Skip to content

ktool fails to parse Kernel Collections on macOS 15.5 Beta (24F74) on Intel (x86_64) #65

Description

@Microsvuln

Environment:

macOS Version: 15.5 (Build 24F74)

Hardware Architecture: x86_64 (Intel)

ktool Version: 2.1.1

Installation Method: pip3 install git+https://github.com/cxnder/ktool.git

Steps to Reproduce :

On a clean installation of ktool on the specified OS, run the following command:

ktool kcache --kexts /System/Library/KernelCollections/SystemKernelExtensions.kc

Output :

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.10/bin/ktool", line 8, in <module>
    sys.exit(main())
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/ktool_script.py", line 382, in main
    args.func(args)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/ktool_script.py", line 985, in kcache
    kernel_cache = KernelCache(macho_file)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/kcache.py", line 106, in __init__
    self.mach_kernel = ktool.load_image(macho_file)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/ktool.py", line 104, in load_image
    return MachOImageLoader.load(macho_slice, load_symtab=load_symtab, load_imports=load_imports,
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/loader.py", line 59, in load
    image = Image(macho_slice, force_misaligned_vm)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/image.py", line 268, in __init__
    self.macho_header: MachOImageHeader = MachOImageHeader.from_image(macho_slice=macho_slice)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/macho.py", line 417, in from_image
    image_header.filetype = MH_FILETYPE(header.filetype)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/enum.py", line 385, in __call__
    return cls.__new__(cls, value)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/enum.py", line 710, in __new__
    raise ve_exc
ValueError: 12 is not a valid MH_FILETYPE

I tried to manually fix it, but I ended up with no result .

Is there an alternative way of doing this or how would you recommend this problem to be solved ? Or are you going to fix this ?

Thanks.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions