Skip to content

ktool fails to parse Kernel Collections on macOS 15.5 Beta (24F74) on Intel (x86_64) #65

Description

@Microsvuln

Environment:

macOS Version: 15.5 (Build 24F74)

Hardware Architecture: x86_64 (Intel)

ktool Version: 2.1.1

Installation Method: pip3 install git+https://github.com/cxnder/ktool.git

Steps to Reproduce :

On a clean installation of ktool on the specified OS, run the following command:

ktool kcache --kexts /System/Library/KernelCollections/SystemKernelExtensions.kc

Output :

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.10/bin/ktool", line 8, in <module>
    sys.exit(main())
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/ktool_script.py", line 382, in main
    args.func(args)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/ktool_script.py", line 985, in kcache
    kernel_cache = KernelCache(macho_file)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/kcache.py", line 106, in __init__
    self.mach_kernel = ktool.load_image(macho_file)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/ktool.py", line 104, in load_image
    return MachOImageLoader.load(macho_slice, load_symtab=load_symtab, load_imports=load_imports,
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/loader.py", line 59, in load
    image = Image(macho_slice, force_misaligned_vm)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/image.py", line 268, in __init__
    self.macho_header: MachOImageHeader = MachOImageHeader.from_image(macho_slice=macho_slice)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/ktool/macho.py", line 417, in from_image
    image_header.filetype = MH_FILETYPE(header.filetype)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/enum.py", line 385, in __call__
    return cls.__new__(cls, value)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/enum.py", line 710, in __new__
    raise ve_exc
ValueError: 12 is not a valid MH_FILETYPE

I tried to manually fix it, but I ended up with no result .

Is there an alternative way of doing this or how would you recommend this problem to be solved ? Or are you going to fix this ?

Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions