allow overriding images

This commit is contained in:
Nick Chan committed 2023-01-18 17:58:20 +08:00
1 parent 23d60a52ef
commit 4027ad0611
2 files changed
+134 -9

No files matched your search

+12 -1
View File
@@ -20,7 +20,9 @@ typedef enum {
LOG_WARNING = 2,
LOG_INFO = 3,
LOG_VERBOSE = 4,
LOG_VERBOSE2 = 5
LOG_VERBOSE2 = 5,
LOG_VERBOSE3 = 6,
LOG_VERBOSE4 = 7,
} log_level_t;
typedef struct {
@@ -40,6 +42,15 @@ typedef struct {
char iboot_ver[0x20];
} recvinfo_t;
typedef struct {
uint32_t magic; /* 0xd803b376*/
unsigned char* ptr; /* pointer to the override file in memory */
unsigned int len; /* length of override file */
unsigned char* orig_ptr; /* pointer to the overriden file */
unsigned int orig_len; /* length of the overriden file */
int fd; /* file descriptor of the override file */
} override_file_t;
// set this value to 0 gracefully exit
extern int spin;
extern unsigned int verbose;
+122 -8
View File
@@ -18,15 +18,44 @@
#include <inttypes.h>
#include <getopt.h>
#include <errno.h>
#include <sys/mman.h>
#include <libimobiledevice/libimobiledevice.h>
#if defined(__APPLE__)
#include <mach-o/loader.h>
#else
#define MH_MAGIC 0xfeedface
#define MH_CIGAM 0xcefaedfe
#define MH_KEXT_BUNDLE 0xb
typedef int cpu_type_t;
typedef int cpu_subtype_t;
#define CPU_ARCH_ABI64 0x01000000
#define CPU_TYPE_ARM ((cpu_type_t) 12)
#define CPU_TYPE_ARM64 (CPU_TYPE_ARM | CPU_ARCH_ABI64)
struct mach_header_64
{
uint32_t magic; /* mach magic number identifier */
cpu_type_t cputype; /* cpu specifier */
cpu_subtype_t cpusubtype; /* machine specifier */
uint32_t filetype; /* type of file */
uint32_t ncmds; /* number of load commands */
uint32_t sizeofcmds; /* the size of all the load commands */
uint32_t flags; /* flags */
uint32_t reserved; /* reserved */
};
#endif
#include "ANSI-color-codes.h"
#include "common.h"
#include "checkra1n.h"
#include "kerninfo.h"
#define CMD_LEN_MAX 512
#define OVERRIDE_MAGIC 0xd803b376
unsigned int verbose = 0;
int enable_fakefs = 0;
@@ -36,6 +65,10 @@ char xargs_cmd[0x270] = "xargs serial=3 wdt=-1";
char checkrain_flags_cmd[0x20] = "checkra1n_flags 0x0";
char fakefs[512];
override_file_t override_ramdisk;
override_file_t override_kpf;
override_file_t override_overlay;
uint32_t checkrain_flags = 0;
int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, char *__restrict format, ...)
@@ -45,7 +78,8 @@ int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxna
va_start(args, format);
if (verbose >= 2 && verbose >= (loglevel - 3))
printf(BLU "%s:%d: " BMAG "%s(): \n--> " WHT, fname, lineno, fxname);
switch (loglevel) {
switch (loglevel)
{
case LOG_FATAL:
printf(BRED "[!] " RED);
break;
@@ -88,9 +122,12 @@ void *pongo_usb_callback(void *arg)
issue_pongo_command(handle, "modload");
issue_pongo_command(handle, "kpf_flags 0x00000000");
issue_pongo_command(handle, checkrain_flags_cmd);
if (enable_fakefs) {
if (enable_fakefs)
{
issue_pongo_command(handle, fakefs);
} else {
}
else
{
strcat(xargs_cmd, " rootdev=md0");
upload_pongo_file(handle, ramdisk_dmg, ramdisk_dmg_len);
issue_pongo_command(handle, "ramdisk");
@@ -103,7 +140,6 @@ void *pongo_usb_callback(void *arg)
issue_pongo_command(handle, "bootux");
LOG(LOG_INFO, "Booting Kernel...");
spin = false;
exit(0);
return NULL;
}
@@ -120,12 +156,15 @@ static struct option longopts[] = {
{"force-revert", no_argument, NULL, checkrain_option_force_revert},
{"safe-mode", no_argument, NULL, 's'},
{"version", no_argument, NULL, palerain_option_version},
{"override-overlay", required_argument, NULL, 'o'},
{"override-ramdisk", required_argument, NULL, 'r'},
{"override-kpf", required_argument, NULL, 'K'},
{NULL, 0, NULL, 0}};
int usage(int e)
{
fprintf(stderr,
"Usage: %s [-DhpPvlds] [-e boot arguments] [-f root device]\n"
"Usage: %s [-DhpPvlds] [-e boot arguments] [-f root device] [-o overlay file] [-r ramdisk file] [-K KPF file]\n"
"Copyright (C) 2023, palera1n team, All Rights Reserved.\n\n"
"iOS/iPadOS 15+ arm64 jailbreaking tool\n\n"
"\t--version\t\t\t\tPrint version\n"
@@ -140,11 +179,46 @@ int usage(int e)
"\t-f, --rootfs <root device>\t\tBoots rootful setup on <root device>\n"
"\t-l, --rootless\t\t\t\tBoots rootless. This is the default\n"
"\t-s, --safe-mode\t\t\t\tEnter safe mode (on rootless)\n"
"\t-d, --demote\t\t\t\tDemote\n",
"\t-d, --demote\t\t\t\tDemote\n"
"\t-o, --override-overlay <file>\t\tOverride overlay\n"
"\t-r, --override-ramdisk <file>\t\tOverride ramdisk\n"
"\t-K, --override-kpf <file>\t\tOverride kernel patchfinder\n",
getprogname());
exit(e);
}
int override_file(override_file_t *finfo, unsigned char orig[], unsigned int *orig_len, char *filename)
{
int ret = 0;
int fd = open(filename, O_RDONLY);
if (fd == -1)
{
LOG(LOG_ERROR, "Cannot open file %s: %d (%s)\n", filename, errno, strerror(errno));
return errno;
}
struct stat st;
ret = fstat(fd, &st);
if (ret)
{
LOG(LOG_ERROR, "Cannot fstat fd from file %s: %d (%s)\n", filename, errno, strerror(errno));
return errno;
}
void *addr = mmap(NULL, st.st_size, PROT_READ, MAP_FILE | MAP_PRIVATE, fd, 0);
if (addr == MAP_FAILED) {
LOG(LOG_ERROR, "Failed to map file %s: %d (%s)", filename, errno, strerror(errno));
return errno;
}
finfo->magic = OVERRIDE_MAGIC;
finfo->fd = fd;
finfo->len = (unsigned int)st.st_size;;
finfo->ptr = (unsigned char*)addr;
finfo->orig_len = *orig_len;
finfo->orig_ptr = orig;
orig = (unsigned char*)addr;
*orig_len = (unsigned int)st.st_size;
return 0;
}
bool dfuhelper_only = false;
bool pongo_exit = false;
bool start_from_pongo = false;
@@ -154,7 +228,7 @@ int main(int argc, char *argv[])
{
int opt;
int index;
while ((opt = getopt_long(argc, argv, "DhpPvldse:f:", longopts, NULL)) != -1)
while ((opt = getopt_long(argc, argv, "DhpPvldse:f:o:r:K:", longopts, NULL)) != -1)
{
switch (opt)
{
@@ -189,6 +263,29 @@ int main(int argc, char *argv[])
case 's':
checkrain_flags |= checkrain_option_safemode;
break;
case 'o':
if (override_file(&override_overlay, binpack_dmg, &binpack_dmg_len, optarg))
return 1;
break;
case 'r':
if (override_file(&override_ramdisk, ramdisk_dmg, &ramdisk_dmg_len, optarg))
return 1;
break;
case 'K':
if (override_file(&override_kpf, checkra1n_kpf_pongo, &checkra1n_kpf_pongo_len, optarg))
return 1;
struct mach_header_64* hdr = (struct mach_header_64*)override_kpf.ptr;
if (hdr->magic != MH_MAGIC_64 && hdr->magic != MH_CIGAM_64) {
LOG(LOG_ERROR, "Invalid kernel patchfinder: Not thin 64-bit Mach-O");
goto cleanup;
} else if (hdr->filetype != MH_KEXT_BUNDLE) {
LOG(LOG_ERROR, "Invalid kernel patchfinder: Not a kext bundle");
goto cleanup;
} else if (hdr->cputype != CPU_TYPE_ARM64) {
LOG(LOG_ERROR, "Invalid kernel patchfinder: CPU type is not arm64");
goto cleanup;
}
break;
case checkrain_option_force_revert:
checkrain_flags |= checkrain_option_force_revert;
break;
@@ -200,12 +297,16 @@ int main(int argc, char *argv[])
break;
}
}
if (palerain_version) {
if (palerain_version)
{
printf("palera1n %s\n", PALERAIN_VERSION);
return 0;
}
snprintf(checkrain_flags_cmd, 0x20, "checkra1n_flags 0x%x", checkrain_flags);
LOG(LOG_VERBOSE2, "checkrain_flags: %s\n", checkrain_flags_cmd);
LOG(LOG_VERBOSE4, "binpack_dmg @ %p", binpack_dmg);
LOG(LOG_VERBOSE4, "ramdisk_dmg @ %p", ramdisk_dmg);
LOG(LOG_VERBOSE4, "checkra1n_kpf_pongo @ %p", checkra1n_kpf_pongo);
for (index = optind; index < argc; index++)
{
@@ -253,5 +354,18 @@ pongo:
{
sleep(1);
}
cleanup:
if (override_kpf.magic == OVERRIDE_MAGIC) {
munmap(override_kpf.ptr, (size_t)override_kpf.len);
close(override_kpf.fd);
}
if (override_ramdisk.magic == OVERRIDE_MAGIC) {
munmap(override_ramdisk.ptr, (size_t)override_ramdisk.len);
close(override_ramdisk.fd);
}
if (override_overlay.magic == OVERRIDE_MAGIC) {
munmap(override_overlay.ptr, (size_t)override_overlay.len);
close(override_overlay.fd);
}
return 0;
}