vega01 wrote:Hi,
I got the following when trying to dump decrypted and decompressed 32-bit kernelcache from iOS 6.0 for iPhone 5,1 (build 10A405)
./joker.universal -k
- Code: Select all
(2107.2.33.0.0)
Trying method #2
Unable to get kexts from __PRELINK_INFO.. going straight for __PRELINK_TEXT
1: built-in?(2107.2.33.0.0) at 0x355000 (8000 bytes)
2: built-in?(2107.2.33.0.0) at 0x35d000 (17000 bytes)
3: built-in?(2107.2.33.0.0) at 0x374000 (1000 bytes)
4: built-in?(2107.2.33.0.0) at 0x375000 (5000 bytes)
5: built-in?(2107.2.33.0.0) at 0x37a000 (2000 bytes)
6: built-in?(2107.2.33.0.0) at 0x37c000 (6000 bytes)
7: com.apple.driver.AppleARMPlatform(284.7.0.0.0) at 0x382000 (3a000 bytes)
8: com.apple.driver.IOSlaveProcessor(7.0.0.0.0) at 0x3bc000 (5000 bytes)
9: com.apple.driver.AppleA5AE2(43.1.0.0.0) at 0x3c1000 (5000 bytes)
10: com.apple.driver.LSKDIOKit(0.0.0.0.0) at 0x3c6000 (1d000 bytes)
11: com.apple.driver.IODARTFamily(31.0.0.0.0) at 0x3e3000 (b000 bytes)
12: com.apple.driver.AppleM2ScalerCSC(138.0.6.0.0) at 0x3ee000 (14000 bytes)
13: com.apple.driver.FairPlayIOKit(0.0.0.0.0) at 0x402000 (68000 bytes)
14: com.apple.driver.AppleVXD390(4.63.0.0.0) at 0x46a000 (27000 bytes)
15: com.apple.driver.AppleSamsungSPI(42.2.0.0.0) at 0x491000 (4000 bytes)
16: built-in?(42.2.0.0.0) at 0x495000 (1000 bytes)
17: com.apple.iokit.IOCryptoAcceleratorFamily(67.0.0.0.0) at 0x496000 (e000 bytes)
Segmentation fault: 11
joker version:
- Code: Select all
3.0b with MACF Policies and (coming soon) IOUserClients!
Compiled on Jun 20 2016
Am I doing something wrong?
Edit: I got what I wanted by using the source. Thank you for sharing the tools and knowledge!
Hi, I have a similar Segmentation fault when I run it on 32-bit kernelcache from iOS 8.3 for iPhone 5,2
./joker.universal -k kerneldump
This is a 32-bit kernel from iOS 8.x, or later (2784.20.34.0.0)
This is not a Mach-O 64-bit file. Sorry (Magic: 0xfeedface)
Unable to get symbols from SYMTAB (fine for dumps)
Found iOS 8+ sysent table @39a4a4 (Addr: 0xa0f9b4a4)
Number of kexts way too small.. Trying method #2
Unable to get kexts from __PRELINK_INFO.. going straight for __PRELINK_TEXT
1: Mach Kernel Pseudoextension (com.apple.kpi.mach) at 0x41d000 (2000 bytes)
2: Unsupported Pseudoextension (com.apple.kpi.unsupported) at 0x41f000 (3000 bytes)
3: I/O Kit Pseudoextension at 0x422000 (1a000 bytes)
4: Libkern Pseudoextension (com.apple.kpi.libkern) at 0x43c000 (9000 bytes)
5: BSD Kernel Pseudoextension (com.apple.kpi.bsd) at 0x445000 (7000 bytes)
6: com.apple.driver.AppleCredentialManager(33.10.2.0.0) at 0x44c000 (b000 bytes)
7: Private Pseudoextension (com.apple.kpi.private) at 0x457000 (6000 bytes)
8: com.apple.iokit.IOSlowAdaptiveClockingFamily(4.0.0.0.0) at 0x45d000 (4000 bytes)
9: com.apple.iokit.IOReportFamily(33.0.0.0.0) at 0x461000 (5000 bytes)
10: com.apple.driver.AppleARMPlatform(406.20.5.0.0) at 0x466000 (45000 bytes)
11: com.apple.driver.IOSlaveProcessor(8.0.0.0.0) at 0x4ab000 (4000 bytes)
12: com.apple.driver.AppleA5AE2(64.0.0.0.0) at 0x4af000 (5000 bytes)
13: com.apple.driver.LSKDIOKit(0.0.0.0.0) at 0x4b4000 (31000 bytes)
14: com.apple.iokit.IOSurface(52.8.8.0.0) at 0x4e5000 (f000 bytes)
15: com.apple.driver.IODARTFamily(58.0.0.0.0) at 0x4f4000 (d000 bytes)
16: com.apple.driver.AppleM2ScalerCSCDriver(5.6.0.0.0) at 0x501000 (2a000 bytes)
17: com.apple.driver.FairPlayIOKit(0.0.0.0.0) at 0x52b000 (63000 bytes)
18: com.apple.driver.LSKDIOKitMSE(0.0.0.0.0) at 0x58e000 (2e000 bytes)
19: com.apple.driver.AppleVXD390(5.29.0.0.0) at 0x5bc000 (23000 bytes)
20: com.apple.driver.AppleSamsungSPI(81.5.2.0.0) at 0x5df000 (4000 bytes)
21: unrecognized.or.unhandledyet.Please.Report.Me at 0x5e3000 (2000 bytes)
22: com.apple.kec.corecrypto(235.10.8.0.0) at 0x5e5000 (46000 bytes)
Segmentation fault: 11
may I know how do u solve this? Thanks