ipsw

What problem does it solve?

This Skill provides a guided, automated workflow for analyzing Apple firmware and binaries by enabling streamlined acquisition, inspection, and analysis of IPSWs, kernelcaches, dyld_shared_cache, entitlements, and Mach-O data for iOS/macOS security research.

Core Features & Use Cases

• Firmware acquisition: Download the latest IPSWs and extract components such as kernelcaches and dyld_shared_cache for quick RE workflows.
• Userspace analysis: Inspect the dyld_shared_cache, perform symbol lookups, cross-references, string searches, and ObjC header extraction from private frameworks.
• Mach-O & kernel exploration: Analyze Mach-O binaries, inspect entitlements, inspect code signatures, and examine kernel/KEXT data across versions.
• Entitlements research: Build and query entitlement data across IPSWs to identify privilege escalations and sandbox configurations.
• Use Case: In vulnerability triage, fetch the latest device firmware, inspect the DSC, and verify private API surfaces and entitlements across builds.

Quick Start

Install the ipsw CLI and run a basic workflow to fetch kernel and DSC data for a device, for example: ipsw download ipsw --device iPhone16,1 --latest --kernel --dyld