SECURITY Signal 408
Talk demonstrates how to pack malware inside Rosetta 2 translation caches on Apple Silicon
↗
Illustration only Photo by Tyler on Unsplash
A security talk explains how to abuse Rosetta 2's ahead-of-time and just-in-time translation mechanisms to pack malware and game cheats on Apple Silicon.
This technique leverages the translation layer's memory layout and dynamic linker behavior to hide malicious code from standard debugging tools. Rosetta 2 is scheduled to be phased out in the next major macOS update, which will eventually eliminate this specific attack surface.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Rosetta 2 uses a combination of ahead-of-time caching and just-in-time compilation to run x86_64 binaries on AARCH64.
Attackers can use dynamic linker characteristics and function pointer swizzling to pack arbitrary code into the translation layer.
The translation layer will be removed in the next major macOS update, replacing it with the Game Porting ToolKit and VZVirtualMachine.
THE CLUSTER