WMSA: Where My Strings At?

IDA Python plugin for converting HMAC'd strings in iBoot to file names for aiding iBoot Reverse Engineering.

Explanation

Apple started obfuscating iBoot strings with iOS 9. They basically stripped down some printfs and (all?) panic/assert calls to be the file path with some crypto magic and the line number of print/panic. What this plugin will basically do is convert such disassembly:

TO:

(string and line number highlighting is totally optional)

Notice

This script can only decode hashes for iBoots later than iOS 11.3 beta 3 becuase older iBoots had strings hashed differently and this won't decode all hashes.

I haven't tested this script on > IDA 7.2.

Usage

Copy WMSA.py and hash.plist from this repo into plugins folder or based on OS.

Requirement

Xerub's Simp7.py is necessary if using < IDA 7.1.