Patch Different On *OS

Overview: Binary diffing is a powerful technique for reverse engineering, vulnerability research, and malware analysis. It allows security researchers to compare two versions of a binary and identify the changes related to security patches. By doing so, they can gain insights into the root causes of the latest CVEs and patched vulnerabilities. However, patch diffing is not equal for all operating systems. While Windows provides convenient access to binaries, download links, and public symbols, \*OS poses several challenges for patch diffing. Apple has historically made its binaries less accessible, and Details: even encrypted its software distributions in the IPSW (IPhone Software) format until later versions of iOS. Moreover, \*OS security updates vary across products (watchOS, tvOS, iOS, and MacOS) and the binaries are embedded in the dyld_shared_cache (DSC), complicating the diffing process. In this talk, we will show you how to overcome these challenges and perform effective patch diffing on \*OS platforms in 2024. We will demonstrate how to use open-source reverse engineering tools (such as ipsw and Ghidra) to extract and analyze IPSW files, which contain the software updates for iOS and MacOS. We will also show you how to find the updated binaries, extract embedded binaries from the DSC, and how to use freely available binary diffing tools to compare them. Finally, we will walk you through