From 7da28702a79228e0708dcde632970cb8760133e3 Mon Sep 17 00:00:00 2001
From: JBJF <jbjf@jbjf-Mac-mini.local>
Date: Sun, 1 Nov 2026 01:43:39 +0800
Subject: [PATCH] tools: ARM64 decompiler wrapper (Cutter/rizin/rz-ghidra, no
 Java)

---
 tools/decompiler/README.md    | 17 +++++++++++++++++
 tools/decompiler/decompile.sh |  8 ++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 tools/decompiler/README.md
 create mode 100755 tools/decompiler/decompile.sh

diff --git a/tools/decompiler/README.md b/tools/decompiler/README.md
new file mode 100644
index 0000000..972e7f5
--- /dev/null
+++ b/tools/decompiler/README.md
@@ -0,0 +1,17 @@
+# ARM64 decompiler (Cutter / rizin / rz-ghidra)
+
+IDA Pro is commercial; this uses the open-source decompiler bundled with Cutter 2.5.0
+(`/Applications/Cutter.app`). No Java is involved, so it works on macOS 27 where the
+Ghidra JVM crashes in CodeHeap.
+
+```bash
+tools/decompiler/decompile.sh <raw-arm64-text.bin> <function-offset-hex>
+```
+
+Raw blobs are the `__TEXT_EXEC,__text` section of a Mach-O (see
+`tools/ipsw/ipswlib.py` for extraction). `SLEIGHHOME` is set to the bundled
+`rz_ghidra_sleigh` specs; without it rz-ghidra reports "No sleigh specification".
+
+Limitations: PAC instructions (`pacibsp`, `retab`) and some pointer-auth branches
+truncate the decompiler output. Patch `retab` (0xd65f0fff) to `ret` (0xd65f03c0) in
+a copy of the blob before decompiling; keep the original for ground truth.
diff --git a/tools/decompiler/decompile.sh b/tools/decompiler/decompile.sh
new file mode 100755
index 0000000..d9f8bb4
--- /dev/null
+++ b/tools/decompiler/decompile.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Decompile one function from a raw ARM64 blob with Cutter's rz-ghidra.
+# usage: decompile.sh <raw.bin> <offset-hex> [sleighhome]
+set -e
+RZ=/Applications/Cutter.app/Contents/Resources/bin/rizin
+export DYLD_LIBRARY_PATH=/Applications/Cutter.app/Contents/Resources/lib
+export SLEIGHHOME=${3:-/Applications/Cutter.app/Contents/Resources/lib/rizin/plugins/rz_ghidra_sleigh}
+"$RZ" -a arm -b 64 -e scr.color=0 -q -c "s $2; af; pdg" "$1"