Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

On modern iPhones, iBoot doesn't actually load immediately after the Boot ROM, and the Secure Enclave doesn't wait for the kernel to boot up. The process starts when the power button signals the Power Management Integrated Circuit to wake the main Application Processor. The processor immediately executes the Boot...

137,400 görüntüleme • 1 ay önce •via TikTok

0 Yorum

Yorum bulunmuyor

Orijinal gönderinin yorumları burada görünecek

Benzer Videolar

When you shut down a modern iPhone, the Power Management Unit (PMU) cuts voltage to the main A-series processor, the OLED display, and the camera array. It leaves a separate Low Power Mode (LPM) rail live on the motherboard. Sitting on that energized rail are three wireless chips: the Bluetooth controller, the NXP NFC controller, and the Apple U1 Ultra-Wideband chip. Apple built this hardware partition to run "Findable After Power Off," Express Transit passes, and Digital Car Keys when your battery dies. Even with iOS completely unloaded from RAM, those three chips stay powered for up to 24 hours on a manual shutdown (and up to 5 hours on automatic battery reserve). Right before iOS powers down, it pre-computes 96 rolling NIST P-224 public keys (one for every 15-minute window over the next 24 hours) and sends them to the Bluetooth chip using Host Controller Interface (HCI) commands. The final HCI command severs communication with the main processor and starts a standalone thread inside the Bluetooth silicon. While the main SoC sits unpowered, the Bluetooth chip wakes up every 2 seconds to broadcast the current P-224 public key over Bluetooth Low Energy. Any passing iPhone or MacBook that hears that broadcast encrypts its own GPS coordinates with your broadcasted public key and relays the packet to Apple servers. In 2022, researchers at the SEEMOO lab at TU Darmstadt audited this low-power hardware chain ("Evil Never Sleeps") and found a major gap between the three wireless chips. While the NFC chip runs encrypted and signed firmware and the U1 Ultra-Wideband chip checks cryptographic signatures at boot, the Broadcom Bluetooth chip has neither encryption nor signature verification on its firmware updates. Broadcom bakes its base Bluetooth firmware into read-only Mask ROM at the factory. To fix bugs and load the standalone Find My feature, iOS writes raw binary patches directly into the chip internal SRAM using a mechanism called PatchRAM (Write_RAM HCI commands). The hardware never checks a cryptographic signature on those RAM patches. If an attacker already has kernel-level code execution on iOS (through spyware or a local jailbreak exploit), they can overwrite the Bluetooth chip PatchRAM in SRAM before the user powers the phone down. When the user drags the power-off slider, iOS halts and wipes main system RAM. Because the PMU keeps the LPM power rail alive, the modified Bluetooth firmware stays in SRAM and keeps executing on reserve battery power. Worse, the TU Darmstadt team showed from iPhone board schematics that the Bluetooth and U1 chips are wired directly to the Secure Element inside the NFC controller via dedicated hardware buses (SE_I2C and R1_WAKE/SYNC) so car keys and transit cards work while the phone is off. Compromised Bluetooth firmware running in LPM can broadcast custom tracking beacons, listen for over-the-air wake commands, or talk directly to the Secure Element over SE_I2C while the main operating system is dead. Apple lets you tap "Temporarily Turn Off Finding" on the shutdown screen and enter your passcode to disable LPM for that power cycle. That toggle works if your phone is clean, because a clean iOS kernel tells the PMU to cut the LPM rail. If your phone is already compromised by kernel spyware, the malware controls the shutdown sequence. It can turn off the screen, play the shutdown animation, ignore your toggle, and tell the PMU to keep the patched Bluetooth chip powered in the background. Once kernel malware can hide inside unverified radio SRAM, a software power-off slider means nothing. Until the battery is physically disconnected from the board or the phone goes inside an RF-shielded Faraday bag, the Bluetooth silicon can stay on the air.

Zoe

228,957 görüntüleme • 17 gün önce

Want to understand UEFI bootkits at a low level? Whether you're doing malware analysis, reverse engineering, exploit development, or kernel research, these are the resources that actually matter. First in-the-wild UEFI bootkit to bypass Secure Boot on fully patched Windows 11. Exploits CVE-2022-21894 (BatonDrop), enrolls attacker MOK keys, deploys a kernel driver and HTTP downloader. Sold for $5,000 on forums. by WeLiveSecurity UEFI firmware rootkit targeting VMware VMs. Design inspired by CosmicStrand, MoonBounce, and ESPecter. Injects into a UEFI driver firmware volume, hooks ExitBootServices, catches WinLoad.EFI, hooks OslArchTransferToKernel, then injects a stager into ACPI.SYS to reach kernel execution without triggering PatchGuard. Originally by Austin Hudson (@ilove2pwn_) who deleted his account. Mirrored here. Binarly's analysis of BlackLotus by Alex Matrosov. Reveals that BlackLotus's code is directly based on btbd's Umap project from 2020, same main function logic, same ImgArchStartBootApplication hook chain, identical trampoline code. Game hacking UEFI bootkit code combined with a publicly available Secure Boot bypass PoC became the first in-the-wild bootkit to defeat Secure Boot. Also covers the CVSS scoring problem, supply chain failures in UEFI revocation, and MokList NVRAM manipulation. by BINARLY🔬 The book. Covers everything from legacy MBR bootkits to modern UEFI implants, firmware rootkits, and Secure Boot internals. If you only read one thing on this list, make it this. by Alex Matrosov ESPecter. Real-world UEFI espionage bootkit found in the wild with roots back to 2012. Patches bootmgfw.efi on disk, hooks the boot chain, disables DSE by patching SepInitializeCodeIntegrity in the kernel. Deploys a keylogger and document stealer. by WeLiveSecurity Reverse engineering of kernel driver by IDontCode. Shows how the entire cheat is public code resold for six figures. Documents the win32kbase.sys vtable pointer swap for kernel function invocation, manual driver mapping using btbd's modmap, and communication via Can's NtConvertBetweenAuxiliaryCounterAndPerformanceCounter .data pointer hook. Credits both Can and btbd directly. by Back Engineering Labs One of the earliest public Windows UEFI bootkit PoCs. Patches winload.efi to disable DSE and load unsigned kernel drivers. Directly inspired EfiGuard. by legendary anti-cheat engineer Aidan Khoury Bootkitting Windows Sandbox. Patches bootmgfw.efi inside the sandbox VHDx to hook the boot chain, disable PatchGuard and DSE, and load unsigned drivers without a debugger attached. Built for kernel research and driver development. by Duncan Ogilvie 🍍 and Dylan Goods from secret club UEFI DXE driver that passively disables PatchGuard and DSE at boot time. Does not modify bootmgfw.efi on disk. Instead hooks EFI System Table LoadImage to intercept the boot chain in memory, then patches SepInitializeCodeIntegrity and KeInitAmd64SpecificState in ntoskrnl. Supports every EFI-compatible Windows x64 from Vista SP1 to Windows 11. by Mattiwatti DMA backdoor via PCIe FPGA. No software on the target machine at all. A Spartan-6 FPGA on a PCIe card reads and writes physical memory over DMA to inject code into the UEFI boot process before the OS loads. The hardware end of the escalation ladder. by Dmytro Oleksiuk 💥 [email protected] Popular in the game hacking community. UEFI manual mapper that maps unsigned drivers into kernel memory from the boot environment, bypassing DSE entirely. Binarly confirmed BlackLotus reused this project's code directly. by BTBD Another UEFI bootkit approach for manual mapping unsigned kernel drivers. Hooks ExitBootServices to patch the kernel in memory before execution. by Samuel Tulach UEFI mapper in the same lineage. by ekknod Many of these use the .data section function pointer hook technique pioneered by the legendary Can. Instead of patching code (which PatchGuard monitors), you overwrite function pointers stored in .data (which PatchGuard doesn't). Still widely used. Combining a Secure Boot bypass with the RedLotus UEFI Bootkit on Windows 11. Full demo. #ReverseEngineering #MalwareAnalysis #Infosec

cr3ghost

12,734 görüntüleme • 3 ay önce

LSposed (Vector) is a modern evolution of the classic Xposed Framework for the Android ecosystem. It allows you to install modules to modify the behavior of the system and applications without altering local files. The tool works systemless, injecting temporary code directly into the phone's RAM. Its operating base leverages Magisk or KernelSU root through the technology known as Zygisk. LSposed intercepts the Zygote process, which is the parent generator of all applications open on the system. Through the Hooking technique, the modules create "clips" that divert and alter app functions in real time. Its biggest difference compared to the old Xposed is intelligent scope management. The user explicitly chooses which specific applications will be affected by each installed module. This prevents sensitive applications, such as banking apps, from detecting modifications to the memory structure. Scope separation also saves battery and keeps the overall performance of the device intact. Recently, after a pause in the original project, the community took over the code under the name Vector. Vector updates support for the latest Android versions and fixes old stability bugs. The ecosystem allows for everything from extreme visual customizations to the removal of ads and premium features. If a serious error occurs with a module, simply disable it to return the phone to normal. In short, it's the most powerful tool for deep and secure customization on modern Android. . . . . . . . #fpy #trend #fpyyyyyyyyyyyyyyyyyyyyyy #samsung #techtok

Kzrxe.7z #TeamGalaxy

44,700 görüntüleme • 1 ay önce

Whitney Webb breaks down the coordinated global push for a new, dystopian system of control, marrying digital ID with CBDCs. This isn't conspiracy; it's all in their own documentation. They are building a full-spectrum digital cage, and its two locked doors are Digital Identity and Central Bank Digital Currencies (CBDCs). You cannot have one without the other. The plan is to replace your government-issued ID with a Digital ID, but it's not just a card in your phone. It is fundamentally built upon your immutable biometrics: your fingerprints, the precise structure of your face, the unique pattern of your iris. This biometric data is the key. It is the hard link that ties your physical body directly to your digital identity credential. Your very body becomes your password. The reason this is so critical for them is the financial system. UN & Bank for International Settlements docs overtly state that Digital ID and CBDCs are designed to be integrated. The system cannot exist without this biometric digital ID. Why? Know Your Customer (KYC) protocols. For this new digital financial system to function, they must absolutely "know" every single participant. Your digital wallet will be tied to your digital ID, which is mapped to your biometrics. Total financial-biological linkage. We see the prototypes being rolled out now: • Sam Altman's WorldCoin lures people to scan their irises for a "unique identifier" and a digital wallet. This is the exact model. • The UN's "Building Blocks" program forces refugees to scan their iris at checkout to receive food rations. The value is deducted from a wallet tied to that biometric ID. They justify this total surveillance under the guise of closing the "identity gap," claiming the world's poor need digital IDs to access essential services like banking and healthcare. The reality? This is the ultimate onboarding mechanism into a system of programmable control, where your access to society and your own money is permissioned and revocable based on your compliance. This is the bedrock of the new global financial system. It is not about convenience. It is about control. Your body is the new currency, and they are forcing you to hand over the keys.

Camus

312,922 görüntüleme • 1 yıl önce