iOS Sandbox Profiles

This repository is a data archive of Apple sandbox profiles extracted from selected iOS firmware builds.

The main content lives under profiles, where each target directory contains the recovered sandbox collections, the sandbox operation table, and the decompiled readable profiles for a specific build and device set.

Repository Purpose

This repository exists to store and organize sandbox profile data across iOS releases.

It is intended for:

• browsing sandbox profile changes across builds,
• comparing profile collections between releases,
• and referencing extracted profile data without having to regenerate it locally.

Layout

profiles/
  19A346__iPhone11,2_4_6_iPhone12,3_5/
  20A362__iPhone11,2_4_6/
  21A329__iPhone11,2_4_6/
  22A3354__iPhone11,2_4_6/
  23C55__iPhone12,1/
targets.txt
LICENSE

Each directory in profiles is named as build__devices.

Example:

• 23C55__iPhone12,1
• 22G86__iPhone11,2_4_6
• 19A346__iPhone11,2_4_6_iPhone12,3_5

Target Contents

Each target directory typically contains:

• metadata.json: metadata about the source firmware and extracted collections.
• operations.txt: the sandbox operation table for that build.
• builtin_collection.bin: binary builtin sandbox collection.
• platform_collection.bin: binary platform sandbox collection.
• protobox_collection.bin or autobox_collection.bin: binary auxiliary collection, depending on release family.
• builtin_collection/: decompiled readable profiles for the builtin collection.
• platform_collection/: decompiled readable profiles for the platform collection.
• protobox_collection/ or autobox_collection/: decompiled readable profiles for the auxiliary collection.

The auxiliary collection name changes by release:

• iOS 15 through iOS 17 use protobox_collection.
• iOS 18 and newer use autobox_collection.

Coverage

The currently tracked targets are listed in targets.txt.

The committed dataset spans builds from 19A346 through 23C55, covering multiple iOS generations and device families.

Notes

• This repository stores extracted results, not firmware files.
• Directory names follow build identifiers rather than marketing version names.
• Different targets may cover one device or multiple devices when the extracted profile data is shared.

Acknowledgements

This repository builds on the work of two upstream projects.

• blacktop/ipsw provides the firmware extraction and Mach-O analysis capabilities that make kernelcache and sandbox component recovery practical.
• SandBlaster provides the sandbox profile reversing foundation that makes the binary collections readable and comparable.

Their work made this profile archive possible.

This repository uses a modified SandBlaster fork maintained at Lessica/sandblaster.

License

This repository is licensed under the BSD 3-Clause License. See LICENSE.