MacOS and iOS Userspace Fuzzing - On Demand


Posted: by Stefan Esser   |  More posts about Blog Training iOS MacOS Userspace Fuzzing Ondemand
/images/afl_screen.png
Instructor: Stefan Esser (Antid0te UG/Antid0te SG)
Dates: Whenever you want
Venue: Online, Zoom, Discord
Availability: Unlimited
Language: English
Status: Under Active Development

There are a lot of resources and training courses available when if comes to fuzzing code for security vulnerabilities. And there are various resources like demo exploits or training courses available for learning about iOS and MacOS exploitation. However until now what has been missing is a compact course that applies fuzzing technology to the latest iOS and MacOS targets. With this new course we want to provide a compact resource that introduces security researchers in the techniques and tricks to perform effective fuzzing of iOS devices and Apple Mac computers that run either x86_64 or ARM64 code.

This training is made available as a set of modules of pre-recorded videos and accompanying material for each module. This means every trainee can work through the course in their own time. Trainees get access to a Discord channel were they can ask questions or discuss the content of the training course. Depending on the number of trainees a number of office hours will be offered in which questions from Discord will be answered live in Discord and in Zoom.

Please note that the training course is still in development and while already 27 modules exist a part of the planned material has not been recorded yet. We plan to complete the training videos before the end of the year.

Topics

The following list of topics shows what content is planned for the course at the moment. You can LOOK HERE for a list of the currently existing modules.

Topics

  • Basic building blocks of MacOS/iOS Fuzzers
    • Building a basic fuzzer from the found up
    • Test Generation
    • Code Coverage
    • Crash Reporting / Triage
    • Scaling
  • Using and adapting off the shelf fuzzers for MacOS/iOS
    • AFL++
  • Fuzzing of Fileformats
    • Image File Parser Fuzzing
    • Audio File Parser Fuzzing
    • Font Parser Fuzzing
    • Document File Parser Fuzzing
  • Fuzzing of IPC
    • Fuzzing of Mig Servers
    • Fuzzing of XPC Services
  • Fuzzing of Browsers and JavaScript Engines
    • WebKit Fuzzing
    • JSC Fuzzing

Training Takeaways

  • The whole training material will be handed to the students in digital form.
  • Access to the training course is guaranteed for 3 months from the time of signup (timer only starts after full training topics have been posted)

Training Requirements

  • Student Requirements
    • Basic understanding of exploitation
    • C and Python Programming knowledge
    • Able to understand X64/ARM64 assembly
  • Hardware Requirements
    • Apple Mac M1 system
    • Access to x86_64 system
  • Software Requirements
    • Mac OS X 11, with latest XCode and iOS 14.x SDK (or newer)
    • Additional Software will be made available during the training

Virtual Venue

The training is fully virtual. All training videos have been pre-recorded and will be made available as online watchable videos. Keep in mind that the training course is still under development. Have a LOOK HERE what modules already exist.

Furthermore trainees get access to a Discord server that will be used to post information regarding the training and will be used to discuss questions about the training material and content. Depending on the number of trainees working on the course a number of office hours will be offered in which a trainer will discuss questions live via Discord and Zoom.

Timezones

Trainees can watch the training videos and work through the course whenever they want. However the live question hours will be scheduled depending on how many trainees are currently working on the course and depending on what timezone they are in. We will try to accomodate as many people as possible.

Pricing

We offer the following introductory prices for this training.

EUR 3200,- EUR Sign up and pay in EUR
SGD 4500,- SGD Sign up and pay in SGD
USD 3500,- USD Sign up and pay in USD

Payment will be possible via international bank transfer or via credit card featured by STRIPE. Please note that we will usually charge customers in SGD. On request we can charge in USD or EUR.

Register

If you want to pay by credit card you can directly register by clicking the payment links above. Please ensure that you enter a valid email address while paying. You will then be contacted within one business day with further instructions about how to access the material and the Discord server.

If you have further questions or want to register for this training and pay by bank transfer please contact us by e-mail training@antid0te.com. Please notice that signup, billing and execution of the training is handled by Antid0te SG Pte. Ltd..

In-House Training / Conferences / Additional Trainings

If you are interested in this training, but want us to perform the training for your people, want to feature our training at your online conference or would just like to know if we provide the training again at a later time please contact us by e-mail training@antid0te.com.