https://arxiv.org/abs/2510.09272

Skip to main content
Cornell University
We gratefully acknowledge support from the Simons Foundation, member
institutions, and all contributors. Donate
 
arxiv logo > cs > arXiv:2510.09272
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv logo
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Cryptography and Security

arXiv:2510.09272 (cs)
[Submitted on 10 Oct 2025]

Title:Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and
Exclaves

Authors:Moritz Steffin, Jiska Classen
View a PDF of the paper titled Modern iOS Security Features -- A Deep
Dive into SPTM, TXM, and Exclaves, by Moritz Steffin and 1 other
authors
View PDF

    Abstract:The XNU kernel is the basis of Apple's operating
    systems. Although labeled as a hybrid kernel, it is found to
    generally operate in a monolithic manner by defining a single
    privileged trust zone in which all system functionality resides.
    This has security implications, as a kernel compromise has
    immediate and significant effects on the entire system. Over the
    past few years, Apple has taken steps towards a more
    compartmentalized kernel architecture and a more microkernel-like
    design. To date, there has been no scientific discussion of SPTM
    and related security mechanisms. Therefore, the understanding of
    the system and the underlying security mechanisms is minimal. In
    this paper, we provide a comprehensive analysis of new security
    mechanisms and their interplay, and create the first conclusive
    writeup considering all current mitigations. SPTM acts as the
    sole authority regarding memory retyping. Our analysis reveals
    that, through SPTM domains based on frame retyping and memory
    mapping rule sets, SPTM introduces domains of trust into the
    system, effectively gapping different functionalities from one
    another. Gapped functionality includes the TXM, responsible for
    code signing and entitlement verification. We further demonstrate
    how this introduction lays the groundwork for the most recent
    security feature of Exclaves, and conduct an in-depth analysis of
    its communication mechanisms. We discover multifold ways of
    communication, most notably xnuproxy as a secure world request
    handler, and the Tightbeam IPC framework. The architecture
    changes are found to increase system security, with key and
    sensitive components being moved out of XNU's direct reach. This
    also provides additional security guarantees in the event of a
    kernel compromise, which is no longer an immediate threat at the
    highest trust level.

Subjects: Cryptography and Security (cs.CR)
Cite as:  arXiv:2510.09272 [cs.CR]
          (or arXiv:2510.09272v1 [cs.CR] for this version)
          https://doi.org/10.48550/arXiv.2510.09272
          Focus to learn more
          arXiv-issued DOI via DataCite (pending registration)

Submission history

From: Jiska Classen [view email]
[v1] Fri, 10 Oct 2025 11:14:27 UTC (1,928 KB)
Full-text links:

Access Paper:

    View a PDF of the paper titled Modern iOS Security Features -- A
    Deep Dive into SPTM, TXM, and Exclaves, by Moritz Steffin and 1
    other authors
  * View PDF
  * TeX Source

license icon view license
Current browse context:
cs.CR
< prev   |   next >
new | recent | 2025-10
Change to browse by:
cs

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

export BibTeX citation Loading...

BibTeX formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Reddit logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
[ ] scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
( ) Code, Data, Media

Code, Data and Media Associated with this Article

[ ] alphaXiv Toggle
alphaXiv (What is alphaXiv?)
[ ] Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
[ ] DagsHub Toggle
DagsHub (What is DagsHub?)
[ ] GotitPub Toggle
Gotit.pub (What is GotitPub?)
[ ] Huggingface Toggle
Hugging Face (What is Huggingface?)
[ ] Links to Code Toggle
Papers with Code (What is Papers with Code?)
[ ] ScienceCast Toggle
ScienceCast (What is ScienceCast?)
( ) Demos

Demos

[ ] Replicate Toggle
Replicate (What is Replicate?)
[ ] Spaces Toggle
Hugging Face Spaces (What is Spaces?)
[ ] Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
( ) Related Papers

Recommenders and Search Tools

[ ] Link to Influence Flower
Influence Flower (What are Influence Flowers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)

  * Author
  * Venue
  * Institution
  * Topic

( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status
    Get status notifications via email or slack