Improve support for older kernel caches (pre-iOS 16 / MH_FILESET)

Open
#8,070 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
cpp, ios, macos
Domain
operating-systems, reverse-engineering

Research direction

Reproduce the issue by running the listed ipsw download and ipsw extract commands, then open kernelcache.release.iPhone9,1_3 in Binary Ninja. Compare analysis time and results for the older MH_EXECUTE cache, focusing on the indirect calls and IOKit C++ vtables described in the report; done means these caches receive appropriate analysis without the listed slowdowns and omissions.

Written by the indexing model from the issue text.

Description

File Format: Mach-O

Version and Platform (required):

  • Binary Ninja Version: 5.3.9417-dev Ultimate, 8f260d72
  • OS: macos
  • OS Version: 26.3.1
  • CPU Architecture: arm64

Bug Description:
macOS 11 / iOS 16 moved their kernel caches to the newer MH_FILESET format. Prior to that, they used MH_EXECUTE. Binary Ninja ends up loading these older kernel caches as if they were any other Mach-O executable.

I see a couple of problems when loading kernelcache.release.iPhone9,1_3 from iOS 19H364:

  1. Analysis is much slower than I'd expect, even given the relatively large binary size (~43MB). Phases 2 and 3 are particularly slow. The initial phase takes ~3 minutes, with the final two phases taking over 45 minutes as they discover and analyze an additional ~80,000 functions.
  2. The kernel cache contains indirect calls via pointers in sections the Mach-O headers indicate are writable. These appear to be used for cross-image calls (i.e., kext to kernel). Since the pointer appears to be writable we do not resolve the indirect call target, which severely hampers analysis.
  3. C++ vtables for IOKit classes are not detected or processed.

Steps To Reproduce:

ipsw download appledb --os iOS --version 15.7.8 --device iPhone9,1
ipsw extract --kernel iPhone_4.7_P3_15.7.8_19H364_Restore.ipsw

Then open 19H364__iPhone9,1_3/kernelcache.release.iPhone9,1_3 and wait.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.