AwesomeREA.org

Tool

ghidra_kernelcache

Ghidra script framework for reverse engineering Apple kernelcaches and kernel extensions on iOS and macOS. Starting from the C++ class information that Siguza's iometa extracts, it symbolicates the kernel, rebuilds IOKit class hierarchies, structures, namespaces and virtual tables with typed method definitions, and resolves virtual call references, either through arm64e pointer-authentication constants or with a p-code data-flow pass. Other scripts fix the externalMethod and getTargetAndMethodForIndex dispatch tables, apply XNU function signatures from header files, propagate types, load KDK DWARF symbols and copy structures between projects.

Targets
Binary · Firmware
Category
Firmware tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • No releases or tags. The reviewed master commit, from 2022-01-19, is the latest. The README says the framework works on iOS 12–15 kernelcaches and on macOS 11–12 kernelcaches and single KEXTs (arm64e and x86_64). It was tested on Ghidra 10.1_PUBLIC and 10.2_DEV and is not backward compatible. Support for later Ghidra releases or for kernelcaches after iOS 15 and macOS 12 is not documented.
  • Installation means adding the clone to Ghidra's Script Manager directories; the scripts then appear under iOS→kernel with toolbar buttons and key shortcuts. They are Ghidra Jython scripts with Python 2 syntax. Their toolbar icons point to a logos/ folder that the repository does not include, and the README's utils/class.py corresponds to utils/ios_kc.py in the tree.
  • Analysts supply their own kernel images: a decompressed iOS kernelcache loaded as a single Mach-O image (the README warns against batch import), or a macOS kernel and KEXTs from their own system or KDK. Symbolication first needs the output of Siguza's separate iometa tool (MPL-2.0), which describes itself as an arm64 Darwin class dumper; jtool2 symbols are optional. The README notes that Ghidra could not parse a whole macOS kernelcache at the time and suggests initial analysis in IDA followed by an XML import, a step it leaves out of scope. Symbolicating a single KEXT first needs the kernel symbolicated into a shared Ghidra project archive.
  • The repository holds only Python scripts, the C++ signature files under signatures/ and README screenshots; it commits no Apple kernelcaches, KEXTs or keys. The README calls type propagation basic and likely to fail with complex casts, and says kc.process_kernel_kext() can fail on symbols Ghidra could not demangle until DemangleAllScript is run. Apache-2.0 license. No kernelcache was loaded and no script was run.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  2. README.md#L13-L56 GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  3. README.md#L137-L190 GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  4. README.md#L229-L318 GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  5. KC.py GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  6. jsymbols.py GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  7. utils GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  8. signatures GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  9. LICENSE GitHub · 0x36/ghidra_kernelcache · Revision b0961b3
  10. README.md GitHub · Siguza/iometa · Revision 2af3602

More in Firmware and hardware

All 65 entries in Firmware and hardware