Research Apple Kernel Boot And Firmware

Overview

Keep kernel, boot, and firmware research separate from app analysis. Require exact build, hardware identity, UUID, and provenance before correlating public source, symbols, or extracted components.

Read references/apple-system-artifacts.md for artifact identities, source-correlation rules, boot context, and authoritative sources.

Workflow

1. Define the artifact family and question.

   • Separate kernel collection, KDK, panic report, device tree, boot object, LocalPolicy, restore manifest, IPSW component, and coprocessor firmware.

2. Preserve acquisition and exact identity.

   • Record hashes, source, date, container and member paths, device or Mac model, board and SoC identifiers, OS marketing version and build, component version, UUID, and signing or personalization metadata.

3. Match supporting material.

   • Match KDK and symbols by exact OS build, architecture, and UUID.
   • Match public XNU, dyld, Security, or distribution manifests by published release and preserve the limits of that match.