Renaming a dylib load command recomputed cmdsize from the classic
24-byte dylib_command header, which under-sizes commands using the
dylib_use_command encoding (iOS 18+/macOS 15+, name offset 28 plus
DYLIB_USE_* flags). Use the encoding-aware LoadSize() instead and
deduplicate the per-type switch arms.
Adds `--fs` flag to bypass the database and scan entitlements
directly from IPSW filesystem DMGs or input folders. Introduces
`--has`/`--without` for required/excluded entitlement key filtering,
`--pem-db` for AEA-encrypted IPSWs, and `--format` (text, tsv, jsonl)
for structured output.
`ipsw download ipsw --kernel` now fetches firmware keys from
theapplewiki and decrypts encrypted kernelcaches inline. Unencrypted
members in the same IPSW pass through unchanged.
- pkg/img4: DecryptPayload reuses Payload.GetData for decompression,
removing the duplicate LZSS/LZFSE branches.
- pkg/kernelcache: ParseImg4Data switches to img4.ParsePayload and
exports ErrEncryptedKernelCache so callers can detect the missing-key
case via errors.Is.
- internal/commands/extract: new keyed remote path with all-or-nothing
preflight; the encryption-status peek lets unencrypted variants
succeed even when the wiki has no entry for them.
closes#1193
Skip entries marked `hideFromLatestVersions` in `Latest` and `Query`
when the `Latest` flag is set on the query. Adds tests covering the
skip behavior and fallback to the newest visible release.
Introduces direct OTA file diffing without requiring pre-extraction.
Users can now pass `.ota`/`.aea` files directly to `ipsw diff` alongside
existing IPSW and directory input modes.
Key additions:
- `internal/diff/ota_inputs.go`: OTA-specific input handling including
cryptex mounting, kernelcache extraction, firmware parsing, iBoot
parsing, and feature flag collection from mounted volumes
- `inputModeOTA` enum variant in `directory_inputs.go`
- `--key-db`, `--key-val`, and `--insecure` flags on `diff` command for
AEA-encrypted OTA decryption
- AEA key database lookup mirroring the `ota` command's key resolution
- Magic-byte-aware error handling: AEA/AA files propagate decryption
errors while ambiguous ZIPs fail silently (not-an-OTA)
- Validation rejects partial/delta and RSR OTAs with actionable messages
- Comprehensive unit tests covering all new helpers
In delta OTA mode, `--build` specifies the currently-installed
(prerequisite) build, not the target build. Previously, the build
filter always compared against the target `Build` field, causing
delta queries with `--build` to return no results.
Changes:
- Filter against `PrerequisiteBuild` when `--delta` is set
- Send `BuildVersion: "0"` to Pallas for non-delta/non-RSR requests
so the server returns all available targets instead of only updates
newer than the specified build
- Remove POST /diff/files endpoint that allowed arbitrary host file reads
(CWE-22); clients must now read files locally and POST content to
/diff/blobs instead
- Add validatePublicURL() to /info remote endpoints, rejecting URLs that
resolve to loopback, private, link-local, or multicast addresses to
prevent SSRF; also remove attacker-controlled proxy/insecure params
- Add SanitizeArchivePath() helper that verifies extracted archive entry
paths stay within the destination directory (zip-slip / tar-slip,
CWE-22); replace bare filepath.Join(dest, filepath.Clean(name)) calls
in SearchZip, OTA parser, AA payload extractor, and ota_extract
- Fix server listen address to use net.JoinHostPort to respect Host config
- Add `--build`, `--train`, `--app`, `--version` flags to filter
releases before interactive selection
- Show a TTY progress bar while fetching the PCC transparency log
- Resolve OS IPSW versions via partial-zip of BuildManifest.plist,
caching results in `pcc_versions.json` to avoid redundant fetches
- Display build/train/app metadata in release list and info output
- Preflight HEAD-check all assets before downloading to catch CDN
propagation delays early
- Sort releases by timestamp (newest first) instead of log index
- Auto-generate output directory name from release index and build
- Promote `go-isatty` from indirect to direct dependency
IsImg4 and IsIm4p returned errors when ASN.1 parsing failed,
but parse failure just means the file isn't that format. This
broke callers like `kernel kmutil inspect -x` on x86_64 Macs
where the kernel collection is a Mach-O .kc file, not IMG4.
Return (false, nil) for parse failures; only error on I/O failure.
Closes#1081
Sanitize Swift type/protocol names before using them as filenames,
replacing characters illegal or problematic on APFS/HFS+ (.<> ,()/\:)
with underscores and clamping to the 255-byte filesystem limit.
When truncation is required, embed an 8-char FNV-1a hash of the original
name in the filename so that two long names sharing the same sanitised
prefix remain distinct and do not silently overwrite each other.
Closes#1132
Add API endpoints and CLI support for discovering C++ classes and symbolication of kernelcaches, refactor Mach-O handling, and improve symbol collection.
- API: add /kernel/cpp and /kernel/symbolicate routes, request param structs, response types, and openKernel helper. Use cpp scanner and signature parsing to return classes and symbol maps.
- CLI: wire scanner LogStats flag, refactor kernel symbolicate command (schema writer helper, improved signature parsing, and symbol matching logic). Add tests for symbolicator schema and kernel symbol matching.
- Signature pkg: add kernel C++ symbol extraction (pkg/signature/kernel_cpp.go) and SymbolicateMachO to symbolicate already-open Mach-Os; integrate C++ symbols into symbol map and update signature matching/logging behavior.
- Internal: refactor in-memory DB lookups (findMachOByUUID, findSymbolByAddr) to reduce duplication. Improve symbols collection for kernel Mach-Os (collectKernelMachoSymbols, extra kernel symbols from signature/C++), add helpers to append symbols.
- Kernelcache CPP: add LogStats option and conditional logging of scan stats.
- Crashlog/ips: update wording to reflect kernel symbols are from kernel analysis and store KernelSymbols earlier in processing; parse signatures only when configured.
Also add unit tests for new symbolication helpers and kernel C++ signature handling. Overall this consolidates kernel symbol discovery, improves reuse, and surfaces C++-derived symbols in symbol maps.
blacktop
vnescapeandGitHub
Mischan Toosarani-HausbergerandGitHub
codecoloristandGitHub
PollyandGitHub