https://hanh.me/tags/ios/Recent content in Ios on Hanh Pham's BlogHugoen-usFri, 23 Oct 2026 09:53:53 +0700https://hanh.me/posts/ios-jailbreak-rootless-era/Sat, 17 Oct 2026 09:00:00 +0700https://hanh.me/posts/ios-jailbreak-rootless-era/The modern checkm8 continuation patches code signing, mount policy and task ports, and has no page-protection patch at all. What the gap in its own patch set says about the boundary everyone assumes is being crossed.https://hanh.me/posts/ios-jailbreak-userland-era/Fri, 16 Oct 2026 09:00:00 +0700https://hanh.me/posts/ios-jailbreak-userland-era/The bootrom era was unpatchable but fully readable. The userland era inverted both properties: every bug had a fix, and most of the tool’s shipped life has no published source at all.https://hanh.me/posts/ios-jailbreak-bootrom-era/Thu, 15 Oct 2026 09:00:00 +0700https://hanh.me/posts/ios-jailbreak-bootrom-era/The boot ROM is the one component no update can reach, so a bug in it is a bug in the hardware’s own trust anchor. What checkm8 established about unpatchable vulnerabilities, read from the public record rather than from a device.https://hanh.me/posts/ios-webkit-and-app-layer/Sat, 10 Oct 2026 09:30:00 +0700https://hanh.me/posts/ios-webkit-and-app-layer/WebKit and the app layer are the Apple surfaces you can actually study without a research device. How the browser’s processes are isolated from each other, what crosses between them, and where a third-party app’s own checks sit relative to the server’s.https://hanh.me/posts/xnu-patch-margin-research/Fri, 09 Oct 2026 09:30:00 +0700https://hanh.me/posts/xnu-patch-margin-research/A source-first method for Apple kernel research: diff consecutive XNU tags, mine the regression tests that ship with the fixes, map sibling call sites, and rank candidates by how well they survive Memory Integrity Enforcement. Four evidence gates, a safe workflow, and the stop conditions that keep this work honest.https://hanh.me/posts/ios-reversing-mach-o-dyld-shared-cache/Fri, 09 Oct 2026 09:00:00 +0700https://hanh.me/posts/ios-reversing-mach-o-dyld-shared-cache/iOS system libraries ship inside one dyld shared cache instead of on disk, and a fat Mach-O will happily hand you the wrong architecture without an error. Here is the static workflow that reads headers, metadata, and topology before you open a decompiler.https://hanh.me/posts/ios-architecture-from-sandbox-to-secure-enclave/Wed, 07 Oct 2026 10:00:00 +0700https://hanh.me/posts/ios-architecture-from-sandbox-to-secure-enclave/A boundary-first map of the iOS stack, from app sandbox and XPC through XNU subsystems to PAC, SPTM, and the Secure Enclave, with the evidence gates I use before calling anything a finding.