IOKit ARM7* Binary, where is it located on the iPhone device?

Question

Environment

• iOS 9.3.5 ( Jail broken )
• SSH

Problem at hand

I am trying to find the IOKit framework binary On the Jailbroken iOS device, "find / -name IOKit" results "/System/Library/Frameworks/IOKit.framework/IOKit" where "IOKit" points to "IOKit -> Versions/A/IOKit", on the "/System/Library/Frameworks/IOKit.framework/Versions/A/" there is no IOKit file exists... more over, IOKit is also not found at "/System/Library/PrivateFrameworks".

Where is the ARM7* IOKit binary found?

Answer 1

It doesn't exist as its own file.

On iOS, all stock (Apple-supplied) frameworks and libraries are bundled together in one huge file, which is known as the "shared cache".
If you're on an ARMv7 device, that file is gonna be located at:

/System/Library/Caches/com.apple.dyld/dyld_shared_cache_armv7

A multitude of tools have been written to operate on, or extract libraries from it, all with their own faults and shortcomings, including Apple's own dsc_extractor . An extracted framework or library is highly unlikely to actually work as intended, if you can get it working at all. They are good enough for reverse engineering however. For more info on cache extraction, see the iPhone dev wiki .

As for IOKit specifically though, I can't imagine what you'd really want with the binary - for the purpose of linking, XCode provides a much, much slimmer .tbd file, and reverse engineering is pretty pointless since it's open source .