Skip to content

Siguza/iometa

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
src
 
 
sym
 
 
 
 
 
 
 
 
 
 

iometa

Extracts C++ class runtime information from an arm64 Darwin kernel.
Class names, inheritance, vtables, methods, etc.

Building

Should be simple enough:

make

Links against CoreFoundation and IOKit though, so probably only works on Darwin platforms.

Usage

Run with no arguments for exhaustive help.

Examples:

iometa kernel                                   # List all classes
iometa -a kernel                                # List all classes with more info
iometa -A kernel                                # List all classes and print all virtual methods
iometa -AC IOSurfaceRoot kernel                 # Print info and methods of class IOSurfaceRoot
iometa -Ae IOSurfaceRoot kernel                 # Print info and methods of all classes extending IOSurfaceRoot
iometa -Ap IOSurfaceRoot kernel                 # Print info and methods of all classes from which IOSurfaceRoot inherits
iometa -AB com.apple.iokit.IOSurface kernel     # Print info and methods of classes from kext com.apple.iokit.IOSurface
iometa -M kernel >map.txt                       # Create symbol map
iometa -A kernel map.txt                        # List all classes with virtual methods, and resymbolicate them
iometa -R kernel map.txt                        # Generate a radare2 script file with all symbols

For more info on symbol maps and resymbolication, see /sym.

License

MPL2 with Exhibit B.

About

arm64 IOKit class dumper

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages