Process Firmware IMG with iOracle

Process Firmware IMG with iOracle

There are X steps to complete when processing firmware IMG files with iOracle.

1. Use iOracle to extract all relevant data from the jailbroken device(s) that will provide dynamic data (e.g., process ownership, sandbox extensions, and file access behaviors) to compliment the static data extracted from the firmware.
2. Collect the .img files for the root file systems of the firmware versions you want to process.
3. On a macOS system, run the iOracle/automatedDataExtraction/dataExtractorForIMGFile.sh. This script seems to have trouble if the input and output files are not all on the same system. I suspect this has something to do with mounting the file systems.
4. Move the results of dataExtractorForIMGFile.sh to a Linux system with IDA Pro and process the results with dataExtractorForExtractedFileSystem.sh.
5. Set up symlinks to dynamic analysis facts from step 1 in the prolog facts directory for the firmware version's analysis directory (e.g., iPad2,1_7.0.6_11B651/prologFacts).
6. Set up symlinks to sandbox profile facts produced by Sandscout in the prolog facts directory for the firmware version's analysis directory (e.g., iPad2,1_7.0.6_11B651/prologFacts).