You Have a Kernel Read/Write. Not Enough! How to Extract Offsets from XNU Kernelcaches

How to systematically extract struct field offsets from Apple's stripped XNU kernelcache using static analysis alone.