Skip to content

WIP: iOS 18.0 support#1

Draft
gilboz wants to merge 3 commits into
cellebrite-labs:masterfrom
gilboz:feature/ios18_support
Draft

WIP: iOS 18.0 support#1
gilboz wants to merge 3 commits into
cellebrite-labs:masterfrom
gilboz:feature/ios18_support

Conversation

@gilboz

@gilboz gilboz commented Jun 23, 2024

Copy link
Copy Markdown
  • Make SandboxData class abstract in order to make it extendable, prep work to extend for iOS 18 format - Provide richer API to the SandboxData object (read_short, read_string, read_binary, ...) which makes the code easier to write and understand - Removed parse_profile method and instead you can create a new instance of SandboxData by providing it an input file.. - Moved display_sandbox_profile to a method of SandboxData (and make it actually print its findings..) - Main logic is now borken into SandboxData.parse_common and SandboxData.decompile
  • Got rid of read_sandbox_operations method, this is now handled in parse_args method..
  • Better order of operations (regex list parsing only if the mode is not -psb)
  • Code cleanup for unused imports and variables, make the code more modern by adding type hinting (gradually..) and making better us of argparse usage (e.g. using type=argparse.FileType to open files)
  • This code was already tested and found working against sandbox blobs dumped from iOS 17.X kernelcaches..

gilboz added 3 commits June 23, 2024 19:42
- Make `SandboxData` class abstract in order to make it extendable, prep work to extend for iOS 18 format
    - Provide richer API to the `SandboxData` object (`read_short`, `read_string`, `read_binary`, ...) which makes the code easier to write and understand
    - Removed `parse_profile` method and instead you can create a new instance of `SandboxData` by providing it an input file..
    - Moved `display_sandbox_profile` to a method of `SandboxData` (and make it actually print its findings..)
    - Main logic is now borken into `SandboxData.parse_common` and
      `SandboxData.decompile`
- Got rid of `read_sandbox_operations` method, this is now handled in `parse_args` method..
- Better order of operations (regex list parsing only if the mode is not `-psb`)
- Code cleanup for unused imports and variables, make the code more modern by adding type hinting (gradually..) and making better us of argparse usage (e.g. using type=argparse.FileType to open files)
- This code was already tested and found working against sandbox blobs dumped from iOS 17.X
  kernelcaches..
…beta, the autobox collection seems to work but not the main collection
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant