Update documentation

docs/palera1n.1

@@ -2,11 +2,11 @@
 .\" Copyright (c) 2024 Nick Chan
 .\" SPDX-License-Identifier: MIT
 .\"
-.Dd "23 March 2024"
+.Dd "30 March 2024"
 .Dt palera1n 1
 .Sh NAME
 .Nm palera1n
-.Nd iOS 15.0-17.4.1 arm64 iOS/iPadOS jailbreaking tool
+.Nd arm64 iOS/iPadOS/tvOS 15.0-17.4.1, bridgeOS 6.0-8.3 jailbreaking tool
 .Sh SYNOPSIS
 .Nm
 .Op Fl cCdDEfhIlLnpRsSvV
@@ -20,14 +20,19 @@
 .Op Fl -force-revert
 .Sh DESCRIPTION
 .Nm
-jailbreaks any iOS/iPadOS device with an arm64 (arm64e excluded) on iOS 15.0-17.4.1,
+jailbreaks an iOS/iPadOS/tvOS 15.0-17.4.1, bridgeOS 6.0-8.3 device with an arm64 (arm64e excluded) on iOS 15.0-17.4.1,
 utilizing the
 .Em checkm8
 bootROM exploit.
 .Pp
 .Nm
+provides rootful and rootless jailbreak modes.
+On iOS/iPadOS,
+.Nm
 is able to jailbreak the device in fakefs-rootful mode, where /
 is writable, as well as rootless mode, where / cannot be written to.
+On tvOS and bridgeOS,
+only rootful is supported, and it uses the actual filesystem instead of a fakefs.
 .Pp
 Due to the nature of the
 .Em checkm8
@@ -82,8 +87,34 @@ list of supported devicecs:
 .It iPod Touch (7th generation)
 .El
 
-Support for other arm64 Darwin devices, including Apple TV, HomePod and iBridge
-on Darwin 21 and above could be added, but they are currently unsupported.
+.Bl -tag -compact
+.It Apple TV HD
+.It Apple TV 4K (1st generation)
+.El
+
+.Bl -tag -compact
+.It Apple T2 iMacPro1,1
+.It Apple T2 MacBookPro15,1
+.It Apple T2 MacBookPro15,2
+.It Apple T2 Macmini8,1
+.It Apple T2 MacPro7,1
+.It Apple T2 MacBookPro15,3
+.It Apple T2 MacBookAir8,1
+.It Apple T2 MacBookPro15,4
+.It iBridge2,11 (Unknown Mac)
+.It Apple T2 MacBookAir8,2
+.It iBridge2,13 (Unknown Mac)
+.It Apple T2 MacBookPro16,1
+.It Apple T2 MacBookAir9,1
+.It Apple T2 MacBookPro16,2
+.It Apple T2 iMac20,1
+.It Apple T2 iMac20,2
+.It Apple T2 MacBookPro16,3
+.It Apple T2 MacBookPro16,4
+.El
+
+Support for the A8 HomePod on Darwin 21 and above could be added,
+but it is currently unsupported.
 
 arm64e devices will NEVER be supported.
 
@@ -93,7 +124,7 @@ arm64e devices will NEVER be supported.
 Prints the program version and exit.
 .It Fl -force-revert
 Remove the jailbreak while keeping user data. Some jailbreak files may remain
-after running this command. Additionally, jailbreak apps will remain on the 
+after running this command. Additionally, jailbreak apps may remain on the
 home screen on for a while even when the files are deleted as the icon cache
 still has their icons. When used with
 .Fl f , -fakefs ,
@@ -108,23 +139,16 @@ Like
 but the size of the created fakefs is smaller at the expense of having unwritable
 parts in rarely-written paths. When jailbreaking 16 GB devices, this option must be used
 when setting up fakefs for rootful, as they do not have enough storage for full fakefs.
-This option currently does not work on iOS 16.
+This flag is only supported on iOS/iPadOS.
 .It Fl c , -setup-fakefs
 When used with
 .Fl f , -fakefs ,
 creates the new APFS volume required for rootful. Will fail if one already exists.
+This flag is only supported on iOS/iPadOS.
 .It Fl C , -clean-fakefs
-This reverts the fakefs to the 
-.Em orig-fs
-snapshot that is created when the fakefs
-is first created, then the device will continue to boot jailbroken. This option 
-allows resetting the rootful environment without deleting the entire fakefs. 
-Note that this option will not work if the fakefs is created in an older version
-of palera1n that does not create the
-.Em orig-fs
-snapshot on the fakefs. This option will also remove some jailbreak files inside
-of /var. The files in /var will not be deleted when a userspace reboot is done
-with this flag set.
+This option is not currently supported and is a no-operation in this version of
+.Nm
+\[char46]
 .It Fl d , -demote
 Set the effective production fuse to 0, so as to enable hardware debugging features.
 .It Fl D , -dfuhelper
@@ -141,7 +165,8 @@ argument is used during fakefs setup.
 .It Fl E , -enter-recovery
 Exit after entering recovery mode.
 .It Fl f , -fakefs
-Proceed in rootful mode. This applies to both full fakefs and partial fakefs.
+Proceed in rootful mode. This applies to both full, partial fakefs, as well as realfs.
+This option is not supported on iOS/iPadOS 17.
 .It Fl h , -help
 Prints help text.
 .It Fl i , -checkra1n-file Ar checkra1n file
@@ -158,15 +183,11 @@ command. If in doubt, use
 .Sy https://github.com/palera1n/PongoOS
 iOS15 branch or your own fork of it.
 .It Fl l , -rootless
-Proceed in rootless mode, this is the default when neither
-.Fl l , -rootless
-and
-.Fl f , -fakefs
-is specified.
-.Fl L , -jbinit-log-to-file
-Makes jbinit log to
-.Em /cores/jbinit.log
-This file may be viewed from sandboxed applications while jailbroken.
+Proceed in rootless mode. This option is only supported on iOS/iPadOS.
+.It Fl L , -jbinit-log-to-file
+This option is not currently supported and is a no-operation in this version of
+.Nm
+\[char46]
 .It Fl n , -exit-recovery
 Exit recovery mode and exit.
 .It Fl o , -override-overlay Ar overlay file
@@ -185,15 +206,15 @@ Like
 .Fl p , -pongo-shell
 but default images and options have been uploaded and applied respectively.
 .It Fl r , -override-ramdisk Ar ramdisk file
-Override the ramdisk. At a very minimum, it should contain a
-.Em /sbin/launchd
+Override the ramdisk. At a very minimum, it should contain
+.Em /cores/ploosh
 as well as a fake dyld
 .Em /usr/lib/dyld
 where the logic is expected to be in.
 .It Fl R , -reboot-device
 Reboot device in normal mode and exit.
 .It Fl s , -safe-mode
-Enter safe mode. An alert will be displayed. Jailbreak daemons nor early boot executable files
+Enter safe mode. An alert will be displayed on iOS/iPadOS/tvOS. Jailbreak daemons nor early boot executable files
 specified (see
 .Sy FILES
 section below) will be executed. The loader app and the built in SSH server can still be used,
@@ -274,17 +295,31 @@ When using rootful mode, the
 .Fl f , -fakefs
 flag must be specified at all times. It does not matter whether you want to create fakefs,
 create partial fakefs, rejailbreak or remove jailbreak.
-.Sh POST INSTALLATION
+.Pp
+Due to a stock bug, using the
+.Fl V , -verbose-boot
+option might cause some versions for tvOS to crash and not boot.
+.Sh POST INSTALLATION (iOS/iPadOS)
 The palera1n loader app will take up to 30 seconds to appear on the homescreen after the
 device has booted. If it does not appear, you can try using the shortcut:
 .Pp
 .Lk https://www.icloud.com/shortcuts/8cd5f489c8854ee0ab9ee38f2e62f87d
 .Pp
-to open it. After opening the loader app, press install to install a bootstrap as well as
-the
-.Em Sileo
-package manager.
-You can install other package managers from settings of the loader app.
+to open it. After opening the loader app, select a package manager to install.
+This will also bootstrap your device.
+.Pp
+A built-in SSH server runs on port 44 on loopback interfaces.
+.Sh POST INSTALLATION (tvOS)
+.Pp
+The palera1n loader app will appear on homescreen. Open the loader and select a package manager to install.
+This will also bootstrap your device.
+.Pp
+A built-in SSH server runs on port 44 on all interfaces.
+.Sh POST INSTALLATION (bridgeOS)
+.Pp
+A built-in SSH server runs on port 22 on all interfaces.
+.Pp
+Bootstrapping is currently not supported on this device.
 .Sh FILES
 During the jailbreak process, a temporary filesystem is mounted on /cores as a place
 to stash jailbreak files needed during the boot process. No files are ever written
@@ -294,19 +329,10 @@ loader app to install additional jailbreak files.
 .Bl -tag -width "/var/jb/Library/LaunchDaemons"
 .It Pa /cores
 The location of the temporary filesystem where jailbreak files are stash during boot.
-.It Pa /cores/jbinit.log
-When
-.Fl L
-is used, the log file of jbinit.
-<<<<<<< HEAD
-The log file of jbinit.
-||||||| 52d20c8 (docs: do not mention options that does not appear in help menu)
-=======
 .It Pa /Library/LaunchDaemons
 The directory where jailbreak-specific
 .Xr launchd.plist 5
 property list files should be placed on rootful.
->>>>>>> parent of 52d20c8 (docs: do not mention options that does not appear in help menu)
 .It Pa /var/jb/Library/LaunchDaemons
 The directory where jailbreak-specific
 .Xr launchd.plist 5
@@ -328,14 +354,13 @@ may crash if the machine it is running on:
 .Pp
 The exploit may also work less reliably on some hosts, like AMD desktops, or some MediaTek devices.
 .Pp
-The device may randomly crash and reboot due to launchd exiting with code 7.
-.Sh NOTES
-.Nm
-injects a dylib into launchd to allow the
-.Sy launchctl runstats
-command to be used on the device.
+The device may randomly crash and reboot due to launchd using too much memory.
+.Pp
+The built-in SSH server might be not accessible with password after bootstrapping rootful,
+since the bootstrap uses a custom crypt() function that is not supported
+by the built-in SSH server.
 .Sh DEPRECATED AND REMOVED FUNCTIONALITY
-There was an option in 
+There was an option in
 .Nm
 to force create the fakefs even when one already exists (which would overwrite
 the existing fakefs), by setting the palerain_option_setup_rootful_forced flag
@@ -344,6 +369,10 @@ in palera1n flags. This option was removed because using
 and
 .Fl c
 at the same time has exactly the same effect.
+.Pp
+The hook that enabled
+.Sy launchctl runstats
+has been removed, since it leaks memory in launchd.
 .Sh SEE ALSO
 .Xr launchd 8
 .Xr launchd.plist 5