Dockerized ipsw: dyld_shared_cache extraction inside docker

[mosherp]

Hi,

Do you have plans to add support for supporting the extraction of dyld_shared_cache from inside your container ?

In your doc's you state you only support pre IOS16.

Your tool is no less than amazing, but I think that Docker is overlooked.
Utilizing ipsw via docker to perform automation is a huge leap forward !

You also stated in #345 you plan to add APFS support to all platforms - Is Docker included ?

Thanks !

[blacktop]

Have you tried it yet? (in docker?)

[mosherp]

Yes, I am running it on a linux server and it fails on mounting using apfs-fuse.
I thought its by-design as your docs state you only support up to IOS16.x.

My server has ipsw installed on the host and it works well.
Via docker it always fails (i have also tried mounting the fuse device, running it as privileged, nothing works).

My linux distro is Debian 11. kernel 5.10, x86_64

running:

docker run --rm -it -v ./ipsw:/data blacktop/ipsw:latest -V extract -d /data/iPhone16,2_17.6_21G5066d_Restore.ipsw
   • Extracting dyld_shared_cache
      • Extracted 092-29684-023.dmg from iPhone16,2_17.6_21G5066d_Restore.ipsw
      • Mounting DMG 092-29684-023.dmg
Usage:
  ipsw extract <IPSW/OTA | URL> [flags]

Aliases:
  extract, e, ex

Flags:
      --device string           Device to extract kernel for (e.g. iPhone10,6)
      --dmg string              Extract DMG file (app, sys, fs)
      --driverkit               Extract DriverKit dyld_shared_cache
      --dtree                   Extract DeviceTree
  -d, --dyld                    Extract dyld_shared_cache
  -a, --dyld-arch stringArray   dyld_shared_cache architecture to extract
  -x, --exclave                 Extract Exclave Bundle
      --fcs-key                 Extract AEA1 DMG fcs-key pem files
  -f, --files                   Extract File System files
      --flat                    Do NOT perserve directory structure when extracting
  -h, --help                    help for extract
      --iboot                   Extract iBoot
      --insecure                do not verify ssl certs
  -j, --json                    Output extracted paths as JSON
      --kbag                    Extract Im4p Keybags
  -k, --kernel                  Extract kernelcache
  -o, --output string           Folder to extract files to
  -p, --pattern string          Extract files that match regex
      --pem-db string           AEA pem DB JSON file
      --proxy string            HTTP/HTTPS proxy
  -r, --remote                  Extract from URL
      --sep                     Extract sep-firmware
      --sptm                    Extract SPTM and TXM Firmwares
      --sys-ver                 Extract SystemVersion

Global Flags:
      --color           colorize output
      --config string   config file (default is $HOME/.config/ipsw/config.yaml)
      --no-color        disable colorize output
  -V, --verbose         verbose output

   ⨯ failed to IPSW FS dmg: failed to mount 092-29684-023.dmg: failed to mount '092-29684-023.dmg' via apfs-fuse: exit status 1: cmd output - 'fuse: device not found, try 'modprobe fuse' first

Downloaded the image right now just to make sure I did not miss a newer version (hash: f2f75a4c21b7 - built 21 hours ago)

[blacktop]

ok, it should work. I'll try testing it myself as well

[mosherp]

Much appreciated!

If there is anything I can assist you with please let me know

[blacktop]

Try adding --security-opt apparmor:unconfined

[blacktop]

https://blacktop.github.io/ipsw/docs/guides/extract/#extract-dyld_shared_cache-from-a-previously-downloaded-ipsw

[mosherp]

This seems to do the trick :-)
In that case, in order to run the dockerized version, one must install fuse and APFS on the host.
Might worth adding it to the docs as well.

Thank you so much for your quick support !

[blacktop]

I didn't have it installed on the host, just inside the docker container. there appears to have been changes to the apparmor profile since I first documented how to use it

[mosherp]

You have solved my issue and your code is working properly.

If you are willing to advise i'll be more than grateful:

Any reason you might think of that building python or installing one of the following ontop of your image might break the ability to mount a DMG ?

I am building ontop of your image (which i successfully extract dyld with) the following:

apt-get install docker.io \
software-properties-common \
python 3.12 python 3.12-dev python 3.12-venv python 3.12-dnsutils \
ca-certificates \
wget \
git

Using your "clean" image i successfully extract dyld_shared_cache.
Using my image (based on yours but adding the above) the extraction fails with:

failed to parse plists in IPSW: failed to parse plists: failed to open IPSW zip: open .....: no such file or directory

[blacktop]

my apologies, but providing help on using docker is out of scope for this project