Corellium Blog

> it was never hacked and made to run on other ARM platforms. Barring Corellium[0], of course. My first instinct is that any company with the resources to make such a thing could tell it wouldn't last long. Petty copyright violations go over pretty smoothly in China all the time, but any attempts to go international would get them sued out of the market. It would also stand to sabotage Apple's investments in Chinese success, which is a no-go for any domestic business. It wouldn't surprise me if the PRC shut down some iOS hacker hopefuls to maintain their contract and keep things civil. [0] https://www.corellium.com/

Apple has been kind of forced into the open source model by tools like Corellium[1] and some source code leaks. This means that the black box advantage that iOS has had is no longer as significant. Apple's move with the Security Research Device Program[2] proves this point. They wouldn't be offering it if they didn't think it was a serious problem for them. [1] https://www.corellium.com/ [2] https://security.apple.com/research-device/

We do have https://www.corellium.com/ but that's a hosted solution and not generally available to consumers.

Not advertising, but apple did have beef with https://www.corellium.com/ -they tried to shut them down as of 2020. Pretty cool tool.

If you want a potential alternative to the security research device from Apple look into Corellium[1] - startup that emulates iOS on ARM64 server hardware, sued by Apple for copyright claims and survived. It is a paid product (eg $x/hr cloud billing). Supposedly easier to obtain than the security research device. [1] https://corellium.com

For those that don’t know about it, you can find a fairly complete commercial iPhone emulator at Corellium: https://www.corellium.com/ It does essentially everything, short of hardware accelerated rendering You can even emulate it being attached directly to your Mac and use it as a cloud device from Xcode

> How hard is it to emulate an iPhone or Android Check out Correlium https://corellium.com/ They operate in a sort of legal grey-area since you're not 'supposed' to emulate iOS so if you decide to use it, keep in mind it could all be shut down at a moments notice.

They have: https://corellium.com Though there is an ongoing lawsuit as a result.

How do they actually run the iOS OS code involved in this debugging? Jailbroken iPhones? iOS virtualization ala Corellium (https://corellium.com)?

> when you cannot trust the OS The list above is not about distrusting the vendor or OS, it's about leveraging the vendor's officially published statements of behavior (e.g. HTTPS network traffic identified by PKI certificates tied to vendor's legal identity), used in contracts with enterprise customers that have competent lawyers, for the benefit of smaller customers. MDM policy can be configured to narrow the vendor's documented claims of software+hardware behavior. Narrowed claims are cheaper to verify empirically. If evidence can be found that MDM policy is not being enforced, then the pool of affected parties grows from powerless individuals to a class action (Apple has paid millions in the past) and/or large enterprises who use MDM to protect confidential enterprise data. > How do you ensure that the OS does not by itself connect to a random open WLAN In the case of Wi-Fi, MDM and Apple Configurator can configure device policy to connect only to approved SSIDs + a null list of approved SSIDs. To validate enforcement of this WiFi policy, the device can be placed in a small faraday box (commercial < $1000, DIY < $100) that blocks external RF, with an SDR that records all internal RF traffic for analysis. For a device with a null list of approved SSIDs, there should be zero Wi-Fi traffic from the baseband radio. Another option for MDM policy enforcement validation is to use a virtual iOS/macOS instance, where a hypervisor can perform live behavioral analysis of OS…

I googled a bit and found this, which points to some other tools. https://www.corellium.com/blog/ios-mobile-reverse-engineering (No affiliation.)

These people: https://www.corellium.com/about#:~:text=Who%20we%20serve

This doesn't look like "fake news" to me. Timeline: Monday, August 16: Corellium launches its "Open Security Initiative" to fund "research projects designed to validate any security and privacy claims for any mobile software vendor". The announcement prominently lists Apple's privacy and security claims about its CSAM scanning as one of the topics that would be eligible for funding under this initiative. (https://www.corellium.com/blog/open-security-initiative) Tuesday, August 17: Apple appeals the copyright case that it lost against Corellium. Reuters reports that the appeal was a "surprise" after the recent settlement. (https://www.reuters.com/legal/transactional/apple-files-appeal-notice-…

It looks like some folks have made it work on linux: https://corellium.com/blog/linux-m1 For Windows support, I thought Apple said something along the lines of: "If Windows wants to add support, we are fine with it" - but I could be mistaken.

Interfacets, it is mentioned in the article > Apple designed their own interrupt controller, the Apple Interrupt Controller (AIC), not compatible with either of the major ARM GIC standards. And not only that: the timer interrupts - normally connected to a regular per-CPU interrupt on ARM - are instead routed to the FIQ, an abstruse architectural feature, seen more frequently in the old 32-bit ARM days. Naturally, Linux kernel did not support delivering any interrupts via the FIQ path, so we had to add that. and many others https://corellium.com/blog/linux-m1 It is on top of HN now https://news.ycombinator.com/item?id=25859907

> Looking up the Librem 5 devicetree in the upstream kernel, it seems it was submitted on Aug 21 2020. Aspen shipped in September 2019, so it took them about a year from shipping to upstreaming bring-up, and that's not considering internal prototypes and that the SoC was announced in mid 2018, so they had plenty of time to work on things internally. I submitted upstream bring-up for the M1 Mac Mini with the device tree on Feb 4 2021, just 4 months after it was announced in Nov 2020. Before anything else, let me say thank you for your work on the M1, because it is essential that we have Linux support for processors even when the device maker is opposed. Considering how many millions of people have bought Apple's M1 devices, Asahi's work is critical because it provides a path for people to discover a freer system when they get disgusted with Apple's bad practices and the restrictions of its "walled garden." Having said that, I don't think that your criticism of Purism's kernel work is very fair. Purism made its first commit to mainline Linux for the Librem 5 in July 2018 (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/com… Purism submitted the device tree for the Librem 5 DevKit to mainline Linux on June 17, 2019 (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/com… which was 7 months after it started shipping the DevKits in mid-December…

> The M1 felt like yet another step towards making the Mac more closed There's a certain amount of hubris in this, in that (at least until AMD came along), pretty much every single Intel chip has only made Intel money, while ARM is broadly-licensed and is ripe for a surge. All Apple did was create an ARM-compatible chip, which is how someone already got Linux running on it: https://corellium.com/blog/linux-m1 Here's ARM themselves on their licensing model: https://www.arm.com/why-arm/how-licensing-works Now, which one is more "closed", really? Near-absolute Intel hegemony that only benefits Intel, or ARM, which seems to benefit anyone who wants to tackle creating an ARM chip? Honestly (disclosing my bias here), I hope IA64 dies in a fire in 5-10 years. It's had enough time in the limelight, Intel has rested on its laurels of late (arguably holding back progress), and its technical flaws run quite deep (another reason why the M1 seems impressive; ARM is simply a better-designed architecture from the ground up)