IPSW-SYMBOLICATE(1)

NAME
ipsw-symbolicate - Symbolicate ARM 64-bit crash logs (similar to Apple's symbolicatecrash)

SYNOPSIS
ipsw symbolicate [IPSW|DSC] [flags]

DESCRIPTION
Symbolicate ARM 64-bit crash logs (similar to Apple's symbolicatecrash)

OPTIONS
-a, --all[=false]
    Show all threads in crashlog

-d, --demangle[=false]
    Demangle symbol names

--dsc-slide=""
    Rebase dyld_shared_cache frames onto this base for static analysis (hex, e.g. 0x180000000)

-x, --extra=""
    Path to folder with extra files for symbolication

--force[=false]
    Force using the supplied IPSW even if it doesn't match the crashlog (e.g. for vPhone)

-h, --help[=false]
    help for symbolicate

--hex[=false]
    Display function offsets in hexadecimal

--ida[=false]
    Generate IDAPython script to mark panic frames in IDA Pro

--kc-slide=""
    Apply custom KASLR slide to kernelcache frames for live debugging (hex, e.g. 0x14f74000)

--peek[=false]
    Show disassembly instructions around each panicked frame

--peek-count=5
    Number of instructions to show with --peek (centered on frame, respects function boundaries)

--pem-db=""
    AEA pem DB JSON file

-p, --proc=""
    Filter crashlog by process name

-r, --running[=false]
    Show all running (TH_RUN) threads in crashlog

-s, --server=""
    Symbol Server DB URL

--signatures=""
    Path to signatures folder

-u, --unslide[=false]
    Unslide user-space addresses for static analysis (kernel frames are always unslid)

OPTIONS INHERITED FROM PARENT COMMANDS
--color[=false]
    colorize output

--config=""
    config file (default is $HOME/.config/ipsw/config.yaml)

--no-color[=false]
    disable colorize output

-V, --verbose[=false]
    verbose output

EXAMPLE
    # Symbolicate a panic crashlog (BugType=210) with an IPSW
    ❯ ipsw symbolicate panic-full-2024-03-21-004704.000.ips iPad_Pro_HFR_17.4_21E219_Restore.ipsw
    # Symbolicate without an IPSW/DSC; falls back to the matching Xcode DeviceSupport DSC
    ❯ ipsw symbolicate panic-full-2024-03-21-004704.000.ips
      # Uses ~/Library/Developer/Xcode/<Platform> DeviceSupport/<device> (<build>)/Symbols
      # (userspace frames only for panics; kernel frames still need an IPSW)
    # Show disassembly around panic frames with --peek (default 5 instructions)
    ❯ ipsw symbolicate panic.ips firmware.ipsw --peek
    # Show more instructions around panic frames (10 instructions, centered on frame)
    ❯ ipsw symbolicate panic.ips firmware.ipsw --peek --peek-count 10
      # Note: If frame is at function start, extra instructions shift to after the frame
    # Unslide user-space addresses for static analysis (kernel frames are always unslid)
    ❯ ipsw symbolicate panic.ips firmware.ipsw --unslide
      # Note: Kernel frame addresses are already KASLR-unslid and match static disassemblers
      # The --unslide flag only affects user-space frames (processes like launchd, SpringBoard, etc.)
    # Apply custom KASLR slide to kernelcache frames for lldb live debugging
    ❯ ipsw symbolicate panic.ips firmware.ipsw --kc-slide 0x14f74000
      # Useful when reproducing a crash with a different KASLR slide
      # Shows runtime addresses you can use with lldb breakpoints
    # Rebase dyld_shared_cache frames onto a static base (e.g. to match Binary Ninja/IDA)
    ❯ ipsw symbolicate crash.ips --dsc-slide 0x180000000
      # Cache frames display as base + offset-into-cache so they line up with your disassembler
      # (uses the report's sharedCache.base to compute the offset; pass 0 for raw cache offsets)
    # Combine both slides for full runtime address mapping
    ❯ ipsw symbolicate panic.ips firmware.ipsw --kc-slide 0x14f74000 --dsc-slide 0x1a000000
    # Generate IDAPython script to mark panic frames in IDA Pro
    ❯ ipsw symbolicate panic.ips firmware.ipsw --ida
      # Outputs panic.ips.kc.ida.py for kernel frames (load in IDA with kernelcache)
      # Outputs panic.ips.dsc.ida.py for DSC frames if present (load in IDA with DSC image)
    # Pretty print a crashlog (BugType=309) these are usually symbolicated by the OS
    ❯ ipsw symbolicate --color Delta-2024-04-20-135807.ips
    # Summarize a JetsamEvent low-memory report (BugType=298): killed process, cause, and top memory consumers
    ❯ ipsw symbolicate JetsamEvent-2026-06-14-150819.ips
      # Add --all to list every process, or --proc <name> to filter to one
    # Summarize a Microstackshots resource report (BugType=145 SymptomsIO disk-writes, 202 CPU usage)
    ❯ ipsw symbolicate analyticsd.diskwrites_resource-2025-07-24-160552.ips
      # Shows the resource Event, the limit that was exceeded, and the heaviest stack
      # Pass an IPSW/DSC (or rely on matching Xcode DeviceSupport) to symbolicate the stack:
    ❯ ipsw symbolicate analyticsd.diskwrites_resource-2025-07-24-160552.ips iPhone17,1_26.0_23A5297m_Restore.ipsw
    # Symbolicate an old style crashlog (BugType=109) requiring a dyld_shared_cache
    ❯ ipsw symbolicate Delta-2024-04-20-135807.ips dyld_shared_cache
      ⨯ please supply a dyld_shared_cache for iPhone13,3 running 14.5 (18E5154f)

SEE ALSO
ipsw(1)

HISTORY
4-Jul-2026 Auto generated by spf13/cobra