Search code examples
ioskerneljailbreak

What binary in the Update Ramdisk loads the Kernel during an iOS update?

enter image description here

Above image indicates that the Update Ramdisk loads the kernel during an iOS update. If so which binary (ASR, etc.) in the iOS 10.3.1 Update Ramdisk loads the Kernel?

Solution

  • None of them, that's not how ramdisks work.

    For starters, the kernel operates on and with the ramdisk, not the other way round. This is true for any kernel-ramdisk pair I've seen on any platform so far.

    Furthermore, binaries from the iOS ramdisks are all userland binaries, which means:

    • They rely on the dynamic linker (/usr/lib/dyld) and system libraries.
    • They rely on system calls.
    • They rely on the availability of a file system.
    • They run in EL0 ("userland"), the least privileged processor mode.

    If any of those wanted to load the kernel, there would be a number of problems with that:

    • The kernel runs in EL1. If you run in EL0, then you are not privileged to access anything in EL1 and thus cannot put any kernel there.
    • Linking, libraries and system calls work very differently in EL1:
      • System libraries are not available in EL1. I suppose they could be made available, but since there can only be one binary executing in EL1 at any given time, that sounds like a huge overkill.
      • There exists a linker for EL1 in iOS (KXLD), but it is part of the iOS kernel and its designed to link kernel extensions to the kernel. It doesn't operate on userland binaries.
      • While technically you can generate an exception from EL1 targeting EL1 with the svc instruction, you yourself will be invoked to handle it, which means that until you load the kernel, you are the kernel. Userland binaries are not prepared for that.

    That said, I'm not sure what your image is trying to express. My best guess would be that it means that the denoted ramdisk is passed to the kernel. In any case though, iBoot is the one loading and setting up the kernel.