I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an exact match for the kernel installed at /System/Library/Caches/com.apple.kernelcaches/kernelcache. What process does Apple perform on the ipsw kernelcache to produce the installed kernelcache? How do I identify which kernelcache is the one installed on my phone?

  • A partial answer was to use joker because it can list the prelinked KEXTs. In the above example I can see that the kernelcache.release.iphone9 has 211 KEXTs and so does the version installed on the iPhone. The base addresses for each of the KEXTs are the same so that is suggestive that the files are equivalent - but the installed kernelcache and the IPSW kernelcache files are of different sizes and I was hoping to find a more certain solution than this guesswork.
    – stiabhan
    Jan 8, 2019 at 12:28

1 Answer 1


The /System/Library/Caches/com.apple.kernelcaches/kernelcache and the IPSW's kernelcache.release.iphone9 files have the same payload content but the former uses the IMG4 file format (containing a wrapper + payload) whereas the latter uses the IM4P file format (containing just the payload).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.