mirror of
https://github.com/palera1n/palera1n.git
synced 2026-10-28 12:09:48 +01:00
iOS 16 Support (#280)
* ios 16 stuff, booting may not work yet - does not mount user data partition for iPhone X compatibility, isn't even really needed anymore - deploys files to the rootfs (fakefs if needed) - copies cryptexes on ios 16 - fix deviceid finding - use apticket.der because dumping seems to freeze on my device? - add /palera1n/info.json - uicache loader app on boot (no more Tips app hijacking) - fix rootless - semi-tethered webkit fix on 16 - switch to local boot * make sure submodule uses ios16 branch * fixes * other fixes * maybe it needs more time to execute * cant local boot tethered for now * new jbin funnies * changes * payload i guess (home button fix on iphone 7(+) and 8(+)) * this will probably fix errors * post.sh is needed * changes * .rd_in_progress * kill iproxy before starting ramdisk process * shouldnt need cryptexes copying anymore (-h in kernel64patcher) * requested changes * rootless fixes * more changes * keep fs number * update submodule * my tfp0 patch doesnt work on 15.x the way the patch grabs the tfp0 function is using a panic string in a developer mode check introduced in ios 16's kernel and that check happened to be inside of task_conversion_eval_internal, so we could use it to allow tfp0 but since that check was introduced in 16.x we cant use this to get tfp0 on 15.7.x * chmod got broken lol * changes * noobula moment (#281) * final updates & include commits from main (#282) * chmod the post.sh :frcoal: * fixed ibootpatch2 binary * other changes * 16.1* fix * move dyld link to ramdisk * fix disk stuff * update changelog Co-authored-by: Tom E <[email protected]> Co-authored-by: plooshi <[email protected]>
This commit is contained in:
23 files changed
+1033
-164
No files matched your search
+318
-157
@@ -11,7 +11,7 @@ echo "[*] Command ran:`if [ $EUID = 0 ]; then echo " sudo"; fi` ./palera1n.sh $@
|
||||
# Variables
|
||||
# =========
|
||||
ipsw="" # IF YOU WERE TOLD TO PUT A CUSTOM IPSW URL, PUT IT HERE. YOU CAN FIND THEM ON https://appledb.dev
|
||||
version="1.3.0"
|
||||
version="1.4.0"
|
||||
os=$(uname)
|
||||
dir="$(pwd)/binaries/$os"
|
||||
commit=$(git rev-parse --short HEAD)
|
||||
@@ -19,6 +19,7 @@ branch=$(git rev-parse --abbrev-ref HEAD)
|
||||
max_args=1
|
||||
arg_count=0
|
||||
disk=8
|
||||
fs=disk0s1s$disk
|
||||
|
||||
# =========
|
||||
# Functions
|
||||
@@ -45,7 +46,7 @@ step() {
|
||||
print_help() {
|
||||
cat << EOF
|
||||
Usage: $0 [Options] [ subcommand | iOS version ]
|
||||
iOS 15.0-15.7.1 jailbreak tool for checkm8 devices
|
||||
iOS 15.0-16.2 jailbreak tool for checkm8 devices
|
||||
|
||||
Options:
|
||||
--help Print this help
|
||||
@@ -53,11 +54,10 @@ Options:
|
||||
--semi-tethered When used with --tweaks, make the jailbreak semi-tethered instead of tethered
|
||||
--dfuhelper A helper to help get A11 devices into DFU mode from recovery mode
|
||||
--skip-fakefs Don't create the fakefs even if --semi-tethered is specified
|
||||
--no-install Skip murdering Tips app
|
||||
--no-baseband Indicate that the device does not have a baseband
|
||||
--restorerootfs Remove the jailbreak (Actually more than restore rootfs)
|
||||
--debug Debug the script
|
||||
--verbose Enable verbose boot on the device
|
||||
--serial Enable serial output on the device (only needed for testing with a serial cable)
|
||||
|
||||
Subcommands:
|
||||
dfuhelper An alias for --dfuhelper
|
||||
@@ -88,11 +88,8 @@ parse_opt() {
|
||||
--no-baseband)
|
||||
no_baseband=1
|
||||
;;
|
||||
--no-install)
|
||||
no_install=1
|
||||
;;
|
||||
--verbose)
|
||||
verbose=1
|
||||
--serial)
|
||||
serial=1
|
||||
;;
|
||||
--dfu)
|
||||
echo "[!] DFU mode devices are now automatically detected and --dfu is deprecated"
|
||||
@@ -176,15 +173,15 @@ _pwn() {
|
||||
}
|
||||
|
||||
_reset() {
|
||||
echo "[*] Resetting DFU state"
|
||||
"$dir"/gaster reset
|
||||
echo "[*] Resetting DFU state"
|
||||
"$dir"/gaster reset
|
||||
}
|
||||
|
||||
get_device_mode() {
|
||||
if [ "$os" = "Darwin" ]; then
|
||||
apples="$(system_profiler SPUSBDataType 2> /dev/null | grep -B1 'Vendor ID: 0x05ac' | grep 'Product ID:' | cut -dx -f2 | cut -d' ' -f1 | tail -r)"
|
||||
elif [ "$os" = "Linux" ]; then
|
||||
apples="$(lsusb | cut -d' ' -f6 | grep '05ac:' | cut -d: -f2)"
|
||||
apples="$(lsusb | cut -d' ' -f6 | grep '05ac:' | cut -d: -f2)"
|
||||
fi
|
||||
local device_count=0
|
||||
local usbserials=""
|
||||
@@ -226,7 +223,7 @@ get_device_mode() {
|
||||
if [ "$os" = "Linux" ]; then
|
||||
usbserials=$(cat /sys/bus/usb/devices/*/serial)
|
||||
elif [ "$os" = "Darwin" ]; then
|
||||
usbserials=$(system_profiler SPUSBDataType 2> /dev/null| grep 'Serial Number' | cut -d: -f2- | sed 's/ //')
|
||||
usbserials=$(system_profiler SPUSBDataType 2> /dev/null | grep 'Serial Number' | cut -d: -f2- | sed 's/ //')
|
||||
fi
|
||||
if grep -qE '(ramdisk tool|SSHRD_Script) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{1,2} [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2}' <<< "$usbserials"; then
|
||||
device_mode=ramdisk
|
||||
@@ -261,7 +258,7 @@ _dfuhelper() {
|
||||
step 3 "Get ready"
|
||||
step 4 "$step_one" &
|
||||
sleep 3
|
||||
"$dir"/irecovery -c "reset"
|
||||
"$dir"/irecovery -c "reset" &
|
||||
wait
|
||||
if [[ "$1" = 0x801* && "$deviceid" != *"iPad"* ]]; then
|
||||
step 10 'Release side button, but keep holding volume down'
|
||||
@@ -290,21 +287,18 @@ _kill_if_running() {
|
||||
}
|
||||
|
||||
_exit_handler() {
|
||||
if [ "$os" = 'Darwin' ]; then
|
||||
defaults write -g ignore-devices -bool false
|
||||
defaults write com.apple.AMPDevicesAgent dontAutomaticallySyncIPods -bool false
|
||||
killall Finder
|
||||
fi
|
||||
[ $? -eq 0 ] && exit
|
||||
echo "[-] An error occurred"
|
||||
|
||||
cd logs
|
||||
for file in *.log; do
|
||||
mv "$file" FAIL_${file}
|
||||
if [[ "$file" != "SUCCESS_"* ]] || [[ "$file" != "FAIL_"* ]]; then
|
||||
mv "$file" FAIL_${file}
|
||||
fi
|
||||
done
|
||||
cd ..
|
||||
|
||||
echo "[*] A failure log has been made. If you're going to make a GitHub issue, please attach the latest log."
|
||||
echo "[*] A failure log has been made. If you're going ask for help, please attach the latest log."
|
||||
}
|
||||
trap _exit_handler EXIT
|
||||
|
||||
@@ -312,13 +306,6 @@ trap _exit_handler EXIT
|
||||
# Fixes
|
||||
# ===========
|
||||
|
||||
# Prevent Finder from complaning
|
||||
if [ "$os" = 'Darwin' ]; then
|
||||
defaults write -g ignore-devices -bool true
|
||||
defaults write com.apple.AMPDevicesAgent dontAutomaticallySyncIPods -bool true
|
||||
killall Finder
|
||||
fi
|
||||
|
||||
# ============
|
||||
# Dependencies
|
||||
# ============
|
||||
@@ -382,7 +369,7 @@ chmod +x "$dir"/*
|
||||
# ============
|
||||
|
||||
echo "palera1n | Version $version-$branch-$commit"
|
||||
echo "Written by Nebula and Mineek | Some code and ramdisk from Nathan | Loader app by Amy"
|
||||
echo "Written by Nebula and Mineek | Some code and ramdisk from Nathan"
|
||||
echo ""
|
||||
|
||||
version=""
|
||||
@@ -409,8 +396,8 @@ if [ "$tweaks" = 1 ] && [ ! -e ".tweaksinstalled" ] && [ ! -e ".disclaimeragree"
|
||||
echo "!!! WARNING WARNING WARNING !!!"
|
||||
echo "This flag will add tweak support BUT WILL BE TETHERED."
|
||||
echo "THIS ALSO MEANS THAT YOU'LL NEED A PC EVERY TIME TO BOOT."
|
||||
echo "THIS ONLY WORKS ON 15.0-15.7.1"
|
||||
echo "DO NOT GET ANGRY AT US IF UR DEVICE IS BORKED, IT'S YOUR OWN FAULT AND WE WARNED YOU"
|
||||
echo "THIS WORKS ON 15.0-16.2"
|
||||
echo "DO NOT GET ANGRY AT US IF YOUR DEVICE IS BORKED, IT'S YOUR OWN FAULT AND WE WARNED YOU"
|
||||
echo "DO YOU UNDERSTAND? TYPE 'Yes, do as I say' TO CONTINUE"
|
||||
read -r answer
|
||||
if [ "$answer" = 'Yes, do as I say' ]; then
|
||||
@@ -422,9 +409,11 @@ if [ "$tweaks" = 1 ] && [ ! -e ".tweaksinstalled" ] && [ ! -e ".disclaimeragree"
|
||||
tweaks=1
|
||||
touch .disclaimeragree
|
||||
else
|
||||
echo "[-] Please type it exactly if you'd like to proceed. Otherwise, remove --tweaks, or add --semi-tethered"
|
||||
exit
|
||||
fi
|
||||
else
|
||||
echo "[-] Please type it exactly if you'd like to proceed. Otherwise, remove --tweaks, or add --semi-tethered"
|
||||
exit
|
||||
fi
|
||||
fi
|
||||
@@ -511,7 +500,7 @@ else
|
||||
fi
|
||||
|
||||
if [ "$restorerootfs" = "1" ]; then
|
||||
rm -rf "blobs/"$deviceid"-"$version".shsh2" "boot-$deviceid" work .tweaksinstalled
|
||||
rm -rf "blobs/"$deviceid"-"$version".der" "boot-$deviceid" work .tweaksinstalled ".fs-$deviceid"
|
||||
fi
|
||||
|
||||
# Have the user put the device into DFU
|
||||
@@ -529,13 +518,20 @@ sleep 2
|
||||
# ============
|
||||
|
||||
# Dump blobs, and install pogo if needed
|
||||
if [ ! -f blobs/"$deviceid"-"$version".shsh2 ]; then
|
||||
if [ -f blobs/"$deviceid"-"$version".der ]; then
|
||||
if [ -f .rd_in_progress ]; then
|
||||
rm blobs/"$deviceid"-"$version".der
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ ! -f blobs/"$deviceid"-"$version".der ]; then
|
||||
mkdir -p blobs
|
||||
_kill_if_running iproxy
|
||||
|
||||
cd ramdisk
|
||||
chmod +x sshrd.sh
|
||||
echo "[*] Creating ramdisk"
|
||||
./sshrd.sh 15.6 `if [ -z "$tweaks" ]; then echo "rootless"; fi`
|
||||
./sshrd.sh `if [[ "$version" == *"16"* ]]; then echo "16.0.3"; else echo "15.6"; fi` `if [ -z "$tweaks" ]; then echo "rootless"; fi`
|
||||
|
||||
echo "[*] Booting ramdisk"
|
||||
./sshrd.sh boot
|
||||
@@ -562,18 +558,33 @@ if [ ! -f blobs/"$deviceid"-"$version".shsh2 ]; then
|
||||
sleep 1
|
||||
done
|
||||
|
||||
echo "[*] Testing for baseband presence"
|
||||
if [ "$(remote_cmd "/usr/bin/mgask HasBaseband | grep -E 'true|false'")" = "true" ] && [[ "${cpid}" == *"0x700"* ]]; then
|
||||
disk=7
|
||||
elif [ "$(remote_cmd "/usr/bin/mgask HasBaseband | grep -E 'true|false'")" = "false" ]; then
|
||||
if [[ "${cpid}" == *"0x700"* ]]; then
|
||||
disk=6
|
||||
else
|
||||
touch .rd_in_progress
|
||||
|
||||
if [ "$tweaks" = "1" ]; then
|
||||
echo "[*] Testing for baseband presence"
|
||||
if [ "$(remote_cmd "/usr/bin/mgask HasBaseband | grep -E 'true|false'")" = "true" ] && [ "${cpid}" == *"0x700"* ]; then
|
||||
disk=7
|
||||
elif [ "$(remote_cmd "/usr/bin/mgask HasBaseband | grep -E 'true|false'")" = "false" ]; then
|
||||
if [ "${cpid}" == *"0x700"* ]; then
|
||||
disk=6
|
||||
else
|
||||
disk=7
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$semi_tethered" ]; then
|
||||
disk=1
|
||||
fi
|
||||
|
||||
if [[ "$version" == *"16"* ]]; then
|
||||
fs=disk1s$disk
|
||||
else
|
||||
fs=disk0s1s$disk
|
||||
fi
|
||||
fi
|
||||
|
||||
remote_cmd "/usr/bin/mount_filesystems"
|
||||
# mount filesystems, no user data partition
|
||||
remote_cmd "/usr/bin/mount_filesystems_nouser"
|
||||
|
||||
has_active=$(remote_cmd "ls /mnt6/active" 2> /dev/null)
|
||||
if [ ! "$has_active" = "/mnt6/active" ]; then
|
||||
@@ -587,12 +598,9 @@ if [ ! -f blobs/"$deviceid"-"$version".shsh2 ]; then
|
||||
|
||||
if [ "$restorerootfs" = "1" ]; then
|
||||
echo "[*] Removing Jailbreak"
|
||||
remote_cmd "/sbin/apfs_deletefs disk0s1s${disk} > /dev/null || true"
|
||||
remote_cmd "rm -f /mnt2/jb"
|
||||
remote_cmd "rm -rf /mnt2/cache /mnt2/lib"
|
||||
remote_cmd "rm -rf /mnt6/$active/procursus"
|
||||
remote_cmd "/sbin/apfs_deletefs $fs > /dev/null || true"
|
||||
remote_cmd "rm -f /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.im4p /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcachd"
|
||||
remote_cmd "mv /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache 2> /dev/null || true"
|
||||
remote_cmd "mv /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache || true"
|
||||
remote_cmd "/bin/sync"
|
||||
remote_cmd "/usr/sbin/nvram auto-boot=true"
|
||||
rm -f BuildManifest.plist
|
||||
@@ -601,74 +609,62 @@ if [ ! -f blobs/"$deviceid"-"$version".shsh2 ]; then
|
||||
exit;
|
||||
fi
|
||||
|
||||
echo "[*] Dumping blobs and installing Loader"
|
||||
echo "[*] Dumping apticket"
|
||||
sleep 1
|
||||
remote_cmd "cat /dev/rdisk1" | dd of=dump.raw bs=256 count=$((0x4000))
|
||||
"$dir"/img4tool --convert -s blobs/"$deviceid"-"$version".shsh2 dump.raw
|
||||
rm dump.raw
|
||||
remote_cp root@localhost:/mnt6/$active/System/Library/Caches/apticket.der blobs/"$deviceid"-"$version".der
|
||||
#remote_cmd "cat /dev/rdisk1" | dd of=dump.raw bs=256 count=$((0x4000))
|
||||
#"$dir"/img4tool --convert -s blobs/"$deviceid"-"$version".shsh2 dump.raw
|
||||
#rm dump.raw
|
||||
|
||||
if [ "$semi_tethered" = "1" ]; then
|
||||
if [ -z "$skip_fakefs" ]; then
|
||||
echo "[*] Creating fakefs, this may take a while (up to 10 minutes)"
|
||||
remote_cmd "/sbin/newfs_apfs -A -D -o role=r -v System /dev/disk0s1" && {
|
||||
sleep 2
|
||||
remote_cmd "/sbin/mount_apfs /dev/$fs /mnt8"
|
||||
|
||||
sleep 2
|
||||
remote_cmd "/sbin/mount_apfs /dev/disk0s1s${disk} /mnt8"
|
||||
|
||||
sleep 1
|
||||
remote_cmd "cp -a /mnt1/. /mnt8/"
|
||||
sleep 1
|
||||
echo "[*] fakefs created, continuing..."
|
||||
sleep 1
|
||||
remote_cmd "cp -a /mnt1/. /mnt8/"
|
||||
sleep 1
|
||||
echo "[*] fakefs created, continuing..."
|
||||
} || echo "[*] Using the old fakefs, run restorerootfs if you need to clean it"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$no_install" ]; then
|
||||
tipsdir=$(remote_cmd "/usr/bin/find /mnt2/containers/Bundle/Application/ -name 'Tips.app'" 2> /dev/null)
|
||||
sleep 1
|
||||
if [ "$tipsdir" = "" ]; then
|
||||
echo "[!] Tips is not installed. Once your device reboots, install Tips from the App Store and retry"
|
||||
remote_cmd "/sbin/reboot"
|
||||
sleep 1
|
||||
_kill_if_running iproxy
|
||||
exit
|
||||
fi
|
||||
remote_cmd "/bin/mkdir -p /mnt1/private/var/root/temp"
|
||||
sleep 1
|
||||
remote_cmd "/bin/cp -r /usr/local/bin/loader.app/* /mnt1/private/var/root/temp"
|
||||
sleep 1
|
||||
remote_cmd "/bin/rm -rf /mnt1/private/var/root/temp/Info.plist /mnt1/private/var/root/temp/Base.lproj /mnt1/private/var/root/temp/PkgInfo"
|
||||
sleep 1
|
||||
remote_cmd "/bin/cp -rf /mnt1/private/var/root/temp/* $tipsdir"
|
||||
sleep 1
|
||||
remote_cmd "/bin/rm -rf /mnt1/private/var/root/temp"
|
||||
sleep 1
|
||||
remote_cmd "/usr/sbin/chown 33 $tipsdir/Tips"
|
||||
sleep 1
|
||||
remote_cmd "/bin/chmod 755 $tipsdir/Tips $tipsdir/palera1nHelper"
|
||||
sleep 1
|
||||
remote_cmd "/usr/sbin/chown 0 $tipsdir/palera1nHelper"
|
||||
fi
|
||||
|
||||
#remote_cmd "/usr/sbin/nvram allow-root-hash-mismatch=1"
|
||||
#remote_cmd "/usr/sbin/nvram root-live-fs=1"
|
||||
if [ "$semi_tethered" = "1" ] || [ -z "$tweaks" ]; then
|
||||
remote_cmd "/usr/sbin/nvram auto-boot=true"
|
||||
if [ "$tweaks" = "1" ]; then
|
||||
if [ "$semi_tethered" = "1" ]; then
|
||||
remote_cmd "/usr/sbin/nvram auto-boot=true"
|
||||
else
|
||||
remote_cmd "/usr/sbin/nvram auto-boot=false"
|
||||
fi
|
||||
else
|
||||
remote_cmd "/usr/sbin/nvram auto-boot=false"
|
||||
remote_cmd "/usr/sbin/nvram auto-boot=true"
|
||||
fi
|
||||
|
||||
remote_cp binaries/Kernel15Patcher.ios root@localhost:/mnt1/private/var/root/Kernel15Patcher.ios
|
||||
remote_cmd "/usr/sbin/chown 0 /mnt1/private/var/root/Kernel15Patcher.ios"
|
||||
remote_cmd "/bin/chmod 755 /mnt1/private/var/root/Kernel15Patcher.ios"
|
||||
|
||||
# lets actually patch the kernel
|
||||
echo "[*] Patching the kernel"
|
||||
remote_cmd "rm -f /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.im4p /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcachd"
|
||||
if [ "$semi_tethered" = "1" ] || [ -z "$tweaks" ]; then
|
||||
remote_cmd "cp /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak"
|
||||
remote_cmd "rm -f /mnt6/$active/kpf"
|
||||
if [[ "$version" == *"16"* ]]; then
|
||||
if [ "$semi_tethered" = "1" ]; then
|
||||
remote_cp binaries/Kernel16Patcher-nolivefs.ios root@localhost:/mnt6/$active/kpf
|
||||
else
|
||||
remote_cp binaries/Kernel16Patcher.ios root@localhost:/mnt6/$active/kpf
|
||||
fi
|
||||
else
|
||||
remote_cmd "mv /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak"
|
||||
remote_cp binaries/Kernel15Patcher.ios root@localhost:/mnt6/$active/kpf
|
||||
fi
|
||||
remote_cmd "/usr/sbin/chown 0 /mnt6/$active/kpf"
|
||||
remote_cmd "/bin/chmod 755 /mnt6/$active/kpf"
|
||||
|
||||
remote_cmd "rm -f /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.im4p /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcachd"
|
||||
if [ "$tweaks" = "1" ]; then
|
||||
if [ "$semi_tethered" = "1" ]; then
|
||||
remote_cmd "cp /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak"
|
||||
else
|
||||
remote_cmd "mv /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak"
|
||||
fi
|
||||
fi
|
||||
sleep 1
|
||||
|
||||
@@ -679,6 +675,7 @@ if [ ! -f blobs/"$deviceid"-"$version".shsh2 ]; then
|
||||
echo "[*] Downloading kernelcache"
|
||||
"$dir"/pzb -g "$(awk "/""$model""/{x=1}x&&/kernelcache.release/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" "$ipswurl"
|
||||
|
||||
echo "[*] Patching kernelcache"
|
||||
mv kernelcache.release.* work/kernelcache
|
||||
if [[ "$deviceid" == "iPhone8"* ]] || [[ "$deviceid" == "iPad6"* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
|
||||
python3 -m pyimg4 im4p extract -i work/kernelcache -o work/kcache.raw --extra work/kpp.bin
|
||||
@@ -687,9 +684,18 @@ if [ ! -f blobs/"$deviceid"-"$version".shsh2 ]; then
|
||||
fi
|
||||
sleep 1
|
||||
remote_cp work/kcache.raw root@localhost:/mnt6/$active/System/Library/Caches/com.apple.kernelcaches/
|
||||
remote_cmd "/mnt1/private/var/root/Kernel15Patcher.ios /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched"
|
||||
remote_cmd "/mnt6/$active/kpf /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched"
|
||||
remote_cp root@localhost:/mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched work/
|
||||
"$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -e
|
||||
if [ "$tweaks" = "1" ]; then
|
||||
if [[ "$version" == *"16"* ]]; then
|
||||
"$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -e -a -o -u -l -t -h
|
||||
else
|
||||
"$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -e -a -l
|
||||
fi
|
||||
else
|
||||
"$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -a
|
||||
fi
|
||||
|
||||
sleep 1
|
||||
if [[ "$deviceid" == *'iPhone8'* ]] || [[ "$deviceid" == *'iPad6'* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
|
||||
python3 -m pyimg4 im4p create -i work/kcache.patched2 -o work/kcache.im4p -f krnl --extra work/kpp.bin --lzss
|
||||
@@ -709,11 +715,98 @@ if [ ! -f blobs/"$deviceid"-"$version".shsh2 ]; then
|
||||
echo "[!] Custom kernelcache doesn't exist..? Please send a log and report this bug..."
|
||||
fi
|
||||
|
||||
rm -rf work
|
||||
if [ "$tweaks" = "1" ]; then
|
||||
sleep 1
|
||||
if [ "$semi_tethered" = "1" ]; then
|
||||
remote_cmd "/sbin/mount_apfs /dev/$fs /mnt8 || true"
|
||||
di=8
|
||||
else
|
||||
disk=1
|
||||
di=1
|
||||
fi
|
||||
|
||||
if [[ "$version" == *"16"* ]]; then
|
||||
remote_cmd "ln -s /System/Cryptexes/OS/System/Library/Caches/com.apple.dyld /mnt$di/System/Library/Caches/"
|
||||
fi
|
||||
|
||||
# iOS 16 stuff
|
||||
# if [[ "$version" == *"16"* ]]; then
|
||||
# if [ -z "$semi_tethered" ]; then
|
||||
# echo "[*] Performing iOS 16 fixes"
|
||||
# sleep 1
|
||||
# os_disk=$(remote_cmd "/usr/sbin/hdik /mnt6/cryptex1/current/os.dmg | head -3 | tail -1 | sed 's/ .*//'")
|
||||
# sleep 1
|
||||
# app_disk=$(remote_cmd "/usr/sbin/hdik /mnt6/cryptex1/current/app.dmg | head -3 | tail -1 | sed 's/ .*//'")
|
||||
# sleep 1
|
||||
# remote_cmd "/sbin/mount_apfs -o ro $os_disk /mnt2"
|
||||
# sleep 1
|
||||
# remote_cmd "/sbin/mount_apfs -o ro $app_disk /mnt9"
|
||||
# sleep 1
|
||||
|
||||
# remote_cmd "rm -rf /mnt1/System/Cryptexes/App /mnt1/System/Cryptexes/OS"
|
||||
# sleep 1
|
||||
# remote_cmd "mkdir /mnt1/System/Cryptexes/App /mnt1/System/Cryptexes/OS"
|
||||
# sleep 1
|
||||
# remote_cmd "cp -a /mnt9/. /mnt1/System/Cryptexes/App"
|
||||
# sleep 1
|
||||
# remote_cmd "cp -a /mnt2/. /mnt1/System/Cryptexes/OS"
|
||||
# sleep 1
|
||||
# remote_cmd "rm -rf /mnt1/System/Cryptexes/OS/System/Library/Caches/com.apple.dyld"
|
||||
# sleep 1
|
||||
# remote_cmd "cp -a /mnt2/System/Library/Caches/com.apple.dyld /mnt1/System/Library/Caches/"
|
||||
# fi
|
||||
# fi
|
||||
|
||||
echo "[*] Copying files to rootfs"
|
||||
remote_cmd "rm -rf /mnt$di/jbin /mnt$di/.installed_palera1n"
|
||||
sleep 1
|
||||
remote_cmd "mkdir -p /mnt$di/jbin/binpack /mnt$di/jbin/loader.app"
|
||||
sleep 1
|
||||
|
||||
# download loader
|
||||
cd other/rootfs/jbin
|
||||
rm -rf loader.app
|
||||
curl -LO https://nightly.link/palera1n/loader/workflows/build/main/palera1n.zip
|
||||
unzip palera1n.zip -d .
|
||||
unzip palera1n.ipa -d .
|
||||
mv Payload/palera1nLoader.app loader.app
|
||||
rm -rf palera1n.zip loader.zip palera1n.ipa Payload
|
||||
|
||||
# download jbinit files
|
||||
rm -f jb.dylib jbinit jbloader launchd
|
||||
curl -L https://nightly.link/palera1n/jbinit/workflows/build/main/rootfs.zip -o rfs.zip
|
||||
unzip rfs.zip -d .
|
||||
unzip rootfs.zip -d .
|
||||
rm rfs.zip rootfs.zip
|
||||
cd ../../..
|
||||
|
||||
sleep 1
|
||||
remote_cp -r other/rootfs/* root@localhost:/mnt$di
|
||||
{
|
||||
echo "{"
|
||||
echo " \"version\": \"${version} (${commit}_${branch})\","
|
||||
echo " \"args\": \"$@\","
|
||||
echo " \"pc\": \"$(uname) $(uname -r)\""
|
||||
echo "}"
|
||||
} > work/.installed_palera1n
|
||||
sleep 1
|
||||
remote_cp work/.installed_palera1n root@localhost:/mnt$di
|
||||
|
||||
remote_cmd "ldid -s /mnt$di/jbin/launchd /mnt$di/jbin/jbloader /mnt$di/jbin/jb.dylib"
|
||||
remote_cmd "chmod +rwx /mnt$di/jbin/launchd /mnt$di/jbin/jbloader /mnt$di/jbin/post.sh"
|
||||
remote_cmd "tar -xvf /mnt$di/jbin/binpack/binpack.tar -C /mnt$di/jbin/binpack/"
|
||||
sleep 1
|
||||
remote_cmd "rm /mnt$di/jbin/binpack/binpack.tar"
|
||||
fi
|
||||
|
||||
echo "$di" > .fs-"$deviceid"
|
||||
|
||||
rm -rf work BuildManifest.plist
|
||||
mkdir work
|
||||
rm .rd_in_progress
|
||||
|
||||
sleep 2
|
||||
echo "[*] Done! Rebooting your device"
|
||||
echo "[*] Phase 1 done! Rebooting your device (if it doesn't reboot, you may force reboot)"
|
||||
remote_cmd "/sbin/reboot"
|
||||
sleep 1
|
||||
_kill_if_running iproxy
|
||||
@@ -741,8 +834,28 @@ fi
|
||||
# ============
|
||||
|
||||
# Actually create the boot files
|
||||
if [ ! -f boot-"$deviceid"/.local ]; then
|
||||
rm -rf boot-"$deviceid"
|
||||
disk=$(cat .fs-"$deviceid")
|
||||
if [[ "$version" == *"16"* ]]; then
|
||||
fs=disk1s$disk
|
||||
else
|
||||
fs=disk0s1s$disk
|
||||
fi
|
||||
|
||||
boot_args=""
|
||||
if [ "$serial" = "1" ]; then
|
||||
boot_args="serial=3"
|
||||
else
|
||||
boot_args="-v"
|
||||
fi
|
||||
|
||||
if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10"* ]]; then
|
||||
if [ ! -f boot-"$deviceid"/.payload ]; then
|
||||
rm -rf boot-"$deviceid"
|
||||
fi
|
||||
else
|
||||
if [ ! -f boot-"$deviceid"/.local ]; then
|
||||
rm -rf boot-"$deviceid"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ ! -f boot-"$deviceid"/ibot.img4 ]; then
|
||||
@@ -750,47 +863,86 @@ if [ ! -f boot-"$deviceid"/ibot.img4 ]; then
|
||||
rm -rf boot-"$deviceid"
|
||||
mkdir boot-"$deviceid"
|
||||
|
||||
echo "[*] Converting blob"
|
||||
"$dir"/img4tool -e -s "$(pwd)"/blobs/"$deviceid"-"$version".shsh2 -m work/IM4M
|
||||
#echo "[*] Converting blob"
|
||||
#"$dir"/img4tool -e -s $(pwd)/blobs/"$deviceid"-"$version".shsh2 -m work/IM4M
|
||||
cd work
|
||||
|
||||
echo "[*] Downloading BuildManifest"
|
||||
"$dir"/pzb -g BuildManifest.plist "$ipswurl"
|
||||
|
||||
echo "[*] Downloading and decrypting iBSS"
|
||||
"$dir"/pzb -g "$(awk "/""$model""/{x=1}x&&/iBSS[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" "$ipswurl"
|
||||
"$dir"/gaster decrypt "$(awk "/""$model""/{x=1}x&&/iBSS[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]dfu[/]//')" iBSS.dec
|
||||
|
||||
echo "[*] Downloading and decrypting iBoot"
|
||||
"$dir"/pzb -g "$(awk "/""$model""/{x=1}x&&/iBoot[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" "$ipswurl"
|
||||
"$dir"/gaster decrypt "$(awk "/""$model""/{x=1}x&&/iBoot[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]all_flash[/]//')" ibot.dec
|
||||
|
||||
echo "[*] Patching and signing iBSS/iBoot"
|
||||
"$dir"/iBoot64Patcher iBSS.dec iBSS.patched
|
||||
if [ "$semi_tethered" = "1" ]; then
|
||||
if [ "$verbose" = "1" ]; then
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched -b "-v rd=disk0s1s${disk}" -l
|
||||
# Do payload if on iPhone 7-10
|
||||
if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10"* ]]; then
|
||||
if [[ "$version" == "16.0"* ]] || [[ "$version" == "15"* ]]; then
|
||||
newipswurl="$ipswurl"
|
||||
else
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched -b "rd=disk0s1s${disk}" -l
|
||||
buildid=$(curl -sL https://api.ipsw.me/v4/ipsw/16.0.3 | "$dir"/jq '[.[] | select(.identifier | startswith("'iPhone'")) | .buildid][0]' --raw-output)
|
||||
newipswurl=$(curl -sL https://api.appledb.dev/ios/iOS\;$buildid.json | "$dir"/jq -r .devices\[\"$deviceid\"\].ipsw)
|
||||
fi
|
||||
else
|
||||
if [ "$verbose" = "1" ]; then
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched -b '-v' -f
|
||||
else
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched -f
|
||||
fi
|
||||
fi
|
||||
if [ "$os" = 'Linux' ]; then
|
||||
sed -i 's/\/\kernelcache/\/\kernelcachd/g' ibot.patched
|
||||
else
|
||||
LC_ALL=C sed -i.bak -e 's/s\/\kernelcache/s\/\kernelcachd/g' ibot.patched
|
||||
rm *.bak
|
||||
fi
|
||||
cd ..
|
||||
"$dir"/img4 -i work/iBSS.patched -o boot-"$deviceid"/iBSS.img4 -M work/IM4M -A -T ibss
|
||||
"$dir"/img4 -i work/ibot.patched -o boot-"$deviceid"/ibot.img4 -M work/IM4M -A -T `if [[ "$cpid" == *"0x801"* ]]; then echo "ibss"; else echo "ibec"; fi`
|
||||
|
||||
touch boot-"$deviceid"/.local
|
||||
echo "[*] Downloading BuildManifest"
|
||||
"$dir"/pzb -g BuildManifest.plist "$newipswurl"
|
||||
|
||||
echo "[*] Downloading and decrypting iBoot"
|
||||
"$dir"/pzb -g "$(awk "/""$model""/{x=1}x&&/iBoot[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" "$newipswurl"
|
||||
"$dir"/gaster decrypt "$(awk "/""$model""/{x=1}x&&/iBoot[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]all_flash[/]//')" ibot.dec
|
||||
|
||||
echo "[*] Patching and signing iBoot"
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched
|
||||
|
||||
if [[ "$deviceid" == iPhone9,[1-4] ]]; then
|
||||
"$dir"/iBootpatch2 --t8010 ibot.patched ibot.patched2
|
||||
else
|
||||
"$dir"/iBootpatch2 --t8015 ibot.patched ibot.patched2
|
||||
fi
|
||||
|
||||
if [ "$os" = 'Linux' ]; then
|
||||
sed -i 's/\/\kernelcache/\/\kernelcachd/g' ibot.patched2
|
||||
else
|
||||
LC_ALL=C sed -i.bak -e 's/s\/\kernelcache/s\/\kernelcachd/g' ibot.patched2
|
||||
rm *.bak
|
||||
fi
|
||||
|
||||
cd ..
|
||||
"$dir"/img4 -i work/ibot.patched2 -o boot-"$deviceid"/ibot.img4 -M blobs/"$deviceid"-"$version".der -A -T ibss
|
||||
|
||||
touch boot-"$deviceid"/.payload
|
||||
else
|
||||
echo "[*] Downloading BuildManifest"
|
||||
"$dir"/pzb -g BuildManifest.plist "$ipswurl"
|
||||
|
||||
echo "[*] Downloading and decrypting iBSS"
|
||||
"$dir"/pzb -g "$(awk "/""$model""/{x=1}x&&/iBSS[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" "$ipswurl"
|
||||
"$dir"/gaster decrypt "$(awk "/""$model""/{x=1}x&&/iBSS[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]dfu[/]//')" iBSS.dec
|
||||
|
||||
echo "[*] Downloading and decrypting iBoot"
|
||||
"$dir"/pzb -g "$(awk "/""$model""/{x=1}x&&/iBoot[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" "$ipswurl"
|
||||
"$dir"/gaster decrypt "$(awk "/""$model""/{x=1}x&&/iBoot[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]all_flash[/]//')" ibot.dec
|
||||
|
||||
echo "[*] Patching and signing iBSS/iBoot"
|
||||
"$dir"/iBoot64Patcher iBSS.dec iBSS.patched
|
||||
if [ "$semi_tethered" = "1" ]; then
|
||||
if [ "$serial" = "1" ]; then
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched -b "serial=3 rd=$fs" -l
|
||||
else
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched -b "-v rd=$fs" -l
|
||||
fi
|
||||
else
|
||||
if [ "$serial" = "1" ]; then
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched -b "serial=3" -f
|
||||
else
|
||||
"$dir"/iBoot64Patcher ibot.dec ibot.patched -b "-v" -f
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$os" = 'Linux' ]; then
|
||||
sed -i 's/\/\kernelcache/\/\kernelcachd/g' ibot.patched
|
||||
else
|
||||
LC_ALL=C sed -i.bak -e 's/s\/\kernelcache/s\/\kernelcachd/g' ibot.patched
|
||||
rm *.bak
|
||||
fi
|
||||
cd ..
|
||||
"$dir"/img4 -i work/iBSS.patched -o boot-"$deviceid"/iBSS.img4 -M blobs/"$deviceid"-"$version".der -A -T ibss
|
||||
"$dir"/img4 -i work/ibot.patched -o boot-"$deviceid"/ibot.img4 -M blobs/"$deviceid"-"$version".der -A -T `if [[ "$cpid" == *"0x801"* ]]; then echo "ibss"; else echo "ibec"; fi`
|
||||
|
||||
touch boot-"$deviceid"/.local
|
||||
fi
|
||||
fi
|
||||
|
||||
# ============
|
||||
@@ -801,16 +953,35 @@ sleep 2
|
||||
_pwn
|
||||
_reset
|
||||
echo "[*] Booting device"
|
||||
if [[ "$cpid" == *"0x801"* ]]; then
|
||||
if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10"* ]]; then
|
||||
sleep 1
|
||||
"$dir"/irecovery -f boot-"$deviceid"/ibot.img4
|
||||
sleep 3
|
||||
"$dir"/irecovery -c "dorwx"
|
||||
sleep 2
|
||||
if [[ "$deviceid" == iPhone9,[1-4] ]]; then
|
||||
"$dir"/irecovery -f other/payload/payload_t8010.bin
|
||||
else
|
||||
"$dir"/irecovery -f other/payload/payload_t8015.bin
|
||||
fi
|
||||
sleep 3
|
||||
"$dir"/irecovery -c "go"
|
||||
sleep 1
|
||||
"$dir"/irecovery -c "go xargs $boot_args"
|
||||
sleep 1
|
||||
"$dir"/irecovery -c "go xfb"
|
||||
sleep 1
|
||||
"$dir"/irecovery -c "go boot $fs"
|
||||
else
|
||||
sleep 1
|
||||
"$dir"/irecovery -f boot-"$deviceid"/iBSS.img4
|
||||
sleep 1
|
||||
"$dir"/irecovery -f boot-"$deviceid"/ibot.img4
|
||||
sleep 1
|
||||
if [[ "$cpid" == *"0x801"* ]]; then
|
||||
sleep 1
|
||||
"$dir"/irecovery -f boot-"$deviceid"/ibot.img4
|
||||
else
|
||||
sleep 1
|
||||
"$dir"/irecovery -f boot-"$deviceid"/iBSS.img4
|
||||
sleep 4
|
||||
"$dir"/irecovery -f boot-"$deviceid"/ibot.img4
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$semi_tethered" ]; then
|
||||
@@ -818,20 +989,10 @@ if [ -z "$semi_tethered" ]; then
|
||||
"$dir"/irecovery -c fsboot
|
||||
fi
|
||||
|
||||
if [ "$os" = 'Darwin' ]; then
|
||||
defaults write -g ignore-devices -bool false
|
||||
defaults write com.apple.AMPDevicesAgent dontAutomaticallySyncIPods -bool false
|
||||
killall Finder
|
||||
fi
|
||||
|
||||
cd logs
|
||||
for file in *.log; do
|
||||
if [[ "$file" != "SUCCESS_"* ]]; then
|
||||
if [ "$os" = 'Linux' ]; then
|
||||
sudo mv "$file" SUCCESS_${file}
|
||||
else
|
||||
mv "$file" SUCCESS_${file}
|
||||
fi
|
||||
mv "$file" SUCCESS_${file}
|
||||
fi
|
||||
done
|
||||
cd ..
|
||||
@@ -840,8 +1001,8 @@ rm -rf work rdwork
|
||||
echo ""
|
||||
echo "Done!"
|
||||
echo "The device should now boot to iOS"
|
||||
echo "If this is your first time jailbreaking, open Tips app and then press Install"
|
||||
echo "Otherwise, open Tips app and press Do All in the Tools section"
|
||||
echo "If this is your first time jailbreaking, open the Pogo app and then press Install"
|
||||
echo "Otherwise, open the Pogo app and press Do All in the Tools section"
|
||||
echo "If you have any issues, please join the Discord server and ask for help: https://dsc.gg/palera1n"
|
||||
echo "Enjoy!"
|
||||
|
||||
|
||||
Reference in new issue
Block a user