Since iOS 15 Apple has added the read only allocator to XNU to allocate kernel data structures that are read only in kernel land at runtime and can only be written to via PPL. Day 23 of the macOS and iOS Security Internals Advent Calendar covers this. https://youtu.be/4uXodpSmiac
macOS and iOS Security Internals Advent Calendar - Day 23
This year Antid0te is organising an advent calendar around the topic of macOS and iOS Security Internals. Throughout the Christmas time we will be surprising...