That gets you a kernel dump, a decrypted kernelcache gives you very handy MachO headers. And as Will said, the well known kernel dumping methods do not dump Wat

That gets you a kernel dump, a decrypted kernelcache gives you very handy MachO headers. And as Will said, the well known kernel dumping methods do not dump Watchtower. I'm not sure if anyone has privately been able to dump Watchtower with a kernel privsec or if it has only been possible with the kernelcache keys.