Blog explains Apple arm64e pointer authentication and PAC keys
Original title: arm64e pointer authentication: PAC keys, PACIASP, A12
The author says the post has no exploit or bypass and that tests ran on a stock Mac.
A technical post explains Apple's arm64e pointer-authentication ABI: PAC codes sit in unused pointer bits and are checked at branch time against keys that are not in memory. It covers pacia, autia, five 128-bit keys, TBI, and how failed authentication faults under FEAT_FPAC versus poisoned pointers when FEAT_FPACCOMBINE is absent. The Mac in the write-up reports FEAT_FPAC set and FEAT_FPACCOMBINE off.
- User pointers on the tested Mac get a 16-bit PAC field.
- Brandon Azad measured a 24-bit kernel PAC mask on the A12 in 2019.
- Keys IA, IB, DA, DB and GA live in privileged system registers.
- A failed standalone autia traps immediately because FEAT_FPAC is present.
- Fused authenticate-and-branch forms still poison the pointer on this Mac.
From the original article
15 min read at sigreturn.com
The previous post ended one function call short. Credentials, MACF (Mandatory Access Control Framework) labels and process state all moved into read-only zones, and the handful of allocator routines allowed to write them run in a privileged context. An arbitrary kernel write does not reach any of it.
By sigreturn.com via olliej · sigreturn.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.