Failed to parse iOS 15.0.1 kernelcache about ipsw

[KpwnZ]

Can confirm kexts command is working now!

$ ipsw kernel kexts 19A348/kernelcache.release.ipad6f
FOUND: 222
0xfffffff00535c000: com.apple.kpi.bsd (21.0.0)
0xfffffff00535c080: com.apple.kpi.libkern (21.0.0)
0xfffffff00535c100: com.apple.kpi.mach (21.0.0)
.........

[KpwnZ]

Ok got it. I was able to recreate the issue.

Very strange it works for iPhone12,1 but not the iPad6,11 ??

I usually test the iPhone and the iPod, but not the iPad. Thank you for letting me know about this!

Thanks for your great work!

[blacktop]

So that looks like you pulled the im4p file directly out of the ipsw. You could have extracted with:

$ ipsw extract -k IPSW.ipsw

However, what you could do with the file you have is:

$ ipsw img4 extract kernelcache.release.ipad6f

Which is extract and lzfse decompress the im4p payload aka the kernelcache

[KpwnZ]

ipsw img4 extract

Got the same error when using img4 extract command

$ ipsw img4 extract kernelcache.release.ipad6f
   • Parsing Im4p             
Error: unabled to parse Im4p: failed to ASN.1 parse Im4p: asn1: structure error: length too large

[blacktop]

Just to confirm can you run:

$ file kernelcache.release.ipad6f

[KpwnZ]

Oh it seems that it has already been decompressed after using ipsw download kernel.

$ file kernelcache.release.ipad6f
kernelcache.release.ipad6f: Mach-O 64-bit executable arm64

But when I try to run command like kexts or sbopts it shows

$ ipsw kernel sbopts kernelcache.release.ipad6f
Error: failed to read parseSymtab: invalid name in symbol table '2863311530' in record at byte 0x1038

[blacktop]

Can you please tell me what device that is for? I can't remember what ipad6f is off the top of my head.

[KpwnZ]

It's iPad6,11. I also tried to parse kernelcache of others devices and the same error occurred. And it works well when parsing iOS 13 or 14 kernel.

$ ipsw download kernel --build 19A348 
.........
      • Writing 19A348/kernelcache.release.ipad6d
      • Writing 19A348/kernelcache.release.ipad6d
      • Writing 19A348/kernelcache.release.ipad6f
.........

[blacktop]

Ok got it. I was able to recreate the issue.

Very strange it works for iPhone12,1 but not the iPad6,11 ??

I usually test the iPhone and the iPod, but not the iPad. Thank you for letting me know about this!

[blacktop]

So I am releasing a fix now for the ipsw kernel kexts cmd that I believe should cover the cases iPhone/iPod and iPad kernels.

For sbopts it looks like for the phones that info is in the kernel's __DATA_CONST.__const BUT in the iPad it's in the com.apple.security.sandbox kext's __DATA_CONST.__const ?? I need to think a lil' harder on a way to detect which/where I should look and will let you know when I get it merged in.

[blacktop]

So I am releasing a fix now for the ipsw kernel kexts cmd that I believe should cover the cases iPhone/iPod and iPad kernels.

For sbopts it looks like for the phones that info is in the kernel's __DATA_CONST.__const BUT in the iPad it's in the com.apple.security.sandbox kext's __DATA_CONST.__const ?? I need to think a lil' harder on a way to detect which/where I should look and will let you know when I get it merged in.

I fixed this a while back I guess, because I just tested it and it works now 🤷‍♀️