[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71NJ52P9G202VFVA708R1BX":3,"skill-same:01M71NJ52P9G202VFVA708R1BX":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":14,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M71NJ52P9G202VFVA708R1BX","ipsw",null,"Use this skill when reverse-engineering Apple platforms with the ipsw CLI — analyzing iOS\u002FmacOS Mach-O binaries, disassembling functions inside dyld_shared_cache (DSC), dumping Objective-C\u002FSwift headers from private frameworks, extracting kernelcaches, KEXTs, SEP, iBoot, or DeviceTree from IPSWs\u002FOTAs, decompiling\u002Fquerying sandbox profiles (SBPL), querying entitlements, symbolicating crashes\u002Fpanics, diffing two firmware versions, mounting IPSW DMGs, or downloading Apple firmware. Triggers on iOS\u002FmacOS internals, kernel research, dyld_shared_cache, KEXT diffing, sandbox\u002FSeatbelt profile analysis (SBPL\u002FSBASM\u002Fsandboxd), capability\u002FIOKit queries, entitlement lookup, class-dump, IMG4\u002FAEA handling, or vulnerability research on Apple platforms.","pattanation\u002FNorvik","pattanation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F235419268?v=4","01M71M5THHYYB15ME8R2E4FCZG","Patta","01M71M5TJM1NDM992M8PDKYR2K",0,"MIT","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002FSKILL.md",[],[5,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"headers","kernel","frameworks","sep","reverse","swift","dump","capability","macos","analyzing","cli","apple","vulnerability","analysis","when","reverse-engineering","extracting","firmware","shared","2026-11-10 10:56:23",false,"---\nname: ipsw\ndescription: Use this skill when reverse-engineering Apple platforms with the ipsw CLI — analyzing iOS\u002FmacOS Mach-O binaries, disassembling functions inside dyld_shared_cache (DSC), dumping Objective-C\u002FSwift headers from private frameworks, extracting kernelcaches, KEXTs, SEP, iBoot, or DeviceTree from IPSWs\u002FOTAs, decompiling\u002Fquerying sandbox profiles (SBPL), querying entitlements, symbolicating crashes\u002Fpanics, diffing two firmware versions, mounting IPSW DMGs, or downloading Apple firmware. Triggers on iOS\u002FmacOS internals, kernel research, dyld_shared_cache, KEXT diffing, sandbox\u002FSeatbelt profile analysis (SBPL\u002FSBASM\u002Fsandboxd), capability\u002FIOKit queries, entitlement lookup, class-dump, IMG4\u002FAEA handling, or vulnerability research on Apple platforms.\n---\n\n# IPSW - Apple Reverse Engineering Toolkit\n\n**Install:** `brew install blacktop\u002Ftap\u002Fipsw` (Linux: see https:\u002F\u002Fgithub.com\u002Fblacktop\u002Fipsw#install)\n\n## Choose Your Workflow\n\n| Goal | Start Here |\n|------|------------|\n| Download\u002Fextract firmware | [Firmware Acquisition](#firmware-acquisition) |\n| Reverse engineer userspace | [Userspace RE](#userspace-re-dyld_shared_cache) |\n| Analyze kernel\u002FKEXTs | [Kernel Analysis](#kernel-analysis) |\n| Research entitlements | [Entitlements](#entitlements) |\n| Dump private API headers | [Class Dump](#class-dump) |\n| Analyze standalone binary | [Mach-O Analysis](#mach-o-analysis) |\n| Diff two IPSWs\u002FOTAs | [Firmware Diffing](#firmware-diffing) |\n| Symbolicate a crash \u002F panic | [Symbolication](#symbolication) |\n| Parse IMG4\u002FAEA\u002FiBoot\u002FSEP | [Firmware Components](#firmware-components-img4-aea-iboot-sep) |\n| Decompile \u002F query sandbox profiles | [Sandbox Profile Analysis](#sandbox-profile-analysis-sb) |\n| Inspect \u002F mount an IPSW | [IPSW Inspection](#ipsw-inspection) |\n\n---\n\n## Firmware Acquisition\n\n```bash\n# Download latest IPSW for device\nipsw download ipsw --device iPhone16,1 --latest\n\n# Download with automatic kernel\u002FDSC extraction\nipsw download ipsw --device iPhone16,1 --latest --kernel --dyld\n\n# Extract components from local IPSW\nipsw extract --kernel iPhone16,1_18.0_Restore.ipsw\nipsw extract --dyld --dyld-arch arm64e iPhone16,1_18.0_Restore.ipsw\n\n# Remote extraction (no full download)\nipsw extract --kernel --remote \u003CIPSW_URL>\n```\n\nSee [references\u002Fdownload.md](references\u002Fdownload.md) for device identifiers and advanced options.\n\n---\n\n## Userspace RE (dyld_shared_cache)\n\n**macOS DSC location:**\n- macOS 14+: `\u002FSystem\u002FVolumes\u002FPreboot\u002FCryptexes\u002FOS\u002FSystem\u002FLibrary\u002Fdyld\u002Fdyld_shared_cache_arm64e`\n- macOS 13 and earlier: `\u002FSystem\u002FLibrary\u002Fdyld\u002Fdyld_shared_cache_arm64e`\n\nExamples below assume:\n```bash\nexport DSC=\u002FSystem\u002FVolumes\u002FPreboot\u002FCryptexes\u002FOS\u002FSystem\u002FLibrary\u002Fdyld\u002Fdyld_shared_cache_arm64e\n```\n\n### Essential Commands\n\n| Command | Purpose |\n|---------|---------|\n| `dyld a2s \u003CDSC> \u003CADDR>` | Address → symbol (triage crash LR\u002FPC) |\n| `dyld symaddr \u003CDSC> \u003CSYM> --image \u003CDYLIB>` | Symbol → address |\n| `dyld disass \u003CDSC> --vaddr \u003CADDR>` | Disassemble at address |\n| `dyld disass \u003CDSC> --symbol \u003CSYM> --image \u003CDYLIB>` | Disassemble by symbol |\n| `dyld xref \u003CDSC> \u003CADDR> --all` | Find all references to address |\n| `dyld dump \u003CDSC> \u003CADDR> --size 256` | Dump raw bytes at address |\n| `dyld str \u003CDSC> \"pattern\" --image \u003CDYLIB>` | Search strings |\n| `dyld objc --class \u003CDSC> --image \u003CDYLIB>` | List ObjC classes |\n| `dyld extract \u003CDSC> \u003CDYLIB> -o .\u002Fout\u002F` | Extract dylib for external tools |\n\n### Common Workflow\n\n```bash\n# 1. Resolve address from crash\u002Ftrace\nipsw dyld a2s $DSC 0x1bc39e1e0\n# → -[SomeClass someMethod:] + 0x40\n\n# 2. Disassemble around that address\nipsw dyld disass $DSC --vaddr 0x1bc39e1e0\n\n# 3. Find who calls this function\nipsw dyld xref $DSC 0x1bc39e1a0 --all\n\n# 4. Extract string\u002Fdata referenced in disassembly\nipsw dyld dump $DSC 0x1bc39e200 --size 64\n```\n\nSee [references\u002Fdyld.md](references\u002Fdyld.md) for complete DSC commands.\n\n---\n\n## Kernel Analysis\n\n```bash\n# List all KEXTs\nipsw kernel kexts kernelcache.release.iPhone16,1\n\n# Extract specific KEXT\nipsw kernel extract kernelcache sandbox --output .\u002Fkexts\u002F\n\n# Dump syscalls\nipsw kernel syscall kernelcache\n\n# Diff KEXTs between versions\nipsw kernel kexts --diff kernelcache_17.0 kernelcache_18.0\n```\n\nSee [references\u002Fkernel.md](references\u002Fkernel.md) for KEXT extraction and kernel analysis.\n\n---\n\n## Entitlements\n\n```bash\n# Single binary entitlements\nipsw macho info --ent \u002Fpath\u002Fto\u002Fbinary\n\n# Build searchable database from IPSW\nipsw ent --sqlite ent.db --ipsw iOS18.ipsw\n\n# Query database\nipsw ent --sqlite ent.db --key \"com.apple.private.security.no-sandbox\"\nipsw ent --sqlite ent.db --key \"platform-application\"\nipsw ent --sqlite ent.db --key \"com.apple.private.tcc.manager\"\n```\n\nSee [references\u002Fentitlements.md](references\u002Fentitlements.md) for common entitlements and query patterns.\n\n---\n\n## Class Dump\n\nDump Objective-C headers from binaries or dyld_shared_cache:\n\n```bash\n# Dump all headers from framework in DSC\nipsw class-dump $DSC SpringBoardServices --headers -o .\u002Fheaders\u002F\n\n# Dump specific class\nipsw class-dump $DSC Security --class SecKey\n\n# Filter by pattern\nipsw class-dump $DSC UIKit --class 'UIApplication.*' --headers -o .\u002Fheaders\u002F\n\n# Include runtime addresses (for hooking)\nipsw class-dump $DSC Security --re\n\n# Swift class-dump (separate command, same shape)\nipsw swift-dump $DSC SwiftUI --headers -o .\u002Fheaders\u002F\n```\n\nSee [references\u002Fclass-dump.md](references\u002Fclass-dump.md) for filtering and output options.\n\n---\n\n## Mach-O Analysis\n\n```bash\n# Full binary info\nipsw macho info \u002Fpath\u002Fto\u002Fbinary\n\n# Disassemble function\nipsw macho disass \u002Fpath\u002Fto\u002Fbinary --symbol _main\n\n# Get entitlements and signature\nipsw macho info --ent \u002Fpath\u002Fto\u002Fbinary\nipsw macho info --sig \u002Fpath\u002Fto\u002Fbinary\n```\n\nSee [references\u002Fmacho.md](references\u002Fmacho.md) for complete Mach-O commands.\n\n---\n\n## Firmware Diffing\n\nCompare two IPSWs, OTAs, or patched OTA directories — surfaces added\u002Fremoved binaries, entitlement changes, function-starts deltas, and KEXT diffs.\n\n```bash\n# Diff two IPSWs (markdown report)\nipsw diff old.ipsw new.ipsw --output .\u002Fdiff\u002F --markdown\n\n# Include firmware components (iBoot, SEP, etc.) and launchd configs\nipsw diff old.ipsw new.ipsw --fw --launchd --output .\u002Fdiff\u002F --markdown\n\n# Diff with KDKs for kernel symbol resolution\nipsw diff old.ipsw new.ipsw --output .\u002Fdiff\u002F --markdown \\\n  --kdk \u003COLD_KDK>\u002FSystem\u002FLibrary\u002FKernels\u002Fkernel.release.t6031 \\\n  --kdk \u003CNEW_KDK>\u002FSystem\u002FLibrary\u002FKernels\u002Fkernel.release.t6031\n\n# Entitlement-only diff\nipsw diff old.ipsw new.ipsw --ent --output .\u002Fdiff\u002F\n\n# Diff two OTAs (macOS 14+ AEA-encrypted; supply key DB)\nipsw diff old.ota new.ota --key-db keys.json --output .\u002Fdiff\u002F --markdown\n```\n\n---\n\n## Symbolication\n\n```bash\n# Symbolicate a panic \u002F crash log against an IPSW\nipsw symbolicate panic-full-2024-03-21.ips iPhone16,1_18.0_Restore.ipsw\n\n# Show disassembly around panic frames\nipsw symbolicate panic.ips firmware.ipsw --peek --peek-count 10\n\n# Symbolicate against a DSC instead\nipsw symbolicate crash.ips $DSC\n```\n\n---\n\n## Firmware Components (IMG4, AEA, iBoot, SEP)\n\nFor Apple firmware containers — IMG4\u002FIM4P\u002FIM4M, AEA1-encrypted DMGs, iBoot, SEP, AOP, DCP, baseband, and trust caches:\n\n```bash\n# IMG4 \u002F IM4P \u002F IM4M operations\nipsw img4 info my.img4\nipsw img4 extract --im4p my.img4 --output .\u002F             # IM4P payload (decompressed)\nipsw img4 extract --im4p --im4m --im4r my.img4 -o .\u002F     # All components\n\n# Firmware sub-binaries (iBoot, exclave, AOP, GPU, DCP, baseband)\nipsw fw iboot iBoot.img4\nipsw fw aea --info encrypted.dmg.aea     # AEA1 DMG metadata\nipsw fw aea --key encrypted.dmg.aea       # Pull decryption key\nipsw fw tc TrustCache.img4                # Dump trust cache entries\n```\n\nSee `ipsw img4 --help` and `ipsw fw --help` for the full list of subcommands.\n\n---\n\n## Sandbox Profile Analysis (`sb`)\n\nDecode and query Apple sandbox profiles compiled into a kernelcache. Useful for capability analysis (\"which profiles can open IOSurface?\"), attack-surface mapping, and tracking sandbox changes between releases.\n\n```bash\n# List every profile in a kernelcache\nipsw sb list kernelcache.release.iPhone18,1\n\n# Decompile one profile to SBPL (Sandbox Profile Language)\nipsw sb dec kernelcache.release.iPhone18,1 com.apple.WebKit.WebContent -O WebContent.sb\n\n# Diff sandbox operations between two kernels (find new\u002Fremoved checks)\nipsw sb opts --diff kernelcache_old kernelcache_new\n\n# Build the cross-profile graph once, then query repeatedly (queries become sub-second)\nipsw sb graph export kernelcache.release.iPhone18,1 -O graph.json\n\n# Capability queries against the graph\nipsw sb query iokit-open IOSurfaceRootUserClient --graph graph.json\nipsw sb query path-write \u002Fprivate\u002Fvar\u002Fmobile\u002Ftmp --graph graph.json\nipsw sb query syscall mmap --graph graph.json\nipsw sb query mach-lookup com.apple.mobilegestalt.xpc --graph graph.json\n```\n\nAvailable query subcommands: `iokit-open`, `path-read`, `path-write`, `syscall`, `sysctl`, `mach-lookup`, `mach-register`, `preference`, `notification`, `cypher`.\n\nSee [references\u002Fsandbox.md](references\u002Fsandbox.md) for the full sandbox toolkit.\n\n---\n\n## IPSW Inspection\n\n```bash\n# Summarize an IPSW\u002FOTA (devices, builds, file list)\nipsw info iPhone16,1_18.0_Restore.ipsw\nipsw info --list iPhone16,1_18.0_Restore.ipsw       # full file listing\nipsw info --remote \u003CIPSW_URL>                        # without downloading\n\n# Mount the filesystem \u002F system \u002F dyld_shared_cache DMG\nipsw mount fs iPhone16,1_18.0_Restore.ipsw           # filesystem\nipsw mount sys iPhone16,1_18.0_Restore.ipsw          # system\nipsw mount exc iPhone16,1_18.0_Restore.ipsw          # dyld_shared_cache (cryptex)\n\n# Parse the DeviceTree\nipsw dtree iPhone16,1_18.0_Restore.ipsw --summary\nipsw dtree iPhone16,1_18.0_Restore.ipsw --json | jq '.[\"device-tree\"][\"compatible\"]'\n```\n\nFor AEA-encrypted DMGs (macOS 14+), pass `--key-db keys.json` or `--pem-db pem.json`.\n\n---\n\n## Pitfalls\n\n1. **Symbol cache must be primed.** First `dyld a2s`\u002F`symaddr` on a DSC creates `\u003Cdsc>.a2s`. Until then lookups appear to \"find nothing\". Run `dyld a2s $DSC \u003Cany-addr>` once before scripting bulk lookups.\n2. **AEA-encrypted IPSWs\u002FOTAs.** Modern macOS OTAs can ship as AEA1 archives. Pass `--key-val \u003Cbase64>` or `--key-db keys.json` to commands that need to read them (`diff`, `extract`, `fw aea`).\n3. **Always pass `--image \u003CDYLIB>`** for DSC ops. Without it, ipsw walks every dylib map — 10x+ slower.\n4. **Multi-arch DSCs need `--dyld-arch`.** Without it, extraction may pick the wrong slice (arm64 vs arm64e) silently.\n\n---\n\n## Reference Files\n\n- [references\u002Fdownload.md](references\u002Fdownload.md) - Firmware download, device IDs, extraction\n- [references\u002Fdyld.md](references\u002Fdyld.md) - Complete DSC commands (a2s, xref, dump, str, extract)\n- [references\u002Fkernel.md](references\u002Fkernel.md) - Kernel and KEXT analysis\n- [references\u002Fentitlements.md](references\u002Fentitlements.md) - Entitlements database and queries\n- [references\u002Fclass-dump.md](references\u002Fclass-dump.md) - ObjC header dumping\n- [references\u002Fmacho.md](references\u002Fmacho.md) - Mach-O binary analysis\n- [references\u002Fsandbox.md](references\u002Fsandbox.md) - Sandbox profiles (`sb`): decompile, diff, graph, capability queries\n\n## Tips\n\n1. **JSON output:** Most commands support `--json` for scripting (e.g. `ipsw dyld info --dylibs --json $DSC | jq -r '.images[].name'`).\n2. **Device IDs:** `ipsw device-list` lists every known identifier; `ipsw device-info iPhone16,1` describes a specific one.\n","# IPSW - Apple Reverse Engineering Toolkit\n\n**Install:** `brew install blacktop\u002Ftap\u002Fipsw` (Linux: see https:\u002F\u002Fgithub.com\u002Fblacktop\u002Fipsw#install)\n\n## Choose Your Workflow\n\n| Goal | Start Here |\n|------|------------|\n| Download\u002Fextract firmware | [Firmware Acquisition](#firmware-acquisition) |\n| Reverse engineer userspace | [Userspace RE](#userspace-re-dyld_shared_cache) |\n| Analyze kernel\u002FKEXTs | [Kernel Analysis](#kernel-analysis) |\n| Research entitlements | [Entitlements](#entitlements) |\n| Dump private API headers | [Class Dump](#class-dump) |\n| Analyze standalone binary | [Mach-O Analysis](#mach-o-analysis) |\n| Diff two IPSWs\u002FOTAs | [Firmware Diffing](#firmware-diffing) |\n| Symbolicate a crash \u002F panic | [Symbolication](#symbolication) |\n| Parse IMG4\u002FAEA\u002FiBoot\u002FSEP | [Firmware Components](#firmware-components-img4-aea-iboot-sep) |\n| Decompile \u002F query sandbox profiles | [Sandbox Profile Analysis](#sandbox-profile-analysis-sb) |\n| Inspect \u002F mount an IPSW | [IPSW Inspection](#ipsw-inspection) |\n\n---\n\n## Firmware Acquisition\n\n```bash\n# Download latest IPSW for device\nipsw download ipsw --device iPhone16,1 --latest\n\n# Download with automatic kernel\u002FDSC extraction\nipsw download ipsw --device iPhone16,1 --latest --kernel --dyld\n\n# Extract components from local IPSW\nipsw extract --kernel iPhone16,1_18.0_Restore.ipsw\nipsw extract --dyld --dyld-arch arm64e iPhone16,1_18.0_Restore.ipsw\n\n# Remote extraction (no full download)\nipsw extract --kernel --remote \u003CIPSW_URL>\n```\n\nSee [references\u002Fdownload.md](references\u002Fdownload.md) for device identifiers and advanced options.\n\n---\n\n## Userspace RE (dyld_shared_cache)\n\n**macOS DSC location:**\n- macOS 14+: `\u002FSystem\u002FVolumes\u002FPreboot\u002FCryptexes\u002FOS\u002FSystem\u002FLibrary\u002Fdyld\u002Fdyld_shared_cache_arm64e`\n- macOS 13 and earlier: `\u002FSystem\u002FLibrary\u002Fdyld\u002Fdyld_shared_cache_arm64e`\n\nExamples below assume:\n```bash\nexport DSC=\u002FSystem\u002FVolumes\u002FPreboot\u002FCryptexes\u002FOS\u002FSystem\u002FLibrary\u002Fdyld\u002Fdyld_shared_cache_arm64e\n```\n\n### Essential Commands\n\n| Command | Purpose |\n|---------|---------|\n| `dyld a2s \u003CDSC> \u003CADDR>` | Address → symbol (triage crash LR\u002FPC) |\n| `dyld symaddr \u003CDSC> \u003CSYM> --image \u003CDYLIB>` | Symbol → address |\n| `dyld disass \u003CDSC> --vaddr \u003CADDR>` | Disassemble at address |\n| `dyld disass \u003CDSC> --symbol \u003CSYM> --image \u003CDYLIB>` | Disassemble by symbol |\n| `dyld xref \u003CDSC> \u003CADDR> --all` | Find all references to address |\n| `dyld dump \u003CDSC> \u003CADDR> --size 256` | Dump raw bytes at address |\n| `dyld str \u003CDSC> \"pattern\" --image \u003CDYLIB>` | Search strings |\n| `dyld objc --class \u003CDSC> --image \u003CDYLIB>` | List ObjC classes |\n| `dyld extract \u003CDSC> \u003CDYLIB> -o .\u002Fout\u002F` | Extract dylib for external tools |\n\n### Common Workflow\n\n```bash\n# 1. Resolve address from crash\u002Ftrace\nipsw dyld a2s $DSC 0x1bc39e1e0\n# → -[SomeClass someMethod:] + 0x40\n\n# 2. Disassemble around that address\nipsw dyld disass $DSC --vaddr 0x1bc39e1e0\n\n# 3. Find who calls this function\nipsw dyld xref $DSC 0x1bc39e1a0 --all\n\n# 4. Extract string\u002Fdata referenced in disassembly\nipsw dyld dump $DSC 0x1bc39e200 --size 64\n```\n\nSee [references\u002Fdyld.md](references\u002Fdyld.md) for complete DSC commands.\n\n---\n\n## Kernel Analysis\n\n```bash\n# List all KEXTs\nipsw kernel kexts kernelcache.release.iPhone16,1\n\n# Extract specific KEXT\nipsw kernel extract kernelcache sandbox --output .\u002Fkexts\u002F\n\n# Dump syscalls\nipsw kernel syscall kernelcache\n\n# Diff KEXTs between versions\nipsw kernel kexts --diff kernelcache_17.0 kernelcache_18.0\n```\n\nSee [references\u002Fkernel.md](references\u002Fkernel.md) for KEXT extraction and kernel analysis.\n\n---\n\n## Entitlements\n\n```bash\n# Single binary entitlements\nipsw macho info --ent \u002Fpath\u002Fto\u002Fbinary\n\n# Build searchable database from IPSW\nipsw ent --sqlite ent.db --ipsw iOS18.ipsw\n\n# Query database\nipsw ent --sqlite ent.db --key \"com.apple.private.security.no-sandbox\"\nipsw ent --sqlite ent.db --key \"platform-application\"\nipsw ent --sqlite ent.db --key \"com.apple.private.tcc.manager\"\n```\n\nSee [references\u002Fentitlements.md](references\u002Fentitlements.md) for common entitlements and query patterns.\n\n---\n\n## Class Dump\n\nDump Objective-C headers from binaries or dyld_shared_cache:\n\n```bash\n# Dump all headers from framework in DSC\nipsw class-dump $DSC SpringBoardServices --headers -o .\u002Fheaders\u002F\n\n# Dump specific class\nipsw class-dump $DSC Security --class SecKey\n\n# Filter by pattern\nipsw class-dump $DSC UIKit --class 'UIApplication.*' --headers -o .\u002Fheaders\u002F\n\n# Include runtime addresses (for hooking)\nipsw class-dump $DSC Security --re\n\n# Swift class-dump (separate command, same shape)\nipsw swift-dump $DSC SwiftUI --headers -o .\u002Fheaders\u002F\n```\n\nSee [references\u002Fclass-dump.md](references\u002Fclass-dump.md) for filtering and output options.\n\n---\n\n## Mach-O Analysis\n\n```bash\n# Full binary info\nipsw macho info \u002Fpath\u002Fto\u002Fbinary\n\n# Disassemble function\nipsw macho disass \u002Fpath\u002Fto\u002Fbinary --symbol _main\n\n# Get entitlements and signature\nipsw macho info --ent \u002Fpath\u002Fto\u002Fbinary\nipsw macho info --sig \u002Fpath\u002Fto\u002Fbinary\n```\n\nSee [references\u002Fmacho.md](references\u002Fmacho.md) for complete Mach-O commands.\n\n---\n\n## Firmware Diffing\n\nCompare two IPSWs, OTAs, or patched OTA directories — surfaces added\u002Fremoved binaries, entitlement changes, function-starts deltas, and KEXT diffs.\n\n```bash\n# Diff two IPSWs (markdown report)\nipsw diff old.ipsw new.ipsw --output .\u002Fdiff\u002F --markdown\n\n# Include firmware components (iBoot, SEP, etc.) and launchd configs\nipsw diff old.ipsw new.ipsw --fw --launchd --output .\u002Fdiff\u002F --markdown\n\n# Diff with KDKs for kernel symbol resolution\nipsw diff old.ipsw new.ipsw --output .\u002Fdiff\u002F --markdown \\\n  --kdk \u003COLD_KDK>\u002FSystem\u002FLibrary\u002FKernels\u002Fkernel.release.t6031 \\\n  --kdk \u003CNEW_KDK>\u002FSystem\u002FLibrary\u002FKernels\u002Fkernel.release.t6031\n\n# Entitlement-only diff\nipsw diff old.ipsw new.ipsw --ent --output .\u002Fdiff\u002F\n\n# Diff two OTAs (macOS 14+ AEA-encrypted; supply key DB)\nipsw diff old.ota new.ota --key-db keys.json --output .\u002Fdiff\u002F --markdown\n```\n\n---\n\n## Symbolication\n\n```bash\n# Symbolicate a panic \u002F crash log against an IPSW\nipsw symbolicate panic-full-2024-03-21.ips iPhone16,1_18.0_Restore.ipsw\n\n# Show disassembly around panic frames\nipsw symbolicate panic.ips firmware.ipsw --peek --peek-count 10\n\n# Symbolicate against a DSC instead\nipsw symbolicate crash.ips $DSC\n```\n\n---\n\n## Firmware Components (IMG4, AEA, iBoot, SEP)\n\nFor Apple firmware containers — IMG4\u002FIM4P\u002FIM4M, AEA1-encrypted DMGs, iBoot, SEP, AOP, DCP, baseband, and trust caches:\n\n```bash\n# IMG4 \u002F IM4P \u002F IM4M operations\nipsw img4 info my.img4\nipsw img4 extract --im4p my.img4 --output .\u002F             # IM4P payload (decompressed)\nipsw img4 extract --im4p --im4m --im4r my.img4 -o .\u002F     # All components\n\n# Firmware sub-binaries (iBoot, exclave, AOP, GPU, DCP, baseband)\nipsw fw iboot iBoot.img4\nipsw fw aea --info encrypted.dmg.aea     # AEA1 DMG metadata\nipsw fw aea --key encrypted.dmg.aea       # Pull decryption key\nipsw fw tc TrustCache.img4                # Dump trust cache entries\n```\n\nSee `ipsw img4 --help` and `ipsw fw --help` for the full list of subcommands.\n\n---\n\n## Sandbox Profile Analysis (`sb`)\n\nDecode and query Apple sandbox profiles compiled into a kernelcache. Useful for capability analysis (\"which profiles can open IOSurface?\"), attack-surface mapping, and tracking sandbox changes between releases.\n\n```bash\n# List every profile in a kernelcache\nipsw sb list kernelcache.release.iPhone18,1\n\n# Decompile one profile to SBPL (Sandbox Profile Language)\nipsw sb dec kernelcache.release.iPhone18,1 com.apple.WebKit.WebContent -O WebContent.sb\n\n# Diff sandbox operations between two kernels (find new\u002Fremoved checks)\nipsw sb opts --diff kernelcache_old kernelcache_new\n\n# Build the cross-profile graph once, then query repeatedly (queries become sub-second)\nipsw sb graph export kernelcache.release.iPhone18,1 -O graph.json\n\n# Capability queries against the graph\nipsw sb query iokit-open IOSurfaceRootUserClient --graph graph.json\nipsw sb query path-write \u002Fprivate\u002Fvar\u002Fmobile\u002Ftmp --graph graph.json\nipsw sb query syscall mmap --graph graph.json\nipsw sb query mach-lookup com.apple.mobilegestalt.xpc --graph graph.json\n```\n\nAvailable query subcommands: `iokit-open`, `path-read`, `path-write`, `syscall`, `sysctl`, `mach-lookup`, `mach-register`, `preference`, `notification`, `cypher`.\n\nSee [references\u002Fsandbox.md](references\u002Fsandbox.md) for the full sandbox toolkit.\n\n---\n\n## IPSW Inspection\n\n```bash\n# Summarize an IPSW\u002FOTA (devices, builds, file list)\nipsw info iPhone16,1_18.0_Restore.ipsw\nipsw info --list iPhone16,1_18.0_Restore.ipsw       # full file listing\nipsw info --remote \u003CIPSW_URL>                        # without downloading\n\n# Mount the filesystem \u002F system \u002F dyld_shared_cache DMG\nipsw mount fs iPhone16,1_18.0_Restore.ipsw           # filesystem\nipsw mount sys iPhone16,1_18.0_Restore.ipsw          # system\nipsw mount exc iPhone16,1_18.0_Restore.ipsw          # dyld_shared_cache (cryptex)\n\n# Parse the DeviceTree\nipsw dtree iPhone16,1_18.0_Restore.ipsw --summary\nipsw dtree iPhone16,1_18.0_Restore.ipsw --json | jq '.[\"device-tree\"][\"compatible\"]'\n```\n\nFor AEA-encrypted DMGs (macOS 14+), pass `--key-db keys.json` or `--pem-db pem.json`.\n\n---\n\n## Pitfalls\n\n1. **Symbol cache must be primed.** First `dyld a2s`\u002F`symaddr` on a DSC creates `\u003Cdsc>.a2s`. Until then lookups appear to \"find nothing\". Run `dyld a2s $DSC \u003Cany-addr>` once before scripting bulk lookups.\n2. **AEA-encrypted IPSWs\u002FOTAs.** Modern macOS OTAs can ship as AEA1 archives. Pass `--key-val \u003Cbase64>` or `--key-db keys.json` to commands that need to read them (`diff`, `extract`, `fw aea`).\n3. **Always pass `--image \u003CDYLIB>`** for DSC ops. Without it, ipsw walks every dylib map — 10x+ slower.\n4. **Multi-arch DSCs need `--dyld-arch`.** Without it, extraction may pick the wrong slice (arm64 vs arm64e) silently.\n\n---\n\n## Reference Files\n\n- [references\u002Fdownload.md](references\u002Fdownload.md) - Firmware download, device IDs, extraction\n- [references\u002Fdyld.md](references\u002Fdyld.md) - Complete DSC commands (a2s, xref, dump, str, extract)\n- [references\u002Fkernel.md](references\u002Fkernel.md) - Kernel and KEXT analysis\n- [references\u002Fentitlements.md](references\u002Fentitlements.md) - Entitlements database and queries\n- [references\u002Fclass-dump.md](references\u002Fclass-dump.md) - ObjC header dumping\n- [references\u002Fmacho.md](references\u002Fmacho.md) - Mach-O binary analysis\n- [references\u002Fsandbox.md](references\u002Fsandbox.md) - Sandbox profiles (`sb`): decompile, diff, graph, capability queries\n\n## Tips\n\n1. **JSON output:** Most commands support `--json` for scripting (e.g. `ipsw dyld info --dylibs --json $DSC | jq -r '.images[].name'`).\n2. **Device IDs:** `ipsw device-list` lists every known identifier; `ipsw device-info iPhone16,1` describes a specific one.\n",{"name":5,"description":7},"claude\u002Finstall-gsd-build-foQdV","d86cd127f527124b5fd0fd0bc679a4d79b7d01d7",".agents\u002Fskills\u002Fipsw","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik","https:\u002F\u002Fnorvik-orpin.vercel.app","https:\u002F\u002Fgithub.com\u002Fpattanation","2026-07-17 11:17:04",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add pattanation\u002FNorvik --skill ipsw",{"tool":57,"command":58},"bunx","bunx skills add pattanation\u002FNorvik --skill ipsw",{"tool":60,"command":61},"pnpm","pnpm dlx skills add pattanation\u002FNorvik --skill ipsw","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002FSKILL.md",true,[65,70,76,80,84,88,92,96],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":16},"LICENSE.txt","LICENSE","许可证",1070,{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fclass-dump.md","REFERENCE","参考文档",4992,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002Freferences\u002Fclass-dump.md",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fdownload.md",8292,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002Freferences\u002Fdownload.md",{"path":81,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fdyld.md",5472,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002Freferences\u002Fdyld.md",{"path":85,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fentitlements.md",4885,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002Freferences\u002Fentitlements.md",{"path":89,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fkernel.md",4798,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002Freferences\u002Fkernel.md",{"path":93,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fmacho.md",5192,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002Freferences\u002Fmacho.md",{"path":97,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fsandbox.md",5609,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fipsw\u002Freferences\u002Fsandbox.md",[101,136,162,185,207,222],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":105,"licenseFileUrl":106,"sourceHtmlUrl":107,"categories":108,"keywords":117,"publishedAt":135},"01M71QDV4DM8T19HEHWATEF1K4","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fwebapp-testing\u002FSKILL.md",[109,114],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":115,"categoryName":116,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000009","前端开发",[118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134],"webapp","testing","webapp testing","for","applications","local","frontend","debugging","toolkit","logs","browser","with","playwright","web","behavior","ui","screenshots","2026-11-10 13:02:02",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":105,"licenseFileUrl":140,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":135},"01M71QDH2GGMXGA9105C9W1N7B","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fweb-artifacts-builder\u002FSKILL.md",[143],{"categoryNo":115,"categoryName":116,"taxonomyType":112,"taxonomyTypeDesc":113},[145,146,147,131,148,149,150,121,151,152,124,153,154,155,156,157,158,159,160,161],"builder","artifacts builder","artifacts","web artifacts builder","single-file","css","Tailwind","ui components","single","use","file","components","react","multi","state","routing","state management",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":166,"sourceHtmlUrl":167,"categories":168,"keywords":170,"publishedAt":135},"01M71QD9T2XC3EWMQNN9ACNWQ1","vueuse-functions","Apply VueUse composables where appropriate to build concise, maintainable Vue.js \u002F Nuxt features.","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fvueuse-functions\u002FLICENSE.md","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fvueuse-functions\u002FSKILL.md",[169],{"categoryNo":115,"categoryName":116,"taxonomyType":112,"taxonomyTypeDesc":113},[171,172,173,174,175,176,177,178,179,180,181,182,183,184],"functions","vueuse","vueuse functions","project","nuxt","apply","github","concise","build","https","features","vue","js","composables",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":189,"sourceHtmlUrl":190,"categories":191,"keywords":194,"publishedAt":135},"01M71QD51HWSGYMCMB7RW7PGK8","vue-testing-best-practices","Use for Vue.js testing. Covers Vitest, Vue Test Utils, component testing, mocking, testing patterns, and Playwright for E2E testing.","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fvue-testing-best-practices\u002FLICENSE.md","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fvue-testing-best-practices\u002FSKILL.md",[192,193],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},{"categoryNo":115,"categoryName":116,"taxonomyType":112,"taxonomyTypeDesc":113},[195,119,196,182,197,130,198,199,200,177,201,121,202,203,204,154,205,183,206],"vue testing best practices","testing best practices","best practices","test","testing patterns","component","vitest","mocking","e2e","utils","patterns","e2e testing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":211,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":135},"01M71QD358H2DJ9THJRBP77T3T","vue-router-best-practices","Vue Router 4 patterns, navigation guards, route params, and route-component lifecycle interactions.","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fvue-router-best-practices\u002FLICENSE.md","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fvue-router-best-practices\u002FSKILL.md",[214],{"categoryNo":115,"categoryName":116,"taxonomyType":112,"taxonomyTypeDesc":113},[216,182,217,197,218,200,219,177,205,220,221],"router","vue router best practices","route","guards","navigation","lifecycle",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":226,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":135},"01M71QCYPNWDE2MQZ1TF3ED5S4","vue-best-practices","MUST be used for Vue.js tasks. Strongly recommends Composition API with `\u003Cscript setup>` and TypeScript as the standard approach. Covers Vue 3, SSR, Volar, vue-tsc. Load for any Vue, .vue files, Vue Router, Pinia, or Vite with Vue work. ALWAYS use Composition API unless the project explicitly requires Options API.","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fvue-best-practices\u002FLICENSE.md","https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fvue-best-practices\u002FSKILL.md",[229],{"categoryNo":115,"categoryName":116,"taxonomyType":112,"taxonomyTypeDesc":113},[231,182,197,232,174,233,234,235,216,236,237,238,239,240,241,121,242,154,243,244],"vue best practices","Composition","files","tasks","api","pinia","work","options","ssr","typescript","as","vite","load","standard"]