
disable_exc_resource
fill
hwm_user_cores
ifa_debug
ifnet_debug
imp_interactive_receiver 
inaddr_nhash
initmcl
interrupt_accounting
io
io_throttle_period_tier1
io_throttle_period_tier2
io_throttle_period_tier3
io_throttle_window_tier1
io_throttle_window_tier2
io_throttle_window_tier3
iosched
iotrace
jcon
jtag
keepsyms
kernel_stack_pages
kextlog
kmapoff
lcks
lo_txstart
longterm
max_cpumon_interval
max_cpumon_percentage
max_task_pmem
maxmem
maxoffset
mbuf_debug
mbuf_pool
mcache_flags
mleak_sample_factor
mseg
msgbuf
mtxspin
multiq_drain_band_limit
multiq_drain_depth_limit
multiq_drain_urgent_first
nbuf
ncl
net.inet.ip.scopedroute
net.inet6.ip6.scopedroute
net_affinity
net_rtref
net_rxpoll
network-type
panic_on_cs_killed
preempt
qos_override_mode
rd
rootdev
rte_debug
sched
sched_decay_penalty
sched_decay_usage_age_factor
sched_pri_decay_limit
sched_use_combined_fgbg_decay
serial
serverperfmode
slto_us
socket_debug
task_policy_suppression_disable
task_wakeups_monitor_interval
task_wakeups_monitor_rate
task_wakeups_monitor_ustackshots_trigger_pct
tbi
trace
trace_panic
trace_typefilter
trace_wake
unrestrict_coalition_syscalls
vm_compression_limit
vm_compressor
vm_compressor_immediate
vm_compressor_threads
wfi
wqsize 
zalloc_debug
zlog
zp-factor
zp-scale
zrecs
zsize

Versions

In the beginning iOS had consistently maintained a fairly higher kernel version than the corresponding version of OS X, but over time iOS and OS X have "moved nearer" together. And now, OS X El Capitan's XNU is 3247.1.106~1 and iOS 9.0 is 3248.1.2~3. This is not surprising, considering that iOS introduced novel features (such as Kernel ASLR, the default freezer, and various security hardening features) which are first incorporated in it, and later made it to OS X. It seems that Apple is gradually uniting the iOS and OS X kernels over time and with iOS 9 and OS X El Capitan the version numbers are nearer to each other then ever before. The following demonstrates the OS versions at present (via terminal uname -a command):

OS X El Capitan 10.11.6:

Darwin Kernel Version 15.6.0: Thu Jun 20 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64

iOS 9.3.3:

Darwin Kernel Version 15.6.0: Mon Jun 20 20:10:21 PDT 2016; root:xnu-3248.60.9~1\/RELEASE_ARM64_S5L8960X

tvOS 9.2:

Darwin Kernel Version 15.4.0: Wed Feb 24 12:51:38 PST 2016; root:xnu-3248.41.4~47/RELEASE_ARM64_T7000

Note: The RELEASE_ARM_xxxxxxxx file obviously differs on device / CPU and the time varies by a few minutes per device.

Version List (iOS)

The compilation date for each version will vary slightly between processors. This is due to the fact that compilations are sequential.

Version	Build	Comment
1A420	Darwin Kernel Version 9.0.0d1: Thu Mar 8 01:38:53 PST 2007; root:xnu-933.0.0.144.obj~1/DEVELOPMENT_ARM_S5L8900XRB
1.0	Darwin Kernel Version 9.0.0d1: Tue May 22 21:15:55 PDT 2007; root:xnu-933.0.0.178.obj~3/RELEASE_ARM_S5L8900XRB
1.0.1	Darwin Kernel Version 9.0.0d1: Fri Jun 22 00:38:56 PDT 2007; root:xnu-933.0.1.178.obj~1/RELEASE_ARM_S5L8900XRB
1.0.2
1.1.1	Darwin Kernel Version 9.0.0d1: Wed Sep 19 00:08:42 PDT 2007; root:xnu-933.0.203~21/RELEASE_ARM_S5L8900XRB	First kernel that was 8900 encrypted - not sure if version is 100% correct.
1.1.2	Darwin Kernel Version 9.0.0d1: Wed Oct 10 00:07:49 PDT 2007; root:xnu-933.0.204~7/RELEASE_ARM_S5L8900XRB	Not sure if version is 100% correct.
1.1.3	Darwin Kernel Version 9.0.0d1: Wed Dec 12 00:16:00 PST 2007; root:xnu-933.0.211~2/RELEASE_ARM_S5L8900XRB
1.1.4
1.1.5		iPod touch only
2.0	Darwin Kernel Version 9.3.1: Sun Jun 15 21:37:01 PDT 2008; root:xnu-1228.6.76~45/RELEASE_ARM_S5L8900X
2.0.1
2.0.2
2.1	Darwin Kernel Version 9.4.1: Sun Aug 10 21:25:25 PDT 2008; root:xnu-1228.7.27~12/RELEASE_ARM_S5L8720X
2.1.1
2.2	Darwin Kernel Version 9.4.1: Sat Nov 1 19:13:13 PDT 2008; root:xnu-1228.7.36~2/RELEASE_ARM_S5L8720X
2.2.1	Darwin Kernel Version 9.4.1: Mon Dec 8 21:02:57 PST 2008; root:xnu-1228.7.37~4/RELEASE_ARM_S5L8720X
3.0	Darwin Kernel Version 10.0.0d3: Wed May 13 22:16:49 PDT 2009; root:xnu-1357.2.89~4/RELEASE_ARM_S5L8920X
3.0.1
3.1	Darwin Kernel Version 10.0.0d3: Fri Aug 14 13:23:32 PDT 2009; root:xnu-1357.5.30~2/RELEASE_ARM_S5L8920X
3.1.2	Darwin Kernel Version 10.0.0d3: Fri Sep 25 23:35:35 PDT 2009; root:xnu-1357.5.30~3/RELEASE_ARM_S5L8920X
3.1.3	Darwin Kernel Version 10.0.0d3: Fri Dec 18 01:34:28 PST 2009; root:xnu-1357.5.30~6/RELEASE_ARM_S5L8920X
3.2	Darwin Kernel Version 10.3.1: Mon Mar 15 23:15:33 PDT 2010; root:xnu-1504.2.27~18/RELEASE_ARM_S5L8930X	iPad Only
3.2.1	Darwin Kernel Version 10.3.1: Fri May 28 16:46:17 PDT 2010; root:xnu-1504.2.50~4/RELEASE_ARM_S5L8930X
3.2.2	Darwin Kernel Version 10.3.1: Wed Aug 4 19:08:04 PDT 2010; root:xnu-1504.2.60~1/RELEASE_ARM_S5L8930X
4.0	Darwin Kernel Version 10.3.1: Wed May 26 22:28:33 PDT 2010; root:xnu-1504.50.73~2/RELEASE_ARM_S5L8930X
4.0.1
4.0.2	Darwin Kernel Version 10.3.1: Wed Aug 4 18:46:06 PDT 2010; root:xnu-1504.50.80~1/RELEASE_ARM_S5L8930X
4.1	Darwin Kernel Version 10.3.1: Wed Aug 4 22:35:51 PDT 2010; root:xnu-1504.55.33~10/RELEASE_ARM_S5L8930X
4.2.1	Darwin Kernel Version 10.4.0: Wed Oct 20 20:14:45 PDT 2010; root:xnu-1504.58.28~3/RELEASE_ARM_S5L8930X
4.3	Darwin Kernel Version 11.0.0: Thu Feb 10 21:46:56 PST 2011; root:xnu-1735.46~2/RELEASE_ARM_S5L8930X
4.3.1
4.3.2	Darwin Kernel Version 11.0.0: Wed Mar 30 18:51:10 PDT 2011; root:xnu-1735.46~10/RELEASE_ARM_S5L8930X
4.3.3
4.3.4	Darwin Kernel Version 11.0.0: Sat Jul 9 00:59:43 PDT 2011; root:xnu-1735.47~1/RELEASE_ARM_S5L8930X
4.3.5
5.0b5	Darwin Kernel Version 11.0.0: Tue Aug 2 22:31:30 PDT 2011; root:xnu-1878.4.80~1/RELEASE_ARM_S5L8930X
5.0	Darwin Kernel Version 11.0.0: Thu Sep 15 23:34:43 PDT 2011; root:xnu-1878.4.43~2/RELEASE_ARM_S5L8940X
5.0.1 beta	Darwin Kernel Version 11.0.0: Wed Oct 19 19:05:07 PDT 2011; root:xnu-1878.4.45~1/RELEASE_ARM_S5L8930X
5.0.1 beta 2	Darwin Kernel Version 11.0.0: Tue Nov 1 20:34:16 PDT 2011; root:xnu-1878.4.46~1/RELEASE_ARM_S5L8940X
5.0.1
5.1 beta	Darwin Kernel Version 11.0.0: Sun Nov 13 19:10:13 PST 2011; root:xnu-1878.10.61~7/RELEASE_ARM_S5L8930X
5.1 beta 2	Darwin Kernel Version 11.0.0: Sun Dec 4 18:57:33 PST 2011; root:xnu-1878.10.68~2/RELEASE_ARM_S5L8930X
5.1 beta 3	Darwin Kernel Version 11.0.0: Mon Jan 2 18:46:01 PST 2012; root:xnu-1878.10.74~3/RELEASE_ARM_S5L8930X
5.1	Darwin Kernel Version 11.0.0: Wed Feb 1 23:18:07 PST 2012; root:xnu-1878.11.8~1/RELEASE_ARM_S5L8945X
5.1.1	Darwin Kernel Version 11.0.0: Sun Apr 8 21:51:26 PDT 2012; root:xnu-1878.11.10~1/RELEASE_ARM_S5L8930X
6.0 beta	Darwin Kernel Version 13.0.0: Wed May 30 19:23:03 PDT 2012; root:xnu-2107.1.78~18/RELEASE_ARM_S5L8930X
6.0 beta 2	Darwin Kernel Version 13.0.0: Sun Jun 17 19:47:47 PDT 2012; root:xnu-2107.1.61~3/RELEASE_ARM_S5L8930X
6.0 beta 3	Darwin Kernel Version 13.0.0: Sun Jul 8 20:15:17 PDT 2012; root:xnu-2107.2.9~3/RELEASE_ARM_S5L8930X
6.0 beta 4	Darwin Kernel Version 13.0.0: Sun Jul 29 20:15:28 PDT 2012; root:xnu-2107.2.26~4/RELEASE_ARM_S5L8930X
6.0	Darwin Kernel Version 13.0.0: Sun Aug 19 00:31:06 PDT 2012; root:xnu-2107.2.33~4/RELEASE_ARM_S5L8950X
6.0.1	Darwin Kernel Version 13.0.0: Wed Oct 10 23:32:19 PDT 2012; root:xnu-2107.2.34~2/RELEASE_ARM_S5L8950X
6.0.2		iPhone 5 only.
6.1 beta	Darwin Kernel Version 13.0.0: Sun Oct 21 19:28:43 PDT 2012; root:xnu-2107.7.51~17/RELEASE_ARM_S5L8930X
6.1 beta 2	Darwin Kernel Version 13.0.0: Sun Nov 4 19:02:54 PST 2012; root:xnu-2107.7.53~2/RELEASE_ARM_S5L8930X
6.1 beta 3	Darwin Kernel Version 13.0.0: Mon Nov 26 21:17:13 PST 2012; root:xnu-2107.7.53~27/RELEASE_ARM_S5L8930X
6.1 beta 4	Darwin Kernel Version 13.0.0: Sun Dec 9 19:22:45 PST 2012; root:xnu-2107.7.55~6/RELEASE_ARM_S5L8930X
6.1 beta 5	Darwin Kernel Version 13.0.0: Sun Dec 16 20:01:39 PST 2012; root:xnu-2107.7.55~11/RELEASE_ARM_S5L8950X
6.1
6.1.1 beta
6.1.1		iPhone 4S only
6.1.2
6.1.3 beta 2	Darwin Kernel Version 13.0.0: Wed Feb 13 21:35:42 PST 2013; root:xnu-2107.7.55.2.2~1/RELEASE_ARM_S5L8920X
6.1.3
6.1.4		iPhone 5 only.
6.1.5		iPod touch 4 only.
6.1.6		iPod touch 4 and iPhone 3GS only.
7.0 beta	Darwin Kernel Version 14.0.0: Wed May 29 23:53:59 PDT 2013; root:xnu-2423.1.1.1.2~1/RELEASE_ARM_S5L8930X
7.0 beta 2	Darwin Kernel Version 14.0.0: Mon Jun 17 00:51:51 PDT 2013; root:xnu-2423.1.28~7/RELEASE_ARM_S5L8930X
7.0 beta 3	Darwin Kernel Version 14.0.0: Mon Jul 1 04:25:28 PDT 2013; root:xnu-2423.1.40~11/RELEASE_ARM_S5L8930X
7.0 beta 4	Darwin Kernel Version 14.0.0: Mon Jul 22 02:12:11 PDT 2013; root:xnu-2423.1.55~8/RELEASE_ARM_S5L8930X
7.0 beta 5	Darwin Kernel Version 14.0.0: Sun Aug 4 22:40:14 PDT 2013; root:xnu-2423.1.70~6/RELEASE_ARM_S5L8930X
7.0 beta 6
7.0GM	Darwin Kernel Version 14.0.0: Tue Aug 13 21:39:05 PDT 2013; root:xnu-2423.1.73~3/RELEASE_ARM_S5L8930X
7.0
7.0.1	Darwin Kernel Version 14.0.0: Mon Sep 9 20:56:02 PDT 2013; root:xnu-2423.1.74~2/RELEASE_ARM64_S5L8960X	iPhone 5c and 5s only
7.0.2
7.0.3	Darwin Kernel Version 14.0.0: Fri Sep 27 23:08:32 PDT 2013; root:xnu-2423.3.12~1/RELEASE_ARM64_S5L8960X
7.0.4
7.0.5		iPhone 5c (iPhone5,4) and iPhone 5s (iPhone6,2) only.
7.0.6
7.1 beta	Darwin Kernel Version 14.0.0: Mon Nov 11 04:18:01 PST 2013; root:xnu-2423.10.33~9/RELEASE_ARM_S5L8930X
7.1 beta 2	Darwin Kernel Version 14.0.0: Tue Dec 10 21:25:34 PST 2013; root:xnu-2423.10.38.1.1~1/RELEASE_ARM_S5L8930X
7.1 beta 3	Darwin Kernel Version 14.0.0: Thu Jan 2 01:55:45 PST 2014; root:xnu-2423.10.45~5/RELEASE_ARM_S5L8930X
7.1 beta 4	Darwin Kernel Version 14.0.0: Mon Jan 13 03:33:00 PST 2014; root:xnu-2423.10.49.0.1~3/RELEASE_ARM_S5L8930X
7.1 beta 5	Darwin Kernel Version 14.0.0: Mon Jan 27 23:55:13 PST 2014; root:xnu-2423.10.58~2/RELEASE_ARM_S5L8930X
7.1	Darwin Kernel Version 14.0.0: Fri Feb 21 19:41:10 PST 2014; root:xnu-2423.10.67~1/RELEASE_ARM_S5L8930X
7.1.1	Darwin Kernel Version 14.0.0: Fri Mar 28 21:22:10 PDT 2014; root:xnu-2423.10.70~1/RELEASE_ARM_S5L8930X
7.1.2	Darwin Kernel Version 14.0.0: Thu May 15 23:17:54 PDT 2014; root:xnu-2423.10.71~1/RELEASE_ARM64_S5L8960X
8.0 beta	Darwin Kernel Version 14.0.0: Mon May 26 22:09:06 PDT 2014; root:xnu-2729.0.0.0.9~2/RELEASE_ARM_S5L8942X
8.0 beta 2	Darwin Kernel Version 14.0.0: Sat Jun 14 16:36:40 PDT 2014; root:xnu-2775.0.0.1.1~3/RELEASE_ARM64_S5L8960X
8.0 beta 3	Darwin Kernel Version 14.0.0: Wed Jul 2 18:51:34 PDT 2014; root:xnu-2783.1.21~19/RELEASE_ARM_S5L8950X
8.0 beta 4	Darwin Kernel Version 14.0.0: Wed Jul 16 21:55:26 PDT 2014; root:xnu-2783.1.40.0.3~2/RELEASE_ARM_S5L8950X
8.0 beta 5	Darwin Kernel Version 14.0.0: Wed Jul 30 23:04:17 PDT 2014; root:xnu-2783.1.62~20/RELEASE_ARM_S5L8950X
8.0GM	Darwin Kernel Version 14.0.0: Tue Aug 19 15:09:47 PDT 2014; root:xnu-2783.1.72~8/RELEASE_ARM64_S5L8960X
8.0
8.0.1	Darwin Kernel Version 14.0.0: Thu Sep 18 21:52:21 PDT 2014; root:xnu-2783.1.72~23/RELEASE_ARM_S5L8950X
8.0.2
8.1 beta	Darwin Kernel Version 14.0.0: Sat Sep 27 18:49:49 PDT 2014; root:xnu-2783.3.12~18/RELEASE_ARM_S5L8950X
8.1 beta 2	Darwin Kernel Version 14.0.0: Fri Oct 3 21:52:09 PDT 2014; root:xnu-2783.3.13~2/RELEASE_ARM_S5L8950X
8.1	Darwin Kernel Version 14.0.0: Fri Oct 7 00:04:37 PDT 2014; root:xnu-2783.3.13~4/RELEASE_ARM_S5L8950X
8.1.1 beta	Darwin Kernel Version 14.0.0: Sun Nov 2 20:21:29 PDT 2014; root:xnu-2783.3.21~1/RELEASE_ARM_S5L8950X
8.1.1	Darwin Kernel Version 14.0.0: Mon Nov 3 22:54:30 PDT 2014; root:xnu-2783.3.22~1/RELEASE_ARM_S5L8950X
8.1.2
8.1.3	Darwin Kernel Version 14.0.0: Mon Jan 2 21:29:20 PST 2015; root:xnu-2783.3.26~3/RELEASE_ARM_S5L8950X
8.2 beta 3	Darwin Kernel Version 14.0.0: Sun Dec 14 20:59:15 PST 2014; root:xnu-2783.5.29.0.1~1/RELEASE_ARM_S5L8940X
8.2 beta 4	Darwin Kernel Version 14.0.0: Tue Jan 6 21:02:10 PST 2015; root:xnu-2783.5.32~9/RELEASE_ARM_S5L8940X
8.2 beta 5	Darwin Kernel Version 14.0.0: Mon Jan 26 22:16:17 PST 2015; root:xnu-2783.5.37~11/RELEASE_ARM_S5L8940X
8.2	Darwin Kernel Version 14.0.0: Mon Feb 9 22:07:57 PST 2015; root:xnu-2783.5.38~5/RELEASE_ARM_S5L8950X
8.3 beta 3	Darwin Kernel Version 14.0.0: Mon Mar 4 20:55:58 PST 2015; root:xnu-2784.20.25~26/RELEASE_ARM64_S5L8960X
8.3 beta 4	Darwin Kernel Version 14.0.0: Thu Mar 19 00:16:36 PST 2015; root:xnu-2784.20.31~1/RELEASE_ARM64_S5L8960X
8.3	Darwin Kernel Version 14.0.0: Sun Mar 29 19:44:04 PDT 2015; root:xnu-2784.20.34~2/RELEASE_ARM_S5L8950X
8.4 beta	Darwin Kernel Version 14.0.0: Wed Apr 8 21:26:37 PDT 2015; root:xnu-2784.30.1~29/RELEASE_ARM64_T7000X
8.4 beta 2	Darwin Kernel Version 14.0.0: Wed Apr 21 21:49:05 PDT 2015; root:xnu-2784.30.2~9/RELEASE_ARM64_S5L8960X
8.4 beta 3	Darwin Kernel Version 14.0.0: Tue May 5 23:09:22 PDT 2015; root:xnu-2784.30.5~7/RELEASE_ARM64_S5L8960X
8.4 beta 4	Darwin Kernel Version 14.0.0: Tue Wed 3 23:19:49 PDT 2015; root:xnu-2784.30.7~13/RELEASE_ARM64_S5L8960X
8.4	Darwin Kernel Version 14.0.0: Wed Jun 24 00:50:15 PDT 2015; root:xnu-2784.30.7~30/RELEASE_ARM64_S5L8960X
8.4.1	Darwin Kernel Version 14.0.0: Wed Aug 5 19:24:44 PDT 2015; root:xnu-2784.40.6~18/RELEASE_ARM_S5L8950X
9.0 beta	Darwin Kernel Version 15.0.0: Fri May 29 22:14:48 PDT 2015; root:xnu-3216.0.0.1.15~2/RELEASE_ARM64_S5L8960X
9.0 beta 2	Darwin Kernel Version 15.0.0: Mon Jun 15 21:51:54 PDT 2015; root:xnu-3247.1.6.1.1~2/RELEASE_ARM64_S5L8960X
9.0 beta 4	Darwin Kernel Version 15.0.0: Sat Jul 11 20:01:45 PDT 2015; root:xnu-3247.1.56~13\/RELEASE_ARM64_T7001
9.0 beta 5	Darwin Kernel Version 15.0.0: Mon Aug 3 19:58:41 PDT 2015; root:xnu-3247.1.88.1.1~1\/RELEASE_ARM64_T7001
9.0GM	Darwin Kernel Version 15.0.0: Thu Aug 6 22:27:22 PDT 2015; root:xnu-3248.1.2~3\/RELEASE_ARM_S5L8940X
9.0	Darwin Kernel Version 15.0.0: Thu Aug 20 13:11:13 PDT 2015; root:xnu-3248.1.3~1\/RELEASE_ARM_S5L8950X
9.0.1
9.0.2
9.1 beta	Darwin Kernel Version 15.0.0: Sat Aug 29 17:41:04 PDT 2015; root:xnu-3248.10.27~10\/RELEASE_ARM_S5L8940X
9.1 beta 2	Darwin Kernel Version 15.0.0: Mon Sep 14 01:24:55 PDT 2015; root:xnu-3248.10.38~3\/RELEASE_ARM64_S5L8960X
9.1 beta 3	Darwin Kernel Version 15.0.0: Fri Sep 25 17:14:21 PDT 2015; root:xnu-3248.10.41~11\/RELEASE_ARM64_S5L8960X
9.1 beta 4	Darwin Kernel Version 15.0.0: Fri Oct 2 14:07:07 PDT 2015; root:xnu-3248.10.42~4\/RELEASE_ARM64_S5L8960X
9.1 beta 5
9.1
9.2 beta	Darwin Kernel Version 15.0.0: Sun Oct 18 23:34:30 PDT 2015; root:xnu-3248.20.33.0.1~7\/RELEASE_ARM64_S8000X
9.2 beta 2	?
9.2 beta 3	Darwin Kernel Version 15.0.0: Fri Nov 6 22:12:13 PST 2015; root:xnu-3248.21.1~2\/RELEASE_ARM64_S5L8960X
9.2 beta 4	Darwin Kernel Version 15.0.0: Fri Nov 13 16:08:07 PST 2015; root:xnu-3248.21.2~1\/RELEASE_ARM64_S5L8960X
9.2
9.2.1 beta	Darwin Kernel Version 15.0.0: Wed Dec 9 22:19:38 PST 2015; root:xnu-3248.31.3~2\/RELEASE_ARM64_S5L8960X
9.2.1 beta 2
9.2.1
9.3 beta	Darwin Kernel Version 15.4.0: Tue Jan 5 21:24:25 PST 2016; root:xnu-3248.40.155.1.1~3\/RELEASE_ARM64_S5L8960X
9.3 beta 1.1
9.3 beta 2	Darwin Kernel Version 15.4.0: Tue Jan 19 00:18:39 PST 2016; root:xnu-3248.40.166.0.1~10\/RELEASE_ARM64_S8000X
9.3 beta 3	Darwin Kernel Version 15.4.0: Sun Jan 31 22:48:58 PST 2016; root:xnu-3248.40.173.0.1~13\/RELEASE_ARM64_S8000X
9.3 beta 4	Darwin Kernel Version 15.4.0: Sun Feb 14 23:17:56 PST 2016; root:xnu-3248.41.3~16\/RELEASE_ARM64_S8000X
9.3 beta 5	Darwin Kernel Version 15.4.0: Sun Feb 22 01:48:23 PST 2016; root:xnu-3248.41.4~36\/RELEASE_ARM64_S8000X
9.3 beta 6
9.3 beta 7	Darwin Kernel Version 15.4.0: Fri Feb 19 13:54:52 PST 2016; root:xnu-3248.41.4~28\/RELEASE_ARM64_S8000X
9.3
9.3.1
9.3.2 beta	Darwin Kernel Version 15.5.0: Thu Mar 31 17:49:02 PDT 2016; root:xnu-3248.50.18~19\/RELEASE_ARM64_S8000X
9.3.2 beta 2	Darwin Kernel Version 15.5.0: Tue Apr 5 15:12:03 PDT 2016; root:xnu-3248.50.20~12\/RELEASE_ARM64_S8000X
9.3.2 beta 3	Darwin Kernel Version 15.5.0: Mon Apr 18 16:44:07 PDT 2016; root:xnu-3248.50.21~4\/RELEASE_ARM64_S8000X
9.3.2 beta 4
9.3.2
9.3.3 beta	Darwin Kernel Version 15.6.0: Tue May 17 19:53:27 PDT 2016; root:xnu-3248.60.3~3\/RELEASE_ARM64_S5L8960X
9.3.3 beta 2	Darwin Kernel Version 15.6.0: Tue May 31 19:52:45 PDT 2016; root:xnu-3248.60.4~1\/RELEASE_ARM64_S8000X
9.3.3	Darwin Kernel Version 15.6.0: Mon Jun 20 20:10:21 PDT 2016; root:xnu-3248.60.9~1\/RELEASE_ARM64_S5L8960X
10.0 beta	Darwin Kernel Version 16.0.0: Wed May 25 21:19:24 PDT 2016; root:xnu-3705.0.0.2.3~1\/RELEASE_ARM64_S8000X
10.0 beta 2	Darwin Kernel Version 16.0.0: Tue Jun 28 21:38:14 PDT 2016; root:xnu-3757~291\/RELEASE_ARM64_S8000X
10.0 beta 3	Darwin Kernel Version 16.0.0: Sat Jul 9 23:57:18 PDT 2016; root:xnu-3777.0.0.0.1~28\/RELEASE_ARM64_S8000X

Version List (tvOS)

Version	Build	Comment
9.2	Darwin Kernel Version 15.4.0: Wed Feb 24 12:51:38 PST 2016; root:xnu-3248.41.4~47/RELEASE_ARM64_T7000

Source Code

As XNU is based off of the BSD kernel, it is open source. The source is under a 3-clause BSD License for the original BSD portions with the portions added by Apple under the Apple Public Source License. The versions contained in iOS are not available, instead only versions used in OS X are available. This does not appear to be legal as per §2.3 in the APSL:

2.3     Distribution of Executable Versions.  In addition, if You Externally Deploy Covered
Code (Original Code and/or Modifications) in object code, executable form only, You must
include a prominent notice, in the code itself as well as in related documentation, stating
that Source Code of the Covered Code is available under the terms of this License with
information on how and where to obtain such Source Code.

with Source Code defined in §1.8:

1.8     "Source Code" means the human readable form of a program or other work that is
suitable for making modifications to it, including all modules it contains, plus any
associated interface definition files, scripts used to control compilation and installation
of an executable (object code).

It is worth noting that Apple does not list XNU as being an open source component of iOS. This can be seen by viewing opensource.apple.com and selecting any iOS version. As far as can be told, none of the versions of XNU are available in source version.

There are many other open souce components that iOS uses that are not listed, such as:

CF (CoreFoundation - Cocoa)
SQLite (SQLite - database utility)
TimeZoneData (tz database - /usr/share/zoneinfo)
curl(?) (libcurl - various HTTP operations)
hfs (hfs - HFS driver)
launchd (launchd - launch daemon)
libxml2(?) (libxml2 - parser for XML plists)
xnu (XNU - Kernel)
zip (zip - extraction of various files)

It does not appear that Apple assumes what you see in the OS X pages are also on iOS as JavaScriptCore, WebCore, among others are listed on both OS X (10.8) and iOS (6.0), albeit different versions.

It is also worth noting that gdb (GCC debugger) and ld64 are listed as components in iOS 6.0. Why there are present is a mystery as they are not present on unaltered devices, but only through Cydia or Xcode's DeveloperImage.dmg.

Kernel Extensions

iOS, sadly, does not have kexts floating around the file system, but they are indeed present. The kernelcache can be unpacked to show the kernel proper, along with the kexts (all packed in the __PRELINK_TEXT section) and their plists (in the __PRELINK_INFO section).

The kernelcache can also be directly unpacked (if decrypted) using the Jonathan Levin's joker tool from http://NewOSXBook.com/tools/joker.html. With the advent of iOS 10 betas and out-of-box plaintext kernelcaches, this tool can be used after unpacking and applying lzssdec to decompress the kernelcache to its full size.

The Cydia supplied kextstat does not work on iOS. Sadly, the reason is that kextstat relies on kmod_get_info(...), which is a deprecated (and recently removed) API in iOS 4.x and OS X 10.6. With that said, the kexts do exist. As an alternative, consider using kextstat from the iOS BinUtils package (http://NewOSXBook.com/tool/iOSBinaries.html) or the open source modified version "JKextstat" (http://newosxbook.com/src.jl?tree=listings&file=18-1-JKextstat.c), which can also dump the raw XML data.

For a specific extension, e.g. SandBox, the full information (including the handy load address) is also accessible:

root# ./jkextstat -b sandbox -x:

<plist>
<dict>
        <key>CFBundleIdentifier</key>
        <string>com.apple.security.sandbox</string>
        <key>CFBundleVersion</key>
        <string>154.7</string>
        <key>OSBundleCPUSubtype</key>
        <integer>9</integer>
        <key>OSBundleCPUType</key>
        <integer>12</integer>
        <key>OSBundleDependencies</key>
        <array>
                <integer>6</integer>
                <integer>7</integer>
                <integer>5</integer>
                <integer>3</integer>
                <integer>28</integer>
                <integer>1</integer>
                <integer>4</integer>
                <integer>16</integer>
                <integer>2</integer>
        </array>
        <key>OSBundleExecutablePath</key>
        <string>/System/Library/Extensions/Sandbox.kext/Sandbox</string>
        <key>OSBundleIsInterface</key>
        <false/>
        <key>OSBundleLoadAddress</key>
        <integer>2153734144</integer>
        <key>OSBundleLoadSize</key>
        <integer>36864</integer>
        <key>OSBundleLoadTag</key>
        <integer>29</integer>
        <key>OSBundleMachOHeaders</key>
        
        zvrt/gwAAAAJAAAACwAAAAMAAAAgAgAAAQAAAAEAAAAEAQAAX19URVhUAAAAAAAAAAAA
        AABgX4AAgAAAAAAAAACAAAAHAAAABwAAAAMAAAAAAAAAX190ZXh0AAAAAAAAAAAAAF9f
        VEVYVAAAAAAAAAAAAADMbV+AKGEAAMwNAAACAAAAAAAAAAAAAAAABwCAAAAAAAAAAABf
        X2NzdHJpbmcAAAAAAAAAX19URVhUAAAAAAAAAAAAAPTOX4DLDQAA9G4AAAAAAAAAAAAA
        AAAAAAIAAAAAAAAAAAAAAF9fY29uc3QAAAAAAAAAAABfX1RFWFQAAAAAAAAAAAAAwNxf
        gDEDAADAfAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAQBAABfX0RBVEEAAAAA
        AAAAAAAAAOBfgAAQAAAAgAAAABAAAAcAAAAHAAAAAwAAAAAAAABfX2RhdGEAAAAAAAAA
        AAAAX19EQVRBAAAAAAAAAAAAAADgX4C0BgAAAIAAAAQAAAAAAAAAAAAAAAAAAAAAAAAA
        AAAAAF9fYnNzAAAAAAAAAAAAAABfX0RBVEEAAAAAAAAAAAAAwOZfgHgAAAAAAAAABAAA
        AAAAAAAAAAAAAQAAAAAAAAAAAAAAX19jb21tb24AAAAAAAAAAF9fREFUQQAAAAAAAAAA
        AAA451+AGAAAAAAAAAACAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAbAAAAGAAAABasg7Y2
        TzkVrtqsgOViBQ0=
        
        <key>OSBundlePath</key>
        <string>/System/Library/Extensions/Sandbox.kext</string>
        <key>OSBundlePrelinked</key>
        <true/>
        <key>OSBundleRetainCount</key>
        <integer>0</integer>
        <key>OSBundleStarted</key>
        <true/>
        <key>OSBundleUUID</key>
        
        FqyDtjZPORWu2qyA5WIFDQ==
        
        <key>OSBundleWiredSize</key>
        <integer>36864</integer>
        <key>OSKernelResource</key>
        <false/>
</dict>
</plist>

It's also worth mentioning that, in the above listing, the OSBundleMachOHeaders (base-64 encoded binary headers) leak kernel addresses in iOS 6.0, defeating Kernel ASLR. This has been quickly fixed in iOS 6.0.1, effectively locking down iOS for the foreseeable future, thanks to security researcher mdowd.

Winocm's custom kernel

Winocm uses a custom kernel which the version can be found below.

Darwin Kernel Version 13.0.0: Fri Nov 22 18:19:54 CST 2013; root:xnu-2050.48.13~7/DEVELOPMENT_ARM_S5L8930X

External Links

XNU Source (up to latest **OS X** version)
i0n1c on exploiting the kernel
Haifisch on Decrypting the iOS kernel for disassembly
jkextstat.c
OSX/iOS internals book

@@ Line 145: / Line 145: @@
 In the beginning iOS had consistently maintained a fairly higher kernel version than the corresponding version of OS X, but over time iOS and OS X have "moved nearer" together. And now, OS X El Capitan's XNU is 3247.1.106~1 and iOS 9.0 is 3248.1.2~3. This is not surprising, considering that iOS introduced novel features (such as [[Kernel ASLR]], the default freezer, and various security hardening features) which are first incorporated in it, and later made it to OS X. It seems that Apple is gradually uniting the iOS and OS X kernels over time and with iOS 9 and OS X El Capitan the version numbers are nearer to each other then ever before. The following demonstrates the OS versions at present (via terminal '''uname -a''' command):
-OS X El Capitan 10.11.5:
+OS X El Capitan 10.11.6:
- Darwin Kernel Version 15.5.0: Tue Apr 19 18:36:36 PDT 2016; root:xnu-3248.50.21~8/RELEASE_X86_64
+ Darwin Kernel Version 15.6.0: Thu Jun 20 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64
-iOS 9.3.2:
+iOS 9.3.3:
- Darwin Kernel Version 15.5.0: Mon Apr 18 16:44:07 PDT 2016; root:xnu-3248.50.21~4\/RELEASE_ARM64_[[S8000]]X
+ Darwin Kernel Version 15.6.0: Mon Jun 20 20:10:21 PDT 2016; root:xnu-3248.60.9~1\/RELEASE_ARM64_[[S5L8960]]X
 tvOS 9.2:
@@ Line 744: / Line 744: @@
 | 9.3.3 beta 2
 | Darwin Kernel Version 15.6.0: Tue May 31 19:52:45 PDT 2016; root:xnu-3248.60.4~1\/RELEASE_ARM64_[[S8000]]X
+|
+|-
+| 9.3.3
+| Darwin Kernel Version 15.6.0: Mon Jun 20 20:10:21 PDT 2016; root:xnu-3248.60.9~1\/RELEASE_ARM64_[[S5L8960]]X
 |
 |-
@@ Line 752: / Line 756: @@
 | 10.0 beta 2
 | Darwin Kernel Version 16.0.0: Tue Jun 28 21:38:14 PDT 2016; root:xnu-3757~291\/RELEASE_ARM64_[[S8000]]X
+|
+|-
+| 10.0 beta 3
+| Darwin Kernel Version 16.0.0: Sat Jul 9 23:57:18 PDT 2016; root:xnu-3777.0.0.0.1~28\/RELEASE_ARM64_[[S8000]]X
 |
 |}
@@ Line 766: / Line 774: @@
 |
 |}
 == Source Code ==
 As XNU is based off of the [[wikipedia:Berkeley Software Distribution|BSD kernel]], it is [http://opensource.apple.com/source/xnu open source]. The source is under a [http://opensource.apple.com/license/bsd/ 3-clause BSD License] for the original BSD portions with the portions added by Apple under the [http://opensource.apple.com/license/apsl/ Apple Public Source License]. The [[#Versions|versions contained in iOS]] are not available, instead only versions used in ''OS X'' are available. This does not appear to be legal as per &#x00A7;2.3 in the APSL:

Difference between revisions of "Kernel"

Revision as of 22:04, 18 July 2016

Contents

ASLR

Stack

Boot-Args

Versions

Version List (iOS)

Version List (tvOS)

Source Code

Kernel Extensions

Winocm's custom kernel

See Also

External Links

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

Miscellaneous

Tools