Apple Data Formats and Knowledge

A collection of reverse engineered Apple formats, protocols, or other interesting bits.

Join us on Discord - Discord Rules

Repo inspired by Papers we Love

Our Tooling Repos

Our Homebrew Tap

Install our tap with brew tap hack-different/homebrew-jailbreak

Information about the maintaining of that tap can be found at homebrew-jailbreak

Contributing and a warning

Linking your Discord and GitHub

We want this collection to be around for new jailbreakers and hobbyists for years to come, so we must say: this collection accepts (with gratitude) pull-requests that improve it, but under no circumstances will a PR based on AppleInternal, or any other copyrighted works protected by the DMCA be accepted. If you need help determining this, tag the PR with license help, join the Discord server, and ask a #Legit or higher role for help.

Violation of the DMCA or Copyright law is the responsibility of the submitter.

Primary Data Source

We attempt to derive from machine sources and produce machine readable files (YAML) in this repo under _data. For information about creating and extending data format see Data Format Guidance.

Updates and additions there should automatically be reflected in the documents

hack-different/apple-knowledge/_data

Another authoritative source of information is the open source code released by Apple themselves at one of the following locations:

• Open Source at Apple Wesbite
• Apple's GitHub profile
• apple-oss-distributions's Github profile
• Apple Gifts

Tools

Libraries for Binary Analysis and Modification

See docs/Binary_Tooling

Tools for Binary Analysis and Modification

• mootool - FOSS Ruby Mach-O Tool (aims to replicate jtool2 feature set)
• ktool - FOSS Python Mach-O Tool
• checkra1n/toolchain
• alephsecurity/xnu-qemu-arm64
  • alephsecurity/xnu-qemu-arm64-tools
  • Build iOS on QEMU
• IDA Disassembler by Hex-Rays
  • onethawt/idaplugins-list
  • cellebrite-srl/ida_kernelcache
  • cellebrite-srl/PacExplorer
  • cellebrite-srl/FunctionInliner
  • hack-different/iBoot-IDA
  • matteyeux/ida-iboot-loader
  • haiyuidesu/sephelper
  • Cisco-Talos/GhIDA
  • avast/retdec-idaplugin
• Binary Ninja Disassembler
  • cxnder/bn-dyldsharedcache

Guides and General

• Proteas/apple-cve
• kpwn / qwertyoruiop's Wiki
• kpwn / qwertyoruiop's Papers
• About Apple Prototype and CPFM
• OWASP: iOS Tampering and Reverse Engineering
• Kernel Debug Kit
• *OS Internals by Jonathan Levin
• T2 Dev Setup
• Apple 4CC
• bytepack/IntroToiOSReverseEngineering
• Remote Attack Surface
• Lakr233's Research

Devices

• Device List
• T2
  • T2 Dev Team: t8012 / Apple T2 / bridgeOS
  • Duo Labs: Apple T2 XPC
  • t2linux/apple-bce-drv
• Wi-Fi / Bluetooth
  • seemoo-lab/frankenstein
  • seemoo-lab/internalblue
• The iPhone Wiki
• SMC (System Management Controller) for pre-T2
  • acidanthera/VirtualSMC
  • t8012/smcutil - Create SMC binaries from update payloads

Kernel General

• Mach
  • Apple's XNU Tarballs
• Mach and the Mach Interface Generator by nemo
• Apple IPC by Ian Beer
• acidanthera/Lilu
• osy/AMFIExemption
• Siguza's Research on KTRR
• Tick Tock by xerub
• Casa de PPL by Levin
• KTRW by Brandon Azad
• Qwertyoruiopz Attacking XNU: Part 1
• Qwertyoruiopz Attacking XNU: Part 2
• Kernel Heap by Stefan Esser
• Levin's Who needs task_for_pid() anyway...
• Apple Official Documentation
  • Kernel Programming Guide
  • IOKit Fundamentals
  • Virtual Memory System

Protocols / Formats

Bootloader Related

• EFI
  • EFI
• NVRAM
  • NVRAM unlock
• SEP_memmap
• All About Kernels
  • apple/darwin-xnu
• Factory_Firmware_Payloads
• iBoot
  • iBoot Firebloom
  • OpenJailbreak/iBootRE
  • *OS iBoot
• SecureROM
  • SecureROM Binaries
• TXM - Trusted eXecutation Monitor
  • TXM & SPTM

Archive / Disk Formats

• APFS - Apple Filesystem
  • Apple APFS Reference
  • sgan81/apfs-fuse
  • libyal/libfsapfs
  • cugu/apfs.ksy
  • bxl1989 APFS Remount
• LwVM Lightweight Volume Manager
• NeXT / Apple "Bill of Materials" / pkg / bom
  • iineva/bom
• pbzx
• Apple Disk Image - dmg
  • jhermsmeier/node-udif
  • nlitsme/encrypteddmg
  • darlinghq/darling-dmg
• Signed System Volumes (SSV) / root_hash

Databases / Serialization

• Property Lists
  • libimobiledevice/libplist
• iTunes database
  • jeanthom/libitlp
  • josephw/titl
  • https://metacpan.org/pod/Mac::iTunes::Library::Parse
• Apple iDevice Backup Format
  • rickmark/libibackup
  • horrorho/InflatableDonkey

Image, Sound and Other Resources

• Apple Flavored PNG
• Apple IMA ADPCM
  • Using a Custom Startup Sound on a Power Macintosh G3 Blue and White
• AirPlay2
  • mikebrady/shareport-sync

Software Update / Installers

• Mobile Asset URLs
• notpeter/apple-installer-checksums
• ipsw.me
• ipswbeta.dev

Code and Signature Formats

• Mach-O File Types - Mach-O / Signing / Entitlements
  • sbingner/ldid - Codesign tool
  • ProcursusTeam/ldid - Alternative to sbingner/ldid with some updates for iOS 15 and general fixes
  • m4b Mach Binaries
  • J's Entitlements Database
  • Levin's Code Signing
  • Apple CTF / Compact Type Format
• img4 - Apple signed images, version 4
  • TheiPhoneWiki's documentation on IMG4 files
  • xerub/img4lib
  • m1stadev/PyIMG4 - A Python library/CLI tool for parsing IMG4
  • [tihmstar/img4tool](https://