Habemus Securitas - Exploring Apple's Hidden Territories (opens in new tab)

With the Secure Page Table Monitor \(SPTM\) and Exclaves, Apple has introduced a broad spectrum of new memory protection mechanisms over the past few years, realized through their Guarded Execution Feature \(GXF\)\. Currently, there is little public discussion on piecing these mechanisms together and exploring the broader implications of XNU compartmentalization\. In this talk, we will delve into the inner workings of SPTM, exploring how its services are utilized by XNU and other secure world...