I'm referring to this YouTube video, and further comment from John:
I hope everyone knows that the Apple explanation was VASTLY dumbed down for the press. I know the A7 system chip well, including its secure enclave with separate coprocessor that stores the encrypted fingerprint, the ephemeral key generated by the co-processor that even Apple doesn't know, the secure enclave memory isolated from the rest of the processes on the chip, etc. Doesn't matter. The main ARM processor has its own memory and that's what I'm interested in. I will simply sidestep calling the secure enclave and pretend it doesn't exist. I'm not trying to get encrypted data, merely trying to force a complete boot of IOS. Trivial, given the fact that the entire A7 system chip has been expanded into a board with separate components for every subfunction of the chip. on the board, the secure enclave processor and it's memory are fully accessible, even though we won't need it. made in China.
What I don't understand is how this solves the problem. In a nutshell, John is taking the hardware, extracting the assembly into a readable instruction set and running the code flow. He claims that finding the method that accepts the keyboard input and then finding the memory location of the Touch ID code will open the phone. What is is conveyed to the public, at least from a Joe Blogs standpoint, is the Touch ID code is stored in the clear i.e. You can just read it off with no post processing once you know the memory address.
Two things struck me:
- I assume the TouchID Lock code, which is what he is referring to, is at the very least hashed and likely salted. I'm lead to believe it actually resides on a separate chip entirely with the encrypted finger print. So even having the memory location and the hash itself is pointless, you still need to brute force it and depending on complexity you are no further along.
- He claims he needs an iOS full boot, which occurs regardless of if you have the TouchID Lock code or not, but critically you need to enter the TouchID code when the phone is booted anyway to do anything. So I don't see his point.
Unless I'm missing something, I don't see how this solves the problem and I feel its utterly misleading. Explanations & clarification welcome!