---
id: symbolicate
title: symbolicate
hide_title: true
hide_table_of_contents: true
sidebar_label: symbolicate
description: Symbolicate ARM 64-bit crash logs (similar to Apple's symbolicatecrash)
---
## ipsw symbolicate

Symbolicate ARM 64-bit crash logs (similar to Apple's symbolicatecrash)

```
ipsw symbolicate <CRASHLOG> [IPSW|DSC] [flags]
```

### Examples

```bash
# Symbolicate a panic crashlog (BugType=210) with an IPSW
❯ ipsw symbolicate panic-full-2024-03-21-004704.000.ips iPad_Pro_HFR_17.4_21E219_Restore.ipsw

# Symbolicate without an IPSW/DSC; falls back to the matching Xcode DeviceSupport DSC
❯ ipsw symbolicate panic-full-2024-03-21-004704.000.ips
  # Uses ~/Library/Developer/Xcode/<Platform> DeviceSupport/<device> (<build>)/Symbols
  # (userspace frames only for panics; kernel frames still need an IPSW)

# Show disassembly around panic frames with --peek (default 5 instructions)
❯ ipsw symbolicate panic.ips firmware.ipsw --peek

# Show more instructions around panic frames (10 instructions, centered on frame)
❯ ipsw symbolicate panic.ips firmware.ipsw --peek --peek-count 10
  # Note: If frame is at function start, extra instructions shift to after the frame

# Unslide user-space addresses for static analysis (kernel frames are always unslid)
❯ ipsw symbolicate panic.ips firmware.ipsw --unslide
  # Note: Kernel frame addresses are already KASLR-unslid and match static disassemblers
  # The --unslide flag only affects user-space frames (processes like launchd, SpringBoard, etc.)

# Apply custom KASLR slide to kernelcache frames for lldb live debugging
❯ ipsw symbolicate panic.ips firmware.ipsw --kc-slide 0x14f74000
  # Useful when reproducing a crash with a different KASLR slide
  # Shows runtime addresses you can use with lldb breakpoints

# Rebase dyld_shared_cache frames onto a static base (e.g. to match Binary Ninja/IDA)
❯ ipsw symbolicate crash.ips --dsc-slide 0x180000000
  # Cache frames display as base + offset-into-cache so they line up with your disassembler
  # (uses the report's sharedCache.base to compute the offset; pass 0 for raw cache offsets)

# Combine both slides for full runtime address mapping
❯ ipsw symbolicate panic.ips firmware.ipsw --kc-slide 0x14f74000 --dsc-slide 0x1a000000

# Generate IDAPython script to mark panic frames in IDA Pro
❯ ipsw symbolicate panic.ips firmware.ipsw --ida
  # Outputs panic.ips.kc.ida.py for kernel frames (load in IDA with kernelcache)
  # Outputs panic.ips.dsc.ida.py for DSC frames if present (load in IDA with DSC image)

# Pretty print a crashlog (BugType=309) these are usually symbolicated by the OS
❯ ipsw symbolicate --color Delta-2024-04-20-135807.ips

# Summarize a JetsamEvent low-memory report (BugType=298): killed process, cause, and top memory consumers
❯ ipsw symbolicate JetsamEvent-2026-06-14-150819.ips
  # Add --all to list every process, or --proc <name> to filter to one

# Summarize a Microstackshots resource report (BugType=145 SymptomsIO disk-writes, 202 CPU usage)
❯ ipsw symbolicate analyticsd.diskwrites_resource-2025-07-24-160552.ips
  # Shows the resource Event, the limit that was exceeded, and the heaviest stack
  # Pass an IPSW/DSC (or rely on matching Xcode DeviceSupport) to symbolicate the stack:
❯ ipsw symbolicate analyticsd.diskwrites_resource-2025-07-24-160552.ips iPhone17,1_26.0_23A5297m_Restore.ipsw

# Symbolicate an old style crashlog (BugType=109) requiring a dyld_shared_cache
❯ ipsw symbolicate Delta-2024-04-20-135807.ips dyld_shared_cache
  ⨯ please supply a dyld_shared_cache for iPhone13,3 running 14.5 (18E5154f)
```

### Options

```
  -a, --all                 Show all threads in crashlog
  -d, --demangle            Demangle symbol names
      --dsc-slide string    Rebase dyld_shared_cache frames onto this base for static analysis (hex, e.g. 0x180000000)
  -x, --extra string        Path to folder with extra files for symbolication
      --force               Force using the supplied IPSW even if it doesn't match the crashlog (e.g. for vPhone)
  -h, --help                help for symbolicate
      --hex                 Display function offsets in hexadecimal
      --ida                 Generate IDAPython script to mark panic frames in IDA Pro
      --kc-slide string     Apply custom KASLR slide to kernelcache frames for live debugging (hex, e.g. 0x14f74000)
      --peek                Show disassembly instructions around each panicked frame
      --peek-count int      Number of instructions to show with --peek (centered on frame, respects function boundaries) (default 5)
      --pem-db string       AEA pem DB JSON file
  -p, --proc string         Filter crashlog by process name
  -r, --running             Show all running (TH_RUN) threads in crashlog
  -s, --server string       Symbol Server DB URL
      --signatures string   Path to signatures folder
  -u, --unslide             Unslide user-space addresses for static analysis (kernel frames are always unslid)
```

### Options inherited from parent commands

```
      --color           colorize output
      --config string   config file (default is $HOME/.config/ipsw/config.yaml)
      --no-color        disable colorize output
  -V, --verbose         verbose output
```

### SEE ALSO

* [ipsw](/docs/cli/ipsw)	 - Download and Parse IPSWs (and SO much more)

