hack-different/apple-knowledge
GitHub: hack-different/apple-knowledge
系统性地整理 Apple 平台逆向工程所需的底层格式、协议、硬件数据及工具链资源，并将其转化为机器可读的知识库。
Stars: 1350 | Forks: 106
# Apple 数据格式与知识
一系列逆向工程的 Apple 格式、协议及其他有趣内容。
[在 Discord 上加入我们](https://discord.gg/NAxRYvysuc) - [Discord 规则](https://hackdiffe.rent)
本仓库的灵感来源于 [Papers we Love](https://github.com/papers-we-love/papers-we-love)
## 我们的工具仓库
### 我们的 Homebrew Tap
使用 `brew tap hack-different/homebrew-jailbreak` 安装我们的 tap
有关该 tap 维护的信息可在 [homebrew-jailbreak](http://hackdiffe.rent/homebrew-jailbreak/) 中找到
## 贡献与警告
[关联你的 Discord 和 GitHub](https://hackdiffe.rent/LINKING)
我们希望这个集合能在未来几年里继续为新越狱者和爱好者提供帮助，因此我们必须声明：这个
集合接受（并深表感激）改进它的 pull-request，但无论如何都不会
接受基于 `AppleInternal` 或受
[DMCA](https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act) 保护的任何其他版权作品的 PR。如果你
在判断时需要帮助，请为 PR 打上 `license help` 标签，加入
[Discord 服务器](https://discord.gg/hackdifferent)，并向 `#Legit` 或更高身份组的成员求助。
违反 DMCA 或版权法的责任由提交者自行承担。
## 主要数据来源
我们尝试从机器来源中提取，并在本仓库的 `_data` 目录下生成机器可读的文件 (YAML)。有关
创建和扩展数据格式的信息，请参阅 [数据格式指南](docs/Data_Formats)。
那里的更新和添加应该会自动反映在文档
[`hack-different/apple-knowledge/_data`](https://github.com/hack-different/apple-knowledge/tree/main/_data) 中
另一个权威信息来源是 Apple 自己在以下
任一位置发布的开源代码：
* [Apple 官网开源项目](https://opensource.apple.com)
* [Apple 的 GitHub 主页](https://github.com/apple)
* [apple-oss-distributions 的 Github 主页](https://github.com/apple-oss-distributions)
* [Apple Gifts](docs/GIFTS)
## 工具
### 用于二进制分析和修改的库
请参阅 [docs/Binary_Tooling](docs/Binary_Tooling)
### 用于二进制分析和修改的工具
* [mootool](https://github.com/hack-different/mootool) - FOSS Ruby Mach-O 工具（旨在复制 jtool2 的功能集）
* [ktool](https://github.com/cxnder/ktool) - FOSS Python Mach-O 工具
* [`checkra1n/toolchain`](https://github.com/checkra1n/toolchain)
* [`alephsecurity/xnu-qemu-arm64`](https://github.com/alephsecurity/xnu-qemu-arm64)
* [`alephsecurity/xnu-qemu-arm64-tools`](https://github.com/alephsecurity/xnu-qemu-arm64-tools)
* [在 QEMU 上构建 iOS](https://github.com/alephsecurity/xnu-qemu-arm64/wiki/Build-iOS-on-QEMU)
* [由 Hex-Rays 开发的 IDA Disassembler](https://hex-rays.com/ida-pro/)
* [`onethawt/idaplugins-list`](https://github.com/onethawt/idaplugins-list)
* [`cellebrite-srl/ida_kernelcache`](https://github.com/cellebrite-srl/ida_kernelcache)
* [`cellebrite-srl/PacExplorer`](https://github.com/cellebrite-srl/PacXplorer)
* [`cellebrite-srl/FunctionInliner`](https://github.com/cellebrite-srl/FunctionInliner)
* [`hack-different/iBoot-IDA`](https://github.com/hack-different/iBoot-IDA)
* [`matteyeux/ida-iboot-loader`](https://github.com/matteyeux/ida-iboot-loader)
* [`haiyuidesu/sephelper`](https://github.com/haiyuidesu/sephelper)
* [`Cisco-Talos/GhIDA`](https://github.com/Cisco-Talos/GhIDA)
* [`avast/retdec-idaplugin`](https://github.com/avast/retdec-idaplugin)
* [Binary Ninja Disassembler](https://binary.ninja)
* [`cxnder/bn-dyldsharedcache`](https://github.com/cxnder/bn-dyldsharedcache)
* [`jonpalmisc/ObjectiveNinja`](https://github.com/jonpalmisc/ObjectiveNinja)
* [`EliseZeroTwo/iBoot-Binja-Loader`](https://github.com/EliseZeroTwo/iBoot-Binja-Loader/)
* [`matteyeux/seprom-loader`](https://github.com/matteyeux/seprom-loader/)
* [`skr0x1c0/binja_kc`](https://github.com/skr0x1c0/binja_kc)
* [VisUAL ARM 模拟器](https://salmanarif.bitbucket.io/visual/index.html)
* [Ghidra Disassembler](https://ghidra-sre.org)
* [`AllsafeCyberSecurity/awesome-ghidra`](https://github.com/AllsafeCyberSecurity/awesome-ghidra)
* [`0x36/ghidra_kernelcache`](https://github.com/0x36/ghidra_kernelcache)
* [Hopper Disassembler](https://www.hopperapp.com)
* [Capstone Engine](https://github.com/aquynh/capstone)
* [Unicorn Engine](https://github.com/unicorn-engine/unicorn)
* [QEMU](https://qemu.readthedocs.io/en/latest/)
* [QEMU Apple 分支](https://github.com/TrungNguyen1909/qemu-t8030)
* [`geohot/qira`](https://github.com/geohot/qira)
* [`blacktop/ipsw`](https://github.com/blacktop/ipsw)
* [jtool2](https://www.newosxbook.com/tools/jtool.html)
* [frida](https://frida.re)
## 指南与综合资源
* [`Proteas/apple-cve`](https://github.com/Proteas/apple-cve)
* [kpwn / qwertyoruiop 的 Wiki](https://github.com/kpwn/iOSRE/tree/master/wiki)
* [kpwn / qwertyoruiop 的论文](https://github.com/kpwn/iOSRE/tree/master/resources/papers)
* [关于 Apple 原型机和 CPFM](docs/Prototypes)
* [OWASP: iOS 篡改与逆向工程](https://github.com/OWASP/owasp-mstg/blob/master/Document/0x06c-Reverse-Engineering-and-Tampering.md)
* [Kernel Debug Kit](docs/KDK)
* [Jonathan Levin 的 *OS Internals](http://newosxbook.com/index.php)
* [T2 开发环境设置](docs/T2)
* [Apple 4CC](docs/4CC)
* [`bytepack/IntroToiOSReverseEngineering`](https://github.com/bytepack/IntroToiOSReverseEngineering)
* [远程攻击面](https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html)
* [Lakr233 的研究](https://lab.qaq.wiki/Lakr233/iOS-kernel-research/-/tree/master)
## 设备
* [设备列表](docs/Devices)
* T2
* [T2 开发团队: `t8012` / Apple T2 / bridgeOS](https://t8012.dev)
* [Duo Labs: Apple T2 XPC](https://duo.com/labs/research/apple-t2-xpc)
* [`t2linux/apple-bce-drv`](https://github.com/t2linux/apple-bce-drv)
* Wi-Fi / Bluetooth
* [`seemoo-lab/frankenstein`](https://github.com/seemoo-lab/frankenstein)
* [`seemoo-lab/internalblue`](https://github.com/seemoo-lab/internalblue)
* [The iPhone Wiki](https://www.theiphonewiki.com/wiki/Main_Page)
* T2 之前的 SMC (System Management Controller)
* [`acidanthera/VirtualSMC`](https://github.com/acidanthera/VirtualSMC)
* [`t8012/smcutil`](https://github.com/t8012/smcutil) - 从 update payload 创建 SMC 二进制文件
## 内核综合
* [Mach](https://developer.apple.com/library/content/documentation/Darwin/Conceptual/KernelProgramming/Mach/Mach.html)
* [Apple 的 XNU Tarballs](https://opensource.apple.com/tarballs/xnu/)
* [nemo 的 Mach 与 Mach Interface Generator](https://www.exploit-db.com/papers/13176/)
* [Ian Beer 的 Apple IPC](https://thecyberwire.com/events/docs/IanBeer_JSS_Slides.pdf)
* [`acidanthera/Lilu`](https://github.com/acidanthera/Lilu)
* [`osy/AMFIExemption`](https://github.com/osy/AMFIExemption)
* [Siguza 关于 KTRR 的研究](https://blog.siguza.net/KTRR/)
* [xerub 的 Tick Tock](https://xerub.github.io/ios/kpp/2017/04/13/tick-tock.html)
* [Levin 的 Casa de PPL](http://newosxbook.com/articles/CasaDePPL.html)
* [Brandon Azad 的 KTRW](https://googleprojectzero.blogspot.com/2019/10/ktrw-journey-to-build-debuggable-iphone.html)
* [Qwertyoruiopz 攻击 XNU：第 1 部分](https://web.archive.org/web/20160131061526/http://blog.qwertyoruiop.com/?p=38)
* [Qwertyoruiopz 攻击 XNU：第 2 部分](https://web.archive.org/web/20160131061526/http://blog.qwertyoruiop.com/?p=48)
* [Stefan Esser 的 Kernel Heap](http://gsec.hitb.org/materials/sg2016/D2%20-%20Stefan%20Esser%20-%20iOS%2010%20Kernel%20Heap%20Revisited.pdf)
* [Levin 的《谁还需要 `task_for_pid()` 呢...》](https://newosxbook.com/articles/PST2.html)
* Apple 官方文档
* [内核编程指南](https://developer.apple.com/library/content/documentation/Darwin/Conceptual/KernelProgramming)
* [IOKit 基础](https://developer.apple.com/library/content/documentation/DeviceDrivers/Conceptual/IOKitFundamentals)
* [虚拟内存系统](https://developer.apple.com/library/content/documentation/Performance/Conceptual/ManagingMemory/Articles/AboutMemory.html)
## 协议 / 格式
### Bootloader 相关
* EFI
* [`EFI`](docs/EFI)
* [`NVRAM`](docs/NVRAM)
* [NVRAM 解锁](https://stek29.rocks/2018/06/26/nvram.html)
* [`SEP_memmap`](docs/SEP_memmap)
* [关于内核的一切](docs/Kernels)
* [`apple/darwin-xnu`](https://github.com/apple/darwin-xnu)
* [`Factory_Firmware_Payloads`](docs/Factory_Firmware_Payloads)
* iBoot
* [iBoot Firebloom](https://saaramar.github.io/iBoot_firebloom/)
* [`OpenJailbreak/iBootRE`](https://github.com/OpenJailbreak/iBootRE)
* [*OS iBoot](https://newosxbook.com/bonus/iBoot.pdf)
* SecureROM
* [SecureROM 二进制文件](https://github.com/hekapooios/hekapooios.github.io/tree/master/resources/APROM)
* TXM - Trusted eXecutation Monitor
* [TXM & SPTM](https://www.df-f.com/blog/ios17)
### 归档 / 磁盘格式
* APFS - Apple 文件系统
* [Apple APFS 参考](https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf)
* [`sgan81/apfs-fuse`](https://github.com/sgan81/apfs-fuse)
* [`libyal/libfsapfs`](https://github.com/libyal/libfsapfs)
* [`cugu/apfs.ksy`](https://github.com/cugu/apfs.ksy)
* [bxl1989 APFS 重新挂载](https://bxl1989.github.io/2019/01/17/apfs-remount.html)
* [LwVM 轻量级卷管理器](https://stek29.rocks/2018/01/22/lwvm-mapforio.html)
* NeXT / Apple “物料清单” / `pkg` / `bom`
* [`iineva/bom`](https://github.com/iineva/bom)
* `pbzx`
* Apple 磁盘映像 - `dmg`
* [`jhermsmeier/node-udif`](https://github.com/jhermsmeier/node-udif)
* [`nlitsme/encrypteddmg`](https://github.com/nlitsme/encrypteddmg)
* [`darlinghq/darling-dmg`](https://github.com/darlinghq/darling-dmg)
* Signed System Volumes (SSV) / `root_hash`
### 数据库 / 序列化
* Property Lists
* [`libimobiledevice/libplist`](https://github.com/libimobiledevice/libplist)
* iTunes 数据库
* [`jeanthom/libitlp`](https://github.com/jeanthom/libitlp)
* [`josephw/titl`](https://github.com/josephw/titl)
*
* Apple iDevice 备份格式
* [`rickmark/libibackup`](https://github.com/rickmark/libibackup)
* [`horrorho/InflatableDonkey`](https://github.com/horrorho/InflatableDonkey)
### 图像、声音及其他资源
* [Apple 风味的 PNG](docs/PNG)
* [Apple IMA ADPCM](https://wiki.multimedia.cx/index.php?title=Apple_QuickTime_IMA_ADPC)
* [在 Power Macintosh G3 蓝白机上使用自定义开机声音](https://www.downtowndougbrown.com/2012/07/power-macintosh-g3-blue-and-white-custom-startup-sound/)
* AirPlay2
* [`mikebrady/shareport-sync`](https://github.com/mikebrady/shairport-sync)
### 软件更新 / 安装程序
* [Mobile Asset URL](docs/Mobile_Assets)
* [`notpeter/apple-installer-checksums`](https://github.com/notpeter/apple-installer-checksums)
* [ipsw.me](https://ipsw.me)
* [ipswbeta.dev](https://ipswbeta.dev)
### 代码与签名格式
* [Mach-O 文件类型](docs/MachO.md) - Mach-O / 签名 / Entitlements
* [`sbingner/ldid`](https://github.com/sbingner/ldid) - 代码签名工具
* [`ProcursusTeam/ldid`](https://github.com/ProcursusTeam/ldid) - sbingner/ldid 的替代品，包含
针对 iOS 15 的一些更新和常规修复
* [m4b 的 Mach 二进制文件](http://www.m4b.io/reverse/engineering/mach/binaries/2015/03/29/mach-binaries.html)
* [J 的 Entitlements 数据库](https://newosxbook.com/ent.jl)
* [Levin 的代码签名](http://www.newosxbook.com/articles/CodeSigning.pdf)
* [Apple CTF / Compact Type Format](https://github.com/apple-oss-distributions/dtrace/tree/main/tools/ctfconvert)
* img4 - Apple 签名映像，版本 4
* [TheiPhoneWiki 关于 IMG4 文件的文档](https://www.theiphonewiki.com/wiki/IMG4_File_Format)
* [`xerub/img4lib`](https://github.com/xerub/img4lib)
* [`m1stadev/PyIMG4`](https://github.com/m1stadev/PyIMG4) - 用于解析 IMG4 的 Python 库 / CLI 工具
* [`tihmstar/img4tool`](https://github.com/tihmstar/img4tool)
* [`h3adshotzz/img4helper`](https://github.com/h3adshotzz/img4helper)
* TrustCache - 预授权的二进制哈希
* [Apple 平台安全 - Trust caches](https://support.apple.com/guide/security/trust-caches-sec7d38fbf97/web)
* [`t8012/go-aapl-integrity`](https://github.com/t8012/go-aapl-integrity)
* [`CRKatri/trustcache`](https://github.com/CRKatri/trustcache)
* EALF - `eficheck` 基线
* [`t8012/go-aapl-integrity`](https://github.com/t8012/go-aapl-integrity)
* [`t8012/efivalidate`](https://github.com/t8012/efivalidate)
* [`EALF`](docs/EALF)
* ChunkList - 用于验证 macOS 恢复 / Internet 恢复
* [`t8012/go-aapl-integrity`](https://github.com/t8012/go-aapl-integrity)
* `dyld` 和 DSC (dyld Shared Cache)
* [Levin 的 Dyld](http://www.newosxbook.com/articles/DYLD.html)
* [`rickmark/yolo_dsc`](https://github.com/rickmark/yolo_dsc) -最后的手段使用，并依赖于 Xcode
* [`arandomdev/DyldExtractor`](https://github.com/arandomdev/DyldExtractor) - 修复链接问题
* [dyld_shared_cache_util.cpp](https://opensource.apple.com/source/dyld/dyld-195.5/launch-cache/dyld_shared_cache_util.cpp.auto.html)
* iBoot LocalPolicy、RemotePolicy 和 BAA 签名
* [`M1_Boot_Policy`](docs/M1_Boot_Policy)
* Rosetta2
* [ProjectChampollion](https://github.com/FFRI/ProjectChampollion/)
* Swift
* [Swift Mangling](https://github.com/apple/swift/blob/main/docs/ABI/Mangling.rst)
### Sandbox 或 'Seatbelt'
* [Levin 的 - Apple Sandbox](http://newosxbook.com/files/HITSB.pdf)
* [Apple Sandbox 指南 v1.0](https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sandbox-Guide-v1.0.pdf)
* [OWASP - 逆向 Apple Sandbox](https://owasp.org/www-pdf-archive/OWASP_-_EEE_2015_-_Reversing_the_Apple_Sandbox.pdf)
* [iBSparkles 破解 Entitlements](https://sparkes.zone/blog/ios/2018/04/06/diving-into-the-kernel-entitlements.html)
* [stek29: Shenanigans, Shenanigans!](https://stek29.rocks/2018/12/11/shenanigans.html)
* [argp vs com.apple.security.sandbox](https://census-labs.com/media/sandbox-argp-csw2019-public.pdf)
* [`malus-security/sandblaster`](https://github.com/malus-security/sandblaster)
### Secure Enclave Processor
* [SEP_memmap](docs/SEP_memmap)
* [sep.yaml](_data/sep.yaml)
* [SEPROM](https://github.com/hekapooios/hekapooios.github.io/tree/master/resources/SEPROM)
* [`nyuszika7h/sepfinder`](https://github.com/nyuszika7h/sepfinder)
* [`justtryingthingsout/sepsplit-rs`](https://github.com/justtryingthingsout/sepsplit-rs)
* [揭秘 Secure Enclave Processor](https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-Demystifying-The-Secure-Enclave-Processor.pdf)
* [演示文稿镜像](http://mista.nu/research/sep-paper.pdf?_x_tr_sch=http&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US)
* [`seputil`](https://www.theiphonewiki.com/wiki/Seputil)
* [`mwpcheung/AppleSEPFirmware`](https://github.com/mwpcheung/AppleSEPFirmware)
* [SEPOS：引导之旅](https://data.hackinn.com/ppt/2018腾讯安全国际技术峰会/SEPOS：A%20Guided%20Tour.pdf)
* [攻击 SEP 的 Secure Boot - blackbird](https://github.com/windknown/presentations/blob/master/Attack_Secure_Boot_of_SEP.pdf)
* [iPhone 数据保护深度解析](https://www.slideshare.net/seguridadapple/iphone-data-protection-in-depth)
* [突破 iPhone 数据保护](https://www.slideshare.net/andrey.belenko/ios-forensics-overcoming-iphone-data-protection)
### ARM / x86
* ARM 综合
* [ARMv8 概述](https://www.element14.com/community/servlet/JiveServlet/previewBody/41836-102-1-229511/ARM.Reference_Manual.pdf)
* [ARMv8 ARM ARM (架构参考手册)](https://developer.arm.com/docs/ddi0487/latest)
* [ARMv8-A 工具](https://developer.arm.com/products/architecture/cpu-architecture/a-profile/exploration-tools)
* [ARM 软件标准](https://developer.arm.com/architectures/system-architectures/software-standards)
* [Siguza 的 ARM 训练营](https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md)
* Apple CPU
* [Asahi：Apple Silicon 简介](https://github.com/AsahiLinux/docs/wiki/Introduction-to-Apple-Silicon)
* [dougallj 的 applecpu](https://dougallj.github.io/applecpu/firestorm.html)
* 编译器
* [ARM Clang PAC ABI](https://github.com/apple/llvm-project/blob/apple/main/clang/docs/PointerAuthentication.rst)
* ARM 缓解措施
* [APRR](https://blog.siguza.net/APRR/)
* [PAN](https://blog.siguza.net/PAN/)
* [SPRR & GXF](https://blog.svenpeter.dev/posts/m1_sprr_gxf/)
### Hypervisor / 虚拟化
* Apple Hypervisor
* [官方文档](https://developer.apple.com/documentation/hypervisor)
* [Apple Silicon 上的 Hypervisor](https://developer.apple.com/documentation/hypervisor/apple_silicon)
## Baseband
* 数据文件中的 `baseband.yaml`
* Qualcomm
* [`hack-different/apple-baseband`](https://github.com/hack-different/apple-baseband)
* Hexagon DSP
* [Hexagon SDK](https://developer.qualcomm.com/software/hexagon-dsp-sdk)
* [Hexagon QEMU](https://github.com/Comsecuris/qemu-hexagon)
* [Binary Ninja Hexagon](https://github.com/google/binja-hexagon)
* [Hexag00n](https://github.com/programa-stic/hexag00n)
* [IDA Hexagon](https://github.com/gsmk/hexagon)
* [idp_heaxagon](https://github.com/n-o-o-n/idp_hexagon)
### 协处理器
* [hollance/neural-engine](https://github.com/hollance/neural-engine)
* RTKit - "Realtime" Kit
* [19h/ftab-dump](https://github.com/19h/ftab-dump)
### USB / 有线协议 / 底层硬件
* 基本涵盖所有 iDevice / iTunes
* [libimobiledevice.org](https://libimobiledevice.org)
* [`libimobiledevice/libimobiledevice`](https://github.com/libimobiledevice/libimobiledevice)
* [`hack-different/python-libimobiledevice`](https://github.com/hack-different/python-libimobiledevice)
* [`doronz88/pymobiledevice3`](https://github.com/doronz88/pymobiledevice3)
* DFU / Recovery
* [`libimoibledevice/libirecovery`](https://github.com/libimobiledevice/libirecovery)
* [checkm8 漏洞利用的技术分析](https://habr.com/en/company/dsec/blog/472762/)
* usbmuxd - iDevices 的 USB 传输
* [`libimobiledevice/usbmuxd`](https://github.com/libimobiledevice/usbmuxd)
* [`t8012/demuxusb`](https://github.com/t8012/demuxusb)
* `com.apple.restored` - iDevice 恢复协议
* [`libimobiledevice/idevicerestore`](https://github.com/libimobiledevice/idevicerestore)
* UTDM - USB 目标磁盘模式
* [`rickmark/apple_utdm`](https://github.com/rickmark/apple_utdm)
* USB-C Power Delivery - 厂商定义消息
* [USB-C 端口控制器 (ACE) 秘密](https://blog.t8012.dev/ace-part-1/)
* [`rickmark/macvdmtool`](https://github.com/rickmark/macvdmtool)
* Lightning
* [http://ramtin-amin.fr/#tristar](https://web.archive.org/web/20220107101537/http://ramtin-amin.fr/tristar.html)
*
*
* [`gh2o/rvi_capture`](https://github.com/gh2o/rvi_capture)
* [`osy/ThunderboltPatcher`](https://github.com/osy/ThunderboltPatcher)
* [Qi 无线充电](https://www.wirelesspowerconsortium.com/knowledge-base/specifications/download-the-qi-specifications.html)
### 网络 / 无线 / 传输
* Apple Wi-Fi 密码共享
* [`seemoo-lab/openwifipass`](https://github.com/seemoo-lab/openwifipass)
* AWDL - Apple 无线分布链路
* [来自 Ian Beer (Project Zero) 的发现](https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html)
* Bluetooth Bonjour (服务发现)
* iCloud
* [nicolas17/mesu-archive](https://gitlab.com/nicolas17/mesu-archive)
* Apple Watch 配对
* `com.apple.terminusd`
* [Magic Pairing：保护蓝牙外设的安全](https://arxiv.org/pdf/2005.07255.pdf)
* ATC - Air Traffic Control - iTunes Wi-Fi 同步
* RemoteXPC
*
* [XPoCe](http://newosxbook.com/tools/XPoCe2.html)
* macOS Internet Recovery
* [`rickmark/apple_net_recovery`](https://github.com/rickmark/apple_net_recovery)
* [`Internet Recovery`](docs/Internet_Recovery)
* [iCloud 钥匙串](https://www.theiphonewiki.com/wiki/ICloud_Keychain)（涵盖多种格式的统称）
### 系统配置与状态
* FDR - 出厂数据恢复
* SysCfg - 系统配置 - 序列号及其他设备信息
* APTicket - 授权版本集的根源
### 诊断协议
* AWDD - Apple 无线诊断（措辞不当，不仅限于无线，属于系统追踪）
* [`rickmark/awdd_decode`](https://github.com/rickmark/awdd_decode)
* Mojo 序列化
* [MojoKDP.kext.S](https://github.com/rickmark/mojo_thor/blob/master/MojoKDP/mojo.kext.S)
* Apple "tailspin"
* Apple `tracev3` 统一日志
* [`ydkhatri/UnifiedLogReader``](https://github.com/ydkhatri/UnifiedLogReader)
* [dtformats](https://github.com/libyal/dtformats/blob/main/documentation/Apple%20Unified%20Logging%20and%20Activity%20Tracing%20formats.asciidoc)
* XHC20 USB 捕获
* [`hack-different/demuxusb/ext/pcapng.h`](https://github.com/t8012/demuxusb/blob/b6b1a1a6633449c2cb16ad44edcc22aab4dc29cd/ext/pcapng.h)
## 越狱
* [checkra1n](https://checkra.in)
* [checkra1n 1337](https://checkra.in/1337)
* [limera1n](https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/limera1n/limera1n.c)
* [`OpenJailbreak/greenpois0n`](https://github.com/OpenJailbreak/greenpois0n)
* [`0x7ff/gaster`](https://github.com/0x7ff/gaster)
* [`axi0mX/ipwndfu`](https://github.com/axi0mX/ipwndfu)
* [`dora2-iOS/ipwnder_lite`](https://github.com/dora2-iOS/ipwnder_lite)
* [`LinusHenze/Fugu`](https://github.com/LinusHenze/Fugu)
* [unc0ver](https://unc0ver.dev)
* [Taurine](https://taurine.app)
* [Odyssey](https://theodyssey.dev/)
* [Chimera](https://chimera.coolstar.org/)
* [palera1n](https://palera.in/)
* [rootlessJB 分析文章](https://github.com/jakeajames/rootlessJB3/blob/master/writeup.pdf)
* [geohot 的 evasi0n 分析文章](http://geohot.com/e7writeup.html)
* [Fugu14 分析文章](https://github.com/LinusHenze/Fugu14/blob/master/Writeup.pdf)
* TaIG
* [8.0](http://www.newosxbook.com/articles/TaiG.html)
* [8.1.2](http://www.newosxbook.com/articles/TaiG2.html)
* [8.1.3](http://www.newosxbook.com/articles/28DaysLater.html)
* [8.4](http://www.newosxbook.com/articles/HIDeAndSeek.html)
### 越狱工具
* [`Chronic-Dev/syringe`](https://github.com/Chronic-Dev/syringe)
* [`ProcursusTeam/Procursus`](https://github.com/ProcursusTeam/Procursus)
* [`comex/substitute`](https://github.com/comex/substitute)
* [`sbingner/substitute`](https://github.com/sbingner/substitute)
* [Cydia](https://cydia.saurik.com)
* [ElleKit](https://github.com/evelyneee/ellekit)
* [Zebra](https://getzbra.com/)
* [Sileo](https://getsileo.app/)
### 越狱演示文稿
* [在后启示录时代越狱 iOS](https://cameronkatri.com/nullcongoa2022.pdf)
* [Fugu15 演示文稿](https://objectivebythesea.org/v5/talks/OBTS_v5_lHenze.pdf)
## 跨平台
* [pongoOS](https://github.com/checkra1n/pongoOS)
* [适用于 M1 的 Asahi Linux](https://asahilinux.org)
* [Corellium 的 M1 分支](https://github.com/corellium/linux-m1)
* [在 pongoOS 上运行 Android](https://github.com/corellium/projectsandcastle)
* [iphonelinux](https://github.com/planetbeing/iphonelinux)
## 安全 / 防护
* [`rickmark/isafety`](https://github.com/rickmark/isafety)
* [移动验证工具包](https://docs.mvt.re/en/latest/)
* [`mvt-project/mvt`](https://github.com/mvt-project/mvt)
### 设置 `overcommit`、代码检查器和构建
主文章在 [BUILD](BUILD.md) 中
为了保持仓库、文档和数据的整洁，我们使用一个名为 `overcommit` 的工具将 git hook 连接到一组
质量检查。最快上手的方法是运行以下命令以确保你拥有所有工具：
```
brew install hunspell
gem install overcommit bundler
bundle install
overcommit --install
```
### 为什么不使用 \<在此处插入 wiki\>
Wiki 最适合用于展示散文文本，而这里的部分目标是在可能的情况下，利用机器可读和可摄取的信息，并结合人工增强。
截至 2022 年，GitHub 拥有 5600 万用户。这意味着有 5600 万人能够通过 fork 和 PR 直接为本仓库做出贡献，这与潜在编辑者数量相对较少的 wiki 形成对比。PR 流程还允许在纳入之前对修改进行审查、评论和讨论。
## 许可证
本仓库的内容采用双重许可：
代码和数据采用 [MIT](https://opensource.org/licenses/MIT) 许可协议
文档还采用 CC-BY-SA 许可
[{style="border-width:0"}
](http://creativecommons.org/licenses/by-sa/4.0/){rel=license}
[Apple Knowledge](http://creativecommons.org/licenses/by-sa/4.0/){:xmlns:dct="http://purl.org/dc/terms/",
:property="dct:title"} 由
[Hack Different](https://github.com/hack-different/apple-knowledge){:xmlns:cc="http://creativecommons.org/ns#",
:property="cc:attributionName", :rel="cc:attributionURL"}
采用 [Creative Commons Attribution-ShareAlike 4.0 International License](http://creativecommons.org/
licenses/by-sa/4.0/){:rel=license"} 许可
## 致谢
同样献给那些将其用于善事的志愿者，并拒绝将阴影给予那些企图伤害他人的人。
标签：Apple生态, 云资产清单, 硬件数据库, 网络安全研究, 越狱, 逆向工具, 逆向工程, 防御加固