{"product_id":"ios-userland-fuzzing-exploitation-live-edition","title":"iOS Userland Fuzzing \u0026 Exploitation: Live edition","description":"\u003cdiv class=\"course-details\"\u003e\n\u003cp\u003e\u003cstrong\u003eName of Training:\u003c\/strong\u003e iOS Userland Fuzzing \u0026amp; Exploitation: Live edition\u003cbr\u003e\u003cstrong\u003eTrainer(s):\u003c\/strong\u003e Praveen KSM, Ken Gannon, Vikrant Chauhan\u003cbr\u003e\u003cstrong\u003eSkill Level:\u003c\/strong\u003e Intermediate\/Advanced\u003cbr\u003e\u003cstrong\u003eDates:\u003c\/strong\u003e March 5-6\u003cbr\u003e\u003cstrong\u003eTime:\u003c\/strong\u003e 9 am - 5 pm\u003cbr\u003e\u003cstrong\u003eVenue:\u003c\/strong\u003e TBD\u003cbr\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cstrong\u003eEarly Bird Cost:\u003c\/strong\u003e S$3,900 (incl. GST)\u003cbr\u003e\u003cstrong\u003eRegular Cost:\u003c\/strong\u003e S$4,200 (incl. GST)\u003cbr\u003e\u003c\/p\u003e\n\u003c\/div\u003e\n\u003ch3\u003eShort Summary\u003c\/h3\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cspan data-sheets-root=\"1\"\u003eHands-on iOS exploitation from the ground up: build ARM64 and reverse-engineering fluency on Day 1, then use it to fuzz Apple's own ImageIO framework and reproduce real CVEs on iOS 26 before building a complete 0-click exploit chain based on a real published CVE against a messaging app on Day 2. Every student works in their own cloud-hosted macOS VM with a dedicated, jailbroken virtual iOS 26 device, both live in the browser.\u003c\/span\u003e\u003c\/p\u003e\n\u003ch3\u003eCourse Description\u003c\/h3\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cspan data-sheets-root=\"1\"\u003eThis two-day course takes students from zero ARM64\/LLDB experience through to building a working end-to-end iOS exploit chain based on real recent CVEs. Day 1 covers ARM64 assembly and the AAPCS64 calling convention, LLDB from first principles, reverse-engineering real iOS binaries, and coverage-guided fuzzing against Apple's closed-source ImageIO framework, where students reproduce real CVEs on iOS 26.4 themselves. The course includes CVE deep dives into some of the most notable iOS zero-click exploits publicly documented to date, including Operation Triangulation and FORCEDENTRY.\u003cbr\u003e\u003cbr\u003eDay 2 moves into exploitation: heap exploitation, ARM64 ROP chain construction, and defeating ASLR via information leaks, applied across three hands-on vulnerability challenges: Light Leak (a heap overflow in Apple's EXR image decoder inside a messaging client), LensPic (a PAC bypass via signed JOP), and EchoChat (a 0-click bug modeled on a real WhatsApp CVE). The day culminates in a capstone where students build a complete 0-click exploit chain based on CVE-2025-43300 against a vulnerable iOS messaging app, from a crafted message through the heap overflow, an info leak, and a function-pointer hijack, to code execution and exfiltrating the victim's message database.\u003c\/span\u003e\u003c\/p\u003e\n\u003ch3\u003eCourse Outline\u003c\/h3\u003e\n\u003ch4\u003eDay 1 - Morning\u003c\/h4\u003e\n\u003cp\u003eARM64 architecture and the AARCH64 calling convention: registers, instruction set, stack frame mechanics, disassembly. LLDB from the ground up - breakpoints, register\/memory inspection, live patching of running processes. Built from zero; no prior ARM64 or debugger experience required.\u003c\/p\u003e\n\u003ch4\u003eDay 1 - Afternoon\u003c\/h4\u003e\n\u003cp\u003eReverse-engineering real iOS binaries: Objective-C runtime dispatch, Mach-O structure, the DYLD shared cache, ASLR and code signing. CVE deep dives into real zero-click attack chains, including Operation Triangulation and FORCEDENTRY. Transition into coverage-guided fuzzing (Jackalope\/TinyInst) against Apple's closed-source ImageIO framework. Every student independently reproduces a crash for a real CVE (CVE-2026-28990) on iOS 26.4 by end of day.\u003c\/p\u003e\n\u003ch4\u003eDay 2 - Morning\u003c\/h4\u003e\n\u003cp\u003eHeap exploitation fundamentals and ARM64 ROP chain construction against modern mitigations (PAC-aware). Defeating ASLR through information-leak primitives - turning a leaked address into a reliable exploitation primitive. This builds the toolbox applied to the afternoon's challenges.\u003c\/p\u003e\n\u003ch4\u003eDay 2 - Afternoon\u003c\/h4\u003e\n\u003cp\u003eThe main goal of the afternoon is the PwnChat capstone: students build and execute a complete 0-click exploit chain based on CVE-2025-43300 against a vulnerable iOS messaging app. Working on their own live virtual device, they combine a heap overflow, an ASLR information leak, and ROP\/JOP techniques to achieve code execution and extract the app’s message database. This end-to-end exercise serves as the course’s practical proficiency evaluation.\u003cbr\u003e \u003cbr\u003e Three additional hands-on labs provide opportunities to reinforce and extend these skills: Light Leak explores heap exploitation in Apple’s EXR image decoder; LensPic examines PAC bypass techniques using signed JOP; and EchoChat explores a 0-click memory-corruption scenario modeled on a published messaging-app vulnerability. These supplementary exercises support the central objective of completing the full PwnChat exploit chain.\u003c\/p\u003e\n\u003ch3\u003eDifficulty Level\u003c\/h3\u003e\n\u003cp\u003eIntermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.\u003c\/p\u003e\n\u003cp\u003eAdvanced - The student is expected to have significant practical experience with the tools and technologies that the training will focus on.\u003c\/p\u003e\n\u003ch3\u003eSuggested Prerequisites\u003c\/h3\u003e\n\u003cp\u003eComfortable reading C and Objective-C. No prior ARM64 assembly or LLDB experience required. Day 1 builds this from zero. Prior exposure to any debugger (gdb, LLDB, x64dbg, etc.) is helpful but not required. No pre-work required.\u003c\/p\u003e\n\u003ch3\u003eWhat Students Should Bring\u003c\/h3\u003e\n\u003cp\u003eA laptop with a modern browser (Chrome, Firefox, or Safari) and a stable internet connection. No local toolchain, VM, or software installation of any kind — the entire lab environment is cloud-hosted and accessed via browser.\u003c\/p\u003e\n\u003ch3\u003eWhat the Trainer Will Provide\u003c\/h3\u003e\n\u003cp\u003eA dedicated, isolated cloud lab environment per student for the full duration of the course: a macOS VM with the complete toolchain (LLDB, Jackalope\/TinyInst, clang, AFL++), accessed via an in-browser terminal, paired with a dedicated jailbroken virtual iPhone running iOS 26 with live screen access in the browser. Course workbooks\/materials and a support channel. Lifetime access to the online course and exam voucher (Certified iOS Exploit Developer) for after the course.\u003c\/p\u003e\n\u003ch3\u003eTrainer(s) Bio\u003c\/h3\u003e\n\u003ch4\u003ePraveen KSM\u003c\/h4\u003e\n\u003cp\u003ePraveen KSM is a co-founder of Mobile Hacking Lab and an experienced Black Hat trainer with more than 15 years of experience in security and exploitation. He specializes in fuzzing and offensive mobile security, bringing extensive research and enterprise security experience to his hands-on training.\u003c\/p\u003e\n\u003ch4\u003eKen Gannon\u003c\/h4\u003e\n\u003cp\u003eKen Gannon is Head of Research at Mobile Hacking Lab, an mobile security specialist, and a repeat Pwn2Own winner across multiple years. His background includes security research at NCC Group and work with a wide range of enterprises. He brings practical vulnerability research and exploitation experience to the classroom.\u003c\/p\u003e\n\u003ch4\u003eVikrant Chauhan\u003c\/h4\u003e\n\u003cp\u003eVikrant Chauhan is experienced in iOS security and has developed numerous hands-on hacking labs. His skills span lab development, automation, and AI, bringing a practical perspective to building and supporting interactive security training environments.\u003c\/p\u003e\n\u003ch3\u003eProficiency Exam\u003c\/h3\u003e\n\u003cp\u003eStudents complete a graded practical capstone at the end of Day 2: independently reproducing the target vulnerability via fuzzing, then building and executing a working exploit chain end-to-end against their own live virtual device, culminating in exfiltrating the target data. Proficiency is demonstrated by producing a working exploit (not merely describing one) plus a short write-up explaining the vulnerability and the chain. Next to this all participants get access to the CIED (Certified iOS Exploit Developer) 72-hours hands-on, they can schedule anytime after the live course.\u003c\/p\u003e\n\u003chr\u003e\n\u003csection class=\"registration-terms\"\u003e\n\u003ch3\u003eRegistration Terms and Conditions\u003c\/h3\u003e\n\u003cp\u003eTrainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eBetween January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eAll trainings are non-refundable after Feb 28, 2027.\u003c\/p\u003e\n\u003cp\u003eTraining tickets may be transferred to another student. Please email us at training@defcon.org for specifics.\u003c\/p\u003e\n\u003cp\u003eIf a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).\u003c\/p\u003e\n\u003cp\u003eFailure to attend the training without prior written notification will be considered a no-show. No refund will be given.\u003c\/p\u003e\n\u003cp\u003eDEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.\u003c\/p\u003e\n\u003cp\u003eBy purchasing this ticket you agree to abide by the \u003ca href=\"https:\/\/defcon.org\/html\/links\/dc-code-of-conduct.html\"\u003eDEF CON Training Code of Conduct\u003c\/a\u003e and the registration terms and conditions listed above.\u003c\/p\u003e\n\u003cp\u003eSeveral breaks will be included throughout the day. Please note that food is not included.\u003c\/p\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003eAll courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.\u003c\/p\u003e\n\u003c\/section\u003e","brand":"Singapore 2027","offers":[{"title":"Default Title","offer_id":63578778796172,"sku":null,"price":3900.0,"currency_code":"SGD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0750\/9042\/8044\/files\/DCT400x400.png?v=1793205353","url":"https:\/\/sg.shop.defcon.org\/products\/ios-userland-fuzzing-exploitation-live-edition","provider":"DEF CON SG","version":"1.0","type":"link"}