Overview
Syllabus
Intro
Kernel Zone Heap Allocator
Zone Allocator Usage
Zone Memory (Pages)
Dynamic Length Allocations?
Kernel Heap Allocation Debugging (1)
Zone Structure
Free Memory Blocks
How attackers abused the iOS 5 Zone Allocator
IOS & Heap Cookie Leak Protection
Zone Pagelist Feature
Zone Page Meta Data
Zone Pagelists
Allocation under Page Lists
Freeing under Page Lists
Was there a memory corruption? Yes? Continue!
Less Frequent Large Block Poisoning
Zone Page Metadata
Fored Zomestructure Array
new zone metadata region
page freelists
Metadata vs. Wrong Zone Frees
Wrappers and Metadata
Taught by
Hack In The Box Security Conference