2

Recently I was made aware of an iOS bug that when a specifically malformed mp4 was played on an iOS device, it would crash. After searching around for the mp4 I found it and am trying to figure out how to find which value in the binary the issue is caused from. I have opened the file up in vim with the hex view and have been stepping through the RFC for an mp4, but this seems to be a very slow way to go about this. Is there another way that I can validate an MP4 and find out why it is crashing iPhones?

Also, are there bug trackers or forms that I can check to see if anyone else has made any progress on this bug?

*I didn't want to directly link to a potential piece of malware, so check out this safe version of the video.. The actual video that will crash an iPhone is in the description. If that video gets deleted I have it downloaded and can distribute it if the intent is not to use it for malicious purposes.

https://www.youtube.com/watch?v=B15nBZ7pjLs

  • 1
    It's a proprietary OS - the owner holds the bug tracker (because they are the ones making the progress). You will have to wait until they release details. Your other question about how to reverse engineer a bug in iOS is probably off-topic here. – schroeder Nov 30 '16 at 22:28
  • 1
    You could see if your question fits here: reverseengineering.stackexchange.com – schroeder Nov 30 '16 at 22:29
  • ok, let me back up a bit. I am trying to find the bits in the mp4 that are causing the crash so that I can detect when a file comes across the network that contains the bad bits and block it. That would seem like something that would go in this form right? – MikeSchem Nov 30 '16 at 22:57
  • Ah, ok. That's not what you appeared to ask. You want to know what to seed your Snort rules with (or similar). Sure, that could be on topic here. I'm just really unsure you will get an answer before Apple releases details. iOS version release notes will be what you want to keep your eyes on. – schroeder Nov 30 '16 at 23:03
  • 1
    This is exactly what the AFL fuzzer's "minimizer" is for. It permutes the file and feeds it into the application to check for a crash, and keeps doing that, shrinking the file as much as it can while still causing a crash. Unfortunately, I don't know how to get AFL working on iOS, or whether or not it's even possible. – forest Nov 1 '18 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.