[0x05] Reversing Shorts :: iOS Kernel Demystified

The XNU kernel is essential to iOS and macOS security. In this video, we'll take a look into Apple's open-source releases as well as free tools to analyze closed-source extensions.
Full playlist of reversing shorts: • Reversing Shorts
XNU open source: github.com/apple-opensource/xnu
IPSW downloads: ipsw.me/
img4tool: github.com/tihmstar/img4tool
Ghidra kernelcache plugin: github.com/0x36/ghidra_kernel...
iometa: github.com/Siguza/iometa/
jtool2: www.newosxbook.com/tools/jtool...
Chapters:
00:00 - Why does kernel security matter?
01:15 - XNU Open Source
02:00 - IPSW and OTA to get a kernelcache
03:48 - How to unpack a kernelcache
04:35 - Loading a kernelcache into Ghidra
05:56 - Running the kernelcache plugin with iometa
07:18 - Symbolicating a kernel panic with jtool2
08:24 - Why a kernel panic is still a long way to go to a jailbreak

[@appusage299]

cant wait for your next video, so many useful information, thanks

[@incubo4u555]

me too !

[@yomanikaz7878]

Great content! Would love to see more.

[@7Mango033]

Thank you for uploading, this is really really helpful 🙏🏻

[@Simon-vy8fe]

Wow, that's some amazing content right here. Thanks a lot for that!

[@zedeleyici.1337]

I respect you

[@Jaroshevskii]

You are amazing 🦄

[@realkoryheard]

How do you learn this?
I’ve been reading *OS internals, Wardle’s art of Mac malware, etc and I have a iOS development background. Any recommendations for where I should start?

[@eduardschreder1623]

nice video! where can we get that kernel with some symbolic information? were the symbols release accidentally?

[@jiskac]

Some of the early iOS 15 OTA kernels have symbols. The video contains the precise release number I used, but there're more. I assume releases with symbols aren't on purpose, but it happens quite regularly and you have good chances to get a recent release with symbols. For example, iOS 14 had symbols for one of the research phones, etc.