| name | kernel-analysis-vphone600 |
| description | Analyze vphone600 kernel artifacts using the local symbol database and XNU source tree. Use when working on kernel reverse engineering, address-to-symbol lookup, release-vs-research kernel comparison, or patch analysis for vphone600 variants in this repository. |
Kernel Analysis Vphone600
Use the local research/kernel_info dataset as the first source of truth for symbol lookup.
Use research/reference/xnu as the source-level reference for semantics and structure.
Required Paths
research/kernel_info/kernel_symbols.dbresearch/kernel_info/kernel_index.tsvresearch/kernel_info/json/kernelcache.release.vphone600.bin.symbols.jsonresearch/kernel_info/json/kernelcache.research.vphone600.bin.symbols.jsonresearch/reference/xnu
If research/reference/xnu is missing, create it with a shallow clone:
mkdir -p research/reference
git clone --depth 1 https://github.com/apple-oss-distributions/xnu.git research/reference/xnu
Workflow
- Confirm scope is
vphone600 only.
- Query
kernel_symbols.db to select release or research dataset by name.
- Load the linked JSON symbol file and perform symbol/address lookups.
- Cross-reference candidate code paths in
research/reference/xnu.
- Report findings with explicit kernel name, symbol path, and address.
Standard Queries
- List known kernels:
sqlite3 research/kernel_info/kernel_symbols.db "select kernel_name, json_path from kernel_symbols order by kernel_name;"
- Find one kernel by name:
sqlite3 research/kernel_info/kernel_symbols.db "select * from kernel_symbols where kernel_name='kernelcache.release.vphone600';"
- Search symbol by substring in release JSON:
rg -n 'symbol_name_fragment' research/kernel_info/json/kernelcache.release.vphone600.bin.symbols.json
- Search symbol by address in research JSON:
rg -n '0xfffffe00...' research/kernel_info/json/kernelcache.research.vphone600.bin.symbols.json
Output Rules
- Always include which kernel was used:
kernelcache.release.vphone600 or kernelcache.research.vphone600.
- Always include exact symbol name and address when available.
- Always distinguish fact from inference when mapping symbols to XNU behavior.
- Avoid claiming coverage outside vphone600 unless explicitly requested.
References
- Read
references/kernel-info-queries.md for reusable SQL and shell query snippets.
