# iOS_pretty_print **Repository Path**: fatgrass/iOS_pretty_print ## Basic Information - **Project Name**: iOS_pretty_print - **Description**: iOS kernel debug friendly tool,for pretty printing. - **Primary Language**: Python - **License**: Not specified - **Default Branch**: master - **Homepage**: None - **GVP Project**: No ## Statistics - **Stars**: 0 - **Forks**: 0 - **Created**: 2020-07-14 - **Last Updated**: 2020-12-19 ## Categories & Tags **Categories**: Uncategorized **Tags**: None ## README iOS_pretty_printer is a kernel debug pretty printer plugin.
Qemu for iOS:
https://github.com/alephsecurity/xnu-qemu-arm64
When debugging kernel with gdb and gef,will fall in trouble to read these hex datas.
For example when a breakpoint hits,you may not know which breakpoint it exactly is because only the address is prompted.It's also a noisy thing to read the data structures.
iOS_pretty_printer is trying to make debugging easier.
Debug the iOS kernel with following steps:
1.Start the qemu for iOS with -s -S,and the qemu will wait for debugger attaching.
Qemu for iOS howto please refer to https://github.com/alephsecurity/xnu-qemu-arm64
2.cd iOS_pretty_printer diretory,setup the enviroment.
 export PYTHONPATH=currentpath:$PYTHONPATH
3.start gdb debugger: gdb ./kernel (kernel is the unpacked kernel image)
 Then in the gdb command line:
 3.1 gef-remote :1234 (attach the qemu target)
 3.2 source ./run.py
  run.py will set one breakpoint amfi_check_signature @0xFFFFFFF0061E4E78 and continue running.
  More breakpoints can be added in run.py.
 3.3 Waiting for the breakpoint hits,then will see:
  Break at amfi_check_signature
  AMFI details:
  name:vnode addr:0xffffffe000a62490
  structure vnode {
   vnode->v_name: launchd
  };
  name:csblob addr:0xffffffe00097ce40
  structure csblob {
   csblob->cdhash: d026f68f0f7c3558de87e73f5760b8a649e6ae14
   csblob->csb_entitlements:0x0
  };
![Image text](https://gitee.com/fatgrass/iOS_pretty_print/raw/master/images/pp2.jpg) Notes:
 1.Make sure the gdb-python version is 3.X like 3.8.3,2.X may be in trouble.
 2.More printers can be added in xnu_printer directory as you wish.
 3.If you try to debug with x86_64 binary,you should change the PrintStruct to x86_64 at last line in pp.py.
  Try 'source pp.py' directly instead of 'source run.py' in the gdb command line.