tool for statically reconstructing the IOKit classes hierarchy from iOS kernelcache dumps
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
include
lib
libdump
parser
.gitattributes
Makefile
README.md
main.c

README.md

iokit-dumper-arm64 + libdump

iokit-dumper-arm64 is the static iOS AArch64 version for iokit-dumper.
It uses a dumped 64-bit kernelcache to rebuild the IOKit classes hierarchy for a specific image in the kernelcache, and generate a DOT graph for it. You can see some example generated graphs below, in the Examples section.

How to use

Firstly, to generate DOT graphs you will need dot installed. Do:

brew install graphviz

And test with:

dot -v

Now, the arguments accepted by iokit-dumper-arm64:

  • -f: It specifies the kernelcache path to work with.
  • -o: It specifies the output path. The output file name is auto-generated. If not specified, default path used will be /tmp.
  • -n: it specifies the image to dump name. If not specified, all images will be dumped. Pass the string kernel to dump the kernel hierarchy. Pass a KEXT bundle name (Ex. com.apple.iokit.IOHIDFamily) to dump that KEXT hierarchy.
  • -c: Auto convert. If specified, it automatically runs a dot command at the end of the dumping process to generate a PDF file containing the graph.

Example usage to dump kernel hierarchy to Desktop:

./iokit-dumper-arm64 -f /path/to/kernelcache.dump -n kernel -o /Users/$USER/Desktop/ -c

libdump

libdump is a kind-of AArch64 emulator. It is quite sloppy and relies on capstone. It has been written specifically for this project, but it could become a totally separated project in the future.

Notes

I have added some basic support for unencrypted kernelcaches, but it has not been tested on enough cases to say it's perfect. Also the code needs a major refactor and cleanup, so keep in mind that stuff may happen.

If you feel like contrinuting, do not hesitate doing so! Just submit a pull request. I would really appreciate some help.

Future updates are planned, and improvements are coming.

Thanks

Examples

Here are some generated graphs as an example:

IOAudio2Family

com.apple.iokit.IOAudio2Family

IOHIDFamily

com.apple.iokit.IOHIDFamily

IOAcceleratorFamily2

com.apple.iokit.IOAcceleratorFamily2

TODO

A list of to-do for updates.

  • Code cleanup
  • Fix KEXT identification algorithm (it is buggy in some cases)
  • Unencrypted kernelcaches support
  • Add graph customization and details