ipsw

Name: ipsw
Author: blacktop

153installs7forks

How to install ipsw?

blacktop/ipsw-skill/ipsw

$npx -y skills add blacktop/ipsw-skill --skill ipsw

Installs into the current project.

Summary

Use this skill when reverse-engineering Apple platforms with the ipsw CLI — analyzing iOS/macOS Mach-O binaries, disassembling functions inside dyld_shared_cache (DSC), dumping Objective-C/Swift headers from private frameworks, extracting kernelcaches, KEXTs, SEP, iBoot, or Devic

Files · 1

View on GitHub

SKILL.md

1	# IPSW - Apple Reverse Engineering Toolkit
2
3	Install: `brew install blacktop/tap/ipsw` (Linux: see https://github.com/blacktop/ipsw#install)
4
5	## Choose Your Workflow
6
7	\| Goal \| Start Here \|
8	\|------\|------------\|
9	\| Download/extract firmware \| [Firmware Acquisition](#firmware-acquisition) \|
10	\| Reverse engineer userspace \| [Userspace RE](#userspace-re-dyld_shared_cache) \|
11	\| Analyze kernel/KEXTs \| [Kernel Analysis](#kernel-analysis) \|
12	\| Research entitlements \| [Entitlements](#entitlements) \|
13	\| Dump private API headers \| [Class Dump](#class-dump) \|
14	\| Analyze standalone binary \| [Mach-O Analysis](#mach-o-analysis) \|
15	\| Diff two IPSWs/OTAs \| [Firmware Diffing](#firmware-diffing) \|
16	\| Symbolicate a crash / panic \| [Symbolication](#symbolication) \|
17	\| Parse IMG4/AEA/iBoot/SEP \| [Firmware Components](#firmware-components-img4-aea-iboot-sep) \|
18	\| Decompile / query sandbox profiles \| [Sandbox Profile Analysis](#sandbox-profile-analysis-sb) \|
19	\| Inspect / mount an IPSW \| [IPSW Inspection](#ipsw-inspection) \|
20
21	---
22
23	## Firmware Acquisition
24
25	```bash
26	# Download latest IPSW for device
27	ipsw download ipsw --device iPhone16,1 --latest
28
29	# Download with automatic kernel/DSC extraction
30	ipsw download ipsw --device iPhone16,1 --latest --kernel --dyld
31
32	# Extract components from local IPSW
33	ipsw extract --kernel iPhone16,1_18.0_Restore.ipsw
34	ipsw extract --dyld --dyld-arch arm64e iPhone16,1_18.0_Restore.ipsw
35
36	# Remote extraction (no full download)
37	ipsw extract --kernel --remote <IPSW_URL>
38	```
39
40	See [references/download.md](references/download.md) for device identifiers and advanced options.
41
42	---
43
44	## Userspace RE (dyld_shared_cache)
45
46	macOS DSC location:
47	- macOS 14+: `/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e`
48	- macOS 13 and earlier: `/System/Library/dyld/dyld_shared_cache_arm64e`
49
50	Examples below assume:
51	```bash
52	export DSC=/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e
53	```
54
55	### Essential Commands
56
57	\| Command \| Purpose \|
58	\|---------\|---------\|
59	\| `dyld a2s <DSC> <ADDR>` \| Address → symbol (triage crash LR/PC) \|
60	\| `dyld symaddr <DSC> <SYM> --image <DYLIB>` \| Symbol → address \|
61	\| `dyld disass <DSC> --vaddr <ADDR>` \| Disassemble at address \|
62	\| `dyld disass <DSC> --symbol <SYM> --image <DYLIB>` \| Disassemble by symbol \|
63	\| `dyld xref <DSC> <ADDR> --all` \| Find all references to address \|
64	\| `dyld dump <DSC> <ADDR> --size 256` \| Dump raw bytes at address \|
65	\| `dyld str <DSC> "pattern" --image <DYLIB>` \| Search strings \|
66	\| `dyld objc --class <DSC> --image <DYLIB>` \| List ObjC classes \|
67	\| `dyld extract <DSC> <DYLIB> -o ./out/` \| Extract dylib for external tools \|
68
69	### Common Workflow
70
71	```bash
72	# 1. Resolve address from crash/trace
73	ipsw dyld a2s $DSC 0x1bc39e1e0
74	# → -[SomeClass someMethod:] + 0x40
75
76	# 2. Disassemble around that address
77	ipsw dyld disass $DSC --vaddr 0x1bc39e1e0
78
79	# 3. Find who calls this function
80	ipsw dyld xref $DSC 0x1bc39e1a0 --all
81
82	# 4. Extract string/data referenced in disassembly
83	ipsw dyld dump $DSC 0x1bc39e200 --size 64
84	```
85
86	See [references/dyld.md](references/dyld.md) for complete DSC commands.
87
88	---
89
90	## Kernel Analysis
91
92	```bash
93	# List all KEXTs
94	ipsw kernel kexts kernelcache.release.iPhone16,1
95
96	# Extract specific KEXT
97	ipsw kernel extract kernelcache sandbox --output ./kexts/
98
99	# Dump syscalls
100	ipsw kernel syscall kernelcache
101
102	# Diff KEXTs between versions
103	ipsw kernel kexts --diff kernelcache_17.0 kernelcache_18.0
104	```
105
106	See [references/kernel.md](references/kernel.md) for KEXT extraction and kernel analysis.
107
108	---
109
110	## Entitlements
111
112	```bash
113	# Single binary entitlements
114	ipsw macho info --ent /path/to/binary
115
116	# Build searchable database from IPSW
117	ipsw ent --sqlite ent.db --ipsw iOS18.ipsw
118
119	# Query database
120	ipsw ent --sqlite ent.db --key "com.apple.private.security.no-sandbox"
121	ipsw ent --sqlite ent.db --key "platform-application"
122	ipsw ent --sqlite ent.db --key "com.apple.private.tcc.manager"
123	```
124
125	See [references/entitlements.md](references/entitlements.md) for common entitlements and query patterns.
126
127	---
128
129	## Class Dump
130
131	Dump Objective-C headers from binaries or dyld_shared_cache:
132
133	```bash
134	# Dump all headers from framework in DSC
135	ipsw class-dump $DSC SpringBoardServices --headers -o ./headers/
136
137	# Dump speci

People who liked this also viewed

6 picks

Type

ipsw

153installs7forks

View on GitHub

How to install ipsw?

blacktop/ipsw-skill/ipsw

$npx -y skills add blacktop/ipsw-skill --skill ipsw

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# IPSW - Apple Reverse Engineering Toolkit
2
3	Install: `brew install blacktop/tap/ipsw` (Linux: see https://github.com/blacktop/ipsw#install)
4
5	## Choose Your Workflow
6
7	\| Goal \| Start Here \|
8	\|------\|------------\|
9	\| Download/extract firmware \| [Firmware Acquisition](#firmware-acquisition) \|
10	\| Reverse engineer userspace \| [Userspace RE](#userspace-re-dyld_shared_cache) \|
11	\| Analyze kernel/KEXTs \| [Kernel Analysis](#kernel-analysis) \|
12	\| Research entitlements \| [Entitlements](#entitlements) \|
13	\| Dump private API headers \| [Class Dump](#class-dump) \|
14	\| Analyze standalone binary \| [Mach-O Analysis](#mach-o-analysis) \|
15	\| Diff two IPSWs/OTAs \| [Firmware Diffing](#firmware-diffing) \|
16	\| Symbolicate a crash / panic \| [Symbolication](#symbolication) \|
17	\| Parse IMG4/AEA/iBoot/SEP \| [Firmware Components](#firmware-components-img4-aea-iboot-sep) \|
18	\| Decompile / query sandbox profiles \| [Sandbox Profile Analysis](#sandbox-profile-analysis-sb) \|
19	\| Inspect / mount an IPSW \| [IPSW Inspection](#ipsw-inspection) \|
20
21	---
22
23	## Firmware Acquisition
24
25	```bash
26	# Download latest IPSW for device
27	ipsw download ipsw --device iPhone16,1 --latest
28
29	# Download with automatic kernel/DSC extraction
30	ipsw download ipsw --device iPhone16,1 --latest --kernel --dyld
31
32	# Extract components from local IPSW
33	ipsw extract --kernel iPhone16,1_18.0_Restore.ipsw
34	ipsw extract --dyld --dyld-arch arm64e iPhone16,1_18.0_Restore.ipsw
35
36	# Remote extraction (no full download)
37	ipsw extract --kernel --remote <IPSW_URL>
38	```
39
40	See [references/download.md](references/download.md) for device identifiers and advanced options.
41
42	---
43
44	## Userspace RE (dyld_shared_cache)
45
46	macOS DSC location:
47	- macOS 14+: `/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e`
48	- macOS 13 and earlier: `/System/Library/dyld/dyld_shared_cache_arm64e`
49
50	Examples below assume:
51	```bash
52	export DSC=/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e
53	```
54
55	### Essential Commands
56
57	\| Command \| Purpose \|
58	\|---------\|---------\|
59	\| `dyld a2s <DSC> <ADDR>` \| Address → symbol (triage crash LR/PC) \|
60	\| `dyld symaddr <DSC> <SYM> --image <DYLIB>` \| Symbol → address \|
61	\| `dyld disass <DSC> --vaddr <ADDR>` \| Disassemble at address \|
62	\| `dyld disass <DSC> --symbol <SYM> --image <DYLIB>` \| Disassemble by symbol \|
63	\| `dyld xref <DSC> <ADDR> --all` \| Find all references to address \|
64	\| `dyld dump <DSC> <ADDR> --size 256` \| Dump raw bytes at address \|
65	\| `dyld str <DSC> "pattern" --image <DYLIB>` \| Search strings \|
66	\| `dyld objc --class <DSC> --image <DYLIB>` \| List ObjC classes \|
67	\| `dyld extract <DSC> <DYLIB> -o ./out/` \| Extract dylib for external tools \|
68
69	### Common Workflow
70
71	```bash
72	# 1. Resolve address from crash/trace
73	ipsw dyld a2s $DSC 0x1bc39e1e0
74	# → -[SomeClass someMethod:] + 0x40
75
76	# 2. Disassemble around that address
77	ipsw dyld disass $DSC --vaddr 0x1bc39e1e0
78
79	# 3. Find who calls this function
80	ipsw dyld xref $DSC 0x1bc39e1a0 --all
81
82	# 4. Extract string/data referenced in disassembly
83	ipsw dyld dump $DSC 0x1bc39e200 --size 64
84	```
85
86	See [references/dyld.md](references/dyld.md) for complete DSC commands.
87
88	---
89
90	## Kernel Analysis
91
92	```bash
93	# List all KEXTs
94	ipsw kernel kexts kernelcache.release.iPhone16,1
95
96	# Extract specific KEXT
97	ipsw kernel extract kernelcache sandbox --output ./kexts/
98
99	# Dump syscalls
100	ipsw kernel syscall kernelcache
101
102	# Diff KEXTs between versions
103	ipsw kernel kexts --diff kernelcache_17.0 kernelcache_18.0
104	```
105
106	See [references/kernel.md](references/kernel.md) for KEXT extraction and kernel analysis.
107
108	---
109
110	## Entitlements
111
112	```bash
113	# Single binary entitlements
114	ipsw macho info --ent /path/to/binary
115
116	# Build searchable database from IPSW
117	ipsw ent --sqlite ent.db --ipsw iOS18.ipsw
118
119	# Query database
120	ipsw ent --sqlite ent.db --key "com.apple.private.security.no-sandbox"
121	ipsw ent --sqlite ent.db --key "platform-application"
122	ipsw ent --sqlite ent.db --key "com.apple.private.tcc.manager"
123	```
124
125	See [references/entitlements.md](references/entitlements.md) for common entitlements and query patterns.
126
127	---
128
129	## Class Dump
130
131	Dump Objective-C headers from binaries or dyld_shared_cache:
132
133	```bash
134	# Dump all headers from framework in DSC
135	ipsw class-dump $DSC SpringBoardServices --headers -o ./headers/
136
137	# Dump speci

People who liked this also viewed

6 picks

Type