The Apple iPhone boot process begins with the BootROM, a piece of code embedded in the SoC during manufacturing. It serves as the root of trust, verifying the cryptographic signature of the next boot stage before execution. This component cannot be updated once the device leaves the factory.
Following the BootROM, the iBoot component prepares the kernel and ensures that only authorized system images are loaded. This Secure Boot mechanism confirms that the code is signed by Apple, though it does not guarantee the absence of software vulnerabilities within that code.
The Secure Enclave operates as an isolated computer within the iPhone, featuring its own memory, hardware keys, and operating environment. It manages user passcode processing, where the passcode acts as an ingredient in a cryptographic operation tied to the device's unique hardware secret.
Data accessibility on an iPhone depends on the device state, categorized as BFU (Before First Unlock) and AFU (After First Unlock). Certain data classes remain encrypted until the user provides authentication, which triggers the key hierarchy to allow file system access.
Modern iOS security relies on a capability graph rather than a simple privilege hierarchy. Even with root access, a process may lack access to hardware keys or the ability to execute unsigned code. Applications operate within containers restricted by sandboxing and entitlements.
Pointer Authentication (PAC) adds cryptographic signatures to pointers to prevent memory corruption exploits. This mechanism forces attackers to chain multiple vulnerabilities to achieve control flow, as each layer of the system enforces its own security policies independently.
