Kext: I/O Kit USB Family (File: 0x412000) () Kext: AppleEmbeddedLightSensor (File: 0x406000) () Kext: AppleMobileFileIntegrity (File: 0x3cf000) () Kext: IOCryptoAcceleratorFamily (File: 0x3c1000) () Kext: MAC Framework Pseudoextension (File: 0x3c0000) () Kext: AppleSamsungSPI (File: 0x3bc000) () Kext: AppleARMPlatform (File: 0x382000) () Kext: BSD Kernel Pseudoextension (File: 0x37c000) () Kext: Private Pseudoextension (File: 0x377000) () Kext: I/O Kit Pseudoextension (File: 0x360000) () Kext: Unsupported Pseudoextension (File: 0x35e000) () Kext: Mach Kernel Pseudoextension (File: 0x35d000) () Kext: Libkern Pseudoextension (File: 0xffffffff) () The output from a 6.1.3 kernelcache ( iPhone 4 (iPhone3,1)) using this tool, showing 153 kexts, is as follows: The joker tool, from can be used to dump information from a decrypted kernelcache - including system call and Mach trap addresses (in the kernel) as well as a list of all the KEXTs contained therein and their load addresses. The kernelcache is basically the kernel itself as well as all of its extensions (AppleImage3NORAccess, IOAESAccelerator, IOPKEAccelerator, etc.) into one file, then packed/encrypted in an IMG3 (iPhone OS 2.0 and above) or 8900 (iPhone OS 1.0 through 1.1.4) container.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |