JTool2 is a radical rewrite of jtool to make it more featureful and extensible, and less buggy.
From the ChangeLog (WhatsNew)
- Matched JTool features:
- -F (find string)
- -a
- -l
- -S, -v
- --pages (automatically in quick)
- -h (for shared cache)
- Everything is faster. Especially disassembly, and in some cases by an order of magnitude:
- When using -q jtool2 is produces almost same output (but faster than) otool/objdump
- Without -q jtool2 is still on par with otool, often faster, AND provides strings + basic decompilation
- When testing on SpringBoard (THE pathological case), -q -d finishes in under 2s! jtool v1 would get take minutes (even with -q)
- Caching in particular is way faster.
- Jtool v1 had an unnecessary cache lookup when adding, which slowed it considerably. No more.
- Sequential address lookups in cache now use cursor
- Decompilation is smarter:
- JTool detects the number of arguments for a given function automatically. Two corner cases are:
- First function call in a given function (won't know how many arguments)
- Functions with no arguments (void) may still show up with their first argument
- Arguments are also autodetected by type! No need to specify the ([ic@b...) etc (although this
will be supported again in a future release, for those cases where the arguments need to be refined)
- New Architectures: arm64e (A12 chipset and later), ARM64_32 (0x2000000c/0x1, for Apple Watch 4)
- ARMv8.1 instructions (CASP, PAN so far)
- ARMv8.3 instructions (so you don't have to wait for IDA plugins from people who won't ever deliver)
B[L]RA[A/B][Z], RETA[A/B], LDRA[A/B] - still need ERETA[A/B] and XPACD, XPACI, XPACLRI (C6-1002)
AUTIA/PACIA/PACGAA Appear to be unused as yet by AAPL
- Can now work directly on *COMPRESSED* kernelcaches! Plan is to integrate joker fully into jtool2 - and soon
- Fix for weird functions like zinit, which seems to ignore (i.e. not get) some arguments (case in point, X2 is not
set, while X3 is! Weird)
- The '-a' and '-o' switch are now much more precise when in shared caches
- Dyld-625 support: BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB and BIND_SUBOPCODE_THREADED_APPLY
Shows opcodes in -opcodes
Successfully reconstruct the bindings for dyldinfo -bind (even though it's no longer the real table..)
Now, I'm still not caught up on all the features of jtool v1, notably code signing and such, but that's in the works, and when it's done, I'll retire jtool v1 for good.
PLEASE HELP TESTING by looking at WhatsNew.txt and trying out features! If you see something (crash) say something (to me) over this forum. You will help improve the tool, and I'll mention your found bugs in the ChangeLog

IMPORTANT NOTE: JTOOL v1 crashes hideously on arm64e (A12+) binaries. This is resolved in jtool2. Going forward, I will not fix jtoolv1 - just use jtoolv2
Also, feature requests are more than requested. I'm currently working on fixing the shared cache extraction so it creates perfect dylibs, as well as in-kernelcache processing, so as to meld joker into jtool2.
Latest build always available at http://NewOSXBook.com/tools/jtool2.tgz, for ARM64, x86_64, and Linux.