S
Saar Amar
saaramar.github.io · Personal blog · on HN since 2021
Saar Amar, a security researcher, writes about iOS internals, memory safety mitigations, and vulnerability analysis in Apple's kernel and bootloader.
What HN saysHN commenters cite his posts on Apple's Firebloom memory-safe C in iBoot and his survey of memory safety mitigations such as Arm MTE.
18HN people shared it
9linked it in comments
13stories submitted
20story points
9 months agolast shared
2021people per year2026
Most-shared posts
- 1Memory Safety in Apple Firebloom / iBoot7 people · 9 points · first shared 2022 · discussion on HN
- 2Survey of Security Mitigations and Architectures4 people · 2 points · first shared 2023 · discussion on HN
- 3Bindiff and POC for the IOMFB vulnerability, iOS 15.0.23 people · 5 points · first shared 2021 · discussion on HN
- 4WebContent-EL1 LPE: OOBR in AppleCLCD / IOMobileFrameBuffer3 people · 1 points · first shared 2021 · discussion on HN
- 5Exhaust iOS EL1 memory from the app sandbox2 people · 2 points · first shared 2021 · discussion on HN
- 6Kmem_guard_t1 people · 1 points · first shared 2022 · discussion on HN
What HN people wrote when they linked it
transpute · 2024-03-19
Probabilistic Arm MTE memory safety is a stepping stone to deterministic CHERI hardware, https://saaramar.github.io/memory_safety_blogpost_2022/ & https://news.ycombinator.com/item?id=39668053
The right kind of mitigations targets the 1st order primitive; the root cause of the bug. Hardware solutions: CHERI (Morello, CheriIoT), MTE Software mitigations: kalloc_type+dataPAC, AUTOSLAB, Firebloom, GuardedMemcpy, CastGuard, attack surface reduction Safe programming languages: Rust, Swift MTE/CHERI play pretty nicely - they help ensure that whatever bugs we have in these areas are killed at their root cause… MSR, MSRC and Azure Silicon pushed for… scaling CHERI down to RISC-V32E, the smallest core RISC-V specification. Microsoft Research open-sourced a hardware/software stack for CHERI in IoT devices, https://msrc.microsoft.com/blog/2023/02/first-steps-in-cheriot-securit…
CHERI-based microcontroller that aims to… get very strong security guarantees if we are willing to co-design the instruction set architecture (ISA), the application binary interface (ABI), isolation model, and the core parts of the software stack… our microcontroller achieves the following security properties: Deterministic mitigation for spatial safety (using CHERI-ISA capabilities). Deterministic mitigation for heap and cross-compartment stack temporal safety (using a load barrier, zeroing, revocation, and a one-bit information flow control scheme). Fine-grained…
bri3d · 2026-01-31
Many years ago. It’s called Firebloom. I think it’s similar in theory and lineage to Fil-C.
https://saaramar.github.io/iBoot_firebloom/
nielsbot · 2025-10-28
I like to share this every time there's a post about memory safe C:
Apple has a memory-safer C compiler/variant they use to compile their boot loaders:
https://saaramar.github.io/iBoot_firebloom/
ysnp · 2025-09-09
https://saaramar.github.io/memory_safety_blogpost_2022/ is a nice article which goes into this topic for MTE in the past.
fuklief · 2023-11-03
This survey by the same author also provides a good comparison https://saaramar.github.io/memory_safety_blogpost_2022/
dagmx · 2023-10-09
Specifically a dialect called Firebloom (supposedly anyway)
https://saaramar.github.io/iBoot_firebloom/
saagarjha · 2022-12-14
Annotations on top of C, compiled through their private fork of LLVM. Here's what it looks like on our side: https://saaramar.github.io/iBoot_firebloom/
aj3 · 2021-07-27
Initial vulnerability is OOB read, but it can be leveraged to gain arbitrary r/w.
EDIT: source: https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/
muricula · 2021-07-26
Saar Amar, who works at MSRC, wrote a writeup & POC for what he says is the same bug:
https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/
He says he found it independently.