DOCSEARCHbyAlgolia
Submit Docs

ipsw

website·Indexed 30 days ago

https://blacktop.github.io/ipsw/

A comprehensive command-line research tool for downloading, parsing, and analyzing Apple IPSWs and OTAs. It provides capabilities for Mach-O binary inspection, dyld shared cache analysis, kernelcache decompression, symbolication of ARM 64-bit crash logs, and interaction with PongoOS and jailbroken devices via SSH.

Tokens
93.1K
Snippets
604
Records
845
Agent score
75%

What's inside ipsw

  1. Overview of ipsw toolkit capabilities

    ipsw is a comprehensive toolkit designed for iOS and macOS research, reverse engineering, and device management. Its core capabilities include:

    • MachO Analysis: Full read/write support with ARM v9-a disassembly.
    • Firmware Analysis: Support for dyld_shared_cache parsing/extraction, Kernelcache (KEXT extraction and symbolication), IMG4, iBoot, SEP, and co-processors.
    • Device Management: A comprehensive idev subsystem for iOS device interaction and USB device detection.
    • Firmware Acquisition: Support for multiple download sources including IPSW, OTA, Developer Portal, and RSS.
    • AI Integration: AI-powered decompilation integrated with providers such as OpenAI, Claude, Gemini, Ollama, OpenRouter, OrcaRouter, and GitHub Copilot.
    • Platform Support: Native packages for macOS, Linux, and Windows.

  2. Overview of ipsw CLI subcommands

    The ipsw tool provides a comprehensive suite of subcommands for firmware analysis and device interaction. Key capabilities include:

    • Firmware & IPSW: download (fetch firmware), info (display IPSW/OTA info), extract (extract kernelcache/DSC/DeviceTree), mount (mount DMG from IPSW), and diff (compare IPSWs/OTAs).
    • Parsing & Analysis: macho (Parse MachO), kernel (Parse kernelcache), dyld (Parse dyld_shared_cache), img4 (Parse/manipulate IMG4), plist (Dump plist as JSON), and dtree (Parse DeviceTree).
    • Device Interaction: idev (USB connected device commands), ssh (SSH into jailbroken devices), and device-info/device-list (Lookup iOS device details).
    • Reverse Engineering: class-dump (ObjC dump), swift-dump (Swift dump), and symbolicate (ARM 64-bit crash log symbolication).
    • Utilities: comp/decomp (libcompression), pbzx (decompress pbzx), and watch (monitor repositories and firmware releases).

  3. Overview of ipsw research framework

    ipsw is a comprehensive command-line research framework for iOS and macOS designed for security researchers, reverse engineers, and jailbreak developers. It provides a suite of tools to download, parse, analyze, and interact with Apple firmware and devices.

  4. Overview of ipsw AI Decompiler

    The ipsw AI decompiler converts disassembly from iOS binaries, kernelcache files, and dyld_shared_cache libraries into human-readable high-level code (C, C++, Objective-C, or Swift) using state-of-the-art language models.

  5. Print img3 image information using ipsw img3 show

    The ipsw img3 show command is used to parse and print detailed information about an img3 image. It supports standard output formatting flags and configuration overrides.
    ipsw img3 show [flags]

  6. Configure ipsw kernel mach options

    Use the following flags with ipsw kernel mach to control architecture selection and output formatting:

    • -a, --arch <string>: Specifies which architecture to use when processing a fat/universal Mach-O file.
    • -h, --help: Displays help information for the mach command.
    • --color: Enables colorized output.
    • --no-color: Disables colorized output.
    • -V, --verbose: Enables verbose output logging.
    • --config <string>: Path to a configuration file (defaults to $HOME/.config/ipsw/config.yaml).

  7. Dump MachO data at a specific virtual address using ipsw

    The ipsw macho dump command allows you to extract and dump data from a MachO binary at a specified virtual address. You can refine the dump by specifying the architecture for universal binaries, targeting specific segments or sections, and defining the size or count of items to retrieve.
    ipsw macho dump <macho> <address> [flags]

  8. Extract dyld_shared_cache with specific architecture

    When extracting the dyld_shared_cache, use the --dyld-arch flag to specify the target architecture. For certain macOS versions (e.g., 27.0 build 26A428), use the exact spelling arm64e_x1 to target the specific cache variant; using arm64e will select the generic cache instead.
    ipsw extract UniversalMac.ipsw --dyld --device j873gap --dyld-arch arm64e_x1

  9. Configure options for ipsw fw aea

    Use the following flags with ipsw fw aea to control parsing and decryption behavior:

    • -o, --output <string>: Specify the folder to extract files to.
    • -i, --info: Print information about the AEA file.
    • --id: Print the AEA file ID.
    • -k, --key: Retrieve the archive decryption key.
    • -f, --fcs-key: Get the fcs-key in JSON format.
    • -e, --encrypt: Encrypt a file using AEA.
    • -b, --key-val <string>: Provide a Base64 encoded symmetric encryption key.
    • -p, --pem <string>: Path to the private_key.pem file.
    • --pem-db <string>: Path to the AEA pem DB JSON file.
    • --insecure: Allow insecure connections.
    • --proxy <string>: Use a specific HTTP/HTTPS proxy.

  10. Configure ipsw macho a2s options

    The ipsw macho a2s command supports the following specific and inherited flags:

    Command Specific Flags:

    • -a, --arch string: Specifies which architecture to use when processing a fat/universal Mach-O binary.
    • -h, --help: Displays help information for the a2s command.

    Inherited Global Flags:

    • --color: Enable colorized output.
    • --no-color: Disable colorized output.
    • --config string: Path to a configuration file (defaults to $HOME/.config/ipsw/config.yaml).
    • -V, --verbose: Enable verbose output for debugging.

  12. ipswd API Response Schema for Device and Plist Data

    The ipswd API provides detailed technical metadata about iOS/iPadOS/tvOS firmware, structured into DeviceTrees and Plists.

    • DeviceTrees: Contains a nested mapping of device tree properties.
    • Plists: Contains comprehensive build information, including:
      • Build Identities: Detailed hardware and software mappings (ap_board_id, ap_chip_id, ap_product_type, ap_target, etc.) and manifest data (digests, memory maps, and trust status).
      • Mobile Asset Properties: Detailed installation and versioning metadata such as ArchiveDecryptionKey, OSVersion, InstallationSize, SupportedDeviceModels, and SEPDigest.
      • Product Metadata: General product information including product_name, product_version, product_build_version, and release_type.
      • Hardware Mapping: DeviceMap containing BDID, CPID, Platform, and SDOM values.
    {
  "DeviceTrees": {
    "property1": { "property1": null, "property2": null }
  },
  "Plists": {
    "DeviceClass": "string",
    "DeviceMap": [
      {
        "BDID": 0,
        "BoardConfig": "string",
        "CPID": 0,
        "Platform": "string",
        "SCEP": 0,
        "SDOM": 0
      }
    ],
    "ProductBuildVersion": "string",
    "ProductType": "string",
    "ProductVersion": "string",
    "build_identities": [
      {
        "ap_board_id": "string",
        "ap_chip_id": "string",
        "info": {
          "build_number": "string",
          "code_name": "string"
        },
        "manifest": {
          "digest": [0],
          "trusted": true
        }
      }
    ],
    "mobile_asset_properties": {
      "OSVersion": "string",
      "SupportedDeviceModels": ["string"],
      "SEPDigest": [0]
    },
    "product_name": "string",
    "product_version": "string"
  }
}