#JTool2 - Twitter Hashtag

about 3 years ago

#ios17 kernelcache structured a tad differently and breaks #jtool2, but we're on it. Using --analyze already uncovers interesting syscall changes and lots under the hood! Fix soon.

0

8

1

0

3K

Technologeeks @Technologeeks

almost 4 years ago

Announcing the #JTool2 #Pro subscription program: #JTool2 REMAINS FREE, but: For $999/year get up to 5 licenses unlocking advanced features: greatly enhanced kernelcache symbolication, Mach-O editing, dyld shared cache operations, API, feature requests. DM or email products@

0

8

0

1

0

Technologeeks @Technologeeks

almost 4 years ago

Oh, and .. one more thing: if the fileset.0x* names confuse you in #jtool2 output, be confused no more. Extracted filesets are now correctly named, completing jtool2's (formerly, @Morpheus______ 's joker) "Kextraction". https://t.co/3P7uav6MpC (requests/bug reports welcome)

Technologeeks's tweet photo. Oh, and .. one more thing: if the fileset.0x* names confuse you in #jtool2 output, be confused no more.

Extracted filesets are now correctly named, completing jtool2's (formerly, @Morpheus______ 's joker) "Kextraction".

https://t.co/3P7uav6MpC

(requests/bug reports welcome) https://t.co/Yrs00ksShm

1

33

2

1

0

bintelbot @bintelbot

almost 4 years ago

patrickwardle: RT @Technologeeks: #Jtool2(.0.3) update: Now rebuilds filesets (read: kExt) by patching LC_SEGMENTs/LC_SYMTAB, and rebuilds kernel's main portion over full kernelcache, so you can inspect kexts as well as kernel __DATA_CONST (which technic…

bintelbot's tweet photo. patrickwardle: RT @Technologeeks: #Jtool2(.0.3) update: Now rebuilds filesets (read: kExt) by patching LC_SEGMENTs/LC_SYMTAB, and rebuilds kernel's main portion over full kernelcache, so you can inspect kexts as well as kernel __DATA_CONST (which technic… https://t.co/5VZBqdE82P

0

2

1

0

Technologeeks @Technologeeks

almost 4 years ago

#Jtool2(.0.3) update: Now rebuilds filesets (read: kExt) by patching LC_SEGMENTs/LC_SYMTAB, and rebuilds kernel's main portion over full kernelcache, so you can inspect kexts as well as kernel __DATA_CONST (which technically resides outside kernel's main fileset portion)

Technologeeks's tweet photo. #Jtool2(.0.3) update: Now rebuilds filesets (read: kExt) by patching LC_SEGMENTs/LC_SYMTAB, and rebuilds kernel's main portion over full kernelcache, so you can inspect kexts as well as kernel __DATA_CONST (which technically resides outside kernel's main fileset portion) https://t.co/t0j1sroqVE

0

31

10

1

0

Technologeeks @Technologeeks

almost 4 years ago

.@Morpheus______ 's #Jtool2 updated with fixes for new machO features and - most importantly - better analysis of #iOS16/Mx-macOS #kernelcache - bringing 1,450 more symbols (PPL, mach traps, syscalls & more), "illuminating" XNU's darkest corner for all! https://t.co/3P7uav6eA4

Technologeeks's tweet photo. .@Morpheus______ 's #Jtool2 updated with fixes for new machO features and - most importantly - better analysis of #iOS16/Mx-macOS #kernelcache - bringing 1,450 more symbols (PPL, mach traps, syscalls & more), "illuminating" XNU's darkest corner for all!

https://t.co/3P7uav6eA4 https://t.co/617tzagmbq

1

128

36

17

0

Technologeeks @Technologeeks

about 4 years ago

Apple's new #iOS16 #kernelcache format confusing your #IDA or #Ghidra? We've updated #jtool2 to not only support, but also analyze the new kernelcache (with joker lib) and keep the best mach-O command-line parsing tool up-to-date! https://t.co/KzFQjH03dj

Technologeeks's tweet photo. Apple's new #iOS16 #kernelcache format confusing your #IDA or #Ghidra?

We've updated #jtool2 to not only support, but also analyze the new kernelcache (with joker lib) and keep the best mach-O command-line parsing tool up-to-date!

https://t.co/KzFQjH03dj https://t.co/IwOe9Z0LgS

2

175

35

15

0

Technologeeks @Technologeeks

over 4 years ago

Quick fixes for @Morpheus______ 's #Jtool2 have now brought its --analyze feature up to date with XNU-81xx - updated system calls, MIG routines, fixed a segfault https://t.co/KzFQjH03dj Still in our todo list - M1 binary, more symbols, and shared cache.. More to come soon.

2

28

9

2

0

Technologeeks @Technologeeks

over 4 years ago

Do you use @Morpheus______ 's #Jtool2 or other #macOS/#iOS tools , and have issues? Need bug fixes? M1-build? --analyze (for kernel caches) or --symbolicate (for panic) fixes? Let us know over DM! We maintain the tools now, and can put in fixes or updates.

3

29

5

1

0

J @Morpheus______

over 6 years ago

#4/n: This marks the absolute, final updates to the books, as well as my beloved #JTool2 (*Sniff*, AAPL, won't you take it from me already? 😢 ). As promised - Hard cover boxed sets (which are *really* awesome, but I'm biased) will ship by the end of the month.

0

25

2

0

J @Morpheus______

over 6 years ago

#Jtool2 (CAI) is becoming future proof: Not only does it support all Code signing algorithms (SHA1 through SHA-512!), but also #joker - the #kernelcache #symbolication module - now uses an external argument pattern matching file, to easily edit and add any pattern you like!

Morpheus______'s tweet photo. #Jtool2 (CAI) is becoming future proof: Not only does it support all Code signing algorithms (SHA1 through SHA-512!), but also #joker - the #kernelcache #symbolication module - now uses an external argument pattern matching file, to easily edit and add any pattern you like! https://t.co/XDgK1IYje6

0

73

11

0

J @Morpheus______

over 6 years ago

Happy new decade! #jtool (v1) is officially decommissioned for good as #jtool2 (LXR) gets new & improved codesign capabilities, leaving ldid in dust! --stripsig, +ent=(comma separated ents or filename), JENTS=(ents to add to any signature) and more! https://t.co/Alp5QkYxm6

1

118

26

2

0

J @Morpheus______

almost 7 years ago

Just after achieving 100% MIG is_iokit_subsystem coverage in #MOXiI2, AAPL pulls a surprise move of adding two new MIG calls (2888/2889) in iOS 13.2 *Sigh*. Detected by #Jtool2's #joker (--analyze). BVX2 format I mentioned yesterday is now supported. https://t.co/FyNSP2Ohzg

Morpheus______'s tweet photo. Just after achieving 100% MIG is_iokit_subsystem coverage in #MOXiI2, AAPL pulls a surprise move of adding two new MIG calls (2888/2889) in iOS 13.2 *Sigh*.

Detected by #Jtool2's #joker (--analyze). BVX2 format I mentioned yesterday is now supported.

https://t.co/FyNSP2Ohzg https://t.co/aFCNz4uvNM

2

69

10

2

0

J @Morpheus______

almost 7 years ago

Some iOS 13.2 kernelcaches are apparently BVX2 compressed (and others still have other surprises ;-) #jtool2 final release (which I still owe the world, before I can put Darwin behind me) will extend native less/lzvn compressed kernelcache handling for this too. Stay tuned.

3

171

24

3

0

J @Morpheus______

almost 7 years ago

#Jtool2 (BDA) update: bug fixes, more iOS13 symbols. And - finding references to addresses in a hard-fused kernelcache, even if the pointer is tagged. Can your non-free disassembler do that? Maybe. Maybe not. Or maybe in its next version it will ;-) https://t.co/9lsPO0QO1o

Morpheus______'s tweet photo. #Jtool2 (BDA) update: bug fixes, more iOS13 symbols. And - finding references to addresses in a hard-fused kernelcache, even if the pointer is tagged.

Can your non-free disassembler do that? Maybe. Maybe not. Or maybe in its next version it will ;-)

https://t.co/9lsPO0QO1o https://t.co/fh5Qxla6CR

1

137

23

5

0

J @Morpheus______

about 7 years ago

#JTool2 now does 9,000+ symbols on #iOS13 kernelcaches, including all IOKit objects and dispatch tables... (Because somebody has to do the grunt work of finding symbols automatically to populate all them "Internet symbol databases"). https://t.co/HDvvUDpW25

0

58

11

2

0

J @Morpheus______

about 7 years ago

Just realized #MacOS #kernelcache Mach-Os are malformed & break otool/nm/etc. Since for CLI-folk #otool -tV is a necessary evil (for intel), #jtool2 can (again) remove any load command. Also useful for stripping code signatures. Full segedit coming soon. https://t.co/qppJWtXZjw

Morpheus______'s tweet photo. Just realized #MacOS #kernelcache Mach-Os are malformed & break otool/nm/etc. Since for CLI-folk #otool -tV is a necessary evil (for intel), #jtool2 can (again) remove any load command. Also useful for stripping code signatures. Full segedit coming soon.

https://t.co/qppJWtXZjw https://t.co/AFShnhtZnu

0

40

7

1

0

J @Morpheus______

about 7 years ago

Wow! XNU-6041! 1733 is the new 1469 :-) #Jtool2 finds "only" 3,315 symbols, but detects three new syscalls, several new mach_port, task and memory_entry MIGs, and a new MIG subsystem (8,000) - if you see these magically appear in IDA - know where they came from... more soon!

Morpheus______'s tweet photo. Wow! XNU-6041! 1733 is the new 1469 :-)

#Jtool2 finds "only" 3,315 symbols, but detects three new syscalls, several new mach_port, task and memory_entry MIGs, and a new MIG subsystem (8,000) - if you see these magically appear in IDA - know where they came from...

more soon! https://t.co/nbFz35rJRb

0

63

11

0

J @Morpheus______

about 7 years ago

Bracing for #iOS13: #Jtool2 now with (even more) kernelcache symbols (including Sandbox hooks), and --analyze now warns of new Mach traps, MIG routines and sys calls. Also - works directly on RTKit binaries like AOP and Petra firmware https://t.co/fJY7cjzx8Z

Morpheus______'s tweet photo. Bracing for #iOS13: #Jtool2 now with (even more) kernelcache symbols (including Sandbox hooks), and --analyze now warns of new Mach traps, MIG routines and sys calls.

Also - works directly on RTKit binaries like AOP and Petra firmware

https://t.co/fJY7cjzx8Z https://t.co/GhHdIXIXQj

6

138

30

7

0

J @Morpheus______

about 7 years ago

#Jtool2: More #Joker symbols (including network stack), better disassembly, and a killer new feature to symbolicate panic logs from *OS (.ips files) - even on symbol-stripped kernels - far better than high priced but grossly inaccurate commercial products! https://t.co/G3sjTn2obI

Morpheus______'s tweet photo. #Jtool2: More #Joker symbols (including network stack), better disassembly, and a killer new feature to symbolicate panic logs from *OS (.ips files) - even on symbol-stripped kernels - far better than high priced but grossly inaccurate commercial products!
https://t.co/G3sjTn2obI https://t.co/rYtpja5SfF

1

122

29

3

0

Top Tweets for #JTool2

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users