Notes

[acsandmann]

im just curious if you have any further notes on all the private apis you reverse engineered that you could share to help educate me on how they work and etc

thanks

[koekeishiya]

I don't really have any of these notes anymore. However the APIs themselves aren't really that hard to figure out once you understand how the WindowServer works.

If you want some reading material instead of digging through it all yourself, check out some exploitation papers/articles written throughout the years. Here are a couple I've enjoyed reading in the past:

https://keenlab.tencent.com/en/2016/07/22/WindowServer-The-privilege-chameleon-on-macOS-Part-1/

https://keenlab.tencent.com/en/2016/07/28/WindowServer-The-privilege-chameleon-on-macOS-Part-2/

https://www.blackhat.com/docs/us-16/materials/us-16-Chen-Subverting-Apple-Graphics-Practical-Approaches-To-Remotely-Gaining-Root-wp.pdf

https://blog.ret2.io/2018/08/28/pwn2own-2018-sandbox-escape/

[acsandmann]

thanks, appreciate the links