KTRW: The journey to build a debuggable iPhone
Summary: Project Zero researcher Brandon Azad found on June 16th that the A11 SoC in the iPhone 8 and iPhone X has CoreSight External Debug registers enabled, which combined with a reversed proprietary register called DBGWRAP allows debugging the CPU at any point, including during reset vector execution before the MMU and KTRR are re-enabled. He used this to build KTRW, a hardware-level single-step kernel debugger for the iPhone X that works with LLDB and IDA Pro over an off-the-shelf Lightning cable, and notes the work predates and is independent of the checkm8 SecureROM exploit.
Bottom line: Azad argues that researchers who cannot obtain development-fused iPhones are at a disadvantage against adversaries deploying 0-day capabilities, and that the need to maintain a research platform pushes well-intentioned researchers to hoard vulnerabilities that could also be used to attack users.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026