Two Different Perspectives On An OS X Kernel Feature

Thomas Ptacek | July 16th, 2007 | Filed Under: Apple, Uncategorized

1 INT. MATASANO OFFICE - EVENING

Just days before Black Hat. THOMAS PTACEK sits, polishing up Blue Pill detection code. Across the room, DAVID GOLDSMITH, resplendent in purple smoking jacket.

THOMAS PTACEK

I love Apple's IOKit.

DAVID GOLDSMITH

Why?

THOMAS PTACEK

Because you can take a physical address, like the high-performance event timers on the LPC bus, and wire them into a userland process. The process can say, "put the HPET at 0x22220000". And it's like, one line of code!

DAVID GOLDSMITH

Yeah, this is what scares the shit out of me about IOKit.