iOS Userland Fuzzing & Exploitation: Live edition
Description
Name of Training: iOS Userland Fuzzing & Exploitation: Live edition
Trainer(s): Praveen KSM, Ken Gannon, Vikrant Chauhan
Skill Level: Intermediate/Advanced
Dates: March 5-6
Time: 9 am - 5 pm
Venue: TBD
Early Bird Cost: S$3,900 (incl. GST)
Regular Cost: S$4,200 (incl. GST)
Short Summary
Hands-on iOS exploitation from the ground up: build ARM64 and reverse-engineering fluency on Day 1, then use it to fuzz Apple's own ImageIO framework and reproduce real CVEs on iOS 26 before building a complete 0-click exploit chain based on a real published CVE against a messaging app on Day 2. Every student works in their own cloud-hosted macOS VM with a dedicated, jailbroken virtual iOS 26 device, both live in the browser.
Course Description
This two-day course takes students from zero ARM64/LLDB experience through to building a working end-to-end iOS exploit chain based on real recent CVEs. Day 1 covers ARM64 assembly and the AAPCS64 calling convention, LLDB from first principles, reverse-engineering real iOS binaries, and coverage-guided fuzzing against Apple's closed-source ImageIO framework, where students reproduce real CVEs on iOS 26.4 themselves. The course includes CVE deep dives into some of the most notable iOS zero-click exploits publicly documented to date, including Operation Triangulation and FORCEDENTRY.
Day 2 moves into exploitation: heap exploitation, ARM64 ROP chain construction, and defeating ASLR via information leaks, applied across three hands-on vulnerability challenges: Light Leak (a heap overflow in Apple's EXR image decoder inside a messaging client), LensPic (a PAC bypass via signed JOP), and EchoChat (a 0-click bug modeled on a real WhatsApp CVE). The day culminates in a capstone where students build a complete 0-click exploit chain based on CVE-2025-43300 against a vulnerable iOS messaging app, from a crafted message through the heap overflow, an info leak, and a function-pointer hijack, to code execution and exfiltrating the victim's message database.
Course Outline
View full outline
Hide outline
Day 1 - Morning
ARM64 architecture and the AARCH64 calling convention: registers, instruction set, stack frame mechanics, disassembly. LLDB from the ground up - breakpoints, register/memory inspection, live patching of running processes. Built from zero; no prior ARM64 or debugger experience required.
Day 1 - Afternoon
Reverse-engineering real iOS binaries: Objective-C runtime dispatch, Mach-O structure, the DYLD shared cache, ASLR and code signing. CVE deep dives into real zero-click attack chains, including Operation Triangulation and FORCEDENTRY. Transition into coverage-guided fuzzing (Jackalope/TinyInst) against Apple's closed-source ImageIO framework. Every student independently reproduces a crash for a real CVE (CVE-2026-28990) on iOS 26.4 by end of day.
Day 2 - Morning
Heap exploitation fundamentals and ARM64 ROP chain construction against modern mitigations (PAC-aware). Defeating ASLR through information-leak primitives - turning a leaked address into a reliable exploitation primitive. This builds the toolbox applied to the afternoon's challenges.
Day 2 - Afternoon
The main goal of the afternoon is the PwnChat capstone: students build and execute a complete 0-click exploit chain based on CVE-2025-43300 against a vulnerable iOS messaging app. Working on their own live virtual device, they combine a heap overflow, an ASLR information leak, and ROP/JOP techniques to achieve code execution and extract the app’s message database. This end-to-end exercise serves as the course’s practical proficiency evaluation.
Three additional hands-on labs provide opportunities to reinforce and extend these skills: Light Leak explores heap exploitation in Apple’s EXR image decoder; LensPic examines PAC bypass techniques using signed JOP; and EchoChat explores a 0-click memory-corruption scenario modeled on a published messaging-app vulnerability. These supplementary exercises support the central objective of completing the full PwnChat exploit chain.
Difficulty Level
Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.
Advanced - The student is expected to have significant practical experience with the tools and technologies that the training will focus on.
Suggested Prerequisites
Comfortable reading C and Objective-C. No prior ARM64 assembly or LLDB experience required. Day 1 builds this from zero. Prior exposure to any debugger (gdb, LLDB, x64dbg, etc.) is helpful but not required. No pre-work required.
What Students Should Bring
A laptop with a modern browser (Chrome, Firefox, or Safari) and a stable internet connection. No local toolchain, VM, or software installation of any kind — the entire lab environment is cloud-hosted and accessed via browser.
What the Trainer Will Provide
A dedicated, isolated cloud lab environment per student for the full duration of the course: a macOS VM with the complete toolchain (LLDB, Jackalope/TinyInst, clang, AFL++), accessed via an in-browser terminal, paired with a dedicated jailbroken virtual iPhone running iOS 26 with live screen access in the browser. Course workbooks/materials and a support channel. Lifetime access to the online course and exam voucher (Certified iOS Exploit Developer) for after the course.
Trainer(s) Bio
Praveen KSM
Praveen KSM is a co-founder of Mobile Hacking Lab and an experienced Black Hat trainer with more than 15 years of experience in security and exploitation. He specializes in fuzzing and offensive mobile security, bringing extensive research and enterprise security experience to his hands-on training.
Ken Gannon
Ken Gannon is Head of Research at Mobile Hacking Lab, an mobile security specialist, and a repeat Pwn2Own winner across multiple years. His background includes security research at NCC Group and work with a wide range of enterprises. He brings practical vulnerability research and exploitation experience to the classroom.
Vikrant Chauhan
Vikrant Chauhan is experienced in iOS security and has developed numerous hands-on hacking labs. His skills span lab development, automation, and AI, bringing a practical perspective to building and supporting interactive security training environments.
Proficiency Exam
Students complete a graded practical capstone at the end of Day 2: independently reproducing the target vulnerability via fuzzing, then building and executing a working exploit chain end-to-end against their own live virtual device, culminating in exfiltrating the target data. Proficiency is demonstrated by producing a working exploit (not merely describing one) plus a short write-up explaining the vulnerability and the chain. Next to this all participants get access to the CIED (Certified iOS Exploit Developer) 72-hours hands-on, they can schedule anytime after the live course.
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
