half working pongo USB

Makefile

@@ -1,10 +1,10 @@
 SRC = $(shell pwd)
 DEP = $(SRC)/dep_root
 CC = cc
-CFLAGS += -mmacosx-version-min=12.0 -I$(DEP)/include -I/opt/procursus/include -I$(SRC)/include -I$(SRC) -Os -Wall -Wextra
+CFLAGS += -mmacosx-version-min=12.0 -I$(DEP)/include -I/opt/procursus/include -I$(SRC)/include -I$(SRC) -O0 -g -Wall -Wextra
 LIBS = $(DEP)/lib/libimobiledevice-1.0.a $(DEP)/lib/libirecovery-1.0.a $(DEP)/lib/libusbmuxd-2.0.a $(DEP)/lib/libplist-2.0.a $(DEP)/lib/libimobiledevice-glue-1.0.a -pthread
-LIBS += $(DEP)/lib/libcrypto.35.tbd $(DEP)/lib/libssl.35.tbd
-LIBS += -framework CoreFoundation -framework SystemConfiguration -framework IOKit
+LIBS += $(DEP)/lib/libcrypto.35.tbd $(DEP)/lib/libssl.35.tbd $(DEP)/lib/libusb-1.0.a
+LIBS += -framework CoreFoundation -framework SystemConfiguration -framework IOKit -framework Security
 LDFLAGS = $(LIBS)
 
 export SRC DEP CC CFLAGS LDFLAGS LIBS

checkra1n.h

@@ -4,4 +4,7 @@
 extern unsigned char checkra1n[];
 extern unsigned int checkra1n_len;
 
+extern unsigned char checkra1n_kpf_pongo[];
+extern unsigned int checkra1n_kpf_pongo_len;
+
 #endif

src/Makefile

@@ -1,6 +1,6 @@
 all: palera1n
 
-OBJECTS = main.o dfuhelper.o lockdown_helper.o devhelper.o exec_checkra1n.o checkra1n.o
+OBJECTS = main.o dfuhelper.o lockdown_helper.o devhelper.o exec_checkra1n.o pongo_usb.o checkra1n.o
 LIPO = lipo
 
 checkra1n: checkra1n-macos
@@ -10,8 +10,9 @@ else
 	$(LIPO) -thin x86_64 -output checkra1n checkra1n-macos
 endif
 
-checkra1n.c: checkra1n
+checkra1n.c: checkra1n checkra1n-kpf-pongo
 	xxd -iC checkra1n > checkra1n.c
+	xxd -iC checkra1n-kpf-pongo >> checkra1n.c
 
 %.o: %.c
 	$(CC) -c $(CFLAGS) $<

src/common.h

@@ -8,6 +8,7 @@
 #include <stdarg.h>
 #include <usbmuxd.h>
 #include <libirecovery.h>
+#include <libusb-1.0/libusb.h>
 
 #define LOG(loglevel, ...) p1_log(loglevel, __FILE__, __LINE__, __func__, __VA_ARGS__)
 #define CLEAR() printf("\33[2K\r");
@@ -17,8 +18,7 @@ typedef enum {
 	LOG_ERROR = 1,
 	LOG_WARNING = 2,
 	LOG_INFO = 3,
-	LOG_VERBOSE = 4,
-	LOG_DEBUG = 5
+	LOG_VERBOSE = 4
 } log_level_t;
 
 typedef struct {
@@ -40,6 +40,10 @@ typedef struct {
 
 // set this value to 0 gracefully exit
 extern int spin;
+extern int verbose;
+
+extern bool dfuhelper_only;
+extern bool pongo_exit;
 
 void* dfuhelper(void* ptr);
 int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, char* __restrict format, ...);
@@ -58,4 +62,16 @@ int autoboot_cmd(const uint64_t ecid);
 int exitrecv_cmd(const uint64_t ecid);
 
 void exec_checkra1n();
+
+typedef int usb_ret_t;
+typedef libusb_device_handle *usb_device_handle_t;
+
+#define USB_RET_SUCCESS         LIBUSB_SUCCESS
+#define USB_RET_NOT_RESPONDING  LIBUSB_ERROR_OTHER
+
+extern void* pongo_usb_callback(void* arg);
+usb_ret_t USBControlTransfer(usb_device_handle_t handle, uint8_t bmRequestType, uint8_t bRequest, uint16_t wValue, uint16_t wIndex, uint32_t wLength, void *data, uint32_t *wLenDone);
+usb_ret_t USBBulkUpload(usb_device_handle_t handle, void *data, uint32_t len);
+const char *usb_strerror(usb_ret_t err);
+int wait_for_pongo();
 #endif

src/dfuhelper.c

@@ -127,6 +127,7 @@ void* connected_recovery_mode(struct irecv_device_info* info) {
 		LOG(LOG_INFO, "Waiting for device to reconnect...");
 		return NULL;
 	}
+	pthread_exit(NULL);
 	return NULL;
 }
 
@@ -137,6 +138,7 @@ void* connected_dfu_mode(struct irecv_device_info* info) {
 	}
 	unsubscribe_cmd();
 	spin = 0;
+	pthread_exit(NULL);
 	return NULL;
 }
 

src/main.c

@@ -16,47 +16,206 @@
 #include <signal.h>
 #include <pthread.h>
 #include <inttypes.h>
+#include <getopt.h>
+#include <errno.h>
 
 #include "ANSI-color-codes.h"
 #include "common.h"
+#include "checkra1n.h"
 
-int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, char* __restrict format, ...) {
+#define CMD_LEN_MAX 512
+
+int verbose = 0;
+
+int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, char *__restrict format, ...)
+{
+	int ret = 0;
 	va_list args;
 	va_start(args, format);
-	switch(loglevel) {
-		case LOG_FATAL:
-			printf(BRED "[!] " RED);
-			break;
-		case LOG_ERROR:
-			printf(BRED "[Error] " RED);
-			break;
-		case LOG_WARNING:
-			printf(BYEL "[Warning] " YEL);
-			break;
-		case LOG_INFO:
-			printf(BCYN "[Info] " CYN);
-			break;
-		case LOG_VERBOSE:
+	if (verbose >= 2)
+		printf(BLU "%s:%d: " BMAG "%s(): \n--> " WHT, fname, lineno, fxname);
+	switch (loglevel)
+	{
+	case LOG_FATAL:
+		printf(BRED "[!] " RED);
+		break;
+	case LOG_ERROR:
+		printf(BRED "[Error] " RED);
+		break;
+	case LOG_WARNING:
+		printf(BYEL "[Warning] " YEL);
+		break;
+	case LOG_INFO:
+		printf(BCYN "[Info] " CYN);
+		break;
+	case LOG_VERBOSE:
+		if (verbose >= 1)
 			printf(BWHT "[Verbose] " WHT);
-			break;
-		case LOG_DEBUG:
-			printf(BLU "%s:%d: " BMAG "%s(): " WHT, fname, lineno, fxname);
-			break;
-		default:
-			assert(0);
-			break;
+		break;
+	default:
+		assert(0);
+		break;
+	}
+	if (verbose >= 1 || loglevel < LOG_VERBOSE)
+	{
+		ret = vprintf(format, args);
+		va_end(args);
+		printf(CRESET "\n");
 	}
-	int ret = vprintf(format, args);
-	va_end(args);
-	printf(CRESET "\n");
 	return ret;
 }
 
-int main(int argc, char* argv[]) {
+int issue_pongo_command(usb_device_handle_t handle, char *command)
+{
+	int ret;
+	size_t len = strlen(command);
+	if (len > (CMD_LEN_MAX - 2)) {
+		LOG(LOG_ERROR, "Pongo command %s too long (max %d)", command, CMD_LEN_MAX - 2);
+		return EINVAL;
+	}
+	LOG(LOG_VERBOSE, "Executing PongoOS command: '%s'", command);
+	char buf[512];
+	snprintf(buf, 512, "%s\n", command);
+	len = strlen(buf);
+	ret = USBControlTransfer(handle, 0x21, 4, 1, 0, 0, NULL, NULL);
+	if (ret)
+		goto bad;
+	ret = USBControlTransfer(handle, 0x21, 3, 0, 0, (uint32_t)len, buf, NULL);
+	sleep(1);
+bad:
+	if (ret != USB_RET_SUCCESS) {
+		if (ret == USB_RET_NOT_RESPONDING)
+			return 0;
+		LOG(LOG_ERROR, "USB error: %s", usb_strerror(ret));
+		return ret;
+	}
+	else
+		return ret;
+}
+
+int upload_pongo_file(usb_device_handle_t handle, unsigned char *buf, unsigned int buf_len)
+{
+	int ret = 0;
+	ret = USBControlTransfer(handle, 0x21, 1, 0, 0, 4, &buf_len, NULL);
+	if (ret == USB_RET_SUCCESS) {
+		ret = USBBulkUpload(handle, buf, buf_len);
+		if (ret == USB_RET_SUCCESS) {
+			LOG(LOG_VERBOSE, "Uploaded %llu bytes to PongoOS", (unsigned long long)buf_len);
+		}
+	}
+	sleep(1);
+	return ret;
+}
+
+int found_pongo = 0;
+
+void *pongo_usb_callback(void *arg)
+{
+	if (found_pongo) return NULL;
+	found_pongo = 1;
+	usb_device_handle_t handle = *(usb_device_handle_t *)arg;
+	sleep(1);
+	issue_pongo_command(handle, "fuse lock");
+	issue_pongo_command(handle, "sep auto");
+	upload_pongo_file(handle, checkra1n_kpf_pongo, checkra1n_kpf_pongo_len);
+	issue_pongo_command(handle, "modload");
+	issue_pongo_command(handle, "dtpatch disk0s1s8");
+	issue_pongo_command(handle, "xargs serial=3 wdt=-1");
+	issue_pongo_command(handle, "bootx");
+	LOG(LOG_INFO, "Booting Kernel...");
+	spin = false;
+	exit(0);
+	return NULL;
+}
+
+static struct option longopts[] = {
+	{"dfuhelper", no_argument, NULL, 'D'},
+	{"help", no_argument, NULL, 'h'},
+	{"pongo-shell", no_argument, NULL, 'p'},
+	{"start-from-pongo", no_argument, NULL, 'P'},
+	{"debug-logging", no_argument, NULL, 'V'},
+	{NULL, 0, NULL, 0}};
+
+int usage(int e)
+{
+	fprintf(stderr,
+			"Usage: %s [-Dhp]\n"
+			"Copyright (C) 2023, palera1n team, All Rights Reserved.\n\n"
+			"iOS/iPadOS 15+ arm64 jailbreaking tool\n\n"
+			"\n"
+			"\t-D, --dfuhelper-only\tExit after entering DFU\n"
+			"\t-h, --help\t\tShow this help\n"
+			"\t-p, --pongo-shell\tBoots to PongoOS shell\n"
+			"\t-P, --start-from-pongo\tStart with a PongoOS USB Device attached\n"
+			"\t-V, --debug-logging\tEnable debug logging\n"
+			"\t\tThis option can be repeated for extra verbosity\n",
+			getprogname());
+	exit(e);
+}
+
+bool dfuhelper_only = false;
+bool pongo_exit = false;
+bool start_from_pongo = false;
+
+int main(int argc, char *argv[])
+{
+	int opt;
+	int index;
+	while ((opt = getopt_long(argc, argv, "DhpPV", longopts, NULL)) != -1)
+	{
+		switch (opt)
+		{
+		case 'P':
+			start_from_pongo = true;
+			break;
+		case 'p':
+			pongo_exit = true;
+			break;
+		case 'D':
+			dfuhelper_only = true;
+			break;
+		case 'h':
+			usage(0);
+			assert(0);
+		case 'V':
+			verbose++;
+			break;
+		default:
+			usage(1);
+			break;
+		}
+	}
+	for (index = optind; index < argc; index++)
+	{
+		if (!strcmp("windows", argv[index]))
+		{
+			fprintf(stderr,
+					"Windows not really using for manipulating OSX images,\n"
+					"compiled in mingw tool for this working unstable and incorrectly\n");
+			assert(strcmp("windows", argv[index]));
+		}
+		else
+		{
+			fprintf(stderr, "palera1n: unknown argument: %s\n", argv[index]);
+			usage(1);
+		}
+	}
 	LOG(LOG_INFO, "Waiting for devices");
+	if (start_from_pongo == true)
+		goto pongo;
 	pthread_t dfuhelper_thread;
 	pthread_create(&dfuhelper_thread, NULL, dfuhelper, NULL);
 	pthread_join(dfuhelper_thread, NULL);
+	if (dfuhelper_only)
+		return 0;
 	exec_checkra1n();
+	if (pongo_exit)
+		return 0;
+pongo:
+	spin = true;
+	wait_for_pongo();
+	while (spin) {
+		sleep(1);
+	}
 	return 0;
 }

src/pongo_usb.c

@@ -0,0 +1,305 @@
+/*
+ * pongoOS - https://checkra.in
+ *
+ * Copyright (C) 2019-2023 checkra1n team
+ *
+ * This file is part of pongoOS.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+
+#include <errno.h>
+#include <fcntl.h>              // open
+#include <pthread.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>             // exit, strtoull
+#include <string.h>             // strlen, strerror, memcpy, memmove
+#include <unistd.h>             // close
+#include <sys/mman.h>           // mmap, munmap
+#include <sys/stat.h>           // fstst
+#include "common.h"
+#define ERR(...) LOG(LOG_VERBOSE, __VA_ARGS__)
+
+// Keep in sync with Pongo
+#define PONGO_USB_VENDOR    0x05ac
+#define PONGO_USB_PRODUCT   0x4141
+#define CMD_LEN_MAX         512
+#define UPLOADSZ_MAX        (1024 * 1024 * 128)
+
+static uint8_t gBlockIO = 1;
+
+typedef struct stuff stuff_t;
+
+static void io_start(stuff_t *stuff);
+static void io_stop(stuff_t *stuff);
+
+
+const char *usb_strerror(usb_ret_t err)
+{
+    return libusb_error_name(err);
+}
+
+usb_ret_t USBControlTransfer(usb_device_handle_t handle, uint8_t bmRequestType, uint8_t bRequest, uint16_t wValue, uint16_t wIndex, uint32_t wLength, void *data, uint32_t *wLenDone)
+{
+    usb_ret_t r = libusb_control_transfer(handle, bmRequestType, bRequest, wValue, wIndex, data, wLength, 0);
+    if(r < 0) return r;
+    if(wLenDone) *wLenDone = r;
+    return USB_RET_SUCCESS;
+}
+
+usb_ret_t USBBulkUpload(usb_device_handle_t handle, void *data, uint32_t len)
+{
+    static uint32_t maxLen = 0;
+    int transferred = 0;
+    usb_ret_t r;
+    if(maxLen == 0)
+    {
+        r = libusb_bulk_transfer(handle, 2, data, len, &transferred, 0);
+        if(r == LIBUSB_SUCCESS)
+        {
+            return transferred == len ? USB_RET_SUCCESS : LIBUSB_ERROR_INTERRUPTED;
+        }
+        else if(r != LIBUSB_ERROR_NO_MEM)
+        {
+            return r;
+        }
+        // We only get here on ENOMEM
+        FILE *f = fopen("/sys/module/usbcore/parameters/usbfs_memory_mb", "r");
+        if(f)
+        {
+            char str[32]; // More than enough to hold a uint64 in decimal
+            size_t s = fread(str, 1, sizeof(str), f);
+            fclose(f);
+            if(s == 0 || s >= sizeof(str)) return r;
+            str[s] = '\0';
+            char *end = NULL;
+            unsigned long long max = strtoull(str, &end, 0);
+            // Using the limit as-is will lead to ENOMEM, so we multiply
+            // by half a MB and impose an appropriate max value.
+            if(*end == '\n') ++end;
+            if(*end != '\0' || max == 0 || max >= 0x2000) return r;
+            maxLen = (uint32_t)(max << 19);
+        }
+        else
+        {
+            // Just 8MB by default?
+            maxLen = 0x800000;
+        }
+    }
+    // If we get here, we have to chunk our data
+    for(uint32_t done = transferred; done < len; )
+    {
+        uint32_t chunk = len - done;
+        if(chunk > maxLen) chunk = maxLen;
+        transferred = 0;
+        r = libusb_bulk_transfer(handle, 2, (unsigned char*)data + done, chunk, &transferred, 0);
+        done += transferred;
+        if(r == LIBUSB_SUCCESS) continue;
+        if(r != LIBUSB_ERROR_NO_MEM || maxLen <= 0x40) return r;
+        maxLen /= 2;
+    }
+    return LIBUSB_SUCCESS;
+}
+
+struct stuff
+{
+    pthread_t th;
+    libusb_device *dev;
+    usb_device_handle_t handle;
+};
+
+static int FoundDevice(libusb_context *ctx, libusb_device *dev, libusb_hotplug_event event, void *arg)
+{
+    stuff_t *stuff = arg;
+    if(stuff->handle)
+    {
+        return LIBUSB_SUCCESS;
+    }
+
+    libusb_device_handle *handle;
+    int r = libusb_open(dev, &handle);
+    if(r != LIBUSB_SUCCESS)
+    {
+        ERR("libusb_open: %s", libusb_error_name(r));
+        return r;
+    }
+
+    r = libusb_detach_kernel_driver(handle, 0);
+    if(r != LIBUSB_SUCCESS && r != LIBUSB_ERROR_NOT_FOUND)
+    {
+        ERR("libusb_detach_kernel_driver: %s", libusb_error_name(r));
+        return r;
+    }
+
+    r = libusb_set_configuration(handle, 1);
+    if(r != LIBUSB_SUCCESS)
+    {
+        ERR("libusb_set_configuration: %s", libusb_error_name(r));
+        return r;
+    }
+
+    r = libusb_claim_interface(handle, 0);
+    if(r != LIBUSB_SUCCESS)
+    {
+        ERR("libusb_claim_interface: %s", libusb_error_name(r));
+        return r;
+    }
+
+    stuff->dev = dev;
+    stuff->handle = handle;
+    io_start(stuff);
+
+    return LIBUSB_SUCCESS;
+}
+
+static int LostDevice(libusb_context *ctx, libusb_device *dev, libusb_hotplug_event event, void *arg)
+{
+    stuff_t *stuff = arg;
+    if(stuff->dev != dev)
+    {
+        return LIBUSB_SUCCESS;
+    }
+
+    io_stop(stuff);
+    libusb_close(stuff->handle);
+    stuff->handle = NULL;
+    stuff->dev = NULL;
+
+    return LIBUSB_SUCCESS;
+}
+
+int wait_for_pongo(void)
+{
+    stuff_t stuff = {};
+    libusb_hotplug_callback_handle hp[2];
+
+    int r = libusb_init(NULL);
+    if(r != LIBUSB_SUCCESS)
+    {
+        ERR("libusb_init: %s", libusb_error_name(r));
+        return -1;
+    }
+
+    if(!libusb_has_capability(LIBUSB_CAP_HAS_HOTPLUG))
+    {
+        ERR("libusb: no hotplug capability");
+        libusb_exit(NULL);
+        return -1;
+    }
+
+    r = libusb_hotplug_register_callback(NULL, LIBUSB_HOTPLUG_EVENT_DEVICE_ARRIVED, 0, PONGO_USB_VENDOR, PONGO_USB_PRODUCT, LIBUSB_HOTPLUG_MATCH_ANY, FoundDevice, &stuff, &hp[0]);
+    if(r != LIBUSB_SUCCESS)
+    {
+        ERR("libusb_hotplug: %s", libusb_error_name(r));
+        libusb_exit(NULL);
+        return -1;
+    }
+
+    r = libusb_hotplug_register_callback(NULL, LIBUSB_HOTPLUG_EVENT_DEVICE_LEFT, 0, PONGO_USB_VENDOR, PONGO_USB_PRODUCT, LIBUSB_HOTPLUG_MATCH_ANY, LostDevice, &stuff, &hp[1]);
+    if(r != LIBUSB_SUCCESS)
+    {
+        ERR("libusb_hotplug: %s", libusb_error_name(r));
+        libusb_exit(NULL);
+        return -1;
+    }
+
+    libusb_device **list;
+    ssize_t sz = libusb_get_device_list(NULL, &list);
+    if(sz < 0)
+    {
+        ERR("libusb_get_device_list: %s", libusb_error_name((int)sz));
+        libusb_exit(NULL);
+        return -1;
+    }
+
+    for(size_t i = 0; i < sz; ++i)
+    {
+        struct libusb_device_descriptor desc = {};
+        r = libusb_get_device_descriptor(list[i], &desc);
+        if(r != LIBUSB_SUCCESS)
+        {
+            ERR("libusb_get_device_descriptor: %s", libusb_error_name(r));
+            // continue anyway
+        }
+        if(desc.idVendor != PONGO_USB_VENDOR || desc.idProduct != PONGO_USB_PRODUCT)
+        {
+            libusb_unref_device(list[i]);
+            continue;
+        }
+        r = FoundDevice(NULL, list[i], LIBUSB_HOTPLUG_EVENT_DEVICE_ARRIVED, &stuff);
+        for(size_t j = i + 1; j < sz; ++j)
+        {
+            libusb_unref_device(list[j]);
+        }
+        if(r != LIBUSB_SUCCESS)
+        {
+            libusb_free_device_list(list, 0);
+            libusb_exit(NULL);
+            return -1;
+        }
+        break;
+    }
+    libusb_free_device_list(list, 0);
+
+    while(spin)
+    {
+        r = libusb_handle_events(NULL);
+        if(r != LIBUSB_SUCCESS)
+        {
+            ERR("libusb_handle_events: %s", libusb_error_name(r));
+            break;
+        }
+    }
+
+    libusb_exit(NULL);
+    return -1;
+}
+
+
+static void io_start(stuff_t *stuff)
+{
+    int r = pthread_create(&stuff->th, NULL, &pongo_usb_callback, &stuff->handle);
+    if(r != 0)
+    {
+        ERR("pthread_create: %s", strerror(r));
+        exit(-1); // TODO: ok with libusb?
+    }
+	pongo_usb_callback(&stuff->handle);
+}
+
+static void io_stop(stuff_t *stuff)
+{
+    LOG(LOG_VERBOSE, "PongoOS USB Device disconnected");
+    int r = pthread_cancel(stuff->th);
+    if(r != 0)
+    {
+        ERR("pthread_cancel: %s", strerror(r));
+        exit(-1); // TODO: ok with libusb?
+    }
+    r = pthread_join(stuff->th, NULL);
+    if(r != 0)
+    {
+        ERR("pthread_join: %s", strerror(r));
+        exit(-1); // TODO: ok with libusb?
+    }
+}