Field Notes

source

A comprehensive write-up of the checkm8 BootROM exploit

StatusStableUpdatedStands on1 sourceSupportsnotes

An independent technical analysis of checkm8 published 21 July 2023 by Alfie CG, written while designing an independent implementation (the Achilles project, heavily based on the gaster implementation). The saved copy preserves the rendered page. It is the clearest public mechanism-level account of why the exploit works and why it stops at the A12 generation.

What it is evidence for

  • checkm8 is two bugs, not one: a use-after-free in the SecureROM’s USB DFU handling, and a heap-leak primitive that keeps the freed IO buffer from being reallocated in place. Heap grooming arranges an exactly sized hole so the overwritten request structure lands where the payload controls it.
  • The A12 boundary’s actual mechanism: the A12 and A13 SecureROMs still contain the use-after-free — which the write-up dates as patched only in A14 — but Apple patched the memory leak, and without the leak “there is no way to prevent the re-allocation of the IO buffer over the freed one.”
  • What the payload does: overwrites the callback and next pointers of a USB request structure, then patches the image-signature validation so unsigned images boot.
  • Practical exploitation constraints: the incomplete-data-phase trick needs either microcontroller-grade USB control or an extremely short asynchronous-transfer timeout, which is why implementations differ per SoC and reliability is imperfect.

Limitations

This is one researcher’s reverse-engineering analysis, not Apple’s account; the A14 patch dating in particular rests on comparing SecureROM dumps across generations and should be read at that strength. The Apple Wiki’s checkm8 entry agrees with the leak-patch analysis and is cited alongside it in checkm8.

Placement

Mechanism source for checkm8; the two-bug structure and the A12/A14 detail are cited there.

Built on 1 source (1 external).

Working out connections…