Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves
2025/10/10 by Moritz Steffin, Jiska Classen, Steffin, Moritz +1 · 23 voices
Computer Science · #Advanced Data Storage Technologies #Advanced Malware Detection Techniques #Security and Verification in Computing #cs.CR
paper · pdf · doi:10.48550/arxiv.2510.09272
openalex publication_date 2025/10/10 · openalex created_date 2025/10/14 · openalex updated_date 2026/07/28
Abstract
The XNU kernel is the basis of Apple's operating systems. Although labeled as a hybrid kernel, it is found to generally operate in a monolithic manner by defining a single privileged trust zone in which all system functionality resides. This has security implications, as a kernel compromise has immediate and significant effects on the entire system. Over the past few years, Apple has taken steps towards a more compartmentalized kernel architecture and a more microkernel-like design. To date, there has been no scientific discussion of SPTM and related security mechanisms. Therefore, the understanding of the system and the underlying security mechanisms is minimal. In this paper, we provide a comprehensive analysis of new security mechanisms and their interplay, and create the first conclusive writeup considering all current mitigations. SPTM acts as the sole authority regarding memory retyping. Our analysis reveals that, through SPTM domains based on frame retyping and memory mapping rule sets, SPTM introduces domains of trust into the system, effectively gapping different functionalities from one another. Gapped functionality includes the TXM, responsible for code signing and entitlement verification. We further demonstrate how this introduction lays the groundwork for the most recent security feature of Exclaves, and conduct an in-depth analysis of its communication mechanisms. We discover multifold ways of communication, most notably xnuproxy as a secure world request handler, and the Tightbeam IPC framework. The architecture changes are found to increase system security, with key and sensitive components being moved out of XNU's direct reach. This also provides additional security guarantees in the event of a kernel compromise, which is no longer an immediate threat at the highest trust level.
Discussions
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves [hn, 237 points, 32 comments]
- Want to know more details on Apple's SPTM, TXM, and Exclaves? Read more on this in the paper based on Moritz Steffin's thesis. Lots of low-level details including their security implications are cover [bsky, 11 points, 0 comments]
- Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves [lobsters, 5 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves arxiv.org/pdf/2510.09272 [bsky, 1 points, 0 comments]
- arxiv.org/pdf/2510.09272 Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves Moritz Steffin and Jiska Classen (oct 2025) 73 [bsky, 1 points, 1 comments]
- Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves [lemmy, 1 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves https://arxiv.org/abs/2510.09272 [bsky, 0 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves View Article | Join the HN Conversation Summary of HN discussion 🧵👇 #hacker-news [bsky, 0 points, 1 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves https://arxiv.org/abs/2510.09272 [comments] [36 points] [bsky, 0 points, 0 comments]
- Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves https://lobste.rs/s/wn5mcf #pdf #ios #hardware #reversing [bsky, 0 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves https://arxiv.org/abs/2510.09272 (https://news.ycombinator.com/item?id=45571688) [bsky, 0 points, 0 comments]
- https://bsky.app/profile/news.ycombinator.com.web.brid.gy/post/3m34g3tvpfww2 [bsky, 0 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves https://arxiv.org/abs/2510.09272 (http://news.ycombinator.com/item?id=45571688) [bsky, 0 points, 0 comments]
- Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves https://arxiv.org/abs/2510.09272 [bsky, 0 points, 0 comments]
- [2510.09272] Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves [bsky, 0 points, 0 comments]
- https://arxiv.org/abs/2510.09272 この論文では、iOSのセキュリティ機能（SPTM、TXM、Exclaves）について詳細な分析を提供しています。 これらの機能は、カーネルのセキュリティを強化し、システム全体の安全性を向上させるためのものです。 特に、メモリの再構成やコード署名、エンタイトルメント検証における役割を明らかにしています。 [bsky, 0 points, 0 comments]
- Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves arxiv.org/abs/2510.09272 [bsky, 0 points, 0 comments]
- ⚡ Hackernews Top story: Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves [bsky, 0 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves https://arxiv.org/abs/2510.09272 (https://news.ycombinator.com/item?id=45571688) [bsky, 0 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves arxiv.org -> #fromTwitter Original-> [bsky, 0 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves [bsky, 0 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves #HackerNews https://arxiv.org/abs/2510.09272 [bsky, 0 points, 0 comments]
- Modern iOS Security Features – A Deep Dive into SPTM, TXM, and Exclaves https://arxiv.org/abs/2510.09272 https://news.ycombinator.com/item?id=45571688 [bsky, 0 points, 0 comments]
Related