You Have a Kernel Read/Write. Not Enough! How to Extract Offsets from XNU Kernelcaches | Reverse Society
blog.reversesociety.co
How to systematically extract struct field offsets from Apple's stripped XNU kernelcache using static analysis alone.