Difference between revisions of "Kernelcache"

From The iPhone Wiki
Jump to: navigation, search
(dump of kernel cache)
Line 3: Line 3:
 
[[Category:Filesystem]]
 
[[Category:Filesystem]]
   
The joker tool, from http://newosxbook.com/ can be used to dump information from a decrypted kernelcache - including system call and Mach trap addresses (in the kernel) as well as a list of all the KEXTs contained therein and their load addresses. The output from a 6.1.3b2 kernelcache (iPod 4,1) is as follows:
+
The joker tool, from http://newosxbook.com/ can be used to dump information from a decrypted kernelcache - including system call and Mach trap addresses (in the kernel) as well as a list of all the KEXTs contained therein and their load addresses. The output from a 6.1.3 kernelcache (iPod 4,1) is as follows:
   
 
<pre>
 
<pre>

Revision as of 00:08, 9 April 2013

The kernelcache is basically the kernel itself as well as all of its extensions (AppleImage3NORAccess, IOAESAccelerator, IOPKEAccelerator, etc.) into one file, then packed/encrypted in an IMG3 (iOS 2.0 and above) or 8900 (iOS 1.0 through 1.1.4) container.

The joker tool, from http://newosxbook.com/ can be used to dump information from a decrypted kernelcache - including system call and Mach trap addresses (in the kernel) as well as a list of all the KEXTs contained therein and their load addresses. The output from a 6.1.3 kernelcache (iPod 4,1) is as follows:

Kext: MAC Framework Pseudoextension @0x8039600(com.apple.kpi.dsep)
Kext: Private Pseudoextension @0x8039700(com.apple.kpi.private)
Kext: I/O Kit Pseudoextension @0x8039c00(com.apple.kpi.iokit)
Kext: Libkern Pseudoextension @0x803b300(com.apple.kpi.libkern)
Kext: BSD Kernel Pseudoextension @0x803bb00(com.apple.kpi.bsd)
Kext: AppleFSCompressionTypeZlib @0x803c100(com.apple.AppleFSCompression.AppleFSCompressionTypeZlib)
Kext: Mach Kernel Pseudoextension @0x803c600(com.apple.kpi.mach)
Kext: Unsupported Pseudoextension @0x803c700(com.apple.kpi.unsupported)
Kext: I/O Kit USB Family @0x803c900(com.apple.iokit.IOUSBFamily)
Kext: I/O Kit Driver for USB User Clients @0x803f900(com.apple.iokit.IOUSBUserClient)
Kext: I/O Kit Storage Family @0x803fc00(com.apple.iokit.IOStorageFamily)
Kext: AppleDiskImageDriver @0x8041400(com.apple.driver.DiskImages)
Kext: AppleDiskImagesKernelBacked @0x8042000(com.apple.driver.DiskImages.KernelBacked)
Kext: FairPlayIOKit @0x8042c00(com.apple.driver.FairPlayIOKit)
Kext: LSKDIOKit @0x8048c00(com.apple.driver.LSKDIOKit)
Kext: AppleARMPlatform @0x804aa00(com.apple.driver.AppleARMPlatform)
Kext: AppleVXD375 @0x804e400(com.apple.driver.AppleVXD375)
Kext: IOSlaveProcessor @0x8050000(com.apple.driver.IOSlaveProcessor)
Kext: IOP_s5l8930x_firmware @0x8050500(com.apple.driver.IOP_s5l8930x_firmware)
Kext: AppleDiskImagesUDIFDiskImage @0x8053200(com.apple.driver.DiskImages.UDIFDiskImage)
Kext: IOStreamFamily @0x8053900(com.apple.iokit.IOStreamFamily)
Kext: IOAudio2Family @0x8053e00(com.apple.iokit.IOAudio2Family)
Kext: IOAVFamily @0x8054800(com.apple.iokit.IOAVFamily)
Kext: IODisplayPortFamily @0x8057d00(com.apple.iokit.IODisplayPortFamily)
Kext: AppleSamsungDPTX @0x8059300(com.apple.driver.AppleSamsungDPTX)
Kext: IOUSBDeviceFamily @0x805b000(com.apple.iokit.IOUSBDeviceFamily)
Kext: AppleUSBDeviceMux @0x805bd00(com.apple.driver.AppleUSBDeviceMux)
Kext: PPP @0x805c500(com.apple.nke.ppp)
Kext: L2TP @0x805cf00(com.apple.nke.l2tp)
Kext: I/O Kit Networking Family @0x805d500(com.apple.iokit.IONetworkingFamily)
Kext: IO80211Family @0x805ef00(com.apple.iokit.IO80211Family)
Kext: IOKit Serial Port Family @0x8063e00(com.apple.iokit.IOSerialFamily)
Kext: AppleOnboardSerial @0x8064800(com.apple.driver.AppleOnboardSerial)
Kext: Broadcom 802.11 Driver @0x8065600(com.apple.driver.AppleBCMWLANCore)
Kext: AppleSamsungSPI @0x806c400(com.apple.driver.AppleSamsungSPI)
Kext: I/O Kit Driver for USB Composite Devices @0x806c800(com.apple.driver.AppleUSBComposite)
Kext: I/O Kit Driver for USB Devices @0x806cd00(com.apple.driver.AppleUSBMergeNub)
Kext: AppleEmbeddedUSBHost @0x806d200(com.apple.driver.AppleEmbeddedUSBHost)
Kext: AppleUSBEthernetHost @0x806d700(com.apple.driver.AppleUSBEthernetHost)
Kext: AppleARM7M @0x806dc00(com.apple.driver.AppleARM7M)
Kext: corecrypto @0x806e000(com.apple.kec.corecrypto)
Kext: IOTextEncryptionFamily @0x8070b00(com.apple.IOTextEncryptionFamily)
Kext: IOCryptoAcceleratorFamily @0x8071000(com.apple.iokit.IOCryptoAcceleratorFamily)
Kext: AppleMobileFileIntegrity @0x8071e00(com.apple.driver.AppleMobileFileIntegrity)
Kext: Regular Expression Matching Engine @0x8073500(com.apple.kext.AppleMatch)
Kext: Seatbelt sandbox policy @0x8073900(com.apple.security.sandbox)
Kext: AppleProfileFamily @0x8074400(com.apple.iokit.AppleProfileFamily)
Kext: AppleProfileTimestampAction @0x8076f00(com.apple.driver.AppleProfileTimestampAction)
Kext: AppleNANDConfigAccess @0x8077300(com.apple.driver.AppleNANDConfigAccess)
Kext: AppleDiagnosticDataAccessReadOnly @0x8077600(com.apple.driver.AppleDiagnosticDataAccessReadOnly)
Kext: IOMobileGraphicsFamily @0x8077900(com.apple.iokit.IOMobileGraphicsFamily)
Kext: IODARTFamily @0x8078800(com.apple.driver.IODARTFamily)
Kext: Apple M2 Scaler and Color Space Converter Driver @0x8079300(com.apple.driver.AppleM2ScalerCSCDriver)
Kext: IOAcceleratorFamily @0x807a700(com.apple.iokit.IOAcceleratorFamily)
Kext: EncryptedBlockStorage @0x807c400(com.apple.iokit.EncryptedBlockStorage)
Kext: IOFlashStorage @0x807cc00(com.apple.iokit.IOFlashStorage)
Kext: AppleNANDFTL @0x807e500(com.apple.driver.AppleNANDFTL)
Kext: ApplePPNFTL @0x807ee00(com.apple.driver.ApplePPNFTL)
Kext: AppleDiskImagesRAMBackingStore @0x8081b00(com.apple.driver.DiskImages.RAMBackingStore)
Kext: IOHIDFamily @0x8081e00(com.apple.iokit.IOHIDFamily)
Kext: I/O Kit Driver for USB HID Devices @0x8083e00(com.apple.iokit.IOUSBHIDDriver)
Kext: AppleS5L8920X @0x8084400(com.apple.driver.AppleS5L8920X)
Kext: AppleARMPL192VIC @0x8085100(com.apple.driver.AppleARMPL192VIC)
Kext: AppleBluetooth @0x8085400(com.apple.driver.AppleBluetooth)
Kext: I/O Kit Driver for USB EHCI Controllers @0x8085700(com.apple.driver.AppleUSBEHCI)
Kext: I/O Kit Driver for USB OHCI Controllers @0x8086d00(com.apple.driver.AppleUSBOHCI)
Kext: AppleEmbeddedUSB @0x8087900(com.apple.driver.AppleEmbeddedUSB)
Kext: Embedded I/O Kit Driver for USB OHCI Controllers @0x8088200(com.apple.driver.AppleUSBOHCIARM)
Kext: AppleNANDFirmware @0x8088700(com.apple.driver.AppleNANDFirmware)
Kext: AppleEmbeddedCompass @0x8088b00(com.apple.driver.AppleEmbeddedCompass)
Kext: AppleD1815PMU @0x8089300(com.apple.driver.AppleD1815PMU)
Kext: AppleProfileThreadInfoAction @0x808aa00(com.apple.driver.AppleProfileThreadInfoAction)
Kext: AppleEmbeddedGyro @0x808ae00(com.apple.driver.AppleEmbeddedGyro)
Kext: AppleSynopsysOTGDevice @0x808b700(com.apple.driver.AppleSynopsysOTGDevice)
Kext: AppleEmbeddedLightSensor @0x808c100(com.apple.driver.AppleEmbeddedLightSensor)
Kext: AppleSamsungSerial @0x808cd00(com.apple.driver.AppleSamsungSerial)
Kext: AppleUSBMike @0x808d100(com.apple.driver.AppleUSBMike)
Kext: AppleNANDLegacyFTL @0x808d500(com.apple.driver.AppleNANDLegacyFTL)
Kext: AppleSamsungMIPIDSI @0x8090300(com.apple.driver.AppleSamsungMIPIDSI)
Kext: I/O Kit HID Event Driver Safe Boot @0x8090800(com.apple.driver.AppleBSDKextStarter)
Kext: AppleHIDKeyboard @0x8090b00(com.apple.driver.AppleHIDKeyboard)
Kext: IOKit SDIO Family @0x8090e00(com.apple.iokit.IOSDIOFamily)
Kext: AppleIOPSDIO @0x8091e00(com.apple.driver.AppleIOPSDIO)
Kext: AppleLTC4099Charger @0x8092600(com.apple.driver.AppleLTC4099Charger)
Kext: I/O Kit Driver for USB HID Devices @0x8092a00(com.apple.driver.AppleCDMA)
Kext: AppleProfileReadCounterAction @0x8093100(com.apple.driver.AppleProfileReadCounterAction)
Kext: AppleSamsungSWI @0x8093500(com.apple.driver.AppleSamsungSWI)
Kext: IOUserEthernet @0x8093900(com.apple.iokit.IOUserEthernet)
Kext: AppleUSBHSIC @0x8094100(com.apple.driver.AppleUSBHSIC)
Kext: Embedded I/O Kit Driver for USB EHCI Controllers @0x8094900(com.apple.driver.AppleUSBEHCIARM)
Kext: AppleAMC_r2 @0x8095000(com.apple.driver.AppleAMC_r2)
Kext: EmbeddedIOP @0x809c900(com.apple.driver.EmbeddedIOP)
Kext: ApplePinotLCD @0x809d100(com.apple.driver.ApplePinotLCD)
Kext: IOSurface @0x809d400(com.apple.iokit.IOSurface)
Kext: AppleDisplayPipe @0x809e200(com.apple.driver.AppleDisplayPipe)
Kext: AppleCLCD @0x809f200(com.apple.driver.AppleCLCD)
Kext: AppleS5L8930XDART @0x80a0000(com.apple.driver.AppleS5L8930XDART)
Kext: I/O Kit Driver for USB Hubs @0x80a0500(com.apple.driver.AppleUSBHub)
Kext: AppleKernelStorage @0x80a0e00(com.apple.platform.AppleKernelStorage)
Kext: AppleM68Buttons @0x80a1100(com.apple.driver.AppleM68Buttons)
Kext: AppleUSBEthernetDevice @0x80a1500(com.apple.driver.AppleUSBEthernetDevice)
Kext: AppleUSBHIDKeyboard @0x80a1a00(com.apple.driver.AppleUSBHIDKeyboard)
Kext: BasebandSPI @0x80a1d00(com.apple.driver.BasebandSPI)
Kext: AppleEffaceableStorage @0x80a3700(com.apple.driver.AppleEffaceableStorage)
Kext: LightweightVolumeManager @0x80a4100(com.apple.driver.LightweightVolumeManager)
Kext: IMGSGX535 Graphics Kernel Extension @0x80a4b00(com.apple.IMGSGX535)
Kext: I/O Kit HID Event Driver @0x80a7800(com.apple.driver.AppleIOPFMI)
Kext: AppleTetheredDevice @0x80a8800(com.apple.driver.AppleTetheredDevice)
Kext: AppleProfileKEventAction @0x80a8b00(com.apple.driver.AppleProfileKEventAction)
Kext: AppleRGBOUT @0x80a8f00(com.apple.driver.AppleRGBOUT)
Kext: IOFlashNVRAM @0x80a9700(com.apple.driver.IOFlashNVRAM)
Kext: AppleS5L8930XUSB @0x80a9d00(com.apple.driver.AppleS5L8930XUSB)
Kext: AppleDPRepeater @0x80aa100(com.apple.driver.AppleDPRepeater)
Kext: AppleARMPL080DMAC @0x80ad000(com.apple.driver.AppleARMPL080DMAC)
Kext: AppleAC3Passthrough @0x80ad400(com.apple.driver.AppleAC3Passthrough)
Kext: AppleIntegratedProxALSSensor @0x80ada00(com.apple.driver.AppleIntegratedProxALSSensor)
Kext: AppleDiskImagesFileBackingStore @0x80ae400(com.apple.driver.DiskImages.FileBackingStore)
Kext: AppleUSBAudio @0x80ae800(com.apple.driver.AppleUSBAudio)
Kext: AppleTVOut @0x80b1800(com.apple.driver.AppleTVOut)
Kext: tlsnke @0x80b1c00(com.apple.nke.tls)
Kext: AppleS5L8930XUSBPhy @0x80b2200(com.apple.driver.AppleS5L8930XUSBPhy)
Kext: AppleProfileRegisterStateAction @0x80b2600(com.apple.driver.AppleProfileRegisterStateAction)
Kext: IOAccessoryManager @0x80b2a00(com.apple.iokit.IOAccessoryManager)
Kext: AppleS5L8930X @0x80b3e00(com.apple.driver.AppleS5L8930X)
Kext: AppleBSDKextStarterVPN @0x80b4800(com.apple.driver.DiskImages.ReadWriteDiskImage)
Kext: AppleARMIISAudio @0x80b4b00(com.apple.iokit.AppleARMIISAudio)
Kext: AppleEmbeddedProx @0x80b5200(com.apple.driver.AppleEmbeddedProx)
Kext: AppleMultitouchSPI @0x80b5a00(com.apple.driver.AppleMultitouchSPI)
Kext: H3 H264 Video Encoder @0x80b6e00(com.apple.driver.H2H264VideoEncoderDriver)
Kext: Broadcom WLAN SDIO Bus Driver @0x80b8f00(com.apple.driver.AppleBCMWLANBusInterfaceSDIO)
Kext: AppleUSBEthernet @0x80ba000(com.apple.driver.AppleUSBEthernet)
Kext: PPTP @0x80ba900(com.apple.nke.pptp)
Kext: AppleJPEGDriver @0x80bae00(com.apple.driver.AppleJPEGDriver)
Kext: AppleSamsungI2S @0x80bb800(com.apple.driver.AppleSamsungI2S)
Kext: AppleEmbeddedAccelerometer @0x80bbc00(com.apple.driver.AppleEmbeddedAccelerometer)
Kext: IOMikeyBusFamily @0x80bc200(com.apple.iokit.IOMikeyBusFamily)
Kext: AppleEmbeddedAudio @0x80bd400(com.apple.driver.AppleEmbeddedAudio)
Kext: AppleLM48557Amp @0x80bf500(com.apple.driver.AppleLM48557Amp)
Kext: AppleProfileCallstackAction @0x80bf800(com.apple.driver.AppleProfileCallstackAction)
Kext: AppleMultitouchSPIN1F55 @0x80bfc00(com.apple.driver.AppleCD3282Mikey)
Kext: AppleMultitouchSPIZ2F13 @0x80c0000(com.apple.driver.AppleImage3NORAccess)
Kext: AppleH3CameraInterface @0x80c0800(com.apple.driver.AppleH3CameraInterface)
Kext: AppleSamsungPKE @0x80c2700(com.apple.driver.AppleSamsungPKE)
Kext: AppleKeyStore @0x80c2b00(com.apple.driver.AppleKeyStore)
Kext: AppleHIDKeyboardEmbedded @0x80c3800(com.apple.driver.AppleCS42L59Audio)