Dice Question Streamline Icon: https://streamlinehq.com

Internal SPTM metadata structures for frame types and permissions

Identify and describe the internal SPTM data structures used to track type and permission metadata for physical memory frames, and detail how these structures are updated during retype operations.

Information Square Streamline Icon: https://streamlinehq.com

Background

After retype operations, SPTM updates internal data structures to track changes, but neither their design nor behavior is documented.

Reverse engineering these structures is essential to understand SPTM’s enforcement of mapping rules and permissions.

References

There is currently no information available regarding these internal structures, and we have not yet reverse-engineered them.

— Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves (2510.09272 - Steffin et al., 10 Oct 2025) in Section SPTM Frame Retyping — In-Depth, subsubsection “Finalizing the Call”