I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an exact match for the kernel installed at /System/Library/Caches/com.apple.kernelcaches/kernelcache. What process does Apple perform on the ipsw kernelcache to produce the installed kernelcache? How do I identify which kernelcache is the one installed on my phone?
1
-
A partial answer was to use joker because it can list the prelinked KEXTs. In the above example I can see that the kernelcache.release.iphone9 has 211 KEXTs and so does the version installed on the iPhone. The base addresses for each of the KEXTs are the same so that is suggestive that the files are equivalent - but the installed kernelcache and the IPSW kernelcache files are of different sizes and I was hoping to find a more certain solution than this guesswork.– stiabhanJan 8, 2019 at 12:28
Add a comment
|
1 Answer
The /System/Library/Caches/com.apple.kernelcaches/kernelcache and the IPSW's kernelcache.release.iphone9 files have the same payload content but the former uses the IMG4 file format (containing a wrapper + payload) whereas the latter uses the IM4P file format (containing just the payload).