How to unc0ver a 0-day in 4 hours or less

Re:How to unc0ver a 0-day in 4 hours or less by MaxLeiter on Thursday July 09, 2020 @04:19PM (#23784678)

Checkra1n, another iOS exploit (although it's more impressively a bootrom exploit), is mentioned. You can see slides on it from 2019 here: https://iokit.racing/oneweirdtrick.pdf (The One Weird Trick SecureROM Hates)

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by vanshg on Thursday July 09, 2020 @06:34PM (#23786042)

Which just goes to show how useful it is to have these kind of exploits. Imagine if there was a way to fix Checkra1n, and it was fixed a while back. Then, figuring out the details of this exploit would have taken much longer.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by doublerabbit on Friday July 10, 2020 @09:12AM (#23791108)

Interesting, from that slide I should always null my variables after I'm finished with them.

[ Parent | on HN ]

Re:How to unc0ver a 0-day in 4 hours or less by sfink on Saturday July 11, 2020 @01:33PM (#23803948)

If they're globals, then yes you should. Having dangling pointers anywhere, even in supposedly unused areas, tends to come back and bite you.

For locals, why bother? The optimizer will probably discard the writes, and worrying about stack addresses being reused is a waste of mental space and clutters the code.

[ Parent | on HN ]