Skip to content

Commit 2ac9524

Browse files
psifertexplafosse
authored andcommitted
edits to ksc docs
1 parent 00801c4 commit 2ac9524

File tree

1 file changed

+14
-13
lines changed

1 file changed

+14
-13
lines changed

docs/guide/kernelcache.md

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Kernel Cache support in Binary Ninja provides you with tools to selectively load specific images, search for
44
specific symbols, and follow analysis references between any images loaded from an `kernelcache` in one view.
55

6-
Our support for `kernelcache` is largely open source. The supporting code can can be found in our public API repository [here](https://github.com/Vector35/binaryninja-api/tree/dev/view/kernelcache). Instructions for setting up your development environment and building plugins like this yourself can be found in our [Developer Guide](../dev/plugins.md#writing-native-plugins). Contributions are welcome!
6+
Our support for `kernelcache` is largely open source. The supporting code can be found in our public API repository [here](https://github.com/Vector35/binaryninja-api/tree/dev/view/kernelcache). Instructions for setting up your development environment and building plugins like this yourself can be found in our [Developer Guide](../dev/plugins.md#writing-native-plugins). Contributions are welcome!
77

88
## Support Matrix
99

@@ -18,36 +18,37 @@ List of supported features for the given `kernelcache` targets:
1818
- **Core**: Core functionality, such as loading, navigating, and analyzing `kernelcache` files.
1919
- **Objective-C**: Support for analyzing Objective-C information and symbols within the `kernelcache`.
2020

21-
**Note:** *In general, this plugin does not support `kernelcache` files that are not in `MH_FILESET` format at this time.*
21+
???+ Note "Note"
22+
This plugin currently only supports `kernelcache` files in the `MH_FILESET` format.
2223

2324
## Obtaining a Kernel Cache
2425

25-
The `kernelcache` is a file that contains all the kernel and all of its extensions used by modern Apple operating systems (like macOS, iOS, and tvOS). These can be obtained directly from Apple, or with the help of a tool such as `blacktop/ipsw`.
26+
The `kernelcache` is a file that contains all of the kernel and its extensions used by modern Apple operating systems like macOS, iOS, and tvOS. These can be obtained directly from Apple, or with the help of a tool such as [`blacktop/ipsw`](#using-blacktopipsw).
2627

2728
A `kernelcache` should typically be automatically decompressed by Binary Ninja. If automatic decompression fails, Binary Ninja can still load
2829
caches decompressed by other tools as long as they are valid `MH_FILESET` Mach-O files.
2930

30-
### With `blacktop/ipsw`
31+
### Using `blacktop/ipsw`
3132

32-
Our recommended way to retrieve a `kernelcache` is using blacktop's wonderful [`ipsw` tool](https://github.com/blacktop/ipsw).
33+
Our recommended way to retrieve a `kernelcache` is using blacktop's [`ipsw` tool](https://github.com/blacktop/ipsw).
3334

3435
1. [Install blacktop/ipsw](https://github.com/blacktop/ipsw?tab=readme-ov-file#install)
3536
2. Run `ipsw download ipsw --version [target iOS version] --device [target device model (e.g. iPhone10,3)]`
3637
3. Run `ipsw extract --kernel [filename]`
3738

38-
### From Local macOS Install
39+
### Local macOS Install
3940

40-
Getting to the local `kernelcache` on macOS is not the easiest. Try some of the following:
41+
Getting to the local `kernelcache` on macOS depends on the specific version. Try some of the following:
4142

42-
* `/System/Library/Kernel/`, which should have the `kernel`, but not necessarily the extensions
43-
* `/System/Library/Extensions/` should have each of the individual extensions
44-
* `/System/Library/PrelinkedKernels/`, which should have the full `kernelcache`, but may not exist on earlier versions of macOS
45-
* `/System/Library/Caches/com.apple.kernelcaches/`, which may be empty
46-
* `/System/Library/Caches/com.apple.kext.caches/Startup/kernelcache/`, which may be empty
43+
* `/System/Library/Kernel/`, which should have the `kernel`, but not necessarily the extensions
44+
* `/System/Library/Extensions/` should have each of the individual extensions
45+
* `/System/Library/PrelinkedKernels/`, which should have the full `kernelcache`, but may not exist on earlier versions of macOS
46+
* `/System/Library/Caches/com.apple.kernelcaches/`, which may be empty
47+
* `/System/Library/Caches/com.apple.kext.caches/Startup/kernelcache/`, which may be empty
4748

4849
## Interacting With a Kernel Cache
4950

50-
After opening a `kernelcache`, you will be provided a custom binary view. Due to the large size of these files, we do not load all the information into the binary view by default. Instead, we do this selectively.
51+
After opening a `kernelcache`, you will be provided a custom binary view. Due to the large size of these files, we do not load all the information into the binary view by default. Instead, this is done on-demand and selectively.
5152

5253
### Kernel Cache Triage (KCTriage)
5354

0 commit comments

Comments
 (0)