// the find
blacktop/ipsw
iOS/macOS Research Swiss Army Knife
ipsw is a Go CLI for Apple firmware reverse engineering: downloading and unpacking IPSWs/OTAs, parsing dyld shared caches and Mach-O binaries, extracting kernelcaches and KEXTs, and interacting with jailed/connected iOS devices over USB. It's aimed at security researchers and jailbreak/firmware tinkerers, not app developers.
The command surface is genuinely deep — dyld shared cache symbol resolution, Swift/ObjC metadata dumping, ARM64 disassembly, and kernelcache KEXT extraction are things you'd otherwise cobble together from several abandoned Python scripts or IDA plugins. It also ships a REST daemon (ipswd) and OpenAPI spec alongside the CLI, so it's usable as a library/service, not just a one-off tool. Active CI (go.yml, codeql, dependabot) and a real release pipeline (goreleaser, Homebrew tap, scoop, snap) show this isn't a research dump left to rot.
Requires CGO and a C toolchain to build, plus OS/build-variant-dependent features (Frida support is a separate build) — not a clean 'go install' experience. The command tree is enormous (hundreds of subcommands across dyld/idev/kernel/fw/appstore) with help text as the only real documentation for most of them, so the learning curve is steep despite the external docs site. It's narrowly useful outside Apple platform reverse engineering — this is a specialist tool, and treating it as a general firmware/binary analysis kit would be a mismatch.