A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture

Post by QuantumNomad_ » Sun, Nov 23, 2025, 1:52 AM UTC

ethin wrote: post #5

This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.

Post by jshier » Sun, Nov 23, 2025, 2:34 AM UTC

QuantumNomad_ wrote: post #11

ethin wrote: post #5

This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.

> e.g., AES_CMD_USE_GID Sometimes people mix up “i.e.” (“id est”; “that is”) and “e.g.” (“exempli gratia”; “for example”). Of course, only the author knows if this case was a mix up, or if they really wrote what they meant.

Post by VogonPoetry » Sun, Nov 23, 2025, 2:50 AM UTC

kmeisthax wrote: post #10

ethin wrote: post #5

This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.

I smell AI writing assistance. Which is a shame because this is otherwise very good and well-collated information about Apple's security. But AI loves to use bullet point lists just for the hell of it and it makes the information here smell way less reliable than it actually is. I'm also not sure if it's 100% accurate. My (possibly wrong) understanding of the guarded execution feature is that each GL is paired with a…

Post by bri3d » Sun, Nov 23, 2025, 3:03 AM UTC

kmeisthax wrote: post #10

ethin wrote: post #5

This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.

I smell AI writing assistance. Which is a shame because this is otherwise very good and well-collated information about Apple's security. But AI loves to use bullet point lists just for the hell of it and it makes the information here smell way less reliable than it actually is. I'm also not sure if it's 100% accurate. My (possibly wrong) understanding of the guarded execution feature is that each GL is paired with a…

Post by jjtech » Sun, Nov 23, 2025, 3:33 AM UTC

nicolas_17 wrote: post #16

kmeisthax wrote: post #10

Earlier quoted context omitted.

I smell AI writing assistance. Which is a shame because this is otherwise very good and well-collated information about Apple's security. But AI loves to use bullet point lists just for the hell of it and it makes the information here smell way less reliable than it actually is. I'm also not sure if it's 100% accurate. My (possibly wrong) understanding of the guarded execution feature is that each GL is paired with a…

There's many factual errors in this AI slop. For example, it says quite unambiguously that the bootloader is encrypted directly with the GID key (loading the LLB ciphertext into the AES engine), but that's not how it works, the GID key is used to decrypt the LLB's KBAG into an AES key:IV pair and that is used to decrypt the LLB. More: > The behavior of the Boot ROM changes fundamentally based on the "Security Domain"…