diff --git a/.gitignore b/.gitignore index 65d76ac..296abe0 100644 --- a/.gitignore +++ b/.gitignore @@ -3,6 +3,7 @@ dist/ .DS_Store gen/ +docs/*.html embedded/Pongo.bin embedded/checkra1n-kpf-pongo embedded/ramdisk.dmg diff --git a/docs/Makefile b/docs/Makefile new file mode 100644 index 0000000..25b8e54 --- /dev/null +++ b/docs/Makefile @@ -0,0 +1,9 @@ +PAGES = palera1n.1.html p1ctl.8.html + +all: $(PAGES) + +%.html: % + mandoc -T html -O style=mandoc.css $< > $@ + +clean: + rm -f $(PAGES) diff --git a/docs/mandoc.css b/docs/mandoc.css new file mode 100644 index 0000000..6a315d8 --- /dev/null +++ b/docs/mandoc.css @@ -0,0 +1,269 @@ +/* $OpenBSD: mandoc.css,v 1.35 2021/03/30 19:23:50 schwarze Exp $ */ +/* + * Standard style sheet for mandoc(1) -Thtml and man.cgi(8). + * + * Written by Ingo Schwarze . + * I place this file into the public domain. + * Permission to use, copy, modify, and distribute it for any purpose + * with or without fee is hereby granted, without any conditions. + */ + +/* Global defaults. */ + +html { + --bg: #FFFFFF; + --fg: #000000; } +body { background: var(--bg); + color: var(--fg); + font-family: monospace,Helvetica,Arial,sans-serif; + max-width: 80ch; + margin: 1em auto; + padding: 0 1ch; + } +h1 { font-size: 110%; } +table { margin-top: 0em; + margin-bottom: 0em; + border-collapse: collapse; } +/* Some browsers set border-color in a browser style for tbody, + * but not for table, resulting in inconsistent border styling. */ +tbody { border-color: inherit; } +tr { border-color: inherit; } +td { vertical-align: top; + padding-left: 0.2em; + padding-right: 0.2em; + border-color: inherit; } +ul, ol, dl { margin-top: 0em; + margin-bottom: 0em; } +li, dt { margin-top: 1em; } +pre { font-family: inherit; } + +.permalink { border-bottom: thin dotted; + color: inherit; + font: inherit; + text-decoration: inherit; } +* { clear: both } + +/* Search form and search results. */ + +form { + position: sticky; + top: 0px; + background-color: var(--bg); + z-index: 1; +} + +fieldset { border: thin solid silver; + border-radius: 0.3em; + text-align: center; } +input[name=expr] { + width: 25%; } + +table.results { margin-top: 1em; + margin-left: 2em; + font-size: smaller; } + +/* Header and footer lines. */ + +table.head { width: 100%; + border-bottom: 1px dotted #808080; + margin-bottom: 1em; + font-size: smaller; + overflow-wrap: anywhere; } +td.head-vol { text-align: center; } +td.head-rtitle { + text-align: right; } + +table.foot { width: 100%; + border-top: 1px dotted #808080; + margin-top: 1em; + font-size: smaller; + overflow-wrap: anywhere; } +td.foot-os { text-align: right; } + +table.Nm { + overflow-wrap:anywhere; +} + +/* Sections and paragraphs. */ + +.manual-text { + margin-left: 3.8em; } +h1.Sh { margin-top: 1.2em; + margin-bottom: 0.6em; + margin-left: -3.2em; } +h2.Ss { margin-top: 1.2em; + margin-bottom: 0.6em; + margin-left: -1.2em; + font-size: 105%; } +.Pp { margin: 0.6em 0em; } + +/* Displays and lists. */ + +.Bd-indent { margin-left: 3.8em; } + +.Bl-bullet { list-style-type: disc; + padding-left: 1em; } +.Bl-dash { list-style-type: none; + padding-left: 0em; } +.Bl-dash > li:before { + content: "\2014 "; } +.Bl-item { list-style-type: none; + padding-left: 0em; } +.Bl-compact > li { + margin-top: 0em; } + +.Bl-enum { padding-left: 2em; } +.Bl-compact > li { + margin-top: 0em; } + +.Bl-diag > dt { + font-style: normal; + font-weight: bold; } +.Bl-diag > dd { + margin-left: 0em; } +.Bl-hang > dd { + margin-left: 5.5em; } +.Bl-inset > dd { + margin-left: 0em; } +.Bl-ohang > dd { + margin-left: 0em; } +.Bl-tag { margin-top: 0.6em; + margin-left: 5.5em; } +.Bl-tag > dt { + float: left; + margin-top: 0em; + margin-left: -5.5em; + padding-right: 0.5em; + vertical-align: top; } +.Bl-tag > dd { + clear: right; + column-count: 1; /* Force block formatting context. */ + width: 100%; + margin-top: 0em; + margin-left: 0em; + margin-bottom: 0.6em; + vertical-align: top; } +.Bl-compact { margin-top: 0em; } +.Bl-compact > dd { + margin-bottom: 0em; } +.Bl-compact > dt { + margin-top: 0em; } + +.Bl-column > tbody > tr > td { + margin-top: 1em; } +.Bl-compact > tbody > tr > td { + margin-top: 0em; } + +.Rs { font-style: normal; + font-weight: normal; } +.RsB { font-style: italic; + font-weight: normal; } +.RsI { font-style: italic; + font-weight: normal; } +.RsJ { font-style: italic; + font-weight: normal; } +.RsT { text-decoration: underline; } + +.tbl td { vertical-align: middle; } + +.HP { margin-left: 3.8em; + text-indent: -3.8em; } + +/* Semantic markup for command line utilities. */ + +code.Nm { font-style: normal; + font-weight: bold; + font-family: inherit; + overflow-wrap: normal; } +.Fl { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Cm { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Ar { font-style: italic; + font-weight: normal; } +.Op { display: inline; } +.Ic { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Ev { font-style: normal; + font-weight: normal; + font-family: monospace; } +.Pa { font-style: italic; + font-weight: normal; } + +/* Semantic markup for function libraries. */ + +code.In { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Fd { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Ft { font-style: italic; + font-weight: normal; } +.Fn { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Fa { font-style: italic; + font-weight: normal; } +.Vt { font-style: italic; + font-weight: normal; } +.Va { font-style: italic; + font-weight: normal; } +.Dv { font-style: normal; + font-weight: normal; + font-family: monospace; } +.Er { font-style: normal; + font-weight: normal; + font-family: monospace; } + +/* Various semantic markup. */ + +.Cd { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Ad { font-style: italic; + font-weight: normal; } +.Ms { font-style: normal; + font-weight: bold; } + +/* Physical markup. */ + +.Bf { display: inline; } +.No { font-style: normal; + font-weight: normal; } +.Em { font-style: italic; + font-weight: normal; } +.Sy { font-style: normal; + font-weight: bold; } +.Li { font-style: normal; + font-weight: normal; + font-family: monospace; } + +/* Overrides to avoid excessive margins on small devices. */ + +@media (max-width: 37.5em) { +.manual-text { + margin-left: 0.5em; } +h1.Sh, h2.Ss { margin-left: 0em; } +.Bd-indent { margin-left: 2em; } +.Bl-hang > dd { + margin-left: 2em; } +.Bl-tag { margin-left: 2em; } +.Bl-tag > dt { + margin-left: -2em; } +.HP { margin-left: 2em; + text-indent: -2em; } +} + +/* Overrides for a dark color scheme for accessibility. */ + +@media (prefers-color-scheme: dark) { +html { --bg: #000000; + --fg: #FFFFFF; } +:link { color: #BAD7FF; } +:visited { color: #BAD7FF; } +} + diff --git a/docs/p1ctl.8 b/docs/p1ctl.8 new file mode 100644 index 0000000..1702d5f --- /dev/null +++ b/docs/p1ctl.8 @@ -0,0 +1,109 @@ +.\"- +.\" Copyright (c.Xc 2024 Nick Chan +.\" SPDX-License-Identifier: MIT +.\" +.Dd "6 April 2024" +.Dt p1ctl 8 +.Sh NAME +.Nm p1ctl +.Nd command-line access to palera1n loader +.Sh SYNOPSIS +.Nm +.Ar subcommand +.Op subcommand options +.Op subcommand arguments +.Sh DESCRIPTION +.Nm +provide a command-line interface to the graphical palera1n loader. +.Pp +.Nm +interfaces with the palera1n daemon as well as palera1n's launchd hook. + +.Sh SUBCOMMANDS +.Bl -tag -width -indent +.It Xo Ar bootstrap Op Fl s +.Op Fl S Ar password +.Ar bootstrap-file +.Xc +Deploy a bootstrap from a zstd compressed tarball. With no additional options specified, +a new password for the mobile user will be prompted for. The bootstrap you are deploying +must match the jailbreak type (rootful or rootless) you are using. +.Bl -tag -width -indent +.It Fl s +Do not prompt for the password and do not set the mobile password. +.It Fl S Ar password +Do not prompt and set the mobile password to the password specified. +.El +.Pp +.Em NOTE: +Unlike the graphical palera1n loader, this command only deploys the bootstrap itself, +it does not add additional repositories nor install additional packages. +.It Xo Ar exitsafe +.Xc +Exit +.Nm palera1n +safe mode, and trigger a userspace reboot. This command will succeed +even if the device is not currently in safe mode. In this case, a userspace reboot +is still triggered. +.Pp +.Em NOTE: +Many tweak injection packages also provide their own safe mode, p1ctl does not +recognize and cannot control those safe modes. +.It Xo Ar help Op Ar subcommand +.Xc +Prints help text. If +.Ar subcommand +is specified, print help about the subcommand. +.It Xo Ar kbase +.Xc +Print a hexadecimal representation of the kernel base. +.It Xo Ar kslide +.Xc +Print a hexadecimal representation of the kernel slide. +.It Xo Ar palera1n_flags +.Xc +Print a representation of the palera1n flags, which corresponds to the options passed +to +.Xr palera1n 1 +as well as hints to the palera1n userspace stack set by +.Nm PongoOS +\[char46] +By default, a hexadecimal representation of the flags will be printed. +.Bl -tag -width -indent +.It Fl d +Read the flags from the ramdisk block device instead of getting them by interfacing with palera1n daemon. +.It Fl s +Print a string representation of the flags. Each line will contain one flag, and the strings always start +with palerain_option_, and unknown flags are represented as palerain_option_undefined. +.El +.It Xo Ar reboot-userspace +.Xc +Unmount /Developer if mounted and then reboot the userspace. +This command exists because the /Developer mount will be broken +after a plain userspace reboot, which breaks debugging in Xcode. +.Nm palera1n +also hooks the +.Xr reboot3 3 +call so that rebooting userspace using +.Xr launchctl 1 +does not break the /Developer mount. +.It Xo Ar reload +.Xc +Causes the +.Nm palera1n +launchd hook to re-probe the environment and update its internal state. +This will affect the internal environmental variables passed onto new processes, +and is typically used after bootstrapping or reverting installs. +.It Xo Ar revert-install +.Xc +Remove jailbreak files from the device. This command is not supported on rootful with fakefs. On rootful with realfs, the device will reboot after issuing this command. +.Pp +To remove jailbreak files on rootful with fakefs, use +.Xr palera1n 1 +on your computer with the +.Fl -force-revert +.Fl f +options instead. +.El +.Sh SEE ALSO +.Xr palera1n 1 diff --git a/docs/palera1n.1 b/docs/palera1n.1 new file mode 100644 index 0000000..12d38f3 --- /dev/null +++ b/docs/palera1n.1 @@ -0,0 +1,626 @@ +.\"- +.\" Copyright (c) 2026 Nick Chan +.\" SPDX-License-Identifier: MIT +.\" +.Dd "23 December 2024" +.Dt palera1n 1 +.Sh NAME +.Nm palera1n +.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool +.Sh SYNOPSIS +.Nm +.Op Fl hvlfcBsTVpednq +.Op Fl e Ar Boot arguments +.Op Fl k Ar Pongo image +.Op Fl o Ar overlay file +.Op Fl r Ar ramdisk file +.Op Fl K Ar KPF file +.Op Fl -cli +.Op Fl -gui +.Op Fl -tui +.Op Fl -force-revert +.Op Fl -dark-blockchain +.Op Fl -force-enable-ssv +.Sh DESCRIPTION +.Nm +jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device, +utilizing the +.Em checkm8 +bootROM exploit. +.Pp +.Nm +provides rootful and rootless jailbreak modes. +On iOS/iPadOS 15.0 and later, +.Nm +is able to jailbreak the device in fakefs-rootful mode, where / +is writable, as well as rootless mode, where / cannot be written to. +On tvOS and bridgeOS, +only rootful is supported. On versions where fakefs-rootful is not +applicable, palera1n modifies the actual root filesystem instead +of making a fakefs. +.Pp +Due to the nature of the +.Em checkm8 +exploit, +.Nm +is semi-tethered. That is, you must run the +.Nm +tool after the device reboot in order to enter the jailbroken state. +However, it is not required for the device to boot. +.Pp +On A11 devices, that is, iPhone 8, iPhone 8 Plus and iPhone X, the passcode cannot +be used. +.Pp +On iOS 15, the passcode must be off while jailbroken. +.Pp +On iOS 16, the passcode must be off since restore, and +.Sy Reset All Contents and Settings +from settings app counts as a restore. +A backup may be used in this case. +.Pp +In the remainder of this document, the term "iOS" and "iPadOS" will be used interchangably +as the difference is negligible as far as the jailbreak is concerened. +.Pp +.Sh SUPPORTED DEVICES +As described above, arm64 iOS 15.0-26.0 devices are supported, here is an explicit +list of supported devicecs: + +.Bl -tag -compact +.It iPhone 6s +.It iPhone 6s Plus +.It iPhone SE (2016) +.It iPhone 7 +.It iPhone 7 Plus +.It iPhone 8 +.It iPhone 8 Plus +.It iPhone X +.El + +.Bl -tag -compact +.It iPad mini 4 +.It iPad Air 2 +.It iPad (5th generation) +.It iPad (6th generation) +.It iPad (7th generation) +.It iPad Pro (9.7") +.It iPad Pro (12.9") (1st generation) +.It iPad Pro (10.5") +.It iPad Pro (12.9") (2nd generation) +.El + +.Bl -tag -compact +.It iPod Touch (7th generation) +.El + +.Bl -tag -compact +.It Apple TV HD +.It Apple TV 4K (1st generation) +.El + +.Bl -tag -compact +.It Apple T2 iMacPro1,1 +.It Apple T2 MacBookPro15,1 +.It Apple T2 MacBookPro15,2 +.It Apple T2 Macmini8,1 +.It Apple T2 MacPro7,1 +.It Apple T2 MacBookPro15,3 +.It Apple T2 MacBookAir8,1 +.It Apple T2 MacBookPro15,4 +.It Apple T2 MacBookAir8,2 +.It Apple T2 MacBookPro16,1 +.It Apple T2 MacBookAir9,1 +.It Apple T2 MacBookPro16,2 +.It Apple T2 iMac20,1 +.It Apple T2 iMac20,2 +.It Apple T2 MacBookPro16,3 +.It Apple T2 MacBookPro16,4 +.El + +Support for the A8 HomePod on Darwin 21 and above could be added, +but it is currently unsupported. + +arm64e devices will NEVER be supported. + + + +.Sh OPTIONS +.Bl -tag -width -indent + + + +.It Fl h , -help +Prints usage information. + +.It Fl v , -version +Prints the program version and exit. + +.It Fl -cli +Run in command line interface mode. + +.It Fl -gui +Run in graphical user interface mode. +.Pp +This argument is available only in builds compiled with +.Cm WITH_GUI +support enabled. + +.It Fl -tui +Run in text user interface mode. +.Pp +This argument is available only in builds compiled with +.Cm WITH_TUI +support enabled. + +.It Fl -dark-blockchain +Runs the jailbreak in hacker mode. + +.It Fl -force-revert +Remove the jailbreak while keeping user data. Some jailbreak files may remain +after running this command. Additionally, jailbreak apps may remain on the +home screen on for a while even when the files are deleted as the icon cache +still has their icons. When used with + +.It Fl -force-enable-ssv +Force the jailbreak to detect Signed System Volume (SSV) as being required on +the system. This option provides compatibility with previous version of palera1n +that incorrectly detect SSV as being required on tvOS 18.2 and above. When using +this option with +.Fl f , -fakefs , +the jailbreak will behave as if fakefs is required, which allows the user to boot +into fakefs possibly created by previous versions of palera1n, or remove it if +the +.Fl -force-revert +option is specified as well. +(It is technically possible to setup fakefs using this option as well, but this +is not a supported scenario) + +.Fl f , -rootful , +this will actually boot the device in rootless mode then delete the jailbreak +files. As a result, using the loader app to install the jailbreak environment +is not supported when this option is used together with +.Fl f , -rootful +\[char46] + +.It Fl l , -rootless +Proceed in rootless mode. This option is only supported on iOS/iPadOS. + +.It Fl f , -rootful +Proceed in rootful mode. Despite its name, this applies to both full, partial fakefs, as well as realfs, and it still applies even when trying to force revert. + +.It Fl c , -setup-fakefs +When used with +.Fl f , -rootful , +creates the new APFS volume required for rootful. Will fail if one already exists. +This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they +require fakefs for rootful. + +.It Fl B , -setup-fakefs-partial +Like +.Fl c , -setup-fakefs +but the size of the created fakefs is smaller at the expense of having unwritable +parts in rarely-written paths. When jailbreaking 16 GB devices, this option must be used +when setting up fakefs for rootful, as they do not have enough storage for full fakefs. +This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they +require fakefs for rootful. + +.It Fl s , -safe-mode +Enter safe mode. An alert will be displayed on iOS/iPadOS/tvOS. Jailbreak daemons nor early boot executable files +specified (see +.Sy FILES +section below) will be executed. The loader app and the built in SSH server can still be used, +as well as any jailbreak-specific apps you have installed. + +.It Fl T , -telnetd +Enable the TELNET daemon on port 46, all interfaces. Please note that there is no authentication and is therefore insecure. + +.It Fl V , -verbose-boot +Boots the device in verbose mode, allowing boot logs to be seen. + +.It Fl p , -early-exit +Exit after booting into a clean PongoOS shell. + +.It Fl e , -extra-bootargs Ar boot arguments +Specify custom XNU kernel command line. Additionally, the +.Em wdt=-1 +argument is used during fakefs setup. + +.It Fl k , -override-pongo Ar pongo file +Override PongoOS image. The raw image, named +.Em Pongo.bin +when built, should be used. PongoOS 2.6.0 or later is required. + +.It Fl K , -override-kpf Ar KPF file +Override the kernel patchfinder PongoOS module. The module is required to support setting +root filesystem in paleinfo with +.Em rootfs +command. If in doubt, use +.Sy https://github.com/palera1n/PongoOS +iOS15 branch or your own fork of it. + +.It Fl o , -override-overlay Ar overlay file +Specify the path to a custom overlay file, which is then mounted onto /cores/binpack +during boot, if the default ramdisk is used. The default ramdisk expects the overlay +to contain a folder named +.Em Applications +at the root of it, as well as a dmg named +.Em loader.dmg +at the root of it. Otherwise, the device will not boot. It is also expected that it +contains a shell, a ssh server, and various command line utilities. + +.It Fl r , -override-ramdisk Ar ramdisk file +Override the ramdisk. At a very minimum, it should contain +.Em /cores/ploosh +as well as a fake dyld +.Em /usr/lib/dyld +where the logic is expected to be in. + +.It Fl d , -debug-logging +Enable debug logging. Supports up to 5 levels of verbosity, with 5 being the most verbose. + +.It Fl n , -no-colors +Disable colors on the command line. + +.It Fl q , -quick +When used with +.Fl -tui , +or +.Fl -gui , +the interfaces will automate the process of entering DFU mode, without needing to press the interface buttons for every step of the process. +.Pp +This variable is available only in builds compiled with +.Cm WITH_GUI +or +.Cm WITH_TUI +support enabled. + + +.El +.Sh ENVIRONMENTAL VARIABLES +.Bl -tag -width -indent + + + +.It Ev RA1N_ABORT_TIMEOUT +Set a custom timeout value (0 to 999999999) for the exploit abort timer. +While the default value is sufficient for standard platforms (Intel or Apple Silicon), +this variable allows timing adjustments on specific environments such as Linux (AMD) +or Raspberry Pi (ARM64), where the exploit may fail due to platform-specific USB +stack behavior. +.Pp +E.g. Raspberry Pi 5: +.Em RA1N_ABORT_TIMEOUT=1000000 +.Pp +This variable is available only in builds compiled with +.Cm WITH_CIDERRAIN +support enabled. + +.It Ev RA1N_CLI +Equivalent to using the +.Fl -cli +option. + +.It Ev RA1N_GUI +Equivalent to using the +.Fl -gui +option. +.Pp +This variable is available only in builds compiled with +.Cm WITH_GUI +support enabled. + +.It Ev RA1N_TUI +Equivalent to using the +.Fl -tui +option. +.Pp +This variable is available only in builds compiled with +.Cm WITH_TUI +support enabled. + +.It Ev RA1N_DARK_BLOCKCHAIN +Equivalent to using the +.Fl -dark-blockchain +option. + +.It Ev RA1N_FORCE_REVERT +Equivalent to using the +.Fl -force-revert +option. + +.It Ev RA1N_FORCE_ENABLE_SSV +Equivalent to using the +.Fl -force-enable-ssv +option. + +.It Ev RA1N_ROOTLESS +Equivalent to using the +.Fl l , -rootless +option. + +.It Ev RA1N_ROOTFUL +Equivalent to using the +.Fl f , -rootful +option. + + +.It Ev RA1N_SETUP_FAKEFS +Equivalent to using the +.Fl c , -setup-fakefs +option. + +.It Ev RA1N_SETUP_FAKEFS_PARTIAL +Equivalent to using the +.Fl B , -setup-fakefs-partial +option. + +.It Ev RA1N_SAFE_MODE +Equivalent to using the +.Fl s , -safe-mode +option. + +.It Ev RA1N_TELNETD +Equivalent to using the +.Fl T , -telnetd +option. + +.It Ev RA1N_VERBOSE_BOOT +Equivalent to using the +.Fl V , -verbose-boot +option. + +.It Ev RA1N_EARLY_EXIT +Equivalent to using the +.Fl p , -early-exit +option. + +.It Ev RA1N_EXTRA_BOOTARGS +Equivalent to using the +.Fl e , -extra-bootargs +option. + +.It Ev RA1N_OVERRIDE_PONGO +Equivalent to using the +.Fl k , -override-pongo +option. + +.It Ev RA1N_OVERRIDE_KPF +Equivalent to using the +.Fl K , -override-kpf +option. + +.It Ev RA1N_OVERRIDE_OVERLAY +Equivalent to using the +.Fl o , -override-overlay +option. + +.It Ev RA1N_OVERRIDE_RAMDISK +Equivalent to using the +.Fl r , -override-ramdisk +option. + +.It Ev RA1N_DEBUG_LOGGING +Equivalent to using the +.Fl d , -debug-logging +option. Supports up to 5 levels of verbosity, with 5 being the most verbose. +e.g. to enable level 3 debug logging, use +.Em RA1N_DEBUG_LOGGING=3 + +.It Ev RA1N_NO_COLORS +Equivalent to using the +.Fl n , -no-colors +option. + +.It Ev RA1N_QUICK +Equivalent to using the +.Fl q , -quick +option. +.Pp +This variable is available only in builds compiled with +.Cm WITH_GUI +or +.Cm WITH_TUI +support enabled. + + +.El +.Sh EXAMPLES + + + +To (re-)jailbreak in rootless mode: +.Pp +.Dl "palera1n -l" +.Pp + +To setup fakefs for rootful mode: +.Pp +.Dl "palera1n -fc" +.Pp +After the device has rebooted into recovery mode, follow the following example. +.Pp + +To re-jailbreak in rootful mode: +.Pp +.Dl "palera1n -f" +.Pp + +To remove the jailbreak in rootful mode: +.Pp +.Dl "palera1n --force-revert -f" +.Pp + +To remove the jailbreak in rootless mode: +.Pp +.Dl "palera1n --force-revert" +.Pp + +To verbose boot in rootful mode: +.Pp +.Dl "palera1n -Vf" +.Pp + +To create a partial fakefs with bind mounts: +.Pp +.Dl "palera1n -Bf" +.Pp + + +.El +.Sh CAVEATS + + + +.Pp +.Em -v +is not a real XNU boot argument. It is interpreted by iBoot. However, since XNU +boot arguments are set in PongoOS, which is ran after iBoot has ran, it does nothing. +To verbose boot, use the +.Fl V , -verbose-boot +option when jailbreaking. +.Pp +Fakefs takes up around 5-10 GB of storage, and takes up to 10 minutes to setup. +.Pp +iOS 15.0 requires DER entitlements, and iOS 15.1 requires hash agility in code signatures. +As a result, binaries with the old code signature format need to be resigned with a recent +version of the Procursus fork of +.Xr ldid 1 +before they can be ran on a device jailbroken with +.Nm +\[char46] +.Pp +When using rootful mode, the +.Fl f , -rootful +flag must be specified at all times. It does not matter whether you want to create fakefs, +create partial fakefs, rejailbreak or remove jailbreak. +.Pp +Due to a stock bug, using the +.Fl V , -verbose-boot +option might cause some versions for tvOS to crash and not boot. +.Pp +Offical Apple USB-C cables as well as some other USB-C cables cannot be used to enter DFU mode. +USB-A cable with male USB-C to female USB-A adapter works fine. +.Sh POST INSTALLATION (iOS/iPadOS) +The palera1n loader app will take up to 1 minute to appear on the homescreen after the +device has booted. If it does not appear, you can try using the shortcut: +.Pp +.Lk https://www.icloud.com/shortcuts/8cd5f489c8854ee0ab9ee38f2e62f87d +.Pp +to open it. After opening the loader app, select a package manager to install. +This will also bootstrap your device. +.Pp +A built-in SSH server runs on port 44 on loopback interfaces. +.Sh POST INSTALLATION (tvOS) +.Pp +The palera1n loader app will appear on homescreen. Open the loader and select a package manager to install. +This will also bootstrap your device. +.Pp +A built-in SSH server runs on port 44 on all interfaces. +.Sh POST INSTALLATION (bridgeOS) +.Pp +A built-in SSH server runs on port 44 on all interfaces. +.Pp +Bootstrapping is currently not supported on this device. +.Sh FILES +During the jailbreak process, a temporary filesystem is mounted on /cores as a place +to stash jailbreak files needed during the boot process. No files are ever written +onto the actual disk if you do not use the SSH server to write files or using the +loader app to install additional jailbreak files. + +.Bl -tag -width "/var/jb/Library/LaunchDaemons" +.It Pa /cores +The location of the temporary filesystem where jailbreak files are stashed during boot. +.It Pa /Library/LaunchDaemons +The directory where jailbreak-specific +.Xr launchd.plist 5 +property list files should be placed on rootful. +.It Pa /var/jb/Library/LaunchDaemons +The directory where jailbreak-specific +.Xr launchd.plist 5 +property list files should be placed on rootless. +.It Pa /etc/rc.d +The directory where executable files that needs to be executed during boot, before +daemons are launched, are placed on rootful. They are executed after all filesystems +has been mounted. +.It Pa /var/jb/etc/rc.d +The directory where executable files that needs to be executed during boot, before +daemons are launched, are placed on rootless. They are executed after all filesystems +has been mounted. + + + +.El +.Sh BUGS + + + +.Nm +may crash if the machine it is running on has non-compliant USB devices plugged in. +.Pp +.Nm +will fail to initialize on Linux when there are no USB devices plugged in. +Usually this is not a problem on PCs since the built-in root hubs are also +USB devices. However, on platforms such as Apple Silicon Macs in Linux, since +there are no built-in USB hubs, at least one USB device needs to be manually +plugged in for palera1n to be initialized. + +.Pp +The exploit may also work less reliably on some hosts, like AMD desktops, or some MediaTek devices. + +.Pp +The built-in SSH server might be not accessible with password after bootstrapping rootful, +since the bootstrap uses a custom crypt() function that is not supported +by the built-in SSH server. + +.Pp +There are no DFU instructions for iBridge T2 as there are no known ways to connect to the T2's USB +interface when macOS has been booted. + + + +.Sh DEPRECATED AND REMOVED FUNCTIONALITY + + + +There was an option in +.Nm +to force create the fakefs even when one already exists (which would overwrite +the existing fakefs), by setting the palerain_option_setup_rootful_forced flag +in palera1n flags. This option was removed because using +.Fl -force-revert +and +.Fl c +at the same time has exactly the same effect. + +.Pp +The hook that enabled +.Sy launchctl runstats +has been removed, since it leaks memory in launchd. +.Pp + +.Fl f, -fakefs +has been renamed to +.Fl f, -rootful +due to its ambiguity. As it supports both fakefs and realfs on certain platforms. +.Sh SEE ALSO +.Xr launchd 8 +.Xr launchd.plist 5 +.Xr ldid 1 +.Xr p1ctl 8 + + + +.Sh HISTORY + + + +The +.Nm +jailbreak was first written by Nebula and Mineek on September 26, 2022, as a shell +script. Tweak support with DEVELOPMENT kernels are added on October 2, 2022. RELEASE +kernel support is added on November 14, 2022. iOS 16 Support is added on +December 13, 2022. Later, the first attempt to rewrite palera1n into C begins on January +01 2023. The +.Nm +utility described here is the second attempt, which first started on January 16, 2023, +using checkra1n 1337 and a custom KPF. +Something happened on August 15, 2023.