Guide to extract the root file system and decompress the kernel cache for iOS.

iOS-File-System-Extraction.md

iOS File System Extraction

For iOS 10 and Up

Starting with iOS 10.0 Apple decrypted the file system and kernel cache. All you have to do is download an IPSW, change the extension to .zip, and unarchive it. The largest size disk image inside the unarchived zip will be the root file system. Simply mount it to see its contents.

Links to download all iOS IPSWs.

For iOS 9 and Below

Originally from /u/RowRocka on Reddit. Gently edited for clarity.

Links to download all iOS OTA ZIPs.

Extract the Root File System

1. Unzip the OTA .zip.
2. Download Jonatan Levin's OTApack and unzip it into the same directory that you unzipped the OTA image to.
3. Open up Terminal and cd to the aforementioned directory.
4. Execute ./pbzx AssetData/payloadv2/payload > pb.xz
5. Unarchive the pb.xz file with The Unarchiver.
6. Go back to Terminal and execute these commands:

mkdir rootfs
mv ./pb ./rootfs
cd rootfs
 ../otaa -e '*' ./pb

7. Done

Decompress the Kernel Cache

1. Unzip the OTA .zip.
2. Go to AssetData/boot.
3. Open a Terminal and cd to the unzipped OTA image directory.
4. Execute cp /AssetData/boot/kernelcache.release.***** (check what your filename is) ./
5. Compile lzssdec.cpp from here.
6. Open the kernel cache file with a Hex editor (I recomend Hex Fiend) and find 0xFEEDFACE. Note the offset.
7. Execute ./lzssdec -o OFFSET_YOUVE_NOTED_IN_STEP_6 < kernelcache.release.***** > kernelcache.decrypted
8. Done