mirror of
https://github.com/palera1n/palera1n.git
synced 2026-10-21 09:47:01 +02:00
5 files changed
+1014
No files matched your search
@@ -3,6 +3,7 @@ dist/
|
||||
.DS_Store
|
||||
|
||||
gen/
|
||||
docs/*.html
|
||||
embedded/Pongo.bin
|
||||
embedded/checkra1n-kpf-pongo
|
||||
embedded/ramdisk.dmg
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
PAGES = palera1n.1.html p1ctl.8.html
|
||||
|
||||
all: $(PAGES)
|
||||
|
||||
%.html: %
|
||||
mandoc -T html -O style=mandoc.css $< > $@
|
||||
|
||||
clean:
|
||||
rm -f $(PAGES)
|
||||
+269
@@ -0,0 +1,269 @@
|
||||
/* $OpenBSD: mandoc.css,v 1.35 2021/03/30 19:23:50 schwarze Exp $ */
|
||||
/*
|
||||
* Standard style sheet for mandoc(1) -Thtml and man.cgi(8).
|
||||
*
|
||||
* Written by Ingo Schwarze <[email protected]>.
|
||||
* I place this file into the public domain.
|
||||
* Permission to use, copy, modify, and distribute it for any purpose
|
||||
* with or without fee is hereby granted, without any conditions.
|
||||
*/
|
||||
|
||||
/* Global defaults. */
|
||||
|
||||
html {
|
||||
--bg: #FFFFFF;
|
||||
--fg: #000000; }
|
||||
body { background: var(--bg);
|
||||
color: var(--fg);
|
||||
font-family: monospace,Helvetica,Arial,sans-serif;
|
||||
max-width: 80ch;
|
||||
margin: 1em auto;
|
||||
padding: 0 1ch;
|
||||
}
|
||||
h1 { font-size: 110%; }
|
||||
table { margin-top: 0em;
|
||||
margin-bottom: 0em;
|
||||
border-collapse: collapse; }
|
||||
/* Some browsers set border-color in a browser style for tbody,
|
||||
* but not for table, resulting in inconsistent border styling. */
|
||||
tbody { border-color: inherit; }
|
||||
tr { border-color: inherit; }
|
||||
td { vertical-align: top;
|
||||
padding-left: 0.2em;
|
||||
padding-right: 0.2em;
|
||||
border-color: inherit; }
|
||||
ul, ol, dl { margin-top: 0em;
|
||||
margin-bottom: 0em; }
|
||||
li, dt { margin-top: 1em; }
|
||||
pre { font-family: inherit; }
|
||||
|
||||
.permalink { border-bottom: thin dotted;
|
||||
color: inherit;
|
||||
font: inherit;
|
||||
text-decoration: inherit; }
|
||||
* { clear: both }
|
||||
|
||||
/* Search form and search results. */
|
||||
|
||||
form {
|
||||
position: sticky;
|
||||
top: 0px;
|
||||
background-color: var(--bg);
|
||||
z-index: 1;
|
||||
}
|
||||
|
||||
fieldset { border: thin solid silver;
|
||||
border-radius: 0.3em;
|
||||
text-align: center; }
|
||||
input[name=expr] {
|
||||
width: 25%; }
|
||||
|
||||
table.results { margin-top: 1em;
|
||||
margin-left: 2em;
|
||||
font-size: smaller; }
|
||||
|
||||
/* Header and footer lines. */
|
||||
|
||||
table.head { width: 100%;
|
||||
border-bottom: 1px dotted #808080;
|
||||
margin-bottom: 1em;
|
||||
font-size: smaller;
|
||||
overflow-wrap: anywhere; }
|
||||
td.head-vol { text-align: center; }
|
||||
td.head-rtitle {
|
||||
text-align: right; }
|
||||
|
||||
table.foot { width: 100%;
|
||||
border-top: 1px dotted #808080;
|
||||
margin-top: 1em;
|
||||
font-size: smaller;
|
||||
overflow-wrap: anywhere; }
|
||||
td.foot-os { text-align: right; }
|
||||
|
||||
table.Nm {
|
||||
overflow-wrap:anywhere;
|
||||
}
|
||||
|
||||
/* Sections and paragraphs. */
|
||||
|
||||
.manual-text {
|
||||
margin-left: 3.8em; }
|
||||
h1.Sh { margin-top: 1.2em;
|
||||
margin-bottom: 0.6em;
|
||||
margin-left: -3.2em; }
|
||||
h2.Ss { margin-top: 1.2em;
|
||||
margin-bottom: 0.6em;
|
||||
margin-left: -1.2em;
|
||||
font-size: 105%; }
|
||||
.Pp { margin: 0.6em 0em; }
|
||||
|
||||
/* Displays and lists. */
|
||||
|
||||
.Bd-indent { margin-left: 3.8em; }
|
||||
|
||||
.Bl-bullet { list-style-type: disc;
|
||||
padding-left: 1em; }
|
||||
.Bl-dash { list-style-type: none;
|
||||
padding-left: 0em; }
|
||||
.Bl-dash > li:before {
|
||||
content: "\2014 "; }
|
||||
.Bl-item { list-style-type: none;
|
||||
padding-left: 0em; }
|
||||
.Bl-compact > li {
|
||||
margin-top: 0em; }
|
||||
|
||||
.Bl-enum { padding-left: 2em; }
|
||||
.Bl-compact > li {
|
||||
margin-top: 0em; }
|
||||
|
||||
.Bl-diag > dt {
|
||||
font-style: normal;
|
||||
font-weight: bold; }
|
||||
.Bl-diag > dd {
|
||||
margin-left: 0em; }
|
||||
.Bl-hang > dd {
|
||||
margin-left: 5.5em; }
|
||||
.Bl-inset > dd {
|
||||
margin-left: 0em; }
|
||||
.Bl-ohang > dd {
|
||||
margin-left: 0em; }
|
||||
.Bl-tag { margin-top: 0.6em;
|
||||
margin-left: 5.5em; }
|
||||
.Bl-tag > dt {
|
||||
float: left;
|
||||
margin-top: 0em;
|
||||
margin-left: -5.5em;
|
||||
padding-right: 0.5em;
|
||||
vertical-align: top; }
|
||||
.Bl-tag > dd {
|
||||
clear: right;
|
||||
column-count: 1; /* Force block formatting context. */
|
||||
width: 100%;
|
||||
margin-top: 0em;
|
||||
margin-left: 0em;
|
||||
margin-bottom: 0.6em;
|
||||
vertical-align: top; }
|
||||
.Bl-compact { margin-top: 0em; }
|
||||
.Bl-compact > dd {
|
||||
margin-bottom: 0em; }
|
||||
.Bl-compact > dt {
|
||||
margin-top: 0em; }
|
||||
|
||||
.Bl-column > tbody > tr > td {
|
||||
margin-top: 1em; }
|
||||
.Bl-compact > tbody > tr > td {
|
||||
margin-top: 0em; }
|
||||
|
||||
.Rs { font-style: normal;
|
||||
font-weight: normal; }
|
||||
.RsB { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.RsI { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.RsJ { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.RsT { text-decoration: underline; }
|
||||
|
||||
.tbl td { vertical-align: middle; }
|
||||
|
||||
.HP { margin-left: 3.8em;
|
||||
text-indent: -3.8em; }
|
||||
|
||||
/* Semantic markup for command line utilities. */
|
||||
|
||||
code.Nm { font-style: normal;
|
||||
font-weight: bold;
|
||||
font-family: inherit;
|
||||
overflow-wrap: normal; }
|
||||
.Fl { font-style: normal;
|
||||
font-weight: bold;
|
||||
font-family: inherit; }
|
||||
.Cm { font-style: normal;
|
||||
font-weight: bold;
|
||||
font-family: inherit; }
|
||||
.Ar { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.Op { display: inline; }
|
||||
.Ic { font-style: normal;
|
||||
font-weight: bold;
|
||||
font-family: inherit; }
|
||||
.Ev { font-style: normal;
|
||||
font-weight: normal;
|
||||
font-family: monospace; }
|
||||
.Pa { font-style: italic;
|
||||
font-weight: normal; }
|
||||
|
||||
/* Semantic markup for function libraries. */
|
||||
|
||||
code.In { font-style: normal;
|
||||
font-weight: bold;
|
||||
font-family: inherit; }
|
||||
.Fd { font-style: normal;
|
||||
font-weight: bold;
|
||||
font-family: inherit; }
|
||||
.Ft { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.Fn { font-style: normal;
|
||||
font-weight: bold;
|
||||
font-family: inherit; }
|
||||
.Fa { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.Vt { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.Va { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.Dv { font-style: normal;
|
||||
font-weight: normal;
|
||||
font-family: monospace; }
|
||||
.Er { font-style: normal;
|
||||
font-weight: normal;
|
||||
font-family: monospace; }
|
||||
|
||||
/* Various semantic markup. */
|
||||
|
||||
.Cd { font-style: normal;
|
||||
font-weight: bold;
|
||||
font-family: inherit; }
|
||||
.Ad { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.Ms { font-style: normal;
|
||||
font-weight: bold; }
|
||||
|
||||
/* Physical markup. */
|
||||
|
||||
.Bf { display: inline; }
|
||||
.No { font-style: normal;
|
||||
font-weight: normal; }
|
||||
.Em { font-style: italic;
|
||||
font-weight: normal; }
|
||||
.Sy { font-style: normal;
|
||||
font-weight: bold; }
|
||||
.Li { font-style: normal;
|
||||
font-weight: normal;
|
||||
font-family: monospace; }
|
||||
|
||||
/* Overrides to avoid excessive margins on small devices. */
|
||||
|
||||
@media (max-width: 37.5em) {
|
||||
.manual-text {
|
||||
margin-left: 0.5em; }
|
||||
h1.Sh, h2.Ss { margin-left: 0em; }
|
||||
.Bd-indent { margin-left: 2em; }
|
||||
.Bl-hang > dd {
|
||||
margin-left: 2em; }
|
||||
.Bl-tag { margin-left: 2em; }
|
||||
.Bl-tag > dt {
|
||||
margin-left: -2em; }
|
||||
.HP { margin-left: 2em;
|
||||
text-indent: -2em; }
|
||||
}
|
||||
|
||||
/* Overrides for a dark color scheme for accessibility. */
|
||||
|
||||
@media (prefers-color-scheme: dark) {
|
||||
html { --bg: #000000;
|
||||
--fg: #FFFFFF; }
|
||||
:link { color: #BAD7FF; }
|
||||
:visited { color: #BAD7FF; }
|
||||
}
|
||||
|
||||
+109
@@ -0,0 +1,109 @@
|
||||
.\"-
|
||||
.\" Copyright (c.Xc 2024 Nick Chan
|
||||
.\" SPDX-License-Identifier: MIT
|
||||
.\"
|
||||
.Dd "6 April 2024"
|
||||
.Dt p1ctl 8
|
||||
.Sh NAME
|
||||
.Nm p1ctl
|
||||
.Nd command-line access to palera1n loader
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Ar subcommand
|
||||
.Op subcommand options
|
||||
.Op subcommand arguments
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
provide a command-line interface to the graphical palera1n loader.
|
||||
.Pp
|
||||
.Nm
|
||||
interfaces with the palera1n daemon as well as palera1n's launchd hook.
|
||||
|
||||
.Sh SUBCOMMANDS
|
||||
.Bl -tag -width -indent
|
||||
.It Xo Ar bootstrap Op Fl s
|
||||
.Op Fl S Ar password
|
||||
.Ar bootstrap-file
|
||||
.Xc
|
||||
Deploy a bootstrap from a zstd compressed tarball. With no additional options specified,
|
||||
a new password for the mobile user will be prompted for. The bootstrap you are deploying
|
||||
must match the jailbreak type (rootful or rootless) you are using.
|
||||
.Bl -tag -width -indent
|
||||
.It Fl s
|
||||
Do not prompt for the password and do not set the mobile password.
|
||||
.It Fl S Ar password
|
||||
Do not prompt and set the mobile password to the password specified.
|
||||
.El
|
||||
.Pp
|
||||
.Em NOTE:
|
||||
Unlike the graphical palera1n loader, this command only deploys the bootstrap itself,
|
||||
it does not add additional repositories nor install additional packages.
|
||||
.It Xo Ar exitsafe
|
||||
.Xc
|
||||
Exit
|
||||
.Nm palera1n
|
||||
safe mode, and trigger a userspace reboot. This command will succeed
|
||||
even if the device is not currently in safe mode. In this case, a userspace reboot
|
||||
is still triggered.
|
||||
.Pp
|
||||
.Em NOTE:
|
||||
Many tweak injection packages also provide their own safe mode, p1ctl does not
|
||||
recognize and cannot control those safe modes.
|
||||
.It Xo Ar help Op Ar subcommand
|
||||
.Xc
|
||||
Prints help text. If
|
||||
.Ar subcommand
|
||||
is specified, print help about the subcommand.
|
||||
.It Xo Ar kbase
|
||||
.Xc
|
||||
Print a hexadecimal representation of the kernel base.
|
||||
.It Xo Ar kslide
|
||||
.Xc
|
||||
Print a hexadecimal representation of the kernel slide.
|
||||
.It Xo Ar palera1n_flags
|
||||
.Xc
|
||||
Print a representation of the palera1n flags, which corresponds to the options passed
|
||||
to
|
||||
.Xr palera1n 1
|
||||
as well as hints to the palera1n userspace stack set by
|
||||
.Nm PongoOS
|
||||
\[char46]
|
||||
By default, a hexadecimal representation of the flags will be printed.
|
||||
.Bl -tag -width -indent
|
||||
.It Fl d
|
||||
Read the flags from the ramdisk block device instead of getting them by interfacing with palera1n daemon.
|
||||
.It Fl s
|
||||
Print a string representation of the flags. Each line will contain one flag, and the strings always start
|
||||
with palerain_option_, and unknown flags are represented as palerain_option_undefined.
|
||||
.El
|
||||
.It Xo Ar reboot-userspace
|
||||
.Xc
|
||||
Unmount /Developer if mounted and then reboot the userspace.
|
||||
This command exists because the /Developer mount will be broken
|
||||
after a plain userspace reboot, which breaks debugging in Xcode.
|
||||
.Nm palera1n
|
||||
also hooks the
|
||||
.Xr reboot3 3
|
||||
call so that rebooting userspace using
|
||||
.Xr launchctl 1
|
||||
does not break the /Developer mount.
|
||||
.It Xo Ar reload
|
||||
.Xc
|
||||
Causes the
|
||||
.Nm palera1n
|
||||
launchd hook to re-probe the environment and update its internal state.
|
||||
This will affect the internal environmental variables passed onto new processes,
|
||||
and is typically used after bootstrapping or reverting installs.
|
||||
.It Xo Ar revert-install
|
||||
.Xc
|
||||
Remove jailbreak files from the device. This command is not supported on rootful with fakefs. On rootful with realfs, the device will reboot after issuing this command.
|
||||
.Pp
|
||||
To remove jailbreak files on rootful with fakefs, use
|
||||
.Xr palera1n 1
|
||||
on your computer with the
|
||||
.Fl -force-revert
|
||||
.Fl f
|
||||
options instead.
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr palera1n 1
|
||||
+626
@@ -0,0 +1,626 @@
|
||||
.\"-
|
||||
.\" Copyright (c) 2026 Nick Chan
|
||||
.\" SPDX-License-Identifier: MIT
|
||||
.\"
|
||||
.Dd "23 December 2024"
|
||||
.Dt palera1n 1
|
||||
.Sh NAME
|
||||
.Nm palera1n
|
||||
.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Op Fl hvlfcBsTVpednq
|
||||
.Op Fl e Ar Boot arguments
|
||||
.Op Fl k Ar Pongo image
|
||||
.Op Fl o Ar overlay file
|
||||
.Op Fl r Ar ramdisk file
|
||||
.Op Fl K Ar KPF file
|
||||
.Op Fl -cli
|
||||
.Op Fl -gui
|
||||
.Op Fl -tui
|
||||
.Op Fl -force-revert
|
||||
.Op Fl -dark-blockchain
|
||||
.Op Fl -force-enable-ssv
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device,
|
||||
utilizing the
|
||||
.Em checkm8
|
||||
bootROM exploit.
|
||||
.Pp
|
||||
.Nm
|
||||
provides rootful and rootless jailbreak modes.
|
||||
On iOS/iPadOS 15.0 and later,
|
||||
.Nm
|
||||
is able to jailbreak the device in fakefs-rootful mode, where /
|
||||
is writable, as well as rootless mode, where / cannot be written to.
|
||||
On tvOS and bridgeOS,
|
||||
only rootful is supported. On versions where fakefs-rootful is not
|
||||
applicable, palera1n modifies the actual root filesystem instead
|
||||
of making a fakefs.
|
||||
.Pp
|
||||
Due to the nature of the
|
||||
.Em checkm8
|
||||
exploit,
|
||||
.Nm
|
||||
is semi-tethered. That is, you must run the
|
||||
.Nm
|
||||
tool after the device reboot in order to enter the jailbroken state.
|
||||
However, it is not required for the device to boot.
|
||||
.Pp
|
||||
On A11 devices, that is, iPhone 8, iPhone 8 Plus and iPhone X, the passcode cannot
|
||||
be used.
|
||||
.Pp
|
||||
On iOS 15, the passcode must be off while jailbroken.
|
||||
.Pp
|
||||
On iOS 16, the passcode must be off since restore, and
|
||||
.Sy Reset All Contents and Settings
|
||||
from settings app counts as a restore.
|
||||
A backup may be used in this case.
|
||||
.Pp
|
||||
In the remainder of this document, the term "iOS" and "iPadOS" will be used interchangably
|
||||
as the difference is negligible as far as the jailbreak is concerened.
|
||||
.Pp
|
||||
.Sh SUPPORTED DEVICES
|
||||
As described above, arm64 iOS 15.0-26.0 devices are supported, here is an explicit
|
||||
list of supported devicecs:
|
||||
|
||||
.Bl -tag -compact
|
||||
.It iPhone 6s
|
||||
.It iPhone 6s Plus
|
||||
.It iPhone SE (2016)
|
||||
.It iPhone 7
|
||||
.It iPhone 7 Plus
|
||||
.It iPhone 8
|
||||
.It iPhone 8 Plus
|
||||
.It iPhone X
|
||||
.El
|
||||
|
||||
.Bl -tag -compact
|
||||
.It iPad mini 4
|
||||
.It iPad Air 2
|
||||
.It iPad (5th generation)
|
||||
.It iPad (6th generation)
|
||||
.It iPad (7th generation)
|
||||
.It iPad Pro (9.7")
|
||||
.It iPad Pro (12.9") (1st generation)
|
||||
.It iPad Pro (10.5")
|
||||
.It iPad Pro (12.9") (2nd generation)
|
||||
.El
|
||||
|
||||
.Bl -tag -compact
|
||||
.It iPod Touch (7th generation)
|
||||
.El
|
||||
|
||||
.Bl -tag -compact
|
||||
.It Apple TV HD
|
||||
.It Apple TV 4K (1st generation)
|
||||
.El
|
||||
|
||||
.Bl -tag -compact
|
||||
.It Apple T2 iMacPro1,1
|
||||
.It Apple T2 MacBookPro15,1
|
||||
.It Apple T2 MacBookPro15,2
|
||||
.It Apple T2 Macmini8,1
|
||||
.It Apple T2 MacPro7,1
|
||||
.It Apple T2 MacBookPro15,3
|
||||
.It Apple T2 MacBookAir8,1
|
||||
.It Apple T2 MacBookPro15,4
|
||||
.It Apple T2 MacBookAir8,2
|
||||
.It Apple T2 MacBookPro16,1
|
||||
.It Apple T2 MacBookAir9,1
|
||||
.It Apple T2 MacBookPro16,2
|
||||
.It Apple T2 iMac20,1
|
||||
.It Apple T2 iMac20,2
|
||||
.It Apple T2 MacBookPro16,3
|
||||
.It Apple T2 MacBookPro16,4
|
||||
.El
|
||||
|
||||
Support for the A8 HomePod on Darwin 21 and above could be added,
|
||||
but it is currently unsupported.
|
||||
|
||||
arm64e devices will NEVER be supported.
|
||||
|
||||
|
||||
|
||||
.Sh OPTIONS
|
||||
.Bl -tag -width -indent
|
||||
|
||||
|
||||
|
||||
.It Fl h , -help
|
||||
Prints usage information.
|
||||
|
||||
.It Fl v , -version
|
||||
Prints the program version and exit.
|
||||
|
||||
.It Fl -cli
|
||||
Run in command line interface mode.
|
||||
|
||||
.It Fl -gui
|
||||
Run in graphical user interface mode.
|
||||
.Pp
|
||||
This argument is available only in builds compiled with
|
||||
.Cm WITH_GUI
|
||||
support enabled.
|
||||
|
||||
.It Fl -tui
|
||||
Run in text user interface mode.
|
||||
.Pp
|
||||
This argument is available only in builds compiled with
|
||||
.Cm WITH_TUI
|
||||
support enabled.
|
||||
|
||||
.It Fl -dark-blockchain
|
||||
Runs the jailbreak in hacker mode.
|
||||
|
||||
.It Fl -force-revert
|
||||
Remove the jailbreak while keeping user data. Some jailbreak files may remain
|
||||
after running this command. Additionally, jailbreak apps may remain on the
|
||||
home screen on for a while even when the files are deleted as the icon cache
|
||||
still has their icons. When used with
|
||||
|
||||
.It Fl -force-enable-ssv
|
||||
Force the jailbreak to detect Signed System Volume (SSV) as being required on
|
||||
the system. This option provides compatibility with previous version of palera1n
|
||||
that incorrectly detect SSV as being required on tvOS 18.2 and above. When using
|
||||
this option with
|
||||
.Fl f , -fakefs ,
|
||||
the jailbreak will behave as if fakefs is required, which allows the user to boot
|
||||
into fakefs possibly created by previous versions of palera1n, or remove it if
|
||||
the
|
||||
.Fl -force-revert
|
||||
option is specified as well.
|
||||
(It is technically possible to setup fakefs using this option as well, but this
|
||||
is not a supported scenario)
|
||||
|
||||
.Fl f , -rootful ,
|
||||
this will actually boot the device in rootless mode then delete the jailbreak
|
||||
files. As a result, using the loader app to install the jailbreak environment
|
||||
is not supported when this option is used together with
|
||||
.Fl f , -rootful
|
||||
\[char46]
|
||||
|
||||
.It Fl l , -rootless
|
||||
Proceed in rootless mode. This option is only supported on iOS/iPadOS.
|
||||
|
||||
.It Fl f , -rootful
|
||||
Proceed in rootful mode. Despite its name, this applies to both full, partial fakefs, as well as realfs, and it still applies even when trying to force revert.
|
||||
|
||||
.It Fl c , -setup-fakefs
|
||||
When used with
|
||||
.Fl f , -rootful ,
|
||||
creates the new APFS volume required for rootful. Will fail if one already exists.
|
||||
This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they
|
||||
require fakefs for rootful.
|
||||
|
||||
.It Fl B , -setup-fakefs-partial
|
||||
Like
|
||||
.Fl c , -setup-fakefs
|
||||
but the size of the created fakefs is smaller at the expense of having unwritable
|
||||
parts in rarely-written paths. When jailbreaking 16 GB devices, this option must be used
|
||||
when setting up fakefs for rootful, as they do not have enough storage for full fakefs.
|
||||
This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they
|
||||
require fakefs for rootful.
|
||||
|
||||
.It Fl s , -safe-mode
|
||||
Enter safe mode. An alert will be displayed on iOS/iPadOS/tvOS. Jailbreak daemons nor early boot executable files
|
||||
specified (see
|
||||
.Sy FILES
|
||||
section below) will be executed. The loader app and the built in SSH server can still be used,
|
||||
as well as any jailbreak-specific apps you have installed.
|
||||
|
||||
.It Fl T , -telnetd
|
||||
Enable the TELNET daemon on port 46, all interfaces. Please note that there is no authentication and is therefore insecure.
|
||||
|
||||
.It Fl V , -verbose-boot
|
||||
Boots the device in verbose mode, allowing boot logs to be seen.
|
||||
|
||||
.It Fl p , -early-exit
|
||||
Exit after booting into a clean PongoOS shell.
|
||||
|
||||
.It Fl e , -extra-bootargs Ar boot arguments
|
||||
Specify custom XNU kernel command line. Additionally, the
|
||||
.Em wdt=-1
|
||||
argument is used during fakefs setup.
|
||||
|
||||
.It Fl k , -override-pongo Ar pongo file
|
||||
Override PongoOS image. The raw image, named
|
||||
.Em Pongo.bin
|
||||
when built, should be used. PongoOS 2.6.0 or later is required.
|
||||
|
||||
.It Fl K , -override-kpf Ar KPF file
|
||||
Override the kernel patchfinder PongoOS module. The module is required to support setting
|
||||
root filesystem in paleinfo with
|
||||
.Em rootfs
|
||||
command. If in doubt, use
|
||||
.Sy https://github.com/palera1n/PongoOS
|
||||
iOS15 branch or your own fork of it.
|
||||
|
||||
.It Fl o , -override-overlay Ar overlay file
|
||||
Specify the path to a custom overlay file, which is then mounted onto /cores/binpack
|
||||
during boot, if the default ramdisk is used. The default ramdisk expects the overlay
|
||||
to contain a folder named
|
||||
.Em Applications
|
||||
at the root of it, as well as a dmg named
|
||||
.Em loader.dmg
|
||||
at the root of it. Otherwise, the device will not boot. It is also expected that it
|
||||
contains a shell, a ssh server, and various command line utilities.
|
||||
|
||||
.It Fl r , -override-ramdisk Ar ramdisk file
|
||||
Override the ramdisk. At a very minimum, it should contain
|
||||
.Em /cores/ploosh
|
||||
as well as a fake dyld
|
||||
.Em /usr/lib/dyld
|
||||
where the logic is expected to be in.
|
||||
|
||||
.It Fl d , -debug-logging
|
||||
Enable debug logging. Supports up to 5 levels of verbosity, with 5 being the most verbose.
|
||||
|
||||
.It Fl n , -no-colors
|
||||
Disable colors on the command line.
|
||||
|
||||
.It Fl q , -quick
|
||||
When used with
|
||||
.Fl -tui ,
|
||||
or
|
||||
.Fl -gui ,
|
||||
the interfaces will automate the process of entering DFU mode, without needing to press the interface buttons for every step of the process.
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_GUI
|
||||
or
|
||||
.Cm WITH_TUI
|
||||
support enabled.
|
||||
|
||||
|
||||
.El
|
||||
.Sh ENVIRONMENTAL VARIABLES
|
||||
.Bl -tag -width -indent
|
||||
|
||||
|
||||
|
||||
.It Ev RA1N_ABORT_TIMEOUT
|
||||
Set a custom timeout value (0 to 999999999) for the exploit abort timer.
|
||||
While the default value is sufficient for standard platforms (Intel or Apple Silicon),
|
||||
this variable allows timing adjustments on specific environments such as Linux (AMD)
|
||||
or Raspberry Pi (ARM64), where the exploit may fail due to platform-specific USB
|
||||
stack behavior.
|
||||
.Pp
|
||||
E.g. Raspberry Pi 5:
|
||||
.Em RA1N_ABORT_TIMEOUT=1000000
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_CIDERRAIN
|
||||
support enabled.
|
||||
|
||||
.It Ev RA1N_CLI
|
||||
Equivalent to using the
|
||||
.Fl -cli
|
||||
option.
|
||||
|
||||
.It Ev RA1N_GUI
|
||||
Equivalent to using the
|
||||
.Fl -gui
|
||||
option.
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_GUI
|
||||
support enabled.
|
||||
|
||||
.It Ev RA1N_TUI
|
||||
Equivalent to using the
|
||||
.Fl -tui
|
||||
option.
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_TUI
|
||||
support enabled.
|
||||
|
||||
.It Ev RA1N_DARK_BLOCKCHAIN
|
||||
Equivalent to using the
|
||||
.Fl -dark-blockchain
|
||||
option.
|
||||
|
||||
.It Ev RA1N_FORCE_REVERT
|
||||
Equivalent to using the
|
||||
.Fl -force-revert
|
||||
option.
|
||||
|
||||
.It Ev RA1N_FORCE_ENABLE_SSV
|
||||
Equivalent to using the
|
||||
.Fl -force-enable-ssv
|
||||
option.
|
||||
|
||||
.It Ev RA1N_ROOTLESS
|
||||
Equivalent to using the
|
||||
.Fl l , -rootless
|
||||
option.
|
||||
|
||||
.It Ev RA1N_ROOTFUL
|
||||
Equivalent to using the
|
||||
.Fl f , -rootful
|
||||
option.
|
||||
|
||||
|
||||
.It Ev RA1N_SETUP_FAKEFS
|
||||
Equivalent to using the
|
||||
.Fl c , -setup-fakefs
|
||||
option.
|
||||
|
||||
.It Ev RA1N_SETUP_FAKEFS_PARTIAL
|
||||
Equivalent to using the
|
||||
.Fl B , -setup-fakefs-partial
|
||||
option.
|
||||
|
||||
.It Ev RA1N_SAFE_MODE
|
||||
Equivalent to using the
|
||||
.Fl s , -safe-mode
|
||||
option.
|
||||
|
||||
.It Ev RA1N_TELNETD
|
||||
Equivalent to using the
|
||||
.Fl T , -telnetd
|
||||
option.
|
||||
|
||||
.It Ev RA1N_VERBOSE_BOOT
|
||||
Equivalent to using the
|
||||
.Fl V , -verbose-boot
|
||||
option.
|
||||
|
||||
.It Ev RA1N_EARLY_EXIT
|
||||
Equivalent to using the
|
||||
.Fl p , -early-exit
|
||||
option.
|
||||
|
||||
.It Ev RA1N_EXTRA_BOOTARGS
|
||||
Equivalent to using the
|
||||
.Fl e , -extra-bootargs
|
||||
option.
|
||||
|
||||
.It Ev RA1N_OVERRIDE_PONGO
|
||||
Equivalent to using the
|
||||
.Fl k , -override-pongo
|
||||
option.
|
||||
|
||||
.It Ev RA1N_OVERRIDE_KPF
|
||||
Equivalent to using the
|
||||
.Fl K , -override-kpf
|
||||
option.
|
||||
|
||||
.It Ev RA1N_OVERRIDE_OVERLAY
|
||||
Equivalent to using the
|
||||
.Fl o , -override-overlay
|
||||
option.
|
||||
|
||||
.It Ev RA1N_OVERRIDE_RAMDISK
|
||||
Equivalent to using the
|
||||
.Fl r , -override-ramdisk
|
||||
option.
|
||||
|
||||
.It Ev RA1N_DEBUG_LOGGING
|
||||
Equivalent to using the
|
||||
.Fl d , -debug-logging
|
||||
option. Supports up to 5 levels of verbosity, with 5 being the most verbose.
|
||||
e.g. to enable level 3 debug logging, use
|
||||
.Em RA1N_DEBUG_LOGGING=3
|
||||
|
||||
.It Ev RA1N_NO_COLORS
|
||||
Equivalent to using the
|
||||
.Fl n , -no-colors
|
||||
option.
|
||||
|
||||
.It Ev RA1N_QUICK
|
||||
Equivalent to using the
|
||||
.Fl q , -quick
|
||||
option.
|
||||
.Pp
|
||||
This variable is available only in builds compiled with
|
||||
.Cm WITH_GUI
|
||||
or
|
||||
.Cm WITH_TUI
|
||||
support enabled.
|
||||
|
||||
|
||||
.El
|
||||
.Sh EXAMPLES
|
||||
|
||||
|
||||
|
||||
To (re-)jailbreak in rootless mode:
|
||||
.Pp
|
||||
.Dl "palera1n -l"
|
||||
.Pp
|
||||
|
||||
To setup fakefs for rootful mode:
|
||||
.Pp
|
||||
.Dl "palera1n -fc"
|
||||
.Pp
|
||||
After the device has rebooted into recovery mode, follow the following example.
|
||||
.Pp
|
||||
|
||||
To re-jailbreak in rootful mode:
|
||||
.Pp
|
||||
.Dl "palera1n -f"
|
||||
.Pp
|
||||
|
||||
To remove the jailbreak in rootful mode:
|
||||
.Pp
|
||||
.Dl "palera1n --force-revert -f"
|
||||
.Pp
|
||||
|
||||
To remove the jailbreak in rootless mode:
|
||||
.Pp
|
||||
.Dl "palera1n --force-revert"
|
||||
.Pp
|
||||
|
||||
To verbose boot in rootful mode:
|
||||
.Pp
|
||||
.Dl "palera1n -Vf"
|
||||
.Pp
|
||||
|
||||
To create a partial fakefs with bind mounts:
|
||||
.Pp
|
||||
.Dl "palera1n -Bf"
|
||||
.Pp
|
||||
|
||||
|
||||
.El
|
||||
.Sh CAVEATS
|
||||
|
||||
|
||||
|
||||
.Pp
|
||||
.Em -v
|
||||
is not a real XNU boot argument. It is interpreted by iBoot. However, since XNU
|
||||
boot arguments are set in PongoOS, which is ran after iBoot has ran, it does nothing.
|
||||
To verbose boot, use the
|
||||
.Fl V , -verbose-boot
|
||||
option when jailbreaking.
|
||||
.Pp
|
||||
Fakefs takes up around 5-10 GB of storage, and takes up to 10 minutes to setup.
|
||||
.Pp
|
||||
iOS 15.0 requires DER entitlements, and iOS 15.1 requires hash agility in code signatures.
|
||||
As a result, binaries with the old code signature format need to be resigned with a recent
|
||||
version of the Procursus fork of
|
||||
.Xr ldid 1
|
||||
before they can be ran on a device jailbroken with
|
||||
.Nm
|
||||
\[char46]
|
||||
.Pp
|
||||
When using rootful mode, the
|
||||
.Fl f , -rootful
|
||||
flag must be specified at all times. It does not matter whether you want to create fakefs,
|
||||
create partial fakefs, rejailbreak or remove jailbreak.
|
||||
.Pp
|
||||
Due to a stock bug, using the
|
||||
.Fl V , -verbose-boot
|
||||
option might cause some versions for tvOS to crash and not boot.
|
||||
.Pp
|
||||
Offical Apple USB-C cables as well as some other USB-C cables cannot be used to enter DFU mode.
|
||||
USB-A cable with male USB-C to female USB-A adapter works fine.
|
||||
.Sh POST INSTALLATION (iOS/iPadOS)
|
||||
The palera1n loader app will take up to 1 minute to appear on the homescreen after the
|
||||
device has booted. If it does not appear, you can try using the shortcut:
|
||||
.Pp
|
||||
.Lk https://www.icloud.com/shortcuts/8cd5f489c8854ee0ab9ee38f2e62f87d
|
||||
.Pp
|
||||
to open it. After opening the loader app, select a package manager to install.
|
||||
This will also bootstrap your device.
|
||||
.Pp
|
||||
A built-in SSH server runs on port 44 on loopback interfaces.
|
||||
.Sh POST INSTALLATION (tvOS)
|
||||
.Pp
|
||||
The palera1n loader app will appear on homescreen. Open the loader and select a package manager to install.
|
||||
This will also bootstrap your device.
|
||||
.Pp
|
||||
A built-in SSH server runs on port 44 on all interfaces.
|
||||
.Sh POST INSTALLATION (bridgeOS)
|
||||
.Pp
|
||||
A built-in SSH server runs on port 44 on all interfaces.
|
||||
.Pp
|
||||
Bootstrapping is currently not supported on this device.
|
||||
.Sh FILES
|
||||
During the jailbreak process, a temporary filesystem is mounted on /cores as a place
|
||||
to stash jailbreak files needed during the boot process. No files are ever written
|
||||
onto the actual disk if you do not use the SSH server to write files or using the
|
||||
loader app to install additional jailbreak files.
|
||||
|
||||
.Bl -tag -width "/var/jb/Library/LaunchDaemons"
|
||||
.It Pa /cores
|
||||
The location of the temporary filesystem where jailbreak files are stashed during boot.
|
||||
.It Pa /Library/LaunchDaemons
|
||||
The directory where jailbreak-specific
|
||||
.Xr launchd.plist 5
|
||||
property list files should be placed on rootful.
|
||||
.It Pa /var/jb/Library/LaunchDaemons
|
||||
The directory where jailbreak-specific
|
||||
.Xr launchd.plist 5
|
||||
property list files should be placed on rootless.
|
||||
.It Pa /etc/rc.d
|
||||
The directory where executable files that needs to be executed during boot, before
|
||||
daemons are launched, are placed on rootful. They are executed after all filesystems
|
||||
has been mounted.
|
||||
.It Pa /var/jb/etc/rc.d
|
||||
The directory where executable files that needs to be executed during boot, before
|
||||
daemons are launched, are placed on rootless. They are executed after all filesystems
|
||||
has been mounted.
|
||||
|
||||
|
||||
|
||||
.El
|
||||
.Sh BUGS
|
||||
|
||||
|
||||
|
||||
.Nm
|
||||
may crash if the machine it is running on has non-compliant USB devices plugged in.
|
||||
.Pp
|
||||
.Nm
|
||||
will fail to initialize on Linux when there are no USB devices plugged in.
|
||||
Usually this is not a problem on PCs since the built-in root hubs are also
|
||||
USB devices. However, on platforms such as Apple Silicon Macs in Linux, since
|
||||
there are no built-in USB hubs, at least one USB device needs to be manually
|
||||
plugged in for palera1n to be initialized.
|
||||
|
||||
.Pp
|
||||
The exploit may also work less reliably on some hosts, like AMD desktops, or some MediaTek devices.
|
||||
|
||||
.Pp
|
||||
The built-in SSH server might be not accessible with password after bootstrapping rootful,
|
||||
since the bootstrap uses a custom crypt() function that is not supported
|
||||
by the built-in SSH server.
|
||||
|
||||
.Pp
|
||||
There are no DFU instructions for iBridge T2 as there are no known ways to connect to the T2's USB
|
||||
interface when macOS has been booted.
|
||||
|
||||
|
||||
|
||||
.Sh DEPRECATED AND REMOVED FUNCTIONALITY
|
||||
|
||||
|
||||
|
||||
There was an option in
|
||||
.Nm
|
||||
to force create the fakefs even when one already exists (which would overwrite
|
||||
the existing fakefs), by setting the palerain_option_setup_rootful_forced flag
|
||||
in palera1n flags. This option was removed because using
|
||||
.Fl -force-revert
|
||||
and
|
||||
.Fl c
|
||||
at the same time has exactly the same effect.
|
||||
|
||||
.Pp
|
||||
The hook that enabled
|
||||
.Sy launchctl runstats
|
||||
has been removed, since it leaks memory in launchd.
|
||||
.Pp
|
||||
|
||||
.Fl f, -fakefs
|
||||
has been renamed to
|
||||
.Fl f, -rootful
|
||||
due to its ambiguity. As it supports both fakefs and realfs on certain platforms.
|
||||
.Sh SEE ALSO
|
||||
.Xr launchd 8
|
||||
.Xr launchd.plist 5
|
||||
.Xr ldid 1
|
||||
.Xr p1ctl 8
|
||||
|
||||
|
||||
|
||||
.Sh HISTORY
|
||||
|
||||
|
||||
|
||||
The
|
||||
.Nm
|
||||
jailbreak was first written by Nebula and Mineek on September 26, 2022, as a shell
|
||||
script. Tweak support with DEVELOPMENT kernels are added on October 2, 2022. RELEASE
|
||||
kernel support is added on November 14, 2022. iOS 16 Support is added on
|
||||
December 13, 2022. Later, the first attempt to rewrite palera1n into C begins on January
|
||||
01 2023. The
|
||||
.Nm
|
||||
utility described here is the second attempt, which first started on January 16, 2023,
|
||||
using checkra1n 1337 and a custom KPF.
|
||||
Something happened on August 15, 2023.
|
||||
Reference in new issue
Block a user