Why Is IOReportCreateSubscription Always Empty on iPhone 12?

[FlymeToTheMoonIn2012]

Hi，your project has been very helpful to me. And I have a problem，why does IOReportCreateSubscription function always return an empty value on iPhone12？And the iPhone11 is ok!

[freedomtan]

No idea. To use IOReport, it seems you need root privilege or you have to disable amfi amfi_get_out_of_my_way=1 on iOS. I don't have access to either jailbroken iPhone 11 or 12 :-)

[badger200]

I was able to get it to work!! dmesg revealed this: System Policy: test_ioreport(7145) deny(1) iokit-open IOReportUserClient The key is signing the binary with this entitlement:

    <key>com.apple.security.iokit-user-client-class</key>
        <array>
                <string>IOUserClient</string>
        </array>
        <key>com.apple.security.iokit-open</key>
        <true/>

unfortunately since it uses NSLog I can’t pipe the output to text to share it here.

iPad Pro A12X iPad8,4 iOS 14.4 Unc0ver 8.0.2

[ghostsun89]

Hi @badger200 , when I ran the test_ioreport binary on the iPhone13, it caused the following error:

iPhone-13:/var/tmp/test root# ./test_ioreport 
dyld[861]: Library not loaded: /usr/lib/libIOReport.dylib
  Referenced from: /private/var/tmp/test/test_ioreport
  Reason: tried: '/usr/lib/libIOReport.dylib' (wrong platform to load into process)
Abort trap: 6

How can I find libIOReport.dylib? Or Is there anything wrong with the way I compiled it? Do you have any idea about the question? Thanks.

[freedomtan]

Hi @badger200 , when I ran the test_ioreport binary on the iPhone13, it caused the following error:

iPhone-13:/var/tmp/test root# ./test_ioreport 
dyld[861]: Library not loaded: /usr/lib/libIOReport.dylib
  Referenced from: /private/var/tmp/test/test_ioreport
  Reason: tried: '/usr/lib/libIOReport.dylib' (wrong platform to load into process)
Abort trap: 6

How can I find libIOReport.dylib? Or Is there anything wrong with the way I compiled it? Do you have any idea about the question? Thanks.

in your messages,

...
Reason: tried: '/usr/lib/libIOReport.dylib' (wrong platform to load into process)
...

Please make sure that you build the binary with iOS SDK and choose the right archicture (arm64e?)

[ghostsun89]

@freedomtan Many thanks for your advise! I upgrade the compile tools version and choose the arm64e arch. Now it works!

iPhone-13:/var/tmp/test root# ./test_ioreport 
2023-08-24 13:59:39.092 test_ioreport[926:119538] subscribed: {
    IOReportChannels =     (
                {
            DriverID = 4294967804;
            DriverName = "baseband <id 0x1000001fc>";
            IOReportChannelInfo =             {
                IOReportChannelUnit = 0;
            };
            IOReportGroupName = "Interrupt Statistics (by index)";
            IOReportSubGroupName = "baseband 0";
            LegendChannel =             (
                5291294645182005248,
                4295098369,
                "               First Level Interrupt Handler Count"
            );
      ...