symbolicator - GitLite

KO | EN

gitlite — search

#react #llm #android #machine-learning #rust #deep-learning #windows #awesome #cli #kubernetes #awesome-list #vue #security #open-source

symbolicator

(★ 121)

`ipsw` symbolication signatures

File Explorer

Download Latest Version (.zip)

Showing a partial file list — download the zip above to see everything.

- FUNDING.yml
- launch.json
- settings.json
- logo.png
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
- - xnu.json
.gitignore
LICENSE
Makefile
README.md
TODO.md

# Installation Guide

1. Get the code

git clone https://github.com/blacktop/symbolicator

Downloads the entire project code from GitHub to your computer.

cd symbolicator

Moves into the project folder you just downloaded.

2. Make

Medium Recommended

Prerequisites

Git Needed to download the project code from GitHub.
Make Usually pre-installed on Linux/macOS. On Windows, install separately (e.g. via MSYS2 or WSL).

make

Compiles the code based on the generated build configuration to produce an executable.

✅ If it finishes without errors, it worked. Try running the generated executable directly.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<p align="center">
  <a href="https://github.com/blacktop/symbolicator"><img alt="Symbolicator Logo" src="https://github.com/blacktop/symbolicator/blob/main/docs/logo.png?raw=true" height="400" /></a>
  
  <h3><p align="center"><code>ipsw</code> symbolication signatures</p></h3>
  
<br>

## What 🤔

This repo contains the [ipsw](https://github.com/blacktop/ipsw) symbolication signature files.

## How Good 📈

Currently we are sitting at `63.85%` on **xnu**

## Getting Started 🚀

Get the signatures

```bash
git clone https://github.com/blacktop/symbolicator.git
```

Symbolicate a kernelcache with [ipsw](https://github.com/blacktop/ipsw)

```bash
ipsw kernel sym kernelcache --json --signatures /path/to/symbolicator-repo/kernel
```

Install IDA Plugin

```bash
plugins/ida/install.sh
```

Now you can apply the symbols to you kernelcache in IDA by pressing `Alt+F8`

![ida-pluging](https://raw.githubusercontent.com/blacktop/symbolicator/main/plugins/ida/docs/ida.png)

_The first time the IDB if loaded, the plugin will attempt to automatically load the symbols file (This is verified
using an indication file with the suffix `.symbols_loaded`)_

## Plugins 🔌

Supported Plugins/Scripts

- [Binary Ninja](plugins/binja)
- [Ghidra](plugins/ghidra)
- [IDA Pro](plugins/ida)
- [radare2](https://github.com/radareorg/radare2/blob/master/scripts/ipsw-kernel-symbolicate.r2.js)

## Generate NEW signatures

You can set these ENV VARS to control the the outputed signature's metadata

- `TARGET` The target binary. (e.g. com.apple.driver.AppleMobileFileIntegrity)
- `MAX_VERSION` The maximum version of the target darwin.
- `MIN_VERSION` The minimum version of the target darwin.
- `JSON_FILE` The path to the JSON file. (e.g. /path/to/sig.json)

To generate signatures for `xnu`

```bash
scripts/run.sh --kernel '/path/to/KDK/kernel'
```

To generate signatures for a `kext`

```bash
scripts/run.sh --kext '/path/to/KDK/kext'
```

## TODO

- [ ] add support for global variables/constants
- [ ] byte pattern matching
- [ ] use arg count to assist in identifying anchor caller (as arg position/register)

## Credit

Idea was originally inspired by Jonathan Levin's [disarm](https://newosxbook.com/tools/disarm.html) 'matchers' file.

## License

MIT Copyright (c) 2024 blacktop