- Code: Select all
# Look for your kext of interest by grep(1)-ing:
morpheus@Erudite:JTool$ ./joker ~/Documents/iOS/6.1.3.kernel.iPhone4GSM | grep MobileFile
Kext: AppleMobileFileIntegrity @0x80410000 (File: 0x3cf000) (com.apple.driver.AppleMobileFileIntegrity)
Then:
- Code: Select all
morpeus@Erudite:JTool$ dd if=~/Documents/iOS/6.1.3.kernel.iPhone4GSM bs=1 skip=0x3cf000 count=100000 of=AMFI.kext
100000+0 records in
100000+0 records out
100000 bytes transferred in 0.230196 secs (434412 bytes/sec)
morpheus@Erudite:JTool$ file AMFI.kext
AMFI.kext: Mach-O kext bundle arm
morpheus@Erudite:JTool$ ./jtool -d AMFI.kext | more
Processing AMFI.kext:
Disassembling from file offset 0xf3c, Address 0xffffffff80410f3c
-- 80410f3c b590 PUSH {r4,r7,lr}
-- 80410f3e 4a08 LDR R2, [PC, #32] ; R2 = *(80410f60) = 0x121ca
-- 80410f40 4604 MOV R4, R0 ; R4 = 0x0
-- 80410f42 4908 LDR R1, [PC, #32] ; R1 = *(80410f64) = 0x3d86
-- 80410f44 af01 ADD R7, SP, #4 ; R7 += 4 = 4
-- 80410f46 447a ADD R2, PC ; R2 += 80410f4a = 80423114
-- 80410f48 4620 MOV R0, R4 ; R0 = 0x0
-- 80410f4a 4479 ADD R1, PC ; R1 += 80410f4e = 80414cd4AppleMobileFileIntegrityUserClient
.. etc , etc
This should make it very useful for people who want to reverse engineer Kexts, with or without IDA