MIE Deep Dive Part 2 Enabling Apps and Analyzing Memory-Tagg...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://8ksec.io/mie-deep-dive-enabling-apps
• Blog Title: MIE Deep Dive Part 2: Enabling Apps and Analyzing Memory-Tagging Crashes
• Suggested Section: Binary Exploitation > Common Binary Exploitation Protections & Bypasses > Memory Tagging Extension (MTE), with cross-references from Mobile Pentesting > iOS Pentesting and iOS Extracting Entitlements From Compiled Application

🎯 Content Summary

Overview

This post provides a practical guide to enabling, verifying, testing, and debugging Apple's Memory Integrity Enforcement (MIE) in iOS applications. MIE uses hardware memory tagging to detect spatial memory corruption, such as heap buffer overflows, and temporal memory corruption, such as use-after-free (UAF). The post includes copy-paste C and Swift test code, entitlement-inspection commands, a reusable verification script, crash-log fields, and a case study of CVE-20...

🔧 Technical Details

Discovering MIE-enabled iOS applications: Dump an application's signed entitlements with codesign -d --entitlements - App.app/Binary and verify that com.apple.security.cs.checked_allocations exists and is true. The presence of com.apple.security.enhanced_security, com.apple.security.hardened_process, or com.apple.security.hardened_heap alone does not establish that memory tagging is active. This check can be automated by locating the executable in an .app bundle and searching the entitlement output for checked_allocations.

Testing spatial memory-corruption enforcement: Allocate a heap object and access memory beyond its final 16-byte tagged granule, for example char *a = malloc(16); memset(a, 'A', 2000); or char *buffer = malloc(64); buffer[80] = 'X';. Protected accesses compare the tag embedded in the pointer with the tag assig...

🤖 Agent Actions

Plan:

1. Map relevant binary-exploitation and iOS documentation.
2. Read at least five candidate files and check for existing MTE/MIE coverage.
3. Verify the primary technical sources needed for any additions.
4. Edit the single best-fitting existing page, preserving citation/style rules.
5. Review the diff and run focused validation.
   Repository mapping is complete. An existing dedicated MTE page is the clear primary candidate; I’m now comparing it with the iOS entitlement and exploitation pages to avoid duplication and determine whether a single-file update can capture the new material cleanly.
   The main page already covers generic MTE mechanics, collision limits, Linux/Android checks, and speculative tag leakage. The genuinely new material is iOS MIE entitlement verification, reproducible synchronous-fault testing/crash triage, and the device/DMA stale-mapping bypass class. I’ll verify these against Apple’s documentation and the original Mali research before editing that one page.
   Source verification uncovered two important corrections to preserve technical accuracy: current Apple documentation uses com.apple.security.hardened-process.checked-allocations (not only the legacy/research-observed com.apple.security.cs.checked_allocations spelling), and CVE-2025-0072’s demonstrated bypass used a stale user-space PFN mapping rather than GPU writes through a stale GPU mapping. The update will document both nuances explicitly.
   The documentation changes are in place. I’m performing focused validation now: code syntax, reference-number integrity, relative-link resolution, prohibited-source checks, whitespace/diff checks, and an mdBook build if the toolchain is available.
   Implemented the HackTricks update.

Updated

• Expanded the existing MTE page with:
  • Current and legacy iOS MIE entitlement detection.
  • Boolean-aware entitlement inspection script.
  • Heap-overflow and UAF validation probes.
  • iOS .ips crash-log triage fields.
  • Stale PFN/device-alias bypass technique.
  • Accurate CVE-2025-0072 flow based on the original GitHub Security Lab research.
• Added cross-references from:
  • iOS Pentesting.
  • Extracting Entitlements from Compiled Application.
• Added numbered citations to Apple, GitHub Security Lab, and 8kSec sources.

Validation

• git diff --check passed.
• Bash syntax passed.
• Citation numbering, forbidden-source checks, and relative links passed.
• mdbook and Clang were unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://8ksec.io/mie-deep-dive-enabling-apps

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation > Common Binary Exploitation Protections & Bypasses > Memory Tagging Extension (MTE), with cross-references from Mobile Pentesting > iOS Pentesting and iOS Extracting Entitlements From Compiled Application".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0