{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/0x36/ghidra_kernelcache/blob/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/README.md#L13-L56",
    "https://github.com/0x36/ghidra_kernelcache/blob/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/README.md#L137-L190",
    "https://github.com/0x36/ghidra_kernelcache/blob/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/README.md#L229-L318",
    "https://github.com/0x36/ghidra_kernelcache/blob/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/KC.py",
    "https://github.com/0x36/ghidra_kernelcache/blob/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/jsymbols.py",
    "https://github.com/0x36/ghidra_kernelcache/tree/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/utils",
    "https://github.com/0x36/ghidra_kernelcache/tree/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/signatures",
    "https://github.com/0x36/ghidra_kernelcache/blob/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/LICENSE",
    "https://github.com/Siguza/iometa/blob/2af3602e7edb72f478aa8958a6386aba846a89de/README.md"
  ],
  "category": "firmware",
  "description_en": "Ghidra script framework for reverse engineering Apple kernelcaches and kernel extensions on iOS and macOS. Starting from the C++ class information that Siguza's iometa extracts, it symbolicates the kernel, rebuilds IOKit class hierarchies, structures, namespaces and virtual tables with typed method definitions, and resolves virtual call references, either through arm64e pointer-authentication constants or with a p-code data-flow pass. Other scripts fix the externalMethod and getTargetAndMethodForIndex dispatch tables, apply XNU function signatures from header files, propagate types, load KDK DWARF symbols and copy structures between projects.",
  "description_zh": "用于逆向分析 iOS 与 macOS 上 Apple kernelcache 和内核扩展的 Ghidra 脚本框架。它以 Siguza 的 iometa 提取的 C++ 类信息为起点，为内核恢复符号，重建 IOKit 类层次、结构体、命名空间和带类型方法定义的虚表，并通过 arm64e 指针认证常量或基于 p-code 的数据流分析解析虚函数调用引用。其他脚本可修复 externalMethod 和 getTargetAndMethodForIndex 分派表、根据头文件应用 XNU 函数签名、传播类型、加载 KDK 的 DWARF 符号，以及在项目之间复制结构体定义。",
  "entry_url": "https://awesomerea.org/resources/ghidra-kernelcache/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ghidra-kernelcache/",
  "evidence_url": "https://github.com/0x36/ghidra_kernelcache/blob/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/README.md",
  "group": "tools",
  "id": "ghidra-kernelcache",
  "json_url": "https://awesomerea.org/resources/ghidra-kernelcache/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ghidra-kernelcache/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ghidra-kernelcache/index.md",
  "name": "ghidra_kernelcache",
  "name_zh": "ghidra_kernelcache Apple 内核缓存分析框架",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "No releases or tags. The reviewed master commit, from 2022-01-19, is the latest. The README says the framework works on iOS 12–15 kernelcaches and on macOS 11–12 kernelcaches and single KEXTs (arm64e and x86_64). It was tested on Ghidra 10.1_PUBLIC and 10.2_DEV and is not backward compatible. Support for later Ghidra releases or for kernelcaches after iOS 15 and macOS 12 is not documented.",
    "Installation means adding the clone to Ghidra's Script Manager directories; the scripts then appear under iOS→kernel with toolbar buttons and key shortcuts. They are Ghidra Jython scripts with Python 2 syntax. Their toolbar icons point to a logos/ folder that the repository does not include, and the README's utils/class.py corresponds to utils/ios_kc.py in the tree.",
    "Analysts supply their own kernel images: a decompressed iOS kernelcache loaded as a single Mach-O image (the README warns against batch import), or a macOS kernel and KEXTs from their own system or KDK. Symbolication first needs the output of Siguza's separate iometa tool (MPL-2.0), which describes itself as an arm64 Darwin class dumper; jtool2 symbols are optional. The README notes that Ghidra could not parse a whole macOS kernelcache at the time and suggests initial analysis in IDA followed by an XML import, a step it leaves out of scope. Symbolicating a single KEXT first needs the kernel symbolicated into a shared Ghidra project archive.",
    "The repository holds only Python scripts, the C++ signature files under signatures/ and README screenshots; it commits no Apple kernelcaches, KEXTs or keys. The README calls type propagation basic and likely to fail with complex casts, and says kc.process_kernel_kext() can fail on symbols Ghidra could not demangle until DemangleAllScript is run. Apache-2.0 license."
  ],
  "requirements_zh": [
    "没有发布版本或标签。所审阅的 master 提交日期为 2022-01-19，也是最新提交。README 称该框架适用于 iOS 12–15 的 kernelcache，以及 macOS 11–12 的 kernelcache 和单个 KEXT（arm64e 与 x86_64）。它在 Ghidra 10.1_PUBLIC 和 10.2_DEV 上测试过，不向后兼容。文档没有说明对更新的 Ghidra 版本或 iOS 15、macOS 12 之后 kernelcache 的支持。",
    "安装方式是把克隆的仓库加入 Ghidra 脚本管理器的目录列表，脚本随后出现在 iOS→kernel 分类下，并带有工具栏按钮和快捷键。这些脚本是采用 Python 2 语法的 Ghidra Jython 脚本。工具栏图标指向仓库中并不存在的 logos/ 文件夹；README 提到的 utils/class.py 在代码树中对应 utils/ios_kc.py。",
    "内核镜像由分析者自行提供：作为单个 Mach-O 镜像载入的已解压 iOS kernelcache（README 提醒不要使用批量导入），或来自自有系统或 KDK 的 macOS 内核与 KEXT。恢复符号前，需要先运行 Siguza 的独立工具 iometa（MPL-2.0），该工具自述为 arm64 Darwin 内核类信息提取工具；jtool2 符号为可选。README 指出，撰写时 Ghidra 还无法解析完整的 macOS kernelcache，建议先在 IDA 中完成初步分析，再以 XML 形式导入 Ghidra，但这一步不在其说明范围内。为单个 KEXT 恢复符号前，需要先把内核符号化结果存入共享的 Ghidra 项目归档。",
    "仓库只包含 Python 脚本、signatures/ 下的 C++ 签名文件和 README 截图，没有提交任何 Apple kernelcache、KEXT 或密钥。README 称类型传播功能比较基础，遇到复杂类型转换时很可能失败；还说 Ghidra 无法还原某些 C++ 符号时 kc.process_kernel_kext() 可能失败，需先运行 DemangleAllScript。采用 Apache-2.0 许可。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/0x36/ghidra_kernelcache",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}