ipsw

ipsw

ipsw is one CLI for Apple firmware work, organized into command groups (download, extract, dyld, kernel, macho, fw, sb, ent, diff, symbolicate, idev, ...). Install it with brew install blacktop/tap/ipsw (other platforms: github.com/blacktop/ipsw releases). Remote and download commands need network access; idev needs a USB-connected device. This skill describes ipsw as of commit 6e0291a8f (after release 3.1.725); on 3.1.725 and earlier, apply the "Older releases" table below. Flags change between releases: ipsw version shows the installed build, and ipsw <group> <command> --help is the source of truth. Commands marked 🚧 in --help are works in progress.

Examples use these shell variables (POSIX sh/bash/zsh syntax):

IPSW=./iPhone18,1_26.4_23E246_Restore.ipsw   # local IPSW or OTA
URL=https://updates.cdn-apple.com/...          # remote IPSW or OTA (see "Triage a release")
DSC=./dyld_shared_cache_arm64e                 # main file of an extracted cache; subcaches beside it
KC=./kernelcache.release.iPhone18,1            # extracted kernelcache
DEVICE=iPhone18,1                              # any product type from `ipsw device-list`

Working rules

These are where agents most often go wrong with ipsw.

Make every choice explicit on the command line. Without a terminal, ipsw cannot prompt: the command stops with an error such as "use --confirm to proceed unattended" (older releases skip the step silently; see "Older releases" below). Pass the selection instead:
- A short dylib name that matches several images (UIKit, SwiftUI, SpringBoard) fails. Pass the full install path, found with ipsw dyld info --dylibs --json "$DSC" | jq -r '.dylibs[].name' | grep -i <name>.
- Fat Mach-Os need --arch arm64e; multi-device IPSWs need --device <product-type>.
- Downloads and payload searches need -y/--confirm (download, ota extract --pattern).
- ipsw mount blocks until Ctrl+C: pass --detach, then run the hdiutil detach … command it prints.
- idev crash pull needs a path or --all; idev syslog streams forever unless given -t <seconds>.
Read remotely before downloading. A current IPSW is 10–15 GB, but --remote commands fetch only what they need: info --remote (KB), extract --kernel --remote (~75 MB), fw <component> --remote (MBs to tens of MB). A remote extract --dyld is several GB. Download whole images only for filesystem-wide work.
Keep large output out of the conversation. Prefer --json | jq, write to files with -o/--output, and read the head or counts first. Dumps of a whole DSC or kernel run to millions of lines.
Expect one-time costs and plan for them:
- First dyld disass/xref on a cache builds <DSC>.a2s (minutes, ~1.5 GB).
- sb graph export takes ~30 s and writes ~500 MB, then makes queries take ~3 s.
- Filesystem scans (ent --fs, macho search <IPSW>, diff) unpack and decrypt a multi-GB DMG into the current directory.
- The first download appledb clones ~600 MB into ~/.config/ipsw/appledb; --no-update (also on download tss) reuses the existing checkout.
Verify before reporting. Cross-check an address↔symbol result with the opposite command (a2s vs symaddr), confirm a crash log's build matches the firmware before trusting symbolication, and list extraction output (or use extract --json) rather than assuming file names.

Choose a workflow

Task	Start with	Details
Find, read remotely, download, or extract firmware	`ipsw download appledb ... --urls`, `ipsw extract`	`references/download.md`
Coprocessor, exclave, iBoot, SEP, IMG4, AEA, OTA internals	`ipsw fw <component>`, `ipsw img4`, `ipsw ota`	`references/firmware.md`
Userspace code in the dyld_shared_cache	`ipsw dyld a2s / disass / xref`	`references/dyld.md`
ObjC/Swift interfaces of private frameworks	`ipsw class-dump`, `ipsw swift-dump`	`references/class-dump.md`
Standalone binaries: info, entitlements, signing	`ipsw macho info / disass / search`	`references/macho.md`
Kernelcache: KEXTs, symbols, C++ classes, syscalls	`ipsw kernel ...`	`references/kernel.md`
Sandbox profiles and capability questions	`ipsw sb ...`	`references/sandbox.md`
Entitlement search across a firmware image	`ipsw ent ...`	`references/entitlements.md`
What changed between two builds	`ipsw diff`, `--diff`/`--delta` variants	`references/diffing.md`
Crash logs and panics	`ipsw symbolicate`	`references/symbolication.md`
A USB-connected iPhone/iPad	`ipsw idev ...`	`references/device.md`

Triage a release without downloading it

URL="$(ipsw download appledb --os iOS --device "$DEVICE" --latest --release --urls | head -1)"
ipsw info --remote "$URL"                          # version, build, devices, CPU
ipsw info --remote --list "$URL"                   # every file in the IPSW, with sizes
ipsw fw exclave --remote "$URL" --info             # exclave bundle sections (~50 MB fetched)
KC="$(ipsw extract --kernel --remote --json -o ./fw/ "$URL" | jq -r 'keys[0]')"   # just the kernelcache
ipsw dtree --remote "$URL" --summary               # DeviceTree identity

dl and db are aliases for download and appledb. --latest alone means the newest build on any channel (often a beta): add --release, --beta, or --rc, or pin --build <BUILD> / --version <X.Y>; --type ota returns OTA URLs. ipsw download ipsw --device "$DEVICE" --latest --urls gives the newest signed public IPSW without touching AppleDB.

Userspace: from an address to an explanation

ipsw dyld a2s "$DSC" 0x18ebfa9c8                                      # symbol + offset
ipsw dyld disass "$DSC" --vaddr 0x18ebfa9a8 --count 60                 # first run builds the .a2s cache
ipsw dyld xref "$DSC" 0x18ebfa9a8 --imports                            # callers in this and dependent dylibs
ipsw dyld imports "$DSC" /System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices
ipsw class-dump "$DSC" /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore \
  --class '^UIApplication$' --re -V | grep -B1 'BackgroundTask'

--re (which requires -V/--verbose) prints each method's implementation address as a // 0x… comment on the line above the method, so keep one line of leading context when filtering. The addresses feed back into dyld disass --vaddr. UIKit's classes live in UIKitCore; UIKit.framework/UIKit is a shim with no ObjC.

Kernel: name, find, disassemble

ipsw kernel version "$KC"
mkdir -p ./syms && ipsw kernel symbolicate --signatures symbolicator/kernel --json -o ./syms/ "$KC"   # names for a stripped kernel
ipsw kernel cpp "$KC" --class IOSurfaceRootUserClient --inheritance                 # C++ classes (no ObjC in kernels)
ipsw kernel syscall "$KC"                                                           # also: mach, mig, kexts
ipsw macho disass "$KC" --fileset-entry com.apple.kernel --vaddr 0xfffffe000ab90040 --count 40

Signatures come from git clone https://github.com/blacktop/symbolicator; without --signatures, symbolicate still names syscalls, Mach traps, MIG routines, and C++ methods. Release kernels are stripped, so disassemble by --vaddr. Name KEXTs by full bundle ID: short names match by suffix (IOKit resolves to com.apple.driver.ASIOKit).

What changed between two builds

ipsw dyld info --dylibs --delta "$OLD_DSC" "$NEW_DSC"          # added/removed/re-versioned dylibs
ipsw class-dump "$NEW_DSC" <DYLIB_PATH> --diff "$OLD_DSC"       # ObjC API diff (new first, --diff old)
ipsw swift-dump "$NEW_DSC" <DYLIB_PATH> --diff "$OLD_DSC" > api.diff.md   # Swift API diff (long)
ipsw kernel kexts --diff "$OLD_KC" "$NEW_KC"
ipsw sb opts --diff "$OLD_KC" "$NEW_KC"
ipsw diff "$OLD_IPSW" "$NEW_IPSW" -o ./diff/ --markdown --starts --ent   # full report (slow, local IPSWs)

See references/diffing.md for the patch-hunting checklist.

Capabilities: entitlements and sandbox

ipsw ent --fs --has com.apple.private.security.no-sandbox --file-only "$IPSW"   # no database needed
ipsw sb graph export "$KC" -O graph.json
ipsw sb query iokit-open IOSurfaceRootUserClient --graph graph.json -O json \
  | jq -r '.matches[] | select(.decision=="allow") | .profile' | sort -u

Crashes and panics

ipsw symbolicate panic-full-<date>.ips "$IPSW" --peek       # kernel + userspace frames, with disassembly
ipsw symbolicate crash.ips "$DSC" --unslide                  # userspace, addresses usable in static tools

The firmware must be the exact build in the log's header (head -1 <log>.ips | jq -r .os_version). Without local firmware, --server <URL> queries an ipswd symbol server; pass its bearer token through IPSW_SYMBOLICATE_API_TOKEN (see references/symbolication.md).

Pitfalls

dyld symaddr and dyld disass --symbol match exact names, not regexes; use symaddr --in <json> for patterns. The symbol-lookup hint for disass is --symbol-image (--image selects whole dylibs to disassemble).
ObjC instance-method names start with - and parse as flags: put them after -- (ipsw dyld symaddr "$DSC" --image <DYLIB> -- '-[UIApplication endBackgroundTask:]').
dyld str searches the whole cache and has no per-image filter.
dyld xref --all disassembles every image (very slow); start without it.
extract --dyld without --dyld-arch extracts every architecture in the image.
class-dump --re requires -V; the addresses print as // 0x… lines above each method.
In sb commands, -o is the operations list and -O is output.
download git and device-info take --product / --prod, not a positional argument.

Older releases (ipsw 3.1.725 and earlier)

Check ipsw version. These releases behave differently; use the workaround on the right:

Behavior in 3.1.725 and earlier	Workaround
Prompts without a terminal skip the step and exit 0 (`download appledb/ota` "Continue?", `ota extract` payload search)	Always pass `--confirm`/`-y`; check the output rather than the exit status
`download tss --signed` exits 0 when unsigned; no `--no-update`	Match `Is still being signed` / `No longer being signed` in the output
`download kdk` with no selector exits 0 doing nothing	Pass `--host`, `--build`, `--latest`, or `--all`
`dyld a2f <DSC> <ADDR>` fails with `failed to find image containing stub target`	`echo <ADDR> \| ipsw dyld a2f "$DSC" --in /dev/stdin`
`dyld webkit --diff` rejects its second argument	`ipsw dyld webkit --json "$DSC" \| jq -r .version` for each cache
`dyld info --dylibs --diff/--delta` has no `--json`; `--diff` and `kernel kexts --diff` print ANSI even with `--no-color`	Use `--delta` (markdown) and the `kexts --json` recipe in `references/kernel.md`
`class-dump --diff` ignores `@property` changes	Dump the class from both caches and `diff -u`
`kernel symbolicate -o <dir>` fails if `<dir>` does not exist	`mkdir -p <dir>` first
`fw exclave/dcp/c1 --info` leave fetched firmware under `./<BUILD>__<DEVICE>/`	Run from a scratch directory
`extract --remote --kbag` downloads every IM4P whole (~150 MB)	Budget for it, or extract only the IM4Ps you need
`extract` has no `--json-format artifacts`	Use plain `--json`: `jq -r 'keys[0]'` after `--kernel`, `.[]` after `--sptm`/`--pattern`
`ota ls --payload --json` prints a banner before the JSON	`sed -n '/^\[/,$p'` before `jq`
`dyld search objc` prints a `relative method selectors` error for one image	Ignore it; the other results are valid
`device-info` and `download git` silently ignore positional arguments	Use `--prod` / `--product`

Reference files

Read the one that matches the task; each starts with a table of contents.

references/download.md: finding URLs, remote reads, downloads, extraction, AEA keys, config
references/firmware.md: info, mount, dtree, fw components, IMG4, AEA, OTA payloads
references/dyld.md: DSC addresses, disassembly, xrefs, imports, soft links, extraction
references/class-dump.md: ObjC/Swift dumping, header generation, API diffs
references/macho.md: Mach-O info, entitlements, signatures, search, lipo/sign/patch
references/kernel.md: kernel symbols, C++ classes, syscalls/MIG, KEXT extraction, KDK types
references/sandbox.md: profile decompilation, capability queries, sandbox diffs
references/entitlements.md: entitlement search and databases
references/diffing.md: release diffs and the patch-hunting checklist
references/symbolication.md: crash and panic symbolication
references/device.md: idev commands for USB-connected devices