Skip to content

Instantly share code, notes, and snippets.

View rickmark's full-sized avatar
🔬
Decoding iOS Formats

Rick Mark rickmark

🔬
Decoding iOS Formats
View GitHub Profile
@rickmark
rickmark / CoreDevice.framework
Last active January 14, 2025 23:17
Apple's Remote Pairing and App Tampering APIs
@protocol NSSecureCoding <NSCoding>
// class methods
+[NSSecureCoding supportsSecureCoding]
@end
@protocol NSCoding
// instance methods
-[NSCoding encodeWithCoder:]
-[NSCoding encodeWithCoder:]
@rickmark
rickmark / kmutil check
Created July 12, 2021 11:40
Preboot out of volume group
`Checking all load info...
Could not find com.apple.DriverKit.AppleUserEthernetASIX
Loaded extension Dext com.apple.DriverKit-AppleUSBCHCOM v1 in loaded boot kernel collection has UUID (nil), but Dext com.apple.DriverKit-AppleUSBCHCOM v1 in boot kernel collection at /System/Volumes/Preboot/69D08F72-9218-472C-B45B-71A3EC4C97EA/boot/758F74EDBCBF3B4BC66E73812DDB551A7BE20128EC78D3A01822231DAC4719FF0BE6E89757423175511AA228556315F7/System/Library/Caches/com.apple.kernelcaches/kernelcache has UUID B725557A-27B6-3767-9645-21634C01AEB3.
Loaded extension Kext com.apple.kpi.libkern v21.0.0 in loaded boot kernel collection has UUID 6C21BC51-8A4C-33A1-A726-68781E753AD2, but Kext com.apple.kpi.libkern v21.0.0 in boot kernel collection at /System/Volumes/Preboot/69D08F72-9218-472C-B45B-71A3EC4C97EA/boot/758F74EDBCBF3B4BC66E73812DDB551A7BE20128EC78D3A01822231DAC4719FF0BE6E89757423175511AA228556315F7/System/Library/Caches/com.apple.kernelcaches/kernelcache has UUID 4380340E-5CB0-4D4F-BEE1-F65B1DA6403D.
Loaded extension Dext c
@rickmark
rickmark / sudo.crash
Created July 12, 2021 08:12
Sudo crashes worry me (libobjc and libpam?) - macOS 12 Beta 2
Process: sudo [2593]
Path: /usr/bin/sudo
Identifier: sudo
Version: ???
Code Type: ARM-64 (Native)
Parent Process: zsh [2586]
Responsible: Terminal [2584]
User ID: 0
@rickmark
rickmark / certificate.pem.txtq
Created July 12, 2021 08:09
Apple Adding old Certificate?
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 45 (0x2d)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C = US, O = Apple Inc., OU = Apple Certification Authority, CN = Apple iPhone Certification Authority
Validity
Not Before: Jul 14 22:32:48 2011 GMT
Not After : Jul 14 22:32:48 2018 GMT
Subject: C = US, O = Apple Inc., OU = Apple iOS Asset Manifest, CN = Asset Manifest Signing
@rickmark
rickmark / FORMATS.md
Created December 10, 2020 08:00
Apple Documentation Project

Apple Formats for Documentation

File Formats

Archives

  • bom
  • pbzx

Mach-O Binary

  • dyld cache
  • AOT rostetta 2

Signature Formats

@rickmark
rickmark / kernel.panic
Created December 7, 2020 22:16
M1 Crash on TBT
panic(cpu 0 caller 0xfffffe001da67da0): Sleep transition timed out after 35 seconds while entering darkwake on way to sleep. Suspected bundle: com.apple.iokit.IOThunderboltFamily. Thread 0x9b85.
Debugger message: panic
Memory ID: 0xff
OS release type: User
OS version: 20C5061b
Kernel version: Darwin Kernel Version 20.2.0: Mon Nov 23 05:24:01 PST 2020; root:xnu-7195.60.74~7/RELEASE_ARM64_T8101
Fileset Kernelcache UUID: 5352E5B473B02A532B3B251B6171AF27
Kernel UUID: CF8253FF-8BCA-3A5E-AE7D-2B77B965B6E8
iBoot version: iBoot-6723.61.3
secure boot?: YES
@rickmark
rickmark / kmutil_dumpstate.log
Created November 9, 2020 00:58
Confused Kernel Extensions
== Extensions by identifier:
com.apple.iokit.IOBluetoothHostControllerTransport v8.0.1f5 (72EBBACD-EBB9-3FA5-AF28-1A51387689FA) in loaded boot kernel collection signed <none> flags []
com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport v8.0.1f5 (0F8DBE5B-6259-35B5-9DAA-2ADB333C5F97) in loaded boot kernel collection signed <none> flags []
com.apple.driver.iPodSBCDriver v1.7.0 (00D81FB8-8699-346C-AA87-BF43D68269AE) in loaded boot kernel collection signed <none> flags []
com.apple.driver.usb.realtek8153patcher v5.0.0 (E086D2DB-A8CE-3633-91AF-0B7C0512C8AB) in loaded boot kernel collection signed <none> flags []
com.apple.fsplaceholder v1.13.2 (25F2570D-F46C-347E-8E3F-393BC722C74F) in loaded system kext collection signed <none> flags []
com.apple.kext.AMD8000Controller v4.0.0 (B8E5CD2F-2206-3A4A-B0D0-2B148D22C458) in loaded system kext collection signed <none> flags []
com.apple.filesystems.hfs.kext v556.41.1 (E5670ED1-5494-391C-B0C5-D724AD0E602A) in loaded boot kernel collection signed <none> flags []
com
@rickmark
rickmark / gist:65242917c2236e3401f97f6a022843ae
Created October 30, 2020 01:35
Unusual boot.efi manifest (ESEC EPRO)
0:d=0 hl=4 l=2796 cons: SEQUENCE
4:d=1 hl=2 l= 4 prim: IA5STRING :IM4M
10:d=1 hl=2 l= 1 prim: INTEGER :00
13:d=1 hl=4 l= 562 cons: SET
17:d=2 hl=9 l= 553 cons: priv [ 1296125506 ]
26:d=3 hl=4 l= 549 cons: SEQUENCE
30:d=4 hl=2 l= 4 prim: IA5STRING :MANB
36:d=4 hl=4 l= 539 cons: SET
40:d=5 hl=8 l= 177 cons: priv [ 1296125520 ]
48:d=6 hl=3 l= 174 cons: SEQUENCE
@rickmark
rickmark / containermanagerd.log
Created September 24, 2020 01:32
bridgeOS downgrade / upgrade
Fri Aug 28 03:21:20 2020 [36] <notice> (0x16afbb000) containermanagerd_init: containermanagerd performing first boot initialization
Fri Aug 28 03:21:20 2020 [36] <notice> (0x16afbb000) -[MCMMigrationStatus _migrateFromManyMarkerFilesToOne]: Migrating from many marker files down to one
Fri Aug 28 03:21:20 2020 [36] <notice> (0x16afbb000) -[MCMMigrationStatus isBuildUpgrade]: Did not find last build info; we must be upgrading from pre-9.3.1 or this is an erase install.
Fri Aug 28 03:21:20 2020 [36] <notice> (0x16afbb000) -[MCMClientConnection _regenerateAllSystemContainerPaths]: Rolling system container directory UUIDs on disk
Fri Aug 28 03:21:20 2020 [36] <notice> (0x16afbb000) -[MCMMigrationStatus writeCurrentBuildInfoToDisk]: Saved last build version of 17P6610
Fri Aug 28 03:21:20 2020 [36] <notice> (0x16b047000) containermanagerd_init_block_invoke: containermanagerd first boot cleanup complete
Fri Aug 28 05:33:16 2020 [36] <notice> (0x16b31f000) containermanagerd_init: containermanagerd performing first boo
@rickmark
rickmark / get_full_install.py
Created August 26, 2020 07:54
Get Big Sur Installer
from deepdiff import DeepDiff
import plistlib
import inspect
import re
import pprint
import wget
INPUT_FILE_15 = "/Users/rickmark/Documents/index-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog"