applied security conferences and training: CanSecWest | PacSec | EUSecWest |

Security Masters Dojo

Advanced and intermediate security training and technology enhancement for information security professionals.

CanSecWest: Security Masters Dojo Vancouver

iOS 11/12 Kernel Exploitation

Register for the March 16-19, 2019 (4-day course)

Stefan Esser


For the last few years we have taught iOS and OS X kernel exploitation to a wide variety of students. In these years our course has been under constant development, because Apple keeps adding new security mitigations into the kernel or changes how security relevant implementations like how the kernel heap works. Year after year we improved our course to add the latest security changes into the material.

For iOS 12 Apple has once again added a number of changes and mitigations that were not covered in our previous courses and have not been documented anywhere in the public, yet. Furthermore we have added a number of new tools to our iOS toolkit that help during kernel research and during kernel exploit development for newer devices.

During the training we will make available devices on iOS 11.x to perform the hand on tasks, because they can only be performed on devices having vulnerabilities.

PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.


Introduction: Low Level ARM64: iOS Kernel Debugging: iOS Kernel Vulnerability Types iOS Kernel Heap Exploitation: iOS Kernel Exploit Mitigations iOS Kernel Vulnerabilities iOS Kernel Jailbreaking


Students must have prior knowledge in exploitation (basics will not be taught) and must be capable of understanding/programming exploits in C. Students will get an introduction into low level ARM/ARM64 as part of the course.

Software Requirements
Hardware Requirements