21–23 of 23 posts
TIL SecureROM != SecuROM. I came to this post anticipating a nostalgic trip about some ancient DRM and a stupidly simple way to break it. Got confused when it was about Apple phone OS.
It was weird to see people from the jailbreak scene (easily recognisable because they all have names l1ke th1s) in such an exploit... turns out SecureROM is also something from iPhone
Why on earth would you have a heap in a zero-stage-burned-into-chip bootloader, not to mention a USB stack. It's just self-inflicted harm at this point.
One slide says for some roms: No crash is triggered whatsoever as the ROM is deterministic enough that the buffer is reallocated in the same place every time upon USB stack initialization.
We aren't looking at the code, but "deterministic reallocation" or just static storage class? Seems like dynamic memory allocation was introduced recently into this rom. And why is a good question.