Skip to main content 홈 크리에이터 abelrguezr hacktricks-skills macos-iokit-analysis
macos-iokit-analysis Use this skill whenever analyzing macOS kernel drivers, IOKit vulnerabilities, or reverse engineering macOS kernel extensions. Trigger for any macOS security research involving IOKit, driver analysis, IORegistry inspection, kernel extension investigation, or when the user mentions macOS drivers, KEXT files, IOKit services, or kernel-level security analysis. Also use when investigating recent macOS CVEs related to IOKit (IOHIDFamily, IOGPUFamily, etc.) or when the user needs to enumerate driver selectors, inspect IORegistry, or understand IOKit communication patterns.
설치로 이동 Skills Marketplace 커뮤니티가 만든 AI 스킬을 발견하고 탐색하세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/abelrguezr/hacktricks-skills --skill macos-iokit-analysis명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Zip 다운로드 다운로드 중... 이 저장소의 다른 Skills AI-assisted fuzzing and vulnerability discovery. Use this skill whenever the user wants to generate fuzzing seeds, evolve grammars, analyze crashes, create proof-of-vulnerability exploits, or generate patches for discovered bugs. Trigger on mentions of fuzzing, AFL++, libFuzzer, vulnerability discovery, crash analysis, exploit generation, or security testing with LLMs.
Set up and use Burp Suite's MCP Server extension to enable LLM-assisted passive vulnerability discovery. Use this skill whenever the user wants to integrate Burp with MCP-capable AI tools (Codex, Gemini, Ollama, Claude), configure the MCP proxy, troubleshoot handshake issues, or analyze intercepted HTTP traffic for security findings. Trigger on mentions of Burp MCP, Burp AI Agent, MCP proxy setup, or LLM-assisted traffic review.
Help users understand and implement deep learning concepts including neural networks, CNNs, RNNs, LLMs, and diffusion models. Use this skill whenever the user asks about deep learning architectures, wants to build neural networks in PyTorch, needs help with training loops, or wants to understand concepts like backpropagation, activation functions, attention mechanisms, or generative models. Make sure to use this skill for any deep learning related questions, code reviews, architecture design, or implementation help.
name macos-iokit-analysis description Use this skill whenever analyzing macOS kernel drivers, IOKit vulnerabilities, or reverse engineering macOS kernel extensions. Trigger for any macOS security research involving IOKit, driver analysis, IORegistry inspection, kernel extension investigation, or when the user mentions macOS drivers, KEXT files, IOKit services, or kernel-level security analysis. Also use when investigating recent macOS CVEs related to IOKit (IOHIDFamily, IOGPUFamily, etc.) or when the user needs to enumerate driver selectors, inspect IORegistry, or understand IOKit communication patterns.
macOS IOKit Analysis
A skill for analyzing macOS IOKit drivers, understanding kernel extension architecture, and investigating IOKit-related vulnerabilities.
What is IOKit
IOKit is an open-source, object-oriented device-driver framework in the XNU kernel that handles dynamically loaded device drivers . It allows modular code to be added to the kernel on-the-fly, supporting diverse hardware.
Key characteristics:
IOKit drivers export functions from the kernel with predefined, verified parameter types
Built on top of Mach messages (similar to XPC)
Written in C++
User-space components are open source, but no IOKit drivers are open source
Source code locations:
Driver Locations
macOS
/System/Library/Extensions
/Library/Extensions
iOS
/System/Library/Extensions
Core Commands
List Loaded Drivers
kextstat
kextfind -bundle-id com.apple.iokit.IOReportFamily
kextfind -bundle-id -substring IOR
Load/Unload Extensions kextload com.apple.iokit.IOReportFamily
kextunload com.apple.iokit.IOReportFamily
Inspect IORegistry
ioreg -l
ioreg -w 0
ioreg -p <plane>
Common IORegistry planes:
IOService Plane - General service objects, provider-client relationshipsIODeviceTree Plane - Physical device connections (USB, PCI hierarchy)IOPower Plane - Power management relationshipsIOUSB Plane - USB device hierarchyIOAudio Plane - Audio device relationships
Demangling C++ Symbols IOKit is written in C++. Use these commands to get readable symbols:
nm -C com.apple.driver.AppleJPEGDriver
c++filt
__ZN16IOUserClient202222dispatchExternalMethodEjP31IOExternalMethodArgumentsOpaquePK28IOExternalMethodDispatch2022mP8OSObjectPv
↓
IOUserClient2022::dispatchExternalMethod(unsigned int, IOExternalMethodArgumentsOpaque*, IOExternalMethodDispatch2022 const*, unsigned long, OSObject*, void*)
Driver Communication Pattern User-space code connects to IOKit services using this pattern:
IOServiceMatching()IOServiceGetMatchingServices()IOServiceOpen()IOConnectCallScalarMethod() Important: You call functions by selector number , not by name. The selector is the index in the driver's external method dispatch array.
Available Call Functions
IOConnectCallScalarMethod - For scalar argumentsIOConnectCallMethod - For buffer argumentsIOConnectCallStructMethod - For struct arguments
Reversing Driver Entrypoints
Step 1: Get Driver from Firmware Extract KEXT files from IPSW firmware images to get drivers with symbols for debugging.
Step 2: Find dispatchExternalMethod Load the driver into a decompiler and locate the dispatchExternalMethod function. This is the entry point that receives user-space calls.
IOUserClient2022::dispatchExternalMethod (
uint32_t selector,
IOExternalMethodArgumentsOpaque *arguments,
const IOExternalMethodDispatch2022 dispatchArray[],
size_t dispatchArrayCount,
OSObject * target,
void * reference
)
Step 3: Define IOExternalMethodDispatch2022 Struct Define this struct in your decompiler to properly interpret the dispatch array.
Step 4: Enumerate Exported Functions The dispatch array contains all exported functions. Each element corresponds to a selector:
Selector 0 → First function in array
Selector 1 → Second function in array
etc.
Recent IOKit Attack Surface (2023-2025)
CVE-2024-27799 (IOHIDFamily)
Issue: Permissive IOHIDSystem client could grab HID events even with secure inputFix: Ensure externalMethod handlers enforce entitlements, not just user-client typeImpact: Keystroke capture via sandboxed apps
CVE-2024-44197 & CVE-2025-24257 (IOGPUFamily)
Issue: OOB writes from malformed variable-length data to GPU user clientsRoot cause: Poor bounds checking around IOConnectCallStructMethod argumentsImpact: Memory corruption from sandboxed apps
CVE-2023-42891 (IOHIDFamily)
Issue: HID user clients remain a sandbox-escape vectorRecommendation: Fuzz any driver exposing keyboard/event queues
Quick Triage & Fuzzing Tips
1. Enumerate Selectors from Userland Use the enumerate_iokit_selectors.py script to list all external methods for a service:
python3 scripts/enumerate_iokit_selectors.py --service IOHIDSystem
2. Check Sandbox Reachability Before targeting a driver, verify if it's accessible from third-party apps:
strings /System/Library/Extensions/IOHIDFamily.kext/Contents/MacOS/IOHIDFamily | \
grep -E "^com\.apple\.(driver|private)"
3. Common Bug Patterns
Inconsistent size fields: structureInputSize/structureOutputSize vs. actual copyin length → heap OOBMissing entitlement checks: Only checking user-client type, not entitlementsBounds confusion: Passing oversized arrays through IOConnectCallMethod
4. Minimal Fuzzing Harness For GPU/iomfb bugs, oversized arrays often trigger bounds issues:
uint8_t buf[0x1000 ];
size_t outSz = sizeof (buf);
IOConnectCallStructMethod(conn, X, buf, sizeof (buf), buf, &outSz);
Analysis Workflow When investigating an IOKit driver:
Identify the driver - Use kextstat and kextfind to locate itCheck IORegistry - Use ioreg to understand service relationshipsExtract from firmware - Get symbolicated version from IPSWReverse dispatchExternalMethod - Find the entry point and dispatch arrayEnumerate selectors - List all exported functionsCheck entitlements - Verify sandbox reachabilityLook for CVE patterns - Compare against known vulnerability patternsBuild test harness - Create user-space code to call selectors
Scripts Use the bundled scripts for common tasks:
scripts/enumerate_iokit_selectors.py - List driver selectors from userlandscripts/list_kexts.py - Enhanced kextstat with filteringscripts/demangle_symbols.py - Batch demangle C++ symbols
References 