JBJF
3ac5108928
- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7 assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE code change or bypass fix - tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext extractor, llvm-objdump diff, advisory mapper - CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module now sweeps 0/1/7/8/64/1024/16462/16463 - app 2.3 build 7
IPSW kernel-diff toolkit
Read-only helpers used for the 27.0.1 → 27.2 kernel comparison in
docs/IOS27.2-KERNEL-DIFF.md.
| Script | Purpose |
|---|---|
remote_ipsw.py |
HTTP-Range ZIP reader: list/extract a member without downloading the whole IPSW |
ipswlib.py |
IM4P/LZFSE decode, Mach-O/fileset parse, cstring extraction |
extract_kext.py |
dump one fileset entry as a standalone Mach-O (linkedit offsets rebased) |
disasm_diff.py |
normalized llvm-objdump instruction diff for two kexts |
diff_kernel.py |
kext-level diff (bundle id, size, strings, function hashes) |
map_advisory.py |
advisory CVE list → component/binary candidate table |
Requirements: Python 3, pip install lzfse macholib, Xcode command line tools
(llvm-objdump). Nothing writes to a device.