Kernel

The kernel of iOS is the XNU kernel. To learn about what "kernel" means in general, see the Wikipedia article.

Pre-2.0, it was vulnerable to the Ramdisk Hack and may still be, but iBoot doesn't allow boot-args to be passed anymore. It is mapped to memory at 0x80000000, forcing a 2/2GB address separation, similar to Windows 32-bit model. On older iOS versions the separation was 3/1 (mapping the kernel at 0xC0000000), closer to the Linux model.

Note, that this is NOT like 32-bit OS X, wherein the kernel resides in its own address space, but more like OS X 64-bit, wherein CR3 is shared (albeit an address space larger by several orders of magnitude). See the appropriate section.

ASLR
As of iOS 6, the kernel is subject to ASLR, much akin to Mountain Lion (OS X 10.8). This make exploitation harder as the location of kernel code cannot be known.

On production and development devices, the kernel is always stored as a statically linked cache stored at /System/Library/Caches/com.apple.kernelcaches/kernelcache that is decompressed and run on startup.

Stack
The kernel maintains thread specific stacks by calling kernel_memory_allocate, this allocates stacks in the specified kalloc zone. The bootstrap thread has its own specific static kernel stack, which is specified by _intstack. IRQ and FIQ handlers will also have their own execution stack which is specified by _irqstack.

Boot-Args
Like its OS X counterpart, iOS's XNU accepts command line arguments (though the actual passing of arguments is done by iBoot, which as of late refuses to do so). Arguments may be directed at the kernel proper, or any one of the many KExts (discussed below). The arguments of the kernel are largely the same as those of OS X.

Kexts use boot-args as well, as can be seen when disassembly by calls to PE_parse_boot_argn (usually exported, _PE_parse_boot_argn 8027A8EC on the iOS 6.1.3 kernel, discovered by Haifisch). Finding references (using IDA) reveals hundreds places in the code wherein arguments are parsed in modules, pertaining to Flash, HDMI, and AMFI.

Here's a list of boot-args extracted with the IDA script by MuscleNerd:

-disable_aslr (From the xnu source code) _nand-part-poison _panicd_corename _panicd_ip _router_ip acc_debug aesdev als_enable_debug amfi amfi_allow_any_signature amfi_get_out_of_my_way amfi_unrestrict_task_for_pid AppleEmbeddedUSBArbitrator-debug AppleS5L8930XUSBArbitrator-debug AppleUSBPhy-debug arm7m-enable-jtag -b backlight-level backlight-logging baseband-spi-sclk-period bcom.chip.driveStrength_mA bcom.chip.watermark bcom.clock.sd-rate bcom.devif.fn2-block-size bcom.devif.rx-retries bcom.devif.transaction-log bcom.devif.tx-retries bcom.feature.flags bcom.ps.inactivity.timeout bcom.wte.thread-priority boot-uuid brightness burnin-size cameraclocks charger-debug cpus cs_debug cs_enforcement_disable darkwake dart dcc debug disable-usb-iap dp_async_event_fail_hard dp_audio_driver_level dp_audio_driver_mask dp_audio_interface_level dp_audio_interface_mask dp_controller_level dp_controller_mask dp_device_level dp_device_mask dp_display_interface_level dp_display_interface_mask dp_interface_level dp_interface_mask dp_log_level dp_max_channel_count_lpcm dp_max_sample_rate_lpcm dp_max_sample_size_lpcm dp_min_channel_count_lpcm dp_min_sample_rate_lpcm dp_min_sample_size_lpcm dp_service_level dp_service_mask dpsm dvb dvc dvd effaceable-enable-full-scan effaceable-enable-wipe enable-acsleep fairshare_minblockedtime fill fixedpriority_quantum fix-parity force-usb-host force-usb-power hdmi_max_channel_count_lpcm hdmi_max_sample_rate_lpcm hdmi_max_sample_size_lpcm hdmi_min_channel_count_lpcm hdmi_min_sample_rate_lpcm hdmi_min_sample_size_lpcm hdmi_protection_type hp-detect-invert hp-pop-workaround hp-switch-force-config hp-switch-ramp hsic i2c-logsize i2c-verbose ifa_debug ifnet_debug initmcl io iopfmi-timeout iotrace jpeg-log jtag kdp_crashdump_pkt_size kdp_ip_addr kdp_match_mac kdp_match_name keepsyms kextlog link_recovery_enabled mbuf_debug mbuf_pool mcache_flags mleak_sample_factor mseg msgbuf mt-bytes mt-strings mtxspin nand-boot-malloc nand-check-vs nand-commands nand-disable-driver nand-dump-vs-table nand-enable-adm nand-enable-reformat nand-enable-yaftl nand-erase nand-erase-install nand-fbbt-publish nand-force-restore nand-idle-timeout-ms nand-ignore-ptab nand-index-cache-size nand-latency-us nand-max-pages nand-neuralize nand-nvram-debug nand-ppn-debug nand-ppn-vs-debug nand-qual nand-queue-entries nand-read-blocks-max nand-read-dccycle-clks nand-read-hold-clks nand-readonly nand-read-setup-clks nand-reorder-defer-max nand-reorder-defer-size-trigger nand-reorder-read-promote-max nand-reset-burnin nand-save-rma-data nand-set-rma nand-sftl-cache-drain nand-sleep-debug-panic nand-slow-timings nand-wearlevel-timeout-ms nand-whiten-metadata nand-wipe nand-write-blocks-max nand-write-hold-clks nand-write-setup-clks nbuf ncl net.inet6.ip6.scopedroute net_affinity net_rtref network-type -no64exec -novfscache panicd_port pcp pctb pdmvr pio-error pmu-chargetrap pmu-debug ppn-clean -progress prox_enable_debug pthtest rd remote_nmi rootdev -s sdio.clock.base-rate sdio.clock.sd-rate sdio.debug.abort-init sdio.debug.init-delay sdio.log.flags sdio.log.level sdio.transfer.max-pio-blocks sdio.transfer.max-pio-size sdio.transfer.mode serial sgx_panic_on_recovery shadev slto_us socket_debug torchcltm0 usb usb_dev_nmi usb_dev_reset -vnode_cache_defeat wdt wfi wlan.ap.channel wlan.debug.abort-init wlan.debug.generate-mac wlan.log.flags wlan.log.level wlan.log.timestamp wlan.netmanager.stats-timer-interval wlan.panic.factory wqsize WTE -x

Versions
iOS has consistently maintained a higher kernel version than the corresponding version of OS X. At the time of writing, OS X Mavericks' XNU is 2422, whereas iOS 8 is 2783. This is not surprising, considering that iOS has novel features (such as Kernel ASLR, the default freezer, and various security hardening features) which are first incorporated in it, and only later make it to OS X. The following demonstrates the OS versions at present (via terminal uname -a command):

OS X Mavericks 10.9.5: Darwin Kernel Version 13.4.0: Sun Aug 17 19:50:11 PDT 2014; root:xnu-2422.115.4~1/RELEASE_X86_64

OS X Yosemite 10.10 Public Beta 3:

Darwin Kernel Version 14.0.0: Mon Sep 8 05:27:41 PDT 2014; root:xnu-2782.1.96~5/RELEASE_X86_64 iOS 8.0:

Darwin Kernel Version 14.0.0: Tue Aug 19 15:09:47 PDT 2014; root:xnu-2783.1.72~8/RELEASE_ARM64_S5L8960X

Note: The RELEASE_ARM_xxxxxxxx file obviously differs on device / CPU and the time varies by a few minutes per device.

Version List
The compilation date for each version will vary slightly between processors. This is due to the fact that compilations are sequential.

Source Code
As XNU is based off of the BSD kernel, it is open source. The source is under a 3-clause BSD License for the original BSD portions with the portions added by Apple under the Apple Public Source License. The versions contained in iOS are not available, instead only versions used in OS X are available. This does not appear to be legal as per &#x00A7;2.3 in the APSL: 2.3    Distribution of Executable Versions. In addition, if You Externally Deploy Covered Code (Original Code and/or Modifications) in object code, executable form only, You must include a prominent notice, in the code itself as well as in related documentation, stating that Source Code of the Covered Code is available under the terms of this License with information on how and where to obtain such Source Code. with Source Code defined in &#x00A7;1.8: 1.8    "Source Code" means the human readable form of a program or other work that is suitable for making modifications to it, including all modules it contains, plus any associated interface definition files, scripts used to control compilation and installation of an executable (object code).

It is worth noting that Apple does not list XNU as being an open source component of iOS. This can be seen by viewing opensource.apple.com and selecting any iOS version. As far as can be told, none of the versions of XNU are available in source version.

There are many other open souce components that iOS uses that are not listed, such as: It does not appear that Apple assumes what you see in the OS X pages are also on iOS as JavaScriptCore, WebCore, among others are listed on both OS X (10.8) and iOS (6.0), albeit different versions.
 * CF (CoreFoundation - Cocoa)
 * SQLite (SQLite - database utility)
 * TimeZoneData (tz database - /usr/share/zoneinfo)
 * curl(?) (libcurl - various HTTP operations)
 * hfs (hfs - HFS driver)
 * launchd (launchd - launch daemon)
 * libxml2(?) (libxml2 - parser for XML plists)
 * xnu (XNU - Kernel)
 * zip (zip - extraction of various files)

It is also worth noting that gdb (GCC debugger) and ld64 are listed as components in iOS 6.0. Why there are present is a mystery as they are not present on unaltered devices, but only through Cydia or Xcode's.

Kernel Extensions
iOS, sadly, does not have kexts floating around the /|file system, but they are indeed present. The kernelcache can be unpacked to show the kernel proper, along with the kexts (all packed in the __PRELINK_TEXT section) and their plists (in the __PRELINK_INFO section).

The Cydia supplied kextstat does not work on iOS. Sadly, the reason is that kextstat relies on, which is a deprecated (and recently removed) API in recent iOS and OS X versions. With that said, the kexts do exist. The alternative, jkextstat, does work on recent iOS versions. jkextstat can cause some confusion as it uses the executable name, similar to how calling   just launches   but with parameters to treat all   files as C++ files.

The following is the output from jkextstat on an iPod touch 4G running iOS 6(?):

Podicum:~ root# ./kextstat 0 __kernel__ 1 kpi.bsd 2 kpi.dsep 3 kpi.iokit 4 kpi.libkern 5 kpi.mach 6 kpi.private 7 kpi.unsupported 8 driver.AppleARMPlatform 9 iokit.IOStorageFamily 10 driver.DiskImages 11 driver.FairPlayIOKit 12 driver.IOSlaveProcessor 13 driver.IOP_s5l8930x_firmware 14 iokit.AppleProfileFamily 15 iokit.IOCryptoAcceleratorFamily 16 driver.AppleMobileFileIntegrity 17 iokit.IONetworkingFamily 18 iokit.IOUserEthernet 19 platform.AppleKernelStorage 20 iokit.IOSurface 21 iokit.IOStreamFamily 22 iokit.IOAudio2Family 23 driver.AppleAC3Passthrough 24 iokit.EncryptedBlockStorage 25 iokit.IOFlashStorage 26 driver.AppleEffaceableStorage 27 driver.AppleKeyStore 28 kext.AppleMatch 29 security.sandbox 30 driver.AppleS5L8930X 31 iokit.IOHIDFamily 32 driver.AppleM68Buttons 33 iokit.IOUSBDeviceFamily 34 iokit.IOSerialFamily 35 driver.AppleOnboardSerial 36 iokit.IOAccessoryManager 37 driver.AppleProfileTimestampAction 38 driver.AppleProfileThreadInfoAction 39 driver.AppleProfileKEventAction 40 driver.AppleProfileRegisterStateAction 41 driver.AppleProfileCallstackAction 42 driver.AppleProfileReadCounterAction 43 driver.AppleARMPL192VIC 44 driver.AppleCDMA 45 driver.IODARTFamily 46 driver.AppleS5L8930XDART 47 iokit.IOSDIOFamily 48 driver.AppleIOPSDIO 49 driver.AppleIOPFMI 50 driver.AppleSamsungSPI 51 driver.AppleSamsungSerial 52 driver.AppleSamsungPKE 53 driver.AppleS5L8920X 54 driver.AppleSamsungI2S 55 driver.AppleEmbeddedUSB 56 driver.AppleS5L8930XUSBPhy 57 iokit.IOUSBFamily 58 driver.AppleUSBEHCI 59 driver.AppleUSBComposite 60 driver.AppleEmbeddedUSBHost 61 driver.AppleUSBOHCI 62 driver.AppleUSBOHCIARM 63 driver.AppleUSBHub 64 driver.AppleUSBEHCIARM <3 4 5 8 55 57 58 60 63> 65 driver.AppleS5L8930XUSB <1 3 4 5 7 8 55 57 58 60 61 62 64> 66 driver.AppleARM7M 67 driver.EmbeddedIOP 68 driver.AppleVXD375 69 driver.AppleD1815PMU 70 iokit.AppleARMIISAudio 71 driver.AppleEmbeddedAudio 72 driver.AppleCS42L59Audio 73 driver.AppleEmbeddedAccelerometer 74 driver.AppleEmbeddedGyro 75 driver.AppleEmbeddedLightSensor 76 iokit.IOAcceleratorFamily 77 IMGSGX535 78 driver.H2H264VideoEncoderDriver 79 driver.AppleJPEGDriver 80 driver.AppleH3CameraInterface 81 driver.AppleM2ScalerCSCDriver 82 iokit.IOMobileGraphicsFamily 83 driver.AppleDisplayPipe 84 driver.AppleCLCD 85 driver.AppleSamsungMIPIDSI 86 driver.ApplePinotLCD 87 driver.AppleSamsungSWI 88 iokit.IODisplayPortFamily 89 driver.AppleRGBOUT 90 driver.AppleTVOut 91 driver.AppleAMC_r2 92 driver.AppleSamsungDPTX 93 driver.AppleSynopsysOTGDevice 94 driver.AppleNANDFTL 95 driver.AppleNANDLegacyFTL 96 AppleFSCompression.AppleFSCompressionTypeZlib 97 IOTextEncryptionFamily 98 driver.AppleBSDKextStarter 99 nke.ppp 100 nke.l2tp 101 nke.pptp 102 iokit.IO80211Family 103 driver.AppleBCMWLANCore 104 driver.AppleBCMWLANBusInterfaceSDIO 105 driver.AppleDiagnosticDataAccessReadOnly 106 driver.LightweightVolumeManager 107 driver.IOFlashNVRAM 108 driver.AppleNANDFirmware 109 driver.AppleImage3NORAccess 110 driver.AppleBluetooth 111 driver.AppleMultitouchSPI 112 driver.AppleUSBMike 113 driver.AppleUSBDeviceMux 114 driver.AppleUSBEthernetDevice

For a specific extension, e.g. SandBox, the full information (including the handy load address) is also accessible:

com.apple.security.sandbox CFBundleVersion 154.7         OSBundleCPUSubtype 9         OSBundleCPUType 12         OSBundleDependencies 6                 7                  5                  3                  28                  1                  4                  16                  2          OSBundleExecutablePath /System/Library/Extensions/Sandbox.kext/Sandbox OSBundleIsInterface OSBundleLoadAddress 2153734144         OSBundleLoadSize 36864         OSBundleLoadTag 29         OSBundleMachOHeaders OSBundlePath /System/Library/Extensions/Sandbox.kext OSBundlePrelinked OSBundleRetainCount 0         OSBundleStarted OSBundleUUID OSBundleWiredSize 36864         OSKernelResource

It's also worth mentioning that, in the above listing, the OSBundleMachOHeaders (base-64 encoded binary headers) leak kernel addresses in iOS 6.0, defeating Kernel ASLR. This has been quickly fixed in iOS 6.0.1, effectively locking down iOS for the foreseeable future, thanks to security researcher mdowd.

Winocm's custom kernel
Winocm uses a custom kernel which the version can be found below. Darwin Kernel Version 13.0.0: Fri Nov 22 18:19:54 CST 2013; root:xnu-2050.48.13~7/DEVELOPMENT_ARM_S5L8930X