AwesomeREA.org

Tool

ktool

Pure-Python toolkit for static Mach-O and Objective-C analysis, used as the ktool command line, a terminal browser (ktool open) or a library, with no compiled dependencies. Its commands print load commands, linked libraries, symbol tables, imports and exports, Objective-C classes and protocols, Swift types, function starts and code-signing entitlements, and dump reconstructed Objective-C headers or .tbd stubs. It can also list and extract kexts from kernel caches, split and combine fat binaries, change install names and insert load commands.

Targets
App · Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest PyPI release at review: k2l 2.0.0, uploaded 2024-01-10 and also tagged on GitHub. The reviewed master head of 2026-03-07 declares version 2.1.2 in pyproject.toml, which has not been published. The README marks the terminal GUI as still in active development and lists file and img4 utilities that the reviewed command parser does not define.
  • Install with pip install k2l: the package requires Python 3.6.2 or later, depends on Pygments and adds windows-curses on Windows. The README reports running it on Windows, macOS, Linux (including ARM64), iOS through iSH, Android through Termux, WebAssembly and Brython. Unless KTOOL_NO_UPDATE_CHECK is set, each run asks PyPI for a newer k2l in a background thread.
  • Inputs are Mach-O files, fat binaries or kernel caches the user supplies; the repository commits no Mach-O binaries. tests/src holds two small Objective-C test sources, an entitlements plist and libSystem.tbd, a text-based stub of the watchOS libSystem export list of the kind found in Apple's SDKs, used to link the arm64_32 test build; tests/build.ninja compiles the test binaries locally with Xcode's clang, lipo and codesign.
  • The macOS GitHub Actions workflow builds those test binaries, runs tests/unit.py and exercises the insert, edit, lipo, dump and symbols commands; its run on the reviewed commit failed.
  • MIT (LICENSE, copyright 2021 _kritanta). EXTERNAL_LICENSES notes that the chained-fixup code is based on the author's code for Binary Ninja's Mach-O view plugin and includes an Apache-2.0 license for it. The reviewed sources mention no AI or REA use, and nothing was installed or run for this record.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · 0cyn/ktool · Revision faed829
  2. pyproject.toml GitHub · 0cyn/ktool · Revision faed829
  3. src/ktool/ktool_script.py GitHub · 0cyn/ktool · Revision faed829
  4. tests/src GitHub · 0cyn/ktool · Revision faed829
  5. tests/build.ninja GitHub · 0cyn/ktool · Revision faed829
  6. .github/workflows/tests.yml GitHub · 0cyn/ktool · Revision faed829
  7. LICENSE GitHub · 0cyn/ktool · Revision faed829
  8. EXTERNAL_LICENSES/README.md GitHub · 0cyn/ktool · Revision faed829
  9. https://github.com/0cyn/ktool/releases/tag/2.0.0
  10. https://pypi.org/project/k2l/2.0.0/
  11. https://github.com/0cyn/ktool/actions/runs/22801141527

More in Native binaries

All 158 entries in Native binaries