Project Zero
Follow
Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst
Ivan Fratric, from Google Project Zero, discusses the challenges of fuzzing Apple's AV1 video decoding on Apple devices. He mentions that despite hardware support for AV1 decoding, a significant part of the format parsing occurs in software within the kernel, specifically in the AppleAVD kernel extension. Fratric highlights that he was not the first to tackle this issue, noting previous projects such as Fairplay, Cinema time!, KextFuzz, and Pishi. He explains that his approach loads kernel code into userspace in a lightweight manner, differing from the Fairplay project's custom loader. The article also mentions the use of IDA for decompiling code, which requires manual fixing, and the KextFuzz project's method of replacing pointer authentication instructions with a jump to a coverage-collecting trampoline.