From 7c48b7c32c1bcec12a9e0215b5901ee850ed8400 Mon Sep 17 00:00:00 2001 From: Nick Chan Date: Tue, 17 Jan 2023 13:46:42 +0800 Subject: [PATCH] half working pongo USB --- Makefile | 6 +- checkra1n.h | 3 + src/Makefile | 5 +- src/common.h | 20 +++- src/dfuhelper.c | 2 + src/main.c | 211 ++++++++++++++++++++++++++++----- src/pongo_usb.c | 305 ++++++++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 519 insertions(+), 33 deletions(-) create mode 100644 src/pongo_usb.c diff --git a/Makefile b/Makefile index 51df783..4e524d6 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,10 @@ SRC = $(shell pwd) DEP = $(SRC)/dep_root CC = cc -CFLAGS += -mmacosx-version-min=12.0 -I$(DEP)/include -I/opt/procursus/include -I$(SRC)/include -I$(SRC) -Os -Wall -Wextra +CFLAGS += -mmacosx-version-min=12.0 -I$(DEP)/include -I/opt/procursus/include -I$(SRC)/include -I$(SRC) -O0 -g -Wall -Wextra LIBS = $(DEP)/lib/libimobiledevice-1.0.a $(DEP)/lib/libirecovery-1.0.a $(DEP)/lib/libusbmuxd-2.0.a $(DEP)/lib/libplist-2.0.a $(DEP)/lib/libimobiledevice-glue-1.0.a -pthread -LIBS += $(DEP)/lib/libcrypto.35.tbd $(DEP)/lib/libssl.35.tbd -LIBS += -framework CoreFoundation -framework SystemConfiguration -framework IOKit +LIBS += $(DEP)/lib/libcrypto.35.tbd $(DEP)/lib/libssl.35.tbd $(DEP)/lib/libusb-1.0.a +LIBS += -framework CoreFoundation -framework SystemConfiguration -framework IOKit -framework Security LDFLAGS = $(LIBS) export SRC DEP CC CFLAGS LDFLAGS LIBS diff --git a/checkra1n.h b/checkra1n.h index f3cbdb8..d321da0 100644 --- a/checkra1n.h +++ b/checkra1n.h @@ -4,4 +4,7 @@ extern unsigned char checkra1n[]; extern unsigned int checkra1n_len; +extern unsigned char checkra1n_kpf_pongo[]; +extern unsigned int checkra1n_kpf_pongo_len; + #endif \ No newline at end of file diff --git a/src/Makefile b/src/Makefile index e3f718a..0770882 100644 --- a/src/Makefile +++ b/src/Makefile @@ -1,6 +1,6 @@ all: palera1n -OBJECTS = main.o dfuhelper.o lockdown_helper.o devhelper.o exec_checkra1n.o checkra1n.o +OBJECTS = main.o dfuhelper.o lockdown_helper.o devhelper.o exec_checkra1n.o pongo_usb.o checkra1n.o LIPO = lipo checkra1n: checkra1n-macos @@ -10,8 +10,9 @@ else $(LIPO) -thin x86_64 -output checkra1n checkra1n-macos endif -checkra1n.c: checkra1n +checkra1n.c: checkra1n checkra1n-kpf-pongo xxd -iC checkra1n > checkra1n.c + xxd -iC checkra1n-kpf-pongo >> checkra1n.c %.o: %.c $(CC) -c $(CFLAGS) $< diff --git a/src/common.h b/src/common.h index bf8a350..5c2950e 100644 --- a/src/common.h +++ b/src/common.h @@ -8,6 +8,7 @@ #include #include #include +#include #define LOG(loglevel, ...) p1_log(loglevel, __FILE__, __LINE__, __func__, __VA_ARGS__) #define CLEAR() printf("\33[2K\r"); @@ -17,8 +18,7 @@ typedef enum { LOG_ERROR = 1, LOG_WARNING = 2, LOG_INFO = 3, - LOG_VERBOSE = 4, - LOG_DEBUG = 5 + LOG_VERBOSE = 4 } log_level_t; typedef struct { @@ -40,6 +40,10 @@ typedef struct { // set this value to 0 gracefully exit extern int spin; +extern int verbose; + +extern bool dfuhelper_only; +extern bool pongo_exit; void* dfuhelper(void* ptr); int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, char* __restrict format, ...); @@ -58,4 +62,16 @@ int autoboot_cmd(const uint64_t ecid); int exitrecv_cmd(const uint64_t ecid); void exec_checkra1n(); + +typedef int usb_ret_t; +typedef libusb_device_handle *usb_device_handle_t; + +#define USB_RET_SUCCESS LIBUSB_SUCCESS +#define USB_RET_NOT_RESPONDING LIBUSB_ERROR_OTHER + +extern void* pongo_usb_callback(void* arg); +usb_ret_t USBControlTransfer(usb_device_handle_t handle, uint8_t bmRequestType, uint8_t bRequest, uint16_t wValue, uint16_t wIndex, uint32_t wLength, void *data, uint32_t *wLenDone); +usb_ret_t USBBulkUpload(usb_device_handle_t handle, void *data, uint32_t len); +const char *usb_strerror(usb_ret_t err); +int wait_for_pongo(); #endif diff --git a/src/dfuhelper.c b/src/dfuhelper.c index 910e339..cd78ac6 100644 --- a/src/dfuhelper.c +++ b/src/dfuhelper.c @@ -127,6 +127,7 @@ void* connected_recovery_mode(struct irecv_device_info* info) { LOG(LOG_INFO, "Waiting for device to reconnect..."); return NULL; } + pthread_exit(NULL); return NULL; } @@ -137,6 +138,7 @@ void* connected_dfu_mode(struct irecv_device_info* info) { } unsubscribe_cmd(); spin = 0; + pthread_exit(NULL); return NULL; } diff --git a/src/main.c b/src/main.c index a3ff54e..474ffaa 100644 --- a/src/main.c +++ b/src/main.c @@ -16,47 +16,206 @@ #include #include #include +#include +#include #include "ANSI-color-codes.h" #include "common.h" +#include "checkra1n.h" -int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, char* __restrict format, ...) { +#define CMD_LEN_MAX 512 + +int verbose = 0; + +int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, char *__restrict format, ...) +{ + int ret = 0; va_list args; va_start(args, format); - switch(loglevel) { - case LOG_FATAL: - printf(BRED "[!] " RED); - break; - case LOG_ERROR: - printf(BRED "[Error] " RED); - break; - case LOG_WARNING: - printf(BYEL "[Warning] " YEL); - break; - case LOG_INFO: - printf(BCYN "[Info] " CYN); - break; - case LOG_VERBOSE: + if (verbose >= 2) + printf(BLU "%s:%d: " BMAG "%s(): \n--> " WHT, fname, lineno, fxname); + switch (loglevel) + { + case LOG_FATAL: + printf(BRED "[!] " RED); + break; + case LOG_ERROR: + printf(BRED "[Error] " RED); + break; + case LOG_WARNING: + printf(BYEL "[Warning] " YEL); + break; + case LOG_INFO: + printf(BCYN "[Info] " CYN); + break; + case LOG_VERBOSE: + if (verbose >= 1) printf(BWHT "[Verbose] " WHT); - break; - case LOG_DEBUG: - printf(BLU "%s:%d: " BMAG "%s(): " WHT, fname, lineno, fxname); - break; - default: - assert(0); - break; + break; + default: + assert(0); + break; + } + if (verbose >= 1 || loglevel < LOG_VERBOSE) + { + ret = vprintf(format, args); + va_end(args); + printf(CRESET "\n"); } - int ret = vprintf(format, args); - va_end(args); - printf(CRESET "\n"); return ret; } -int main(int argc, char* argv[]) { +int issue_pongo_command(usb_device_handle_t handle, char *command) +{ + int ret; + size_t len = strlen(command); + if (len > (CMD_LEN_MAX - 2)) { + LOG(LOG_ERROR, "Pongo command %s too long (max %d)", command, CMD_LEN_MAX - 2); + return EINVAL; + } + LOG(LOG_VERBOSE, "Executing PongoOS command: '%s'", command); + char buf[512]; + snprintf(buf, 512, "%s\n", command); + len = strlen(buf); + ret = USBControlTransfer(handle, 0x21, 4, 1, 0, 0, NULL, NULL); + if (ret) + goto bad; + ret = USBControlTransfer(handle, 0x21, 3, 0, 0, (uint32_t)len, buf, NULL); + sleep(1); +bad: + if (ret != USB_RET_SUCCESS) { + if (ret == USB_RET_NOT_RESPONDING) + return 0; + LOG(LOG_ERROR, "USB error: %s", usb_strerror(ret)); + return ret; + } + else + return ret; +} + +int upload_pongo_file(usb_device_handle_t handle, unsigned char *buf, unsigned int buf_len) +{ + int ret = 0; + ret = USBControlTransfer(handle, 0x21, 1, 0, 0, 4, &buf_len, NULL); + if (ret == USB_RET_SUCCESS) { + ret = USBBulkUpload(handle, buf, buf_len); + if (ret == USB_RET_SUCCESS) { + LOG(LOG_VERBOSE, "Uploaded %llu bytes to PongoOS", (unsigned long long)buf_len); + } + } + sleep(1); + return ret; +} + +int found_pongo = 0; + +void *pongo_usb_callback(void *arg) +{ + if (found_pongo) return NULL; + found_pongo = 1; + usb_device_handle_t handle = *(usb_device_handle_t *)arg; + sleep(1); + issue_pongo_command(handle, "fuse lock"); + issue_pongo_command(handle, "sep auto"); + upload_pongo_file(handle, checkra1n_kpf_pongo, checkra1n_kpf_pongo_len); + issue_pongo_command(handle, "modload"); + issue_pongo_command(handle, "dtpatch disk0s1s8"); + issue_pongo_command(handle, "xargs serial=3 wdt=-1"); + issue_pongo_command(handle, "bootx"); + LOG(LOG_INFO, "Booting Kernel..."); + spin = false; + exit(0); + return NULL; +} + +static struct option longopts[] = { + {"dfuhelper", no_argument, NULL, 'D'}, + {"help", no_argument, NULL, 'h'}, + {"pongo-shell", no_argument, NULL, 'p'}, + {"start-from-pongo", no_argument, NULL, 'P'}, + {"debug-logging", no_argument, NULL, 'V'}, + {NULL, 0, NULL, 0}}; + +int usage(int e) +{ + fprintf(stderr, + "Usage: %s [-Dhp]\n" + "Copyright (C) 2023, palera1n team, All Rights Reserved.\n\n" + "iOS/iPadOS 15+ arm64 jailbreaking tool\n\n" + "\n" + "\t-D, --dfuhelper-only\tExit after entering DFU\n" + "\t-h, --help\t\tShow this help\n" + "\t-p, --pongo-shell\tBoots to PongoOS shell\n" + "\t-P, --start-from-pongo\tStart with a PongoOS USB Device attached\n" + "\t-V, --debug-logging\tEnable debug logging\n" + "\t\tThis option can be repeated for extra verbosity\n", + getprogname()); + exit(e); +} + +bool dfuhelper_only = false; +bool pongo_exit = false; +bool start_from_pongo = false; + +int main(int argc, char *argv[]) +{ + int opt; + int index; + while ((opt = getopt_long(argc, argv, "DhpPV", longopts, NULL)) != -1) + { + switch (opt) + { + case 'P': + start_from_pongo = true; + break; + case 'p': + pongo_exit = true; + break; + case 'D': + dfuhelper_only = true; + break; + case 'h': + usage(0); + assert(0); + case 'V': + verbose++; + break; + default: + usage(1); + break; + } + } + for (index = optind; index < argc; index++) + { + if (!strcmp("windows", argv[index])) + { + fprintf(stderr, + "Windows not really using for manipulating OSX images,\n" + "compiled in mingw tool for this working unstable and incorrectly\n"); + assert(strcmp("windows", argv[index])); + } + else + { + fprintf(stderr, "palera1n: unknown argument: %s\n", argv[index]); + usage(1); + } + } LOG(LOG_INFO, "Waiting for devices"); + if (start_from_pongo == true) + goto pongo; pthread_t dfuhelper_thread; pthread_create(&dfuhelper_thread, NULL, dfuhelper, NULL); pthread_join(dfuhelper_thread, NULL); + if (dfuhelper_only) + return 0; exec_checkra1n(); + if (pongo_exit) + return 0; +pongo: + spin = true; + wait_for_pongo(); + while (spin) { + sleep(1); + } return 0; } diff --git a/src/pongo_usb.c b/src/pongo_usb.c new file mode 100644 index 0000000..3f02e79 --- /dev/null +++ b/src/pongo_usb.c @@ -0,0 +1,305 @@ +/* + * pongoOS - https://checkra.in + * + * Copyright (C) 2019-2023 checkra1n team + * + * This file is part of pongoOS. + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in all + * copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + * + */ + + +#include +#include // open +#include +#include +#include +#include +#include // exit, strtoull +#include // strlen, strerror, memcpy, memmove +#include // close +#include // mmap, munmap +#include // fstst +#include "common.h" +#define ERR(...) LOG(LOG_VERBOSE, __VA_ARGS__) + +// Keep in sync with Pongo +#define PONGO_USB_VENDOR 0x05ac +#define PONGO_USB_PRODUCT 0x4141 +#define CMD_LEN_MAX 512 +#define UPLOADSZ_MAX (1024 * 1024 * 128) + +static uint8_t gBlockIO = 1; + +typedef struct stuff stuff_t; + +static void io_start(stuff_t *stuff); +static void io_stop(stuff_t *stuff); + + +const char *usb_strerror(usb_ret_t err) +{ + return libusb_error_name(err); +} + +usb_ret_t USBControlTransfer(usb_device_handle_t handle, uint8_t bmRequestType, uint8_t bRequest, uint16_t wValue, uint16_t wIndex, uint32_t wLength, void *data, uint32_t *wLenDone) +{ + usb_ret_t r = libusb_control_transfer(handle, bmRequestType, bRequest, wValue, wIndex, data, wLength, 0); + if(r < 0) return r; + if(wLenDone) *wLenDone = r; + return USB_RET_SUCCESS; +} + +usb_ret_t USBBulkUpload(usb_device_handle_t handle, void *data, uint32_t len) +{ + static uint32_t maxLen = 0; + int transferred = 0; + usb_ret_t r; + if(maxLen == 0) + { + r = libusb_bulk_transfer(handle, 2, data, len, &transferred, 0); + if(r == LIBUSB_SUCCESS) + { + return transferred == len ? USB_RET_SUCCESS : LIBUSB_ERROR_INTERRUPTED; + } + else if(r != LIBUSB_ERROR_NO_MEM) + { + return r; + } + // We only get here on ENOMEM + FILE *f = fopen("/sys/module/usbcore/parameters/usbfs_memory_mb", "r"); + if(f) + { + char str[32]; // More than enough to hold a uint64 in decimal + size_t s = fread(str, 1, sizeof(str), f); + fclose(f); + if(s == 0 || s >= sizeof(str)) return r; + str[s] = '\0'; + char *end = NULL; + unsigned long long max = strtoull(str, &end, 0); + // Using the limit as-is will lead to ENOMEM, so we multiply + // by half a MB and impose an appropriate max value. + if(*end == '\n') ++end; + if(*end != '\0' || max == 0 || max >= 0x2000) return r; + maxLen = (uint32_t)(max << 19); + } + else + { + // Just 8MB by default? + maxLen = 0x800000; + } + } + // If we get here, we have to chunk our data + for(uint32_t done = transferred; done < len; ) + { + uint32_t chunk = len - done; + if(chunk > maxLen) chunk = maxLen; + transferred = 0; + r = libusb_bulk_transfer(handle, 2, (unsigned char*)data + done, chunk, &transferred, 0); + done += transferred; + if(r == LIBUSB_SUCCESS) continue; + if(r != LIBUSB_ERROR_NO_MEM || maxLen <= 0x40) return r; + maxLen /= 2; + } + return LIBUSB_SUCCESS; +} + +struct stuff +{ + pthread_t th; + libusb_device *dev; + usb_device_handle_t handle; +}; + +static int FoundDevice(libusb_context *ctx, libusb_device *dev, libusb_hotplug_event event, void *arg) +{ + stuff_t *stuff = arg; + if(stuff->handle) + { + return LIBUSB_SUCCESS; + } + + libusb_device_handle *handle; + int r = libusb_open(dev, &handle); + if(r != LIBUSB_SUCCESS) + { + ERR("libusb_open: %s", libusb_error_name(r)); + return r; + } + + r = libusb_detach_kernel_driver(handle, 0); + if(r != LIBUSB_SUCCESS && r != LIBUSB_ERROR_NOT_FOUND) + { + ERR("libusb_detach_kernel_driver: %s", libusb_error_name(r)); + return r; + } + + r = libusb_set_configuration(handle, 1); + if(r != LIBUSB_SUCCESS) + { + ERR("libusb_set_configuration: %s", libusb_error_name(r)); + return r; + } + + r = libusb_claim_interface(handle, 0); + if(r != LIBUSB_SUCCESS) + { + ERR("libusb_claim_interface: %s", libusb_error_name(r)); + return r; + } + + stuff->dev = dev; + stuff->handle = handle; + io_start(stuff); + + return LIBUSB_SUCCESS; +} + +static int LostDevice(libusb_context *ctx, libusb_device *dev, libusb_hotplug_event event, void *arg) +{ + stuff_t *stuff = arg; + if(stuff->dev != dev) + { + return LIBUSB_SUCCESS; + } + + io_stop(stuff); + libusb_close(stuff->handle); + stuff->handle = NULL; + stuff->dev = NULL; + + return LIBUSB_SUCCESS; +} + +int wait_for_pongo(void) +{ + stuff_t stuff = {}; + libusb_hotplug_callback_handle hp[2]; + + int r = libusb_init(NULL); + if(r != LIBUSB_SUCCESS) + { + ERR("libusb_init: %s", libusb_error_name(r)); + return -1; + } + + if(!libusb_has_capability(LIBUSB_CAP_HAS_HOTPLUG)) + { + ERR("libusb: no hotplug capability"); + libusb_exit(NULL); + return -1; + } + + r = libusb_hotplug_register_callback(NULL, LIBUSB_HOTPLUG_EVENT_DEVICE_ARRIVED, 0, PONGO_USB_VENDOR, PONGO_USB_PRODUCT, LIBUSB_HOTPLUG_MATCH_ANY, FoundDevice, &stuff, &hp[0]); + if(r != LIBUSB_SUCCESS) + { + ERR("libusb_hotplug: %s", libusb_error_name(r)); + libusb_exit(NULL); + return -1; + } + + r = libusb_hotplug_register_callback(NULL, LIBUSB_HOTPLUG_EVENT_DEVICE_LEFT, 0, PONGO_USB_VENDOR, PONGO_USB_PRODUCT, LIBUSB_HOTPLUG_MATCH_ANY, LostDevice, &stuff, &hp[1]); + if(r != LIBUSB_SUCCESS) + { + ERR("libusb_hotplug: %s", libusb_error_name(r)); + libusb_exit(NULL); + return -1; + } + + libusb_device **list; + ssize_t sz = libusb_get_device_list(NULL, &list); + if(sz < 0) + { + ERR("libusb_get_device_list: %s", libusb_error_name((int)sz)); + libusb_exit(NULL); + return -1; + } + + for(size_t i = 0; i < sz; ++i) + { + struct libusb_device_descriptor desc = {}; + r = libusb_get_device_descriptor(list[i], &desc); + if(r != LIBUSB_SUCCESS) + { + ERR("libusb_get_device_descriptor: %s", libusb_error_name(r)); + // continue anyway + } + if(desc.idVendor != PONGO_USB_VENDOR || desc.idProduct != PONGO_USB_PRODUCT) + { + libusb_unref_device(list[i]); + continue; + } + r = FoundDevice(NULL, list[i], LIBUSB_HOTPLUG_EVENT_DEVICE_ARRIVED, &stuff); + for(size_t j = i + 1; j < sz; ++j) + { + libusb_unref_device(list[j]); + } + if(r != LIBUSB_SUCCESS) + { + libusb_free_device_list(list, 0); + libusb_exit(NULL); + return -1; + } + break; + } + libusb_free_device_list(list, 0); + + while(spin) + { + r = libusb_handle_events(NULL); + if(r != LIBUSB_SUCCESS) + { + ERR("libusb_handle_events: %s", libusb_error_name(r)); + break; + } + } + + libusb_exit(NULL); + return -1; +} + + +static void io_start(stuff_t *stuff) +{ + int r = pthread_create(&stuff->th, NULL, &pongo_usb_callback, &stuff->handle); + if(r != 0) + { + ERR("pthread_create: %s", strerror(r)); + exit(-1); // TODO: ok with libusb? + } + pongo_usb_callback(&stuff->handle); +} + +static void io_stop(stuff_t *stuff) +{ + LOG(LOG_VERBOSE, "PongoOS USB Device disconnected"); + int r = pthread_cancel(stuff->th); + if(r != 0) + { + ERR("pthread_cancel: %s", strerror(r)); + exit(-1); // TODO: ok with libusb? + } + r = pthread_join(stuff->th, NULL); + if(r != 0) + { + ERR("pthread_join: %s", strerror(r)); + exit(-1); // TODO: ok with libusb? + } +}