Dump Kext information from 32bit iOS kernel cache. Applicable to the kernel which dump from memory
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
src
test
.travis.yml
LICENSE
Makefile
README.md

README.md

ioskextdump_32

Dump Kext information from 32bit iOS kernel cache. Applicable to the kernel which dump from memory. The disassembly framework used is Capstone

Contact build license paypal

64bit version of iOS:

64bit(aarch64): ioskextdump

64bit version of iOS10:

64bit(arm): ioskextdump_ios10

Dump Kext info For Mac:

64bit(x86_64): mackextdump

This is the arm 32bit version of ioskextdump

For kernel which dump from memory

Use iosdumpkernelfix to correct the Mach-O header before analyze it, Otherwise The analysis results are not complete list of Kexts

How to use

Download

git clone https://github.com/cocoahuke/ioskextdump_32.git && cd ioskextdump_32

Compile and install to /usr/local/bin/

make
make install

Usage

Usage: ioskextdump_32 [-e] [-p <access directory path>] <kernelcache>

-e Specify the export mode
-p Specifiy a folder path that contains the data file or export data file to there


Example to use I left a sample iOS9.2 kernelcache in the test directory, try to run this command

ioskextdump_32 -e -p test test/iPhone5_9.2_kernel.arm

You will see all Inheritance relationship is empty and allClass_relation.plist saved success should be at end of program print

Inheritance relationship:

Then try same command removes -e

ioskextdump_32 -p test test/iPhone5_9.2_kernel.arm

ioskextdump_32 will print contain lists of inheritance and override functions:

15.0x80772000 - 0x80799000 com.apple.iokit.IOHIDFamily

total 20 modInit in com.apple.iokit.IOHIDFamily

******** 0:com.apple.iokit.IOHIDFamily *******
(0x80774464)->OSMetaClass:OSMetaClass call 4 args list
r0:0x8078f144
r1:IOHIDLibUserClient
r2:0x80412904
r3:0xc0
vtable start from addr 0x8078a2ec
Inheritance relationship:

0 func:0x80772b51  scalar_i:0x0  struct_i:0x0  scalar_o:0x2  struct_o:0x0
1 func:0x80772b71  scalar_i:0x1  struct_i:0x0  scalar_o:0x0  struct_o:0x0
2 func:0x80772b79  scalar_i:0x0  struct_i:0x0  scalar_o:0x0  struct_o:0x0
...

Cannot detect override methods in this program, I was added in [ioskextdump](https://github.com/cocoahuke/ioskextdump program, 32bit device get outdatedness more and more :), anyway 32bit devices are get older and outdatedness :)

Any question just Email me