prelink_unpack.py
is an IDAPython tool to assist with unpacking the prelinked kernel used by iOS.
prelink_unpack.py
is complemented by Apple's own kextcache
for rebuilding unpacked kernels. Refer to the wiki for instructions on how to do this.
prelink_unpack.py
makes use of the plistlib
library, which is not available by default with IDAPython. It also requires modification to deal with some of the prelinked kernel intricacies, so it is included with prelink_unpack.py
.
prelink_unpack.py
also makes use of the struct
library for parsing Mach-O objects.
prelink_unpack.py
is far from a complete, bug-free state. It is reasonably usable and takes a few minutes to run. This is apparently significantly quicker than the IDC script currently used by iDroid developers.
prelink_unpack
is MIT-licensed.