Support iOS BootRom Images ?

[turnerrocks1]

Support SecureRom Dumps, iBoot, IBec, iBSS, and LLB images as references ida pro i think now natively support this and there are plenty of scripts for ida pro but none for ghidra nor hopper.

Reference : https://github.com/matteyeux/ida-iboot-loader
Reference : https://github.com/hack-different/iBoot-IDA Most up to date script
i will drop screenshots of how ghidra handles the bootrom images and also i will drop the files themselves

[turnerrocks1]

@ryanmkurtz This is the SecureRom Image
https://drive.google.com/file/d/1slGGeyKlmeLf5UwojPvo-p0mQJX45XlB/view?usp=sharing

[turnerrocks1]

@ryanmkurtz This is the iBoot image
https://drive.google.com/file/d/1YAqygYn0goF-bSPqY9wRH_lgZFK1qTvQ/view?usp=sharing

[turnerrocks1]

@ryanmkurtz This is the iBec image
https://drive.google.com/file/d/1oEtyVOjV9HMxiuQLIJGizhqeEtE5Ri_8/view?usp=sharing

[turnerrocks1]

@ryanmkurtz This is the iBSS image
https://drive.google.com/file/d/1LmNG5cdNK44JaiJ-kAao3S8sSpKAmQ4o/view?usp=sharing

[turnerrocks1]

@ryanmkurtz This is the LLB image
https://drive.google.com/file/d/1LQkZVHhB6_YPdT7hqRmat1D9GV1GCaL_/view?usp=sharing

[turnerrocks1]

Heres also one last good reference of a decompiler Script for the BootROM
https://github.com/argp/iBoot64helper

[ryanmkurtz]

Thanks I'll investigate soon.

[ryanmkurtz]

It would be helpful if this ticket could describe how the current support is lacking. For example, when you analyze these binaries in Ghidra, what isn't working?

[turnerrocks1]

Problem #1 It doesn't get the right address of loading i think ghidra naturally does that for all binaries ? but for the kernelcache thats not the case the higher bits are always initialized and the base address is found pronto. unlike iboot and other bootrom images it just get instantly intialized with start being 0x0 :( I would add my screenshots i have but i can't moving on to problem #2

[turnerrocks1]

Secondly I dont think it is correctly decompiling the binary such as the beginning in iboot are filled with alot of 00's after the "reset()"

[turnerrocks1]

Not trying to compare scripts or decompilers here at all just trying to better some things because i love ghidra but i tested ghidra against ida pro along with the (https://github.com/hack-different/iBoot-IDA/) scripts as the primary loader unlike ghidra it puts the start address in ida pro as "iBoot:000000018001C000 EXPORT start
iBoot:000000018001C000 start " and rebases the program to the correct base based off its prologue and certain strings and correctly labels the start function

[ryanmkurtz]

It doesn't get the right address of loading i think ghidra naturally does that for all binaries ?

If Ghidra has a loader for binary format like Mach-O, ELF, PE, etc, it will parse the headers for guidance on where to load the parts of the file into memory. These files don't seem to have any such headers, so Ghidra will use its generic BinaryLoader. When the BinaryLoader is used, it's up to to the user to go into the loader options to set the base address. For example, I loaded your iBoot image into Ghidra and set the base address to 0x180000000 and things look a lot better. I'm not totally sure that was the correct base address, i just guessed (maybe it's 0x18001C000?). I can see there are still some bad references though so I'm not sure.

Can you point me at any online documentation about the format of these dumps, other than the IDA scripts? Are these files memory dumps or are they intended to be parsed and loaded into memory at different locations like a normal Mach-O would be? If they are memory dumps, do they all share the same address space? Do they reference each other or are they independent?

[ryanmkurtz]

Have you tried this? https://github.com/ExhoAR22/ghidra-iboot

[turnerrocks1]

Heres one document i know of :
https://h3adsh0tzz.com/inside-xnu/iboot/intro
https://h3adsh0tzz.com/inside-xnu/iboot/tasks
https://h3adsh0tzz.com/inside-xnu/iboot/tasks
Iboot,LLB,IBEC,and SecureRom are all bootrom images for the iphone i dont think they are anything like Mach-Os and they also come encrypted as im4p or img4 images in the ipsw download
Also loading the script up and using it with the ios 15.0 iboot image i provided it seems to do nothing looking at the code it seems it only supports 32 iOS/macOS Bootrom images which is fine and dandy if it wasn't for the fact that most current devices are mostly 64 bit, I would attempt to fix it or try to dig deeper but i wouldnt know how to, who knows its probably as simple as adding device list to the const.java file of the specific device and SoC number https://github.com/ExhoAR22/ghidra-iboot/blob/bd3910b78ea0d1af71c70a901fd76d9841cbc55a/src/main/java/iboot/Consts.java#L16
But I dont know,
Skipping all the exploit stuff and getting to the slide about BootRom image itself aka "SecureRom" this slide was back in the 32 bit iOS days so it's probably a bit outdated but it explains the in's and out's and how it loads and its sizes etc
http://conference.hitb.org/hitbsecconf2013kul/materials/D2T1%20-%20Joshua%20'p0sixninja'%20Hill%20-%20SHAttered%20Dreams.pdf

[turnerrocks1]

It doesn't get the right address of loading i think ghidra naturally does that for all binaries ?

If Ghidra has a loader for binary format like Mach-O, ELF, PE, etc, it will parse the headers for guidance on where to load the parts of the file into memory. These files don't seem to have any such headers, so Ghidra will use its generic BinaryLoader. When the BinaryLoader is used, it's up to to the user to go into the loader options to set the base address. For example, I loaded your iBoot image into Ghidra and set the base address to 0x180000000 and things look a lot better. I'm not totally sure that was the correct base address, i just guessed (maybe it's 0x18001C000?). I can see there are still some bad references though so I'm not sure.

Can you point me at any online documentation about the format of these dumps, other than the IDA scripts? Are these files memory dumps or are they intended to be parsed and loaded into memory at different locations like a normal Mach-O would be? If they are memory dumps, do they all share the same address space? Do they reference each other or are they independent?

Which is correct thats the loading address after manually doing it by hand in ghidra, also yep the xrefs and finding functions names themselves or strings are a bit blotchy in certain areas and as stated "figuratively 40%" of the code seems to be invalid decompiled code showing up as 00's which isn't right either.

[ryanmkurtz]

Thanks for the info. If you load the iBoot image in IDA, does the reference at 18001c084 resolve to something? Is Ghidra getting this wrong?

What about this?

[ryanmkurtz]

Our team discussed if this is something we want to officially support and we decided against it. I suggest reaching out to the wider community, perhaps to the people who support it on IDA, to see if they are willing to implement and maintain a GhidraScript or Extension.