PASTDOOR: After BlastDoor: State Transformation Across Trusted System Services

PASTDOOR examines post-exploitation state transformation beyond Apple’s BlastDoor message-parsing boundary. Rather than treating parser containment as the end of the exploit surface, the paper traces how accepted semantic state can continue into trusted system services that serialize, reconstruct, synchronize, allocate, render, transmit, and otherwise act upon it. The analysis follows downstream mechanisms spanning protobuf and XPC materialization, identity and device-state handling, pairing and synchronization, ImageIOXPC, IOSurface, Metal and Metal Performance Shaders, networking telemetry, and accessory-update services. Recovered implementation diagnostics identify concrete validation and failure surfaces involving serialization consistency, XPC interface reconstruction, cryptographic identity state, graphics-resource allocation and lifetime, texture and region constraints, and accessory protocol state. Runtime artifacts provide corresponding observations across downstream platform domains.PASTDOOR models these transitions in terms of reachability, transformation, and authority, distinguishing semantic-state continuity from representation identity. It further examines local retention, authoritative reconstruction, and hybrid reconstruction across lifecycle boundaries. The resulting analysis demonstrates that BlastDoor can constrain parsing authority without containing the lifetime of accepted semantic state: downstream trusted consumers may reconstruct that state under new representations, invariants, and authority. The work is intended for exploit-development, systems-security, digital-forensics, and runtime-systems research.