Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/blacktop/ipsw-skill/ipswnpx skills add blacktop/ipsw-skill --skill ipswgit clone --depth 1 https://github.com/blacktop/ipsw-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00178 | $0.03244 |
| Opus 5 | $0.00089 | $0.01622 |
| Sonnet 5 | $0.00036 | $0.00649 |
| Haiku 4.5 | $0.00018 | $0.00324 |
Grade A, and why
ipsw scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 313 lines — stays where its author put it; the contents beside it link to each section on GitHub.
IPSW - Apple Reverse Engineering Toolkit
Install: brew install blacktop/tap/ipsw (Linux: see https://github.com/blacktop/ipsw#install)
Choose Your Workflow
| Goal | Start Here |
|---|---|
| Download/extract firmware | Firmware Acquisition |
| Reverse engineer userspace | Userspace RE |
| Analyze kernel/KEXTs | Kernel Analysis |
| Research entitlements | Entitlements |
| Dump private API headers | Class Dump |
| Analyze standalone binary | Mach-O Analysis |
| Diff two IPSWs/OTAs | Firmware Diffing |
| Symbolicate a crash / panic | Symbolication |
| Parse IMG4/AEA/iBoot/SEP | Firmware Components |
| Decompile / query sandbox profiles | Sandbox Profile Analysis |
| Inspect / mount an IPSW | IPSW Inspection |
Firmware Acquisition
# Download latest IPSW for device
ipsw download ipsw --device iPhone16,1 --latest
# Download with automatic kernel/DSC extraction
ipsw download ipsw --device iPhone16,1 --latest --kernel --dyld
# Extract components from local IPSW
ipsw extract --kernel iPhone16,1_18.0_Restore.ipsw
ipsw extract --dyld --dyld-arch arm64e iPhone16,1_18.0_Restore.ipsw
# Remote extraction (no full download)
ipsw extract --kernel --remote <IPSW_URL>
See references/download.md for device identifiers and advanced options.
Userspace RE (dyld_shared_cache)
macOS DSC location:
- macOS 14+:
/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e - macOS 13 and earlier:
/System/Library/dyld/dyld_shared_cache_arm64e
Examples below assume:
export DSC=/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e
Essential Commands
| Command | Purpose |
|---|---|
dyld a2s <DSC> <ADDR> |
Address → symbol (triage crash LR/PC) |
dyld symaddr <DSC> <SYM> --image <DYLIB> |
Symbol → address |
dyld disass <DSC> --vaddr <ADDR> |
Disassemble at address |
dyld disass <DSC> --symbol <SYM> --image <DYLIB> |
Disassemble by symbol |
dyld xref <DSC> <ADDR> --all |
Find all references to address |
dyld dump <DSC> <ADDR> --size 256 |
Dump raw bytes at address |
dyld str <DSC> "pattern" --image <DYLIB> |
Search strings |
dyld objc --class <DSC> --image <DYLIB> |
List ObjC classes |
dyld extract <DSC> <DYLIB> -o ./out/ |
Extract dylib for external tools |
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 313 lines · 178 tokens per session scan A 0a1bde3b4816
ipsw is a skill published in the GitHub repository blacktop/ipsw-skill (81 stars, last pushed 4mo ago), licensed MIT. It adds 178 tokens to every session and 3,244 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically…
asc-revenuecat-catalog-sync
Reconcile App Store Connect subscriptions and in-app purchases with RevenueCat products, entitlements, offerings, and packages using asc and RevenueCat MCP. Use when setting up or syncing subscription catalogs across ASC and RevenueCat.
asc-shots-pipeline
Orchestrate iOS screenshot automation with xcodebuild/simctl for build-run, AXe for UI actions, JSON settings and plan files, Koubou-based framing (asc screenshots frame), and screenshot upload (asc screenshots upload). Use when users ask for automated screenshot capture, AXe-driven simulator flows, frame composition…
asc-metadata-sync
Sync, validate, and apply App Store metadata with the current asc canonical metadata workflow. Use when updating metadata, localizations, keywords, or migrating legacy fastlane metadata.
asc-workflow
Define, validate, run, resume, and audit repo-local multi-step automations with current asc workflow and .asc/workflow.json, including step outputs and safe release/TestFlight workflows.
asc-xcode-build
Build, archive, generate export options, export, upload, and manage Xcode version/build numbers with the current asc xcode helpers. Use when creating an IPA or PKG for App Store Connect, TestFlight, or registered-device release testing.