A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
1–10 of 52 posts
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#2Holy cow I was reading and reading and then I realized I was only 10% through!
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#3This is top 10 for greatest HN deep dives. I learned something new almost every sentence, and could not complete it on my first attempt.
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#4This is top tier. Well written and insanely detailed.
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#5This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#6Holy cow I was reading and reading and then I realized I was only 10% through!
It's long because it's AI-assisted and they're all bullet point lists all the time.
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#7Can't seem to load it. FF on Android. SSL problem?
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#8Can't seem to load it. FF on Android. SSL problem?
Working ok for me
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#9Incredible article. int summarizes it well:
Final Thought: macOS is no longer just a Unix system. It is a distributed system running on a single die, governed by a hypervisor that doesn't exist in software. The kernel is dead; long live the Monitor.
Re: A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
#10This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.
I smell AI writing assistance. Which is a shame because this is otherwise very good and well-collated information about Apple's security. But AI loves to use bullet point lists just for the hell of it and it makes the information here smell way less reliable than it actually is.
I'm also not sure if it's 100% accurate. My (possibly wrong) understanding of the guarded execution feature is that each GL is paired with a normal ARM EL. i.e. GL2 constrains EL2, GL1 constrains EL1, etc. XNU lives in EL2 so SPTM lives in GL2, and GENTER/GEXIT move you between ELx and GLx through a secure call vector. In contrast, this guide refers to GL0 being the "standard XNU kernel context" even though XNU lives in EL2 on macOS. Furthermore, on device OSes (iOS/iPadOS/etc) they put a second kernel in GL1 and various enforcement policy tools (i.e. code signing policy, camera indicator policy) in GL0[0]. So I'm not sure how macOS putting XNU in GL0 makes sense?
[0] XNU source refers to this concept as an Exclave, which itself can be grouped with other isolated resources as a Conclave.