A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture

[ethin]

This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.

[kmeisthax]

I smell AI writing assistance. Which is a shame because this is otherwise very good and well-collated information about Apple's security. But AI loves to use bullet point lists just for the hell of it and it makes the information here smell way less reliable than it actually is.

I'm also not sure if it's 100% accurate. My (possibly wrong) understanding of the guarded execution feature is that each GL is paired with a normal ARM EL. i.e. GL2 constrains EL2, GL1 constrains EL1, etc. XNU lives in EL2 so SPTM lives in GL2, and GENTER/GEXIT move you between ELx and GLx through a secure call vector. In contrast, this guide refers to GL0 being the "standard XNU kernel context" even though XNU lives in EL2 on macOS. Furthermore, on device OSes (iOS/iPadOS/etc) they put a second kernel in GL1 and various enforcement policy tools (i.e. code signing policy, camera indicator policy) in GL0[0]. So I'm not sure how macOS putting XNU in GL0 makes sense?

[0] XNU source refers to this concept as an Exclave, which itself can be grouped with other isolated resources as a Conclave.

[EPWN3D]

It's basically all AI-generated. There are significant omissions and errors for any flow that hasn't previously been reversed engineered. The launchd stuff has details that are just wrong.

[hu3]

It's AI assitance. If you search for "e.g." the page lights up like a christmas tree. There's 90 appearances if "e.g."

I have never seen this frequency before.

[QuantumNomad_]

> e.g., AES_CMD_USE_GID

Sometimes people mix up “i.e.” (“id est”; “that is”) and “e.g.” (“exempli gratia”; “for example”).

Of course, only the author knows if this case was a mix up, or if they really wrote what they meant.

[Genbox]

The security of the Apple ecosystem is miles ahead of others. Every time I reverse engineer some component of their OS, it is very different from what I've seen before. I always find myself surprised by their thoughtfulness and engineering craft.

Recently I've taken on their code signing component. The concepts they've created, such as identifying applications by their "designated requirements" is a stroke of genius. It makes the system completely stateless and capable of almost anything without auxiliary data structure or additional code.

I've seen other engineering teams try and fail at building something similar, and never with such powerful simplicity.

[hulitu]

> The security of the Apple ecosystem is miles ahead of others.

cough iMessage, hardware backdoors cough

[fsflover]

> The security of the Apple ecosystem is miles ahead of others.

Have you heard about Qubes OS?

[quantummagic]

Will this enable someone who buys an apple laptop to boot directly into a third-party OS, from a thumb drive? Last I heard, they were still too locked down to allow it.

[nicolas_17]

The bootloader doesn't even have a USB stack capable of reading external storage.

[bigyabai]

Apple Silicon doesn't support UEFI, so no.

[JSR_FDED]

Incredible article. int summarizes it well:

Final Thought: macOS is no longer just a Unix system. It is a distributed system running on a single die, governed by a hypervisor that doesn't exist in software. The kernel is dead; long live the Monitor.

[ziofill]

Holy cow I was reading and reading and then I realized I was only 10% through!

[astrange]

It's long because it's AI-assisted and they're all bullet point lists all the time.

[Brian_K_White]

Can't seem to load it. FF on Android. SSL problem?

[wpm]

Working ok for me

[wanderingbit]

This is top 10 for greatest HN deep dives. I learned something new almost every sentence, and could not complete it on my first attempt.

[int3trap]

This is top tier. Well written and insanely detailed.