tool we will see its basic uses and how it can make our life a lot easier. ipsw is a tool that can be used for *OS research, it provides a lot of functionalities related to dyld_shared_cache, DeviceTree, kernelcache, Img4, etc. which are all of interest to security researchers.
We will go over each of command to see what it does and how to use it, but before we do that, we first need to get ipsw. We can build ipsw from the source or we can download one of the prebuilt binaries available on the GitHub .
After we have downloaded ipsw, to confirm that everything is working okay and to see the list of the options, we will type --help
appstore
provides:
managing bundle IDs of the created applications
management of signing certificates
listing and registering new devices
managing provisioning profiles
generating jwt token that we can use to interact with
App Store Connect API.
A lot of ipsw commands require App Store Connect API key and we can obtain one by visiting
Download button.
Path to the file will be provided with the -p flag, Issuer ID with the -i flag and Key ID with -k flag
bundle
ipsw appstore bundle ls while providing previously acquired information (.p8 file, Issuer ID and Key ID). We could use this command in order to see all the bundle IDs that we have registered.
command:
cert
provides us with the management of signing certificates. To list the certificates we can simply call ipsw appstore cert ls with the .p8 file, Issuer ID and Key ID. We can use this command in the cases where we would want to quickly create new signing certificate or if we want to check them.
command:
openssl.
command: openssl req -newkey rsa:2048 -keyout 8ksec.key -out 8ksec.csr
After filling required information we will have Certificate Signing Request inside of 8ksec.csr file and private key inside of 8ksec.key. The contents of the 8ksec.csr will be passed to the -c flag of ipsw appstore cert add. We need to clean it up a bit by removing newlines, we can do that with tr -d ’\n’
csr we will call ipsw appstore cert add with the --type DEVELOPMENT.
command:
ipsw appstore cert ls
--id to ipsw appstore cert rm. In our case the command would look like ipsw appstore cert rm --id Q6FAZ3K5VT -p PATH_TO_P8_FILE -i ISSUER_ID -k KEY_ID
device
appstore subcommand such as listing devices or registering new devices. To add new device, we need to have UDID of the device and specify its name and platform (iOS). UDID of the device can simply be seen using idevice_id from libimobiledevice.
To list the devices command is
profile
subcommand provides us with profile subcommand which allows us to manage provisioning profiles. We can do things such as listing, creating, renewing and removing provisioning profiles. Provisioning profiles allow for running apps with entitlements or signing certificates outside of the normal configuration of iOS.
To list provisioning profiles:
the name of the provisioning profile
certificate ID for the newly created provisioning profile
finally, device ID for which device will this new provisioning profile be related
command:
NAME.mobileprovision on the disk. To confirm that we have indeed created the profile, let’s issue another profile ls
ipsw appstore profile rm with -n flag.
command:
token
command:
device-list
device-list
diff
ipsw files. ipsw files are basically firmware files and we can diff or find differences between two ipsw files. This can be useful for example if the vulnerability was patched and we don’t know the exact details, this can point us in the right direction.
We will use and ipsw files.
command:
download
The fourth subcommand allows us to download a whole lot of different stuffs, such as OSs, IPAs, IPSW files, macOS installers and more. We can use this command to go over a bunch of different webpages to download or browse stuff, instead we can do it from the terminal.
appledb
.
command:
dev
allows you to download IPSWs, OSs, Xcode and more from the https://developer.apple.com/download.
command: ipsw download dev
macos
ipsw download is macos
offers other options such as git, ipa
dtree
To parse DeviceTree, we first need to have one and to do that, we can use ipsw extract
ipsw dtree.
command:
dyld
subcommand provides a lot of functionalities related to the dyld_shared_cache. Some of the functionalities are:
getting info about the dyld_shared_cache
finding which dylibs import another dylib
extracting the dyld_shared_cache
search for string inside of dyld_shared_cache
and a bunch more
info
ipsw dyld info with the path to dyld_shared_cache. We also have a couple of optionals, such as printing only dylibs, dlopen closures.
command:
Also, after some general information we can see dylibs inside of dyld_shared_cache as can be seen on the image below.
extract
ipsw dyld extract command.
command: ipsw dyld extract PATH_TO_DYLD_SHARED_CACHE DYLIB
On the image below, we can see extracting Accelerate.framework
macho
ipsw dyld allows us to parse specific dylib inside of dyld_shared_cache file.
command: ipsw dyld macho PATH_TO_DYLD_SHARED_CACHE DYLIB
imports
ipsw dyld imports command. Lets say we have found a vulnerability inside of specific dylib and we want to check which other frameworks/dylibs import it, we can use this command.
command:
Here we can see which dylibs are loading Accelerate.framework.
objc
ipsw dyld objc. We can use it to print classes, protocols, selectors or imp-caches for dyld_shared_cache. This command is useful if we want to see some classes/functionalities inside of PrivateFrameworks.
To dump all the classes, we can use
split
ipsw dyld split which allows us to see everything inside of dyld_shared_cache. We will go over splitting dyld_shared_cache on macOS Ventura.
On macOS Ventura, dyld_shared_cache is stored at the location of /System/Cryptexes/OS/System/Library/dyld/
/System/Cryptexes/OS/System/Library/dyld/ and we will use dyld_shared_cache_arm64e one.
command: ipsw dyld split /System/Cryptexes/Os/System/Library/dyld/dyld_shared_cache_arm64e /tmp/8ksec
A couple of seconds later, we can examine the output directory to see what is inside.
PrivateFrameworks and Frameworks. We can now, for example, see the exported symbols from one of this frameworks, let’s say CalendarWidget.framework using nm -Ug followed by the path to the CalendarWidget
str
allows us to search for specific string patterns inside of dyld_shared_cache files. This comes in handy when we want to check for example where is the specific string used/referenced.
command:
As can be seen on the image above, there are quite a lot of cases where the world string is present. We can also see the name of the framework where the pattern was found.
ent
search
com.apple.developer.carplay-audio, the command would look like this:
command:
diff
command:
info
command allows us to see information regarding IPSW or OTA file. We could use this command if we want to see the chip or iOS version for the specific IPSW or OTA file. We can do the check for the local files, or we can pass the URL with the -r flag to to analysis on the remote file.
command for local file: ipsw info PATH_TO_IPSW_OTA_FILE command for remote:
mdevs
allows us to see all mobile devices inside of specific IPSW file.
command:
mount
command allows us to mount the specific part of IPSW file. Those parts are fs (filesystem), sys (system) or app (library). We may want to use this command if we would like to see what is exactly inside of IPSW file and to do some further analysis/research on the specific part of it, e.g. specific dylib.
command: ipsw mount [fs|sys|app] PATH_TO_IPSW_FILE
On the next two images we can see mounting fs (filesystem) and what is inside of it.
Now, we will mount the sys (system) and we will check its content.
Finally, we will mount app.
plist
file
command:
jq
watch
ipsw plist to watch specific directory for changes inside of plist files. This comes in handy when we want to track what changes inside of plist file while we are working with the application.
command:
update
ipsw update which then allows us to download the new version for out specific OS and architecture.
command:
ipsw update
watch
In the next part, we will look at some additional uses of ipsw for *OS security research.
Looking to elevate your expertise in iOS Security?
Offensive iOS Internals Training
365 Days of Access | Hands-On Learning | Self-Paced Training
GET IN TOUCH
Visit our training page if you’re interested in learning more about these techniques and developing your abilities further. Additionally, you may look through our Events page and sign up for our upcoming Public trainings.
Check out our Certifications Program and get Certified today.
Please don’t hesitate to reach out to us through out Contact Us page or through the Button below if you have any questions or need assistance with Penetration Testing or any other Security-related Services. We will answer in a timely manner within 1 business day.
We are always looking for talented people to join our team. Visit out Careers page to look at the available roles. We would love to hear from you.
