LZVN with kexts/dictionary extraction

It was two weeks ago that I updated LZVN to support kernel extraction from a prelinkedkernel, and todays update adds extraction of the dictionary with:

./lzvn -d /System/Library/Prelinkedkernels/prelinkedkernel dictionary

And all kexts with:

./lzvn -d /System/Library/Prelinkedkernels/prelinkedkernel kexts

The extracted kexts are saved in kexts/Library/Extensions and/or kexts/System/Library/Extensions, in RAW format. The latter means that extracted kexts are saved like they are found in the prelinked kernel. Not like ‘normal’ kexts.

Note: Source code needs a few cleanups here and there, but it works.

Update: The Dictionary.plist is now saved in proper XML format, so that you can open it with Xcode, and the number of signed and unsigned (extracted) kexts is now also dumped in the output.

Edit: Here is a list with the signed kexts:

/System/Library/Extensions/System.kext/PlugIns/Mach.kext
/System/Library/Extensions/System.kext/PlugIns/IOKit.kext
/System/Library/Extensions/System.kext/PlugIns/Libkern.kext
/System/Library/Extensions/System.kext/PlugIns/Private.kext
/System/Library/Extensions/System.kext/PlugIns/Unsupported.kext
/System/Library/Extensions/System.kext/PlugIns/BSDKernel.kext
/System/Library/Extensions/System.kext/PlugIns/MACFramework.kext

All other kexts are stored in unsigned format in the prelinkedkernel.

Have fun with it!

Advertisement