Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
This branch is 91 commits ahead of saelo:master.

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

iOS Kernel Utilities

Beware, chances are the device will panic and reboot.


Just want the binaries?
Head over to Releases. :)


  • Jailbroken Device
  • tfp0 kernel patch (see below)
  • If you don't have XCode:
    • GNU make
    • C compiler for iOS
    • Code signing utility

tfp0 compatibility

A kernel patch is required for these tools to work, since access to kernel memory is natively unavailable for obvious reasons.
That patch is normally referred to as task-for-pid-zero (short tfp0), and is included in almost every public jailbreak.

The latest release of these tools is confirmed to work with:

  • p0sixspwn on 6.1.x
  • Pangu on 7.1.x
  • TaiG on 8.4
  • Pangu9 on 9.1
  • qwertyoruiop's jailbreakme on 9.3.x
  • extra_recipe on 10.0-10.2
  • Yalu102 (beta4 or later) on 10.0.1-10.2

Jailbreaks that DO NOT seem to enable tfp0, and thus DO NOT work with kern-utils:

  • Pangu9 on 9.0.x (but can be enabled with cl0ver)
  • Pangu9 on 9.2-9.3.3 (but see qwertyoruiop's jailbreakme)
  • YaluX on 10.0.1-10.1.1

If you have information about how the kernel task port can be obtained in these versions, please open a ticket and tell me.


Name Function
kdump Dump a running iOS kernel to a file
kinfo Display various kernel information
kmap Visualize the kernel address space
kmem Dump kernel memory to the console
kpatch Apply patches to a running kernel
nvpatch Display and patch NVRAM variables permissions


git clone
cd ios-kern-utils
make        # build just the binaries
make deb    # build a deb file for Cydia
make xz     # package binaries to a .tar.xz
make dist   # deb && xz

For make you may also specify the following environment variables:

Name Function Default value
OS X iOS Linux
IGCC iOS compiler xcrun -sdk iphoneos gcc clang ios-clang
IGCC_ARCH Target architecture(s) -arch armv7 -arch arm64
IGCC_FLAGS Custom compiler flags none
LIBTOOL Archive manipulation utility xcrun -sdk iphoneos libtool libtool ios-libtool
STRIP Symbol remover utility xcrun -sdk iphoneos strip strip ios-strip
SIGN Code signing utility codesign ldid
SIGN_FLAGS Code signing flags -s - --entitlements misc/ent.xml -Smisc/ent.xml


As of late, kern-utils can also be compiled for and used on macOS.
Compile with:

IGCC=gcc IGCC_ARCH='-arch x86_64' SIGN=true STRIP=strip LIBTOOL=libtool make clean all

The SIGN=true is a dirty hack to skip signing, which is necessary because Sierra and later will not allow self-signed binaries with restricted entitlements to run. However, entitlements aren't needed on macOS since the kernel task port is obtained via a different API very much thanks to Jonathan Levin.

In order to use kern-utils, SIP needs to be at least partially disabled. If you don't want to disable it completely, you can use:

csrutil enable --without debug



Original project by Samuel Groß.
nvpatch is largely based on nvram_patcher by Pupyshev Nikita.
Maintained and updated for iOS 8 and later by Siguza.


  • Test on Linux
  • Keep up with the original repo


iOS Kernel utilities







No packages published


  • C 92.7%
  • Makefile 7.3%