From b508c95779cd8bf7a6e4b57f44e0bd2db00d1207 Mon Sep 17 00:00:00 2001 From: Nebula Date: Sun, 18 Sep 2022 10:30:43 -0400 Subject: [PATCH] a9 fix and a10 devicetree fix --- .gitignore | 1 + README.md | 6 +++--- kerneldiff.py | 43 ------------------------------------------- palera1n.sh | 32 +++++++++++++++++++++++++------- 4 files changed, 29 insertions(+), 53 deletions(-) delete mode 100644 kerneldiff.py diff --git a/.gitignore b/.gitignore index d268977..2a6e35c 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ binaries/Darwin/gaster work boot .irecovery +BuildManifest.plist \ No newline at end of file diff --git a/README.md b/README.md index 6386399..1281f26 100644 --- a/README.md +++ b/README.md @@ -4,11 +4,11 @@ iOS 15.0-15.4.1 semi-tethered checkm8 "jailbreak" # What does this do? It boots the device with AMFI patches. Eventually, I want it to automatically install Pogo by Amy. For now, it has to be installed with TrollStore. You can get an IPA [here](https://nightly.link/elihwyma/Pogo/workflows/build/main/Pogo.zip). +**NOTE**: Linux and libimobiledevice don't play well together, and macOS is recommended for this script. If you only have access to a Linux machine, give it a try as it might still work. + **WARNING**: As of now, this is pretty unstable (atleast just on A11). On my A11 device, it has the deep sleep bug while booted with palera1n, and will kernel panic, or just not wake up until force rebooted, about a minute after being in sleep mode. -**WARNING 2**: ~~Some Linux users have their device freeze when it patches and converts the kernelcache. Since the file is so big, it seems like something with Linux isn't able to handle it. This shouldn't seem to be a fault with the script, but a fault with Linux/the patching tools.~~ This should be fixed. - -**WARNING 3**: I am NOT responsible for any data loss. While nothing should happen, jailbreaking has risks in itself. If your device is stuck in recovery, please run `futurerestore --exit-recovery`, or use irecovery. +**WARNING 2**: I am NOT responsible for any data loss. While nothing should happen, jailbreaking has risks in itself. If your device is stuck in recovery, please run `futurerestore --exit-recovery`, or use irecovery. # How to use 1. Install libimobiledevice diff --git a/kerneldiff.py b/kerneldiff.py deleted file mode 100644 index 467f1f7..0000000 --- a/kerneldiff.py +++ /dev/null @@ -1,43 +0,0 @@ -#!/usr/bin/env python3 - -import os -import sys - -if __name__ == "__main__": - args = sys.argv - if len(args) < 4: - print("Usage: kernelcache_raw kernelcache_patched kc.bpatch") - sys.exit(0) - - patched = args[2] - original = args[1] - sizeP = os.path.getsize(patched) - sizeO = os.path.getsize(original) - - if sizeP != sizeO: - print("size does not match, can't compare files! exiting...") - sys.exit(1) - - p = open(patched, "rb").read() - o = open(original, "rb").read() - - a = 0 - diff = [] - diffFile = open(args[3], 'w+') - diffFile.write('#AMFI\n\n') - for i in range(sizeO): - originalByte = o[i] - patchedByte = p[i] - if originalByte != patchedByte: - if a == 1e6: - for d in diff: - data = str(d[0]) + " " + (str(d[1])) + " " + (str(d[2])) - diffFile.write(data + '\n') - diff = [] - a = 0 - diff.append([hex(i), hex(originalByte), hex(patchedByte)]) - a += 1 - - for d in diff: - data = str(d[0]) + " " + (str(d[1])) + " " + (str(d[2])) - diffFile.write(data + '\n') diff --git a/palera1n.sh b/palera1n.sh index 7dc885e..84269d4 100755 --- a/palera1n.sh +++ b/palera1n.sh @@ -44,6 +44,13 @@ if [ ! -e $dir/gaster ]; then rm -rf gaster gaster-$os.zip fi +# Check for pyimg4 +if ! python3 -c 'import pkgutil; exit(not pkgutil.find_loader("pyimg4"))'; then + echo '[-] pyimg4 not installed. Press any key to install it, or press ctrl + c to cancel' + read -n 1 -s + python3 -m pip install pyimg4 > /dev/null +fi + # Re-create work dir if it exists, else, make it if [ -e work ]; then rm -rf work @@ -59,7 +66,6 @@ echo "Written by Nebula | Some code by Nathan | Patching commands and ramdisk by echo "" # Get device's iOS version from ideviceinfo if in normal mode -echo "[*] Getting device version..." if [ "$2" = '--dfu' ]; then if [ -z "$3" ]; then echo "[-] When using --dfu, please pass the version you're device is on" @@ -90,6 +96,12 @@ else done fi version=$(ideviceinfo | grep "ProductVersion: " | sed 's/ProductVersion: //') + arch=$(ideviceinfo | grep "CPUArchitecture: " | sed 's/CPUArchitecture: //') + if [ ! "$arch" = "arm64" ]; then + echo "[-] palera1n doesn't, and never will, work on non-checkm8 devices" + exit + fi + echo "Hello, $(ideviceinfo | grep "ProductType: " | sed 's/ProductType: //') on $version!" fi # Put device into recovery mode, and set auto-boot to true @@ -154,6 +166,7 @@ if [ ! "$2" = '--dfu' ]; then fi sleep 2 +echo "[*] Pwning device" $dir/gaster pwn > /dev/null sleep 1 @@ -175,13 +188,14 @@ if [ ! -e boot ]; then $dir/gaster decrypt "$(awk "/""$cpid""/{x=1}x&&/iBEC[.]/{print;exit}" BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]dfu[/]//')" iBEC.dec > /dev/null echo "[*] Downloading DeviceTree" - $dir/pzb -g "$(awk "/""$cpid""/{x=1}x&&/DeviceTree[.]/{print;exit}" BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1)" $ipswurl > /dev/null + #$dir/pzb -g "$(awk "/""$cpid""/{x=1}x&&/DeviceTree[.]/{print;exit}" BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1)" $ipswurl > /dev/null + $dir/pzb -g Firmware/all_flash/DeviceTree.$model.im4p $ipswurl > /dev/null echo "[*] Downloading trustcache" if [ "$os" = 'Darwin' ]; then - $dir/pzb -g "$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."StaticTrustCache"."Info"."Path" xml1 -o - BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1 | head -1)" $ipswurl > /dev/null + $dir/pzb -g "$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."StaticTrustCache"."Info"."Path" xml1 -o - BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1 | head -1)" $ipswurl > /dev/null else - $dir/pzb -g "$($dir/PlistBuddy BuildManifest.plist -c "Print BuildIdentities:0:Manifest:StaticTrustCache:Info:Path" | sed 's/"//g')" $ipswurl > /dev/null + $dir/pzb -g "$($dir/PlistBuddy BuildManifest.plist -c "Print BuildIdentities:0:Manifest:StaticTrustCache:Info:Path" | sed 's/"//g')" $ipswurl > /dev/null fi #if [[ "$@" == *"install"* ]]; then @@ -210,10 +224,14 @@ if [ ! -e boot ]; then #fi echo "[*] Patching and converting kernelcache" - $dir/img4 -i work/"$(awk "/""$model""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1)" -o work/kcache.raw > /dev/null + #$dir/img4 -i work/"$(awk "/""$model""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1)" -o work/kcache.raw > /dev/null + #$dir/Kernel64Patcher work/kcache.raw work/kcache.patched -a -o > /dev/null + #python3 kerneldiff.py work/kcache.raw work/kcache.patched work/kc.bpatch > /dev/null + #$dir/img4 -i work/"$(awk "/""$model""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1)" -o boot/kernelcache.img4 -M work/IM4M -T rkrn -P work/kc.bpatch `if [ "$os" = 'Linux' ]; then echo "-J"; fi` > /dev/null + python3 -m pyimg4 im4p extract -i work/"$(awk "/""$model""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1)" -o work/kcache.raw `if [ "$deviceid" == *'iPhone8'* ]; then echo "--extra kpp.bin"; fi` > /dev/null $dir/Kernel64Patcher work/kcache.raw work/kcache.patched -a -o > /dev/null - python3 kerneldiff.py work/kcache.raw work/kcache.patched work/kc.bpatch > /dev/null - $dir/img4 -i work/"$(awk "/""$model""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1)" -o boot/kernelcache.img4 -M work/IM4M -T rkrn -P work/kc.bpatch `if [ "$os" = 'Linux' ]; then echo "-J"; fi` > /dev/null + python3 -m pyimg4 im4p create -i work/kcache.patched -o work/krnlboot.im4p `if [ "$deviceid" == *'iPhone8'* ]; then echo "--extra kpp.bin"; fi` -f rkrn --lzss > /dev/null + python3 -m pyimg4 img4 create -p work/krnlboot.im4p -o boot/kernelcache.img4 -m work/IM4M > /dev/null echo "[*] Converting DeviceTree" $dir/img4 -i work/"$(awk "/""$model""/{x=1}x&&/DeviceTree[.]/{print;exit}" work/BuildManifest.plist | grep '' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]all_flash[/]//')" -o boot/devicetree.img4 -M work/IM4M -T rdtr > /dev/null