Unconventional use for a famous Bootrom Exploit - Giulio Zompetti

### Overview In this presentation, Giulio Zompetti presents an unconventional application for the checkm8 BootROM exploit on iOS devices. Rather than focusing on jailbreaking or security bypasses for everyday use, the project explores using the exploit to streamline hardware servicing, repairs, and diagnostics. By leveraging checkm8 to defeat the SecureROM chain of trust, technicians can run Apple's internal diagnostic image (`diags`) directly on the target device, eliminating the need to physically desolder NAND flash chips or purchase costly specialized hardware programmers.

### Key Topics - **iOS Secure Boot Chain**: The execution flow starting from read-only SecureROM on the application processor through LLB/iBoot to the iOS kernel, protected at each stage by signature checks. - **System Configuration (`sysconfig`) & Activation**: The role of `sysconfig` key-value pairs stored in NAND (such as serial numbers, Wi-Fi MAC addresses, and Bluetooth MAC addresses) and how the lockdown daemon (`lockdownd`) and Apple's activation servers validate them. - **Traditional Hardware Servicing Challenges**: The multi-step, high-risk process required when replacing paired components like Wi-Fi integrated circuits (ICs), which traditionally requires physically desoldering NAND, reprogramming it in an external fixture, and resoldering both chips. - **Software-Based Diagnostics via checkm8**: Deploying the checkm8 BootROM exploit in DFU mode to bypass signature checks and load the `diags` environment directly onto devices.

### Technical Details Under standard operation, replacing a hardware component such as an iPhone 6 Wi-Fi IC requires modifying `sysconfig` entries stored in NAND to match the new component's MAC address. The traditional repair procedure demands removing the defective Wi-Fi IC, desoldering the NAND chip, placing NAND into an external NAND IC programmer socket (costing up to $500), editing the `sysconfig` struct over a Lightning/UART interface, resoldering the NAND back onto the motherboard, and soldering the replacement Wi-Fi IC.

Zompetti replaces this physical intervention with a software pipeline enabled by checkm8: 1. The device is placed into DFU mode, running SecureROM. 2. The checkm8 exploit (a use-after-free vulnerability in the SecureROM USB stack) is executed against the application processor, repairing the heap and patching signature verification checks. 3. Custom or patched first-stage bootloaders (`ibss` or `iboot`) are sent to the device. 4. From the interactive iBoot shell in recovery mode, the system loads the `diags` payload, which is the same diagnostic system software typically run inside hardware NAND programmer fixtures. 5. Once `diags` is running on the target device, technicians obtain a user shell that can directly read, add, or alter hexadecimal `sysconfig` keys and values in NAND over USB. 6. In addition to editing hardware IDs, `diags` provides diagnostic tools such as I2C bus probing and physical component testing.

Zompetti demonstrated the workflow manually on an iPhone X (board identifier D22), booting through patched iBoot with UART logs enabled into `diags`, and showcased a one-click automated tool developed to streamline this process for technicians.

### Takeaways Repurposing BootROM exploits like checkm8 allows repair technicians to conduct deep diagnostics and edit low-level device configuration data without physically desoldering NAND flash memory. This software-driven method avoids the risk of hardware damage, bypasses the need for expensive proprietary NAND programmers, and provides a plug-and-play solution across any checkm8-vulnerable iOS device.