Mobile › Module 6 › Lesson 1
iOS Arch Named
iOS architecture literacy — kernel, sandbox, entitlements, Keychain — read reports on $MOB_LAB, not stranger iPhone takeover cookbooks.
Visual · t27_ios_arch_named
iOS arch = named stack layers. $MOB_LAB only. Original Cyberlium.
Opening
iOS defense starts with knowing the stack — learn architecture on YOUR lab device, not by rooting a classmate's phone.
iOS architecture literacy names the stack defenders discuss: XNU kernel, userland daemons, app sandbox per process, entitlements plist capabilities, Keychain Services, Secure Enclave for keys/biometrics, code signing and AMFI enforcement. Analyst reads mobile assessment reports and MASVS mappings — understands why sandbox escape and entitlement abuse are severity drivers — without Frida-on-stranger-iPhone walkthroughs. Cyberlium on $MOB_LAB: your enrolled simulator, owned test device, or instructor DVIA/MSTG sample with written scope. Teach named layers and defender breakpoints — NOT jailbreak stranger devices, NOT bypassing activation lock, NOT extracting neighbor iCloud backups. Lab row: five named layers with one defender control each. chmod 600 under $HOME/cyberlium-lab.
1. Named stack layers
Kernel (XNU), sandbox, entitlements, Keychain, Secure Enclave — five literacy anchors for report reading.
Each layer maps to MASVS categories later in Module 7 — architecture supports checklist rows.
Command guide
Try these commands — Named stack layers
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Apple Platform Security — https://support.apple.com/guide/security/welcome/web (iOS architecture literacy) Apple developer security — https://developer.apple.com/documentation/security OWASP MASTG iOS — https://mas.owasp.org/MASTG/0x06a-Platform-Overview/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 - <<'PY'
layers = ['Secure Enclave', 'Keychain', 'Sandbox', 'Code signing', 'App Store review']
print('iOS security layers literacy:')
for i, layer in enumerate(layers, 1): print(f' {i}. {layer}')
print('Lab: read Apple Platform Security guide — no stranger device forensics')
PYCommand — copy this
curl -sS https://support.apple.com/guide/security/welcome/web | head -8
Primary tools to practice this lesson: curl, python3. Reference sites: Apple Platform Security (https://support.apple.com/guide/security/welcome/web); Apple developer security (https://developer.apple.com/documentation/security); OWASP MASTG iOS (https://mas.owasp.org/MASTG/0x06a-Platform-Overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender breakpoints
Code signing + AMFI block unsigned code; sandbox limits IPC and filesystem; entitlements gate dangerous APIs.
Mis-entitlement or shared Keychain group = common finding class on $MOB_LAB reviews.
3. $MOB_LAB boundary
Architecture notes from YOUR lab device or simulator — not classroom phones without consent.
Refused: stranger iPhone probing, iCloud credential harvesting, unauthorized MDM profile installs.
4. What you ship: iOS arch literacy card
Five named layers + one defender control each + NEVER stranger iPhone line.
5. What you record before the next lesson
iOS arch literacy card path.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Document architecture by jailbreaking a classmate's iPhone without consent.
Right
iOS arch literacy card from $MOB_LAB device. Next: App Store Sandbox.
Mission: iOS arch literacy card
1) Name five iOS stack layers. 2) One defender control per layer. 3) Map one layer to a MASVS category stub. 4) Write NEVER stranger iPhone line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Entitlements vs sandbox — which fails first in reports?”
Knowledge Check
APPLY: iOS arch literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger iPhone probing is course lab.
True or False
Knowledge Check
APPLY: Secure Enclave primarily protects:
Multiple choice