# Ghidra Kernelcache | A Ghidra Framework For iOS Kernelcache Reverse Engineering

**URL:** <https://onehack.st/t/ghidra-kernelcache-a-ghidra-framework-for-ios-kernelcache-reverse-engineering/175229>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, technology\
**Created:** [March 13, 2021, 1:14pm UTC](https://onehack.st/t/ghidra-kernelcache-a-ghidra-framework-for-ios-kernelcache-reverse-engineering/175229 "2021-03-13T13:14:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [March 13, 2021, 1:14pm UTC](https://onehack.st/t/ghidra-kernelcache-a-ghidra-framework-for-ios-kernelcache-reverse-engineering/175229/1 "2021-03-13T13:14:33Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/e/9/e9f8c971aa477da55102818e1fd42c410a997e09.png)

This framework is the end product of my experience in reverse engineering iOS kernelcache,I do manually look for vulnerabilities in the kernel and have automated most of the things I really wanted to see in Ghidra to speed up the process of reversing, and this proven to be effective and saves a lot of time. The framework works on iOS 12/13/14 and has been made to the public with the intention to help people to start VR in iOS kernel without the struggle of preparing their own environment, as I believe, this framework ( including the toolset it provides and with some basic knowledge in IOKit) is sufficient to start dealing with the Kernelcache.

The whole framework is written in Python,and can be extended to build tools upon, it provides some basic APIs which you can use in almost any project and save time from reading the verbose manual, you can just read the code in **[utils/](https://github.com/0x36/ghidra_kernelcache/tree/master/utils)** directory.

Ghidra is good when it comes to analyzing the kernelcache, but like other RE tools, it needs some manual work, **ghidra\_kernelcache** provides a good entry point to fix things at the start and even while doing reverse engineering thus providing a good-looking decompiler output.

There is a similar project done by [@\_bazad](https://twitter.com/_bazad) in IDAPro called [ida\_kernelcache](https://github.com/bazad/ida_kernelcache) which provides a good entry point for researchers wanting to work with the kernel image in IDA, my framework looks a bit similar to Brandon’s work, and goes beyond by providing much more features to make the process of working with the kernelcache a lot easier.

Here are some of the features provided by the framework :

- iOS kernelcache symbolication.
- Resolving virtual call references.
- Auto fixing external method array for both `::externalMethod()` and `::getTargetAndMethodForIndex()`.
- Applying namespaces to class methods.
- Symbol name and type propagation over function arguments.
- Applying function signatures for known kernel functions.
- Import old structures and classes from old project to a new project.
- Auto type-casting `safeMetacast()` return value to the appropriate class object type.

These features are made as a separated tools which can be executed either by key shortcuts or by clicking on their icons in the toolbar.

**Installation**

Clone the repository :

```auto
git clone https://github.com/0x36/ghidra_kernelcache.git $APATH

```

Go to _`Windows → Script Manager`,_ click on _`script Directory` ,_ then add _`$APATH/ghidra_kernelcache`_ to the directory path list.

Go to _`Windows → Script Manager`,_ in _scripts_ listing, go to _`iOS→kernel`_ category and check the plugins seen there, they will appear in GHIDRA Toolbar .

in [logos/](https://github.com/0x36/ghidra_kernelcache/tree/master/logos) directory, you can put you own logos for each tool.

**iOS kernelcache symbolication**

**ghidra\_kernelcache** requires at the first stage [iometa](https://github.com/Siguza/iometa/) (made by [@s1guza](https://twitter.com/s1guza)), a powerful tool providing C++ class information in the kernel binary, the great thing is that it works as a standalone binary, so the output can be imported to your favorite RE framework by just parsing it. My framework takes iometa’s output and parses it to symbolicate and fix virtual tables.

**Usage**

After decompressing the kernel, run the following command :

```auto
$ iometa -n -A /tmp/kernel A10-legacy.txt > /tmp/kernel.txt# if you want also to symbolicate using jtool2$ jtool2 --analyze /tmp/kernel

```

Load the kernelcache in Ghidra, _ **DO NOT USE BATCH import** _ , load it as Mach-O image. After the Kernelcache being loaded and auto-analyzed, click on the icon shown in the toolbar or just press **Meta-Shift-K** , then put the full path of iometa output which is `/tmp/kernel.txt` in our case.

if you want to use jtool2 symbols, you can run `jsymbol.py` located `iOS→kernel` category as well.

**Using APIs**

Full API examples are in [`ghidra_kernelcache/kc.py`](https://github.com/0x36/ghidra_kernelcache/blob/master/KC.py)

→ Here are some examples of manipulating class objects :

Continue following:

## GitHub:

> **[GitHub - 0x36/ghidra\_kernelcache: a Ghidra framework for iOS kernelcache reverse...](https://github.com/0x36/ghidra_kernelcache)**
>
> a Ghidra framework for iOS kernelcache reverse engineering