Stats
Actions
Tags
From apple-silicon-attack-surface-enumeration
Systematic attack surface enumeration for Apple Silicon devices (A-series, M-series). Use when: (1) starting security research on a new Apple chip/device, (2) need to map IOKit UserClients, Mach services, kexts, DART units, and coprocessor boundaries, (3) want to identify cross-platform (Mac↔iPhone/iPad) vulnerability applicability, (4) assessing which attack surfaces are unprivileged vs entitlement-gated. Covers: chip identification, device tree analysis, firmware inventory, boot chain, kext inventory, IOKit driver enumeration, system service mapping, and cross-platform diff methodology.
How this skill is triggered — by the user, by Claude, or both
Slash command
/apple-silicon-attack-surface-enumeration:apple-silicon-attack-surface-enumerationThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
When starting security research on a new Apple Silicon device, you need a systematic
When starting security research on a new Apple Silicon device, you need a systematic approach to enumerate all attack surfaces before diving deep. Without methodology, researchers waste time on well-hardened surfaces while missing exposed ones.
1.1 Chip Identification
# SoC identity
sysctl -a | grep -E 'hw\.(chip|product|target|model|cpufamily|cputype)'
# Core topology and frequencies
sysctl -a | grep -E 'hw\.(perflevel|ncpu|physicalcpu)'
# ARM feature registers (PAC, MTE, BTI, SME, SSBS, SPECRES)
sysctl -a | grep hw.optional
# IOPlatformExpertDevice for board-id, chip-id, silicon revision
ioreg -d2 -c IOPlatformExpertDevice -r
Key things to check:
1.2 Device Tree Analysis
# Full IODeviceTree dump
ioreg -p IODeviceTree -l > device-tree-full.txt
# arm-io children (coprocessors, DARTs, MMIO)
ioreg -p IODeviceTree -n arm-io -r | grep -E '"name"|"compatible"|"AAPL,phandle"'
# DART (IOMMU) inventory
ioreg -p IODeviceTree -l | grep -B2 -A5 'dart'
# Chosen node (security flags, boot args)
ioreg -p IODeviceTree -n chosen -r
Key things to check:
security-downgradable flag (1 = macOS allows SIP disable; 0 = locked like iPhone)exclaves-test presence (active development = less mature)1.3 Firmware Inventory
# Boot firmware
system_profiler SPiBridgeDataType SPHardwareDataType
nvram -p | grep -i boot # boot breadcrumbs
# WiFi/BT (may differ from device tree compatible string!)
system_profiler SPBluetoothDataType SPAirPortDataType
ioreg -l -n wlan | head -50
# NVMe
system_profiler SPNVMeDataType
# All firmware versions accessible from userspace
ioreg -l | grep -i 'firmware\|fw-version\|rom-version'
Critical gotcha: Device tree compatible strings may not match actual hardware.
Example: MacBook Neo reports wlan-pcie,bcm4387 but ships MediaTek MT7932.
Always cross-check with system_profiler and driver IORegistry entries.
1.4 Boot Chain
# Security policy
csrutil status
# Signed System Volume
diskutil apfs listSnapshots /
# Boot mode
nvram -p | grep boot-mode
# Secure Element (if present)
system_profiler SPSecureElementDataType
2.1 Kernel Extensions
# Loaded kexts with addresses
kextstat
# All kexts on disk
find /System/Library/Extensions /Library/Extensions -name '*.kext' -maxdepth 2 2>/dev/null | wc -l
# Chip-specific kexts (replace t8140 with your chip ID)
kextstat | grep -i 't8140\|H16\|Everest\|Sunrise'
# DriverKit extensions
systemextensionsctl list
Identify:
2.2 IOKit Drivers
# Full IOService plane
ioreg -p IOService -l > ioservice-full.txt
# All registry planes
ioreg -l | grep -E '^\+-o .* <class' | head -20
# UserClient classes
ioreg -p IOService -l | grep -c 'UserClient'
# UserClient entitlement requirements
ioreg -p IOService -l | grep -A20 'UserClient' | grep -i 'entitlement\|require'
Priority finding: unprotected UserClients. Count how many have NO entitlement gating. On A18 Pro: 240/248 UserClient instances had zero IOKit-level entitlement checks.
2.3 System Services
# System domain Mach services
launchctl print system/ | grep -E '^\s+(A|D)\s' | wc -l
# User domain
launchctl print gui/$(id -u)/ | grep -E '^\s+(A|D)\s' | wc -l
# LaunchDaemon/Agent counts
ls /System/Library/LaunchDaemons/ | wc -l
ls /System/Library/LaunchAgents/ | wc -l
# XPC services in frameworks
find /System/Library/Frameworks /System/Library/PrivateFrameworks -name '*.xpc' -maxdepth 3 2>/dev/null | wc -l
Look for:
intelligenceplatform)Key question: Which findings apply to iPhone?
| Surface | Mac | iPhone | Cross-applicable? |
|---|---|---|---|
| Kernel/IOKit bugs | Full access | Same code, sandboxed | YES — same drivers |
| DART/IOMMU | Same silicon | Same silicon | YES — same IP |
| SEP/ANE/ISP | Same coprocessors | Same coprocessors | YES |
| WiFi/BT | May differ (MTK vs BCM) | Check model | DEPENDS on chipset |
| UserClients | No sandbox | App sandbox limits reach | PARTIALLY — need reachability |
| Mach services | No sandbox | App sandbox limits reach | PARTIALLY |
| Entitlements | Fewer required | More required | BUGS yes, REACH maybe not |
Mac advantages for research:
security-downgradable = 1)Porting barriers to iPhone:
Scenario: New MacBook Neo (A18 Pro) acquired for research.
dart,t8110), 16 Exclave services, ISP has 67MB MMIO.security-downgradable = 1.exclaves-test node) suggests active development — likely immature.autonomous-research-loop — for running this enumeration autonomously across many tasksProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub dmaynor/dmaynor-skills-marketplace --plugin apple-silicon-attack-surface-enumeration