Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
blacktop avatar

Ipsw

blacktop/ipsw-skill

  • 157 installs
  • 74 repo stars
  • Updated May 4, 2026
  • blacktop/ipsw-skill

Dump Objective-C and Swift headers from IPSW firmware, dyld shared caches, and Mach-O binaries when you need class layouts without Xcode symbols.

About

ipsw is an agent skill that documents how to use the ipsw CLI to dump Objective-C class headers from IPSW images, dyld shared caches, and Mach-O binaries, including filters and Swift-oriented workflows. Solo and indie builders working on iOS, macOS, or security-minded mobile tooling install it when they need reproducible class maps without opening every binary in a GUI disassembler. The skill is organized as a complete reference—from basic invocation through cache extraction, per-binary dumps, class filtering, header generation, formatting, and Swift-specific steps—so an agent can follow procedural steps instead of guessing flags. It fits the Build phase when you are integrating against closed-source frameworks, validating ABI assumptions, or documenting private API surfaces for internal tools. Complexity is advanced because it assumes comfort with Mach-O, caches, and Apple release artifacts. It is a documentation-style integration skill, not an MCP server or a generic debugger wrapper.

  • Reference covers basic usage, dyld_shared_cache, and standalone Mach-O binaries
  • Filtering classes and header generation with output formatting options
  • Dedicated Swift dumping section alongside Objective-C class dumps
  • Table-of-contents structure across seven major workflow areas

Ipsw by the numbers

  • 157 all-time installs (skills.sh)
  • Ranked #522 of 1,039 Mobile Development skills by installs in the Skillselion catalog
  • Security screen: MEDIUM risk (skills.sh audit)
  • Data as of Jul 31, 2026 (Skillselion catalog sync)
npx skills add https://github.com/blacktop/ipsw-skill --skill ipsw

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs157
repo stars★ 74
Security audit2 / 3 scanners passed
Last updatedMay 4, 2026
Repositoryblacktop/ipsw-skill ↗

What it does

Dump Objective-C and Swift headers from IPSW firmware, dyld shared caches, and Mach-O binaries when you need class layouts without Xcode symbols.

Files

SKILL.mdMarkdownGitHub ↗

IPSW - Apple Reverse Engineering Toolkit

Install: brew install blacktop/tap/ipsw (Linux: see https://github.com/blacktop/ipsw#install)

Choose Your Workflow

GoalStart Here
Download/extract firmwareFirmware Acquisition
Reverse engineer userspaceUserspace RE
Analyze kernel/KEXTsKernel Analysis
Research entitlementsEntitlements
Dump private API headersClass Dump
Analyze standalone binaryMach-O Analysis
Diff two IPSWs/OTAsFirmware Diffing
Symbolicate a crash / panicSymbolication
Parse IMG4/AEA/iBoot/SEPFirmware Components
Decompile / query sandbox profilesSandbox Profile Analysis
Inspect / mount an IPSWIPSW Inspection

---

Firmware Acquisition

# Download latest IPSW for device
ipsw download ipsw --device iPhone16,1 --latest

# Download with automatic kernel/DSC extraction
ipsw download ipsw --device iPhone16,1 --latest --kernel --dyld

# Extract components from local IPSW
ipsw extract --kernel iPhone16,1_18.0_Restore.ipsw
ipsw extract --dyld --dyld-arch arm64e iPhone16,1_18.0_Restore.ipsw

# Remote extraction (no full download)
ipsw extract --kernel --remote <IPSW_URL>

See references/download.md for device identifiers and advanced options.

---

Userspace RE (dyld_shared_cache)

macOS DSC location:

  • macOS 14+: /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e
  • macOS 13 and earlier: /System/Library/dyld/dyld_shared_cache_arm64e

Examples below assume:

export DSC=/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e

Essential Commands

CommandPurpose
dyld a2s <DSC> <ADDR>Address → symbol (triage crash LR/PC)
dyld symaddr <DSC> <SYM> --image <DYLIB>Symbol → address
dyld disass <DSC> --vaddr <ADDR>Disassemble at address
dyld disass <DSC> --symbol <SYM> --image <DYLIB>Disassemble by symbol
dyld xref <DSC> <ADDR> --allFind all references to address
dyld dump <DSC> <ADDR> --size 256Dump raw bytes at address
dyld str <DSC> "pattern" --image <DYLIB>Search strings
dyld objc --class <DSC> --image <DYLIB>List ObjC classes
dyld extract <DSC> <DYLIB> -o ./out/Extract dylib for external tools

Common Workflow

# 1. Resolve address from crash/trace
ipsw dyld a2s $DSC 0x1bc39e1e0
# → -[SomeClass someMethod:] + 0x40

# 2. Disassemble around that address
ipsw dyld disass $DSC --vaddr 0x1bc39e1e0

# 3. Find who calls this function
ipsw dyld xref $DSC 0x1bc39e1a0 --all

# 4. Extract string/data referenced in disassembly
ipsw dyld dump $DSC 0x1bc39e200 --size 64

See references/dyld.md for complete DSC commands.

---

Kernel Analysis

# List all KEXTs
ipsw kernel kexts kernelcache.release.iPhone16,1

# Extract specific KEXT
ipsw kernel extract kernelcache sandbox --output ./kexts/

# Dump syscalls
ipsw kernel syscall kernelcache

# Diff KEXTs between versions
ipsw kernel kexts --diff kernelcache_17.0 kernelcache_18.0

See references/kernel.md for KEXT extraction and kernel analysis.

---

Entitlements

# Single binary entitlements
ipsw macho info --ent /path/to/binary

# Build searchable database from IPSW
ipsw ent --sqlite ent.db --ipsw iOS18.ipsw

# Query database
ipsw ent --sqlite ent.db --key "com.apple.private.security.no-sandbox"
ipsw ent --sqlite ent.db --key "platform-application"
ipsw ent --sqlite ent.db --key "com.apple.private.tcc.manager"

See references/entitlements.md for common entitlements and query patterns.

---

Class Dump

Dump Objective-C headers from binaries or dyld_shared_cache:

# Dump all headers from framework in DSC
ipsw class-dump $DSC SpringBoardServices --headers -o ./headers/

# Dump specific class
ipsw class-dump $DSC Security --class SecKey

# Filter by pattern
ipsw class-dump $DSC UIKit --class 'UIApplication.*' --headers -o ./headers/

# Include runtime addresses (for hooking)
ipsw class-dump $DSC Security --re

# Swift class-dump (separate command, same shape)
ipsw swift-dump $DSC SwiftUI --headers -o ./headers/

See references/class-dump.md for filtering and output options.

---

Mach-O Analysis

# Full binary info
ipsw macho info /path/to/binary

# Disassemble function
ipsw macho disass /path/to/binary --symbol _main

# Get entitlements and signature
ipsw macho info --ent /path/to/binary
ipsw macho info --sig /path/to/binary

See references/macho.md for complete Mach-O commands.

---

Firmware Diffing

Compare two IPSWs, OTAs, or patched OTA directories — surfaces added/removed binaries, entitlement changes, function-starts deltas, and KEXT diffs.

# Diff two IPSWs (markdown report)
ipsw diff old.ipsw new.ipsw --output ./diff/ --markdown

# Include firmware components (iBoot, SEP, etc.) and launchd configs
ipsw diff old.ipsw new.ipsw --fw --launchd --output ./diff/ --markdown

# Diff with KDKs for kernel symbol resolution
ipsw diff old.ipsw new.ipsw --output ./diff/ --markdown \
  --kdk <OLD_KDK>/System/Library/Kernels/kernel.release.t6031 \
  --kdk <NEW_KDK>/System/Library/Kernels/kernel.release.t6031

# Entitlement-only diff
ipsw diff old.ipsw new.ipsw --ent --output ./diff/

# Diff two OTAs (macOS 14+ AEA-encrypted; supply key DB)
ipsw diff old.ota new.ota --key-db keys.json --output ./diff/ --markdown

---

Symbolication

# Symbolicate a panic / crash log against an IPSW
ipsw symbolicate panic-full-2024-03-21.ips iPhone16,1_18.0_Restore.ipsw

# Show disassembly around panic frames
ipsw symbolicate panic.ips firmware.ipsw --peek --peek-count 10

# Symbolicate against a DSC instead
ipsw symbolicate crash.ips $DSC

---

Firmware Components (IMG4, AEA, iBoot, SEP)

For Apple firmware containers — IMG4/IM4P/IM4M, AEA1-encrypted DMGs, iBoot, SEP, AOP, DCP, baseband, and trust caches:

# IMG4 / IM4P / IM4M operations
ipsw img4 info my.img4
ipsw img4 extract --im4p my.img4 --output ./             # IM4P payload (decompressed)
ipsw img4 extract --im4p --im4m --im4r my.img4 -o ./     # All components

# Firmware sub-binaries (iBoot, exclave, AOP, GPU, DCP, baseband)
ipsw fw iboot iBoot.img4
ipsw fw aea --info encrypted.dmg.aea     # AEA1 DMG metadata
ipsw fw aea --key encrypted.dmg.aea       # Pull decryption key
ipsw fw tc TrustCache.img4                # Dump trust cache entries

See ipsw img4 --help and ipsw fw --help for the full list of subcommands.

---

Sandbox Profile Analysis (sb)

Decode and query Apple sandbox profiles compiled into a kernelcache. Useful for capability analysis ("which profiles can open IOSurface?"), attack-surface mapping, and tracking sandbox changes between releases.

# List every profile in a kernelcache
ipsw sb list kernelcache.release.iPhone18,1

# Decompile one profile to SBPL (Sandbox Profile Language)
ipsw sb dec kernelcache.release.iPhone18,1 com.apple.WebKit.WebContent -O WebContent.sb

# Diff sandbox operations between two kernels (find new/removed checks)
ipsw sb opts --diff kernelcache_old kernelcache_new

# Build the cross-profile graph once, then query repeatedly (queries become sub-second)
ipsw sb graph export kernelcache.release.iPhone18,1 -O graph.json

# Capability queries against the graph
ipsw sb query iokit-open IOSurfaceRootUserClient --graph graph.json
ipsw sb query path-write /private/var/mobile/tmp --graph graph.json
ipsw sb query syscall mmap --graph graph.json
ipsw sb query mach-lookup com.apple.mobilegestalt.xpc --graph graph.json

Available query subcommands: iokit-open, path-read, path-write, syscall, sysctl, mach-lookup, mach-register, preference, notification, cypher.

See references/sandbox.md for the full sandbox toolkit.

---

IPSW Inspection

# Summarize an IPSW/OTA (devices, builds, file list)
ipsw info iPhone16,1_18.0_Restore.ipsw
ipsw info --list iPhone16,1_18.0_Restore.ipsw       # full file listing
ipsw info --remote <IPSW_URL>                        # without downloading

# Mount the filesystem / system / dyld_shared_cache DMG
ipsw mount fs iPhone16,1_18.0_Restore.ipsw           # filesystem
ipsw mount sys iPhone16,1_18.0_Restore.ipsw          # system
ipsw mount exc iPhone16,1_18.0_Restore.ipsw          # dyld_shared_cache (cryptex)

# Parse the DeviceTree
ipsw dtree iPhone16,1_18.0_Restore.ipsw --summary
ipsw dtree iPhone16,1_18.0_Restore.ipsw --json | jq '.["device-tree"]["compatible"]'

For AEA-encrypted DMGs (macOS 14+), pass --key-db keys.json or --pem-db pem.json.

---

Pitfalls

1. Symbol cache must be primed. First dyld a2s/symaddr on a DSC creates <dsc>.a2s. Until then lookups appear to "find nothing". Run dyld a2s $DSC <any-addr> once before scripting bulk lookups. 2. AEA-encrypted IPSWs/OTAs. Modern macOS OTAs can ship as AEA1 archives. Pass --key-val <base64> or --key-db keys.json to commands that need to read them (diff, extract, fw aea). 3. Always pass `--image <DYLIB>` for DSC ops. Without it, ipsw walks every dylib map — 10x+ slower. 4. Multi-arch DSCs need `--dyld-arch`. Without it, extraction may pick the wrong slice (arm64 vs arm64e) silently.

---

Reference Files

  • references/download.md - Firmware download, device IDs, extraction
  • references/dyld.md - Complete DSC commands (a2s, xref, dump, str, extract)
  • references/kernel.md - Kernel and KEXT analysis
  • references/entitlements.md - Entitlements database and queries
  • references/class-dump.md - ObjC header dumping
  • references/macho.md - Mach-O binary analysis
  • references/sandbox.md - Sandbox profiles (sb): decompile, diff, graph, capability queries

Tips

1. JSON output: Most commands support --json for scripting (e.g. ipsw dyld info --dylibs --json $DSC | jq -r '.images[].name'). 2. Device IDs: ipsw device-list lists every known identifier; ipsw device-info iPhone16,1 describes a specific one.

Related skills

firebaseXcode Project SetupAutomatically create and configure a new Xcode project with Swift Package Manager dependencies for iOS or macOS agent projects.74.7k392expoExpo Tailwind SetupInstantly configure Tailwind CSS v4 with NativeWind v5 and react-native-css inside an Expo project for universal styling.46.7k2.3kexpoExpo Dev ClientCreate custom development clients for Expo React Native apps that need native modules or Apple-specific targets.45.9k2.3kavdleeSwiftui Expert SkillGet expert guidance when writing, reviewing, or refactoring SwiftUI views, state, performance, and modern iOS/macOS APIs.27.6k3.3kflutterFlutter Apply Architecture Best PracticesEnforce clean layered architecture when creating or refactoring a Flutter mobile application.25.4k2.7kexpoExpo ModuleCreate custom config plugins that safely modify native Android and iOS projects generated by Expo prebuild.25k2.3k

FAQ

Is Ipsw safe to install?

skills.sh reports 2 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.

Mobile Developmentintegrationsbackend
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.