ida-iboot-loader's Introduction

IDA iBoot Loader

IDA loader for Apple's iBoot, SecureROM and AVPBooter.

Support

This loader supports IDA 7.5 to IDA 8.4 and works on all Apple ARM64 bootloaders even M1+.

Installation

Copy iboot-loader.py to the loaders folder in IDA directory.

Usage

Open a decrypted 64 bits iBoot image or a SecureROM file with IDA. IDA should ask to open with this loader.

Credits

This code is based on argp's iBoot64helper
iBoot-Binja-Loader

ida-iboot-loader's People

Contributors

Stargazers

Watchers

ida-iboot-loader's Issues

Not sure if AVPBooter.vmapple2 is being rebased correctly

Loading file 'AVPBooter.vmapple2.bin' into database...
Detected file format: SecureROM (AArch64)
  0. Creating a new segment  (0000000000000000-0000000000028250) ... ... OK
[i] bootloader : RELEASE
[+] Rebasing to address 0x100000
Rebasing program to 0x0000000000100000...
[+] _image4_get_partial : 0x100828
[+] _panic : 0x10367c
[+] _platform_get_usb_serial_number_string : 0x102378
[+] _platform_get_usb_more_other_string : 0x102530
[+] _task_init : 0x1042ac
[+] _arm_exception_abort : 0x10e9d4
[+] _platform_get_usb_vendor_id : 0x107d00
[+] _usb_core_init : 0x104ee0
[+] _usb_init_with_controller : 0x104f58
[+] _der_expect_ia5string : 0x1009f0

I personally doubt 0x100000 is the correct rebase address, especially given the amount of errors in the pseudo code:

Although, I'm quite new to reversing iBoot so I could be very wrong though

hello,
i wonder how to find base address per iboot file?, what im trying, always i get this !:
[i] bootloader : RELEASE
[!] Failed to find base address, it's now set to 0x0
[+] Rebasing to address 0x0

IDA 7.6 on windows

thanks

Recommend Projects