update help and documentation

Makefile

@@ -71,7 +71,7 @@ CFLAGS += -DBUILD_COMMIT="\"$(BUILD_COMMIT)\""
 CPATH =
 LIBRARY_PATH =
 
-export SRC DEP UNAME CC CFLAGS LDFLAGS LIBS SHELL TARGET_OS DEV_BUILD BUILD_DATE BUILD_TAG BUILD_WHOAMI BUILD_STYLE BUILD_NUMBER BUILD_BRANCH
+export SRC DEP UNAME CC STRIP CFLAGS LDFLAGS LIBS SHELL TARGET_OS DEV_BUILD BUILD_DATE BUILD_TAG BUILD_WHOAMI BUILD_STYLE BUILD_NUMBER BUILD_BRANCH CC_FOR_BUILD CFLAGS_FOR_BUILD
 
 all: palera1n
 

docs/palera1n.1

@@ -1,12 +1,12 @@
 .\"-
-.\" Copyright (c) 2024 Nick Chan
+.\" Copyright (c) 2026 Nick Chan
 .\" SPDX-License-Identifier: MIT
 .\"
 .Dd "23 December 2024"
 .Dt palera1n 1
 .Sh NAME
 .Nm palera1n
-.Nd arm64 iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 jailbreaking tool
+.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool
 .Sh SYNOPSIS
 .Nm
 .Op Fl cCdDEfhIlLnpRsSTvV
@@ -18,9 +18,10 @@
 .Op Fl i Ar checkra1n file
 .Op Fl -version
 .Op Fl -force-revert
+.Op Fl -override-libcheckra1nhelper Ar hook dylib
 .Sh DESCRIPTION
 .Nm
-jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 device,
+jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device,
 utilizing the
 .Em checkm8
 bootROM exploit.
@@ -168,6 +169,10 @@ Proceed in rootful mode. Despite its name, this applies to both full, partial fa
 Prints help text.
 .It Fl i , -checkra1n-file Ar checkra1n file
 Specify the path to a custom checkra1n file.
+On Apple platforms this will disable the built-in checkra1n helper.
+A custom one may still be specified with
+.Fl -override-libcheckra1nhelper
+\[char46]
 .It Fl k , -override-pongo Ar pongo file
 Override PongoOS image. The raw image, named
 .Em Pongo.bin
@@ -222,6 +227,10 @@ Enable debug logging. The option may be repeated for extra verbosity.
 Boots the device in verbose mode, allowing boot logs to be seen.
 .It Fl I , -device-info
 Prints info about device and exits.
+.It Fl -override-libcheckra1nhelper Ar hook dylib
+(Apple platforms only) Specify a custom dylib to insert into checkra1n via
+.Em DYLD_INSERT_LIBRARIES
+\[char46]
 .El
 .Sh ENVIRONMENTAL VARIABLES
 .Bl -tag -width -indent

include/xxd-embedded.h

@@ -22,7 +22,7 @@ extern uint32_t binpack_dmg_len;
 extern uint8_t Pongo_bin[];
 extern uint32_t Pongo_bin_len;
 
-#if defined(__APPLE__) && (TARGET_OS_IPHONE || defined(DEV_BUILD) || defined(FORCE_HELPER))
+#if defined(__APPLE__)
 extern uint8_t libcheckra1nhelper_dylib[];
 extern uint32_t libcheckra1nhelper_dylib_len;
 #endif

src/Makefile

@@ -4,17 +4,14 @@ OBJDIR = obj
 GENDIR = gen
 RESOURCES_DIR = resources
 
+CC_FOR_BUILD = cc
+CFLAGS_FOR_BUILD = -Wall -Wextra -std=c99 -pedantic-errors -O2
+
+export RESOURCES_DIR OBJDIR GENDIR
+
 C_SRC = $(wildcard *.c)
 OBJS = $(patsubst %,$(OBJDIR)/%,$(C_SRC:.c=.c.o))
 
-ifeq (,$(findstring macosx, $(CFLAGS)))
-ifneq (,$(findstring version-min=, $(CFLAGS)))
-ifneq ($(NO_EMBED_HELPER),1)
-C_SRC += $(GENDIR)/gen-libcheckra1nhelper.dylib.c
-endif
-endif
-endif
-
 ifeq ($(NO_EMBED_HELPER),1)
 CFLAGS += -DNO_EMBED_HELPER
 endif
@@ -23,13 +20,9 @@ ifeq ($(DFUHELPER_AUTO_ONLY),1)
 CFLAGS += -DDFUHELPER_AUTO_ONLY
 endif
 
-ifeq ($(FORCE_HELPER),1)
+ifeq ($(TARGET_OS),Darwin)
-ifneq ($(NO_EMBED_HELPER),1)
 C_SRC += $(GENDIR)/gen-libcheckra1nhelper.dylib.c
 endif
-CFLAGS += -DFORCE_HELPER
-BUILD_OPTIONS += FORCE_HELPER
-endif
 
 ifneq ($(NO_RAMDISK),1)
 C_SRC += $(GENDIR)/gen-ramdisk.dmg.lzma.c
@@ -142,14 +135,14 @@ ifneq (,$(findstring version-min=, $(CFLAGS)))
 endif
 endif
 else
-	cp $(RESOURCES_DIR)/checkra1n-$(CHECKRA1N_NAME) $(RESOURCES_DIR)/checkra1n
+	$(MAKE) -C tools
+	./tools/checkra1npatcher $(RESOURCES_DIR)/checkra1n-$(CHECKRA1N_NAME) $(RESOURCES_DIR)/checkra1n
 endif
 
 $(GENDIR)/gen-%.c: $(RESOURCES_DIR)/%
 	echo '#include <stdint.h>' > $(RESOURCES_DIR)/../$@
 	cd $(RESOURCES_DIR) && xxd -iC $$(echo $< | cut -d/ -f2) | sed -e 's/unsigned int/uint32_t/' -e 's/unsigned char/uint8_t/' >> ../$@
 
-
 $(OBJDIR)/pongo_helper.c.o: pongo_helper.c $(wildcard ../include/*.h) $(RESOURCES_DIR)/ramdisk.dmg $(RESOURCES_DIR)/checkra1n-kpf-pongo
 	$(CC) -c -o $@ $(CFLAGS) -DRAMDISK_UNCOMPRESSED_SIZE="\"$$(wc -c < $(RESOURCES_DIR)/ramdisk.dmg | tr -d ' ')\"" -DKPF_UNCOMPRESSED_SIZE="\"$$(wc -c < $(RESOURCES_DIR)/checkra1n-kpf-pongo | tr -d ' ')\"" $<
 
@@ -167,8 +160,8 @@ ifneq (,$(findstring version-min=, $(CFLAGS)))
 endif
 endif
 
-$(RESOURCES_DIR)/libcheckra1nhelper.dylib: chkstk.S
+$(RESOURCES_DIR)/libcheckra1nhelper.dylib:
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared chkstk.S -o $@
+	$(MAKE) -C helper
 
 $(RESOURCES_DIR)/checkra1n-kpf-pongo:
 	curl -Lfo $@ https://cdn.nickchan.lol/palera1n/artifacts/kpf/iOS15/checkra1n-kpf-pongo
@@ -189,9 +182,10 @@ $(RESOURCES_DIR)/Pongo.bin:
 	curl -Lfo $@ https://cdn.nickchan.lol/palera1n/artifacts/kpf/iOS15/Pongo.bin
 
 clean:
-	rm -rf $(OBJDIR)/*.o $(GENDIR)/*.c $(GENDIR)/*.o palera1n palera1n.dSYM libcheckra1nhelper.dylib
+	rm -rf $(OBJDIR)/*.o $(GENDIR)/*.c $(GENDIR)/*.o palera1n palera1n.dSYM $(RESOURCES_DIR)/libcheckra1nhelper.dylib
+	$(MAKE) -C tools clean
 
 distclean: clean
 	rm -rf $(RESOURCES_DIR)/*
 
-.PHONY: all clean
+.PHONY: all clean $(RESOURCES_DIR)/libcheckra1nhelper.dylib

src/exec_checkra1n.c

@@ -15,6 +15,7 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <sys/stat.h>
+#include <sys/ptrace.h>
 #include <inttypes.h>
 #include <sys/utsname.h>
 
@@ -100,16 +101,23 @@ int exec_checkra1n(void) {
 			return -1;
 		}
 	}
-#if defined(__APPLE__) && defined(__arm64__) && (TARGET_OS_IPHONE || defined(FORCE_HELPER))
+#if defined(__APPLE__)
+	char resolved_c1_path[PATH_MAX], *resolved;
+	resolved = realpath(checkra1n_path, resolved_c1_path);
+
+	if (!resolved) {
+		LOG(LOG_FATAL, "Cannot resolve checkra1n path %s: %d (%s)", checkra1n_path, errno, strerror(errno));
+		if (ext_checkra1n == NULL) {
+			unlink(checkra1n_path);
+			free(checkra1n_path);
+		}
+		checkra1n_path = NULL;
+		return -1;
+	}
+
 	char* libcheckra1nhelper_dylib_path = NULL;
-	{
+	if (ext_checkra1n == NULL || gOverrideLibcheckra1nHelper) {
-		struct utsname name;
+		setenv("LIBCHECKRA1NHELPER_CHECKRA1N_PATH", resolved_c1_path, 1);
-		uname(&name);
-		unsigned long darwinMajor = strtoul(name.release, NULL, 10);
-		assert(darwinMajor != 0);
-#if !defined(FORCE_HELPER)
-		if (darwinMajor < 20) {
-#endif
 		if (gOverrideLibcheckra1nHelper) {
 			libcheckra1nhelper_dylib_path = gOverrideLibcheckra1nHelper;
 			goto setenv_ra1n;
@@ -141,9 +149,6 @@ int exec_checkra1n(void) {
 			}
 setenv_ra1n:
 			setenv("DYLD_INSERT_LIBRARIES", libcheckra1nhelper_dylib_path, 1);
-#if !defined(FORCE_HELPER)
-		}
-#endif
 	}
 #endif
 	char args[0x10] = "-E";
@@ -181,6 +186,15 @@ setenv_ra1n:
 		return -1;
 	}
 	LOG(LOG_VERBOSE2, "%s spawned successfully", checkra1n_path);
+#if defined(__APPLE__)
+#if TARGET_OS_IPHONE && !TARGET_OS_SIMULATOR
+    waitpid(pid, NULL, WUNTRACED);
+    ret = ptrace(PT_DETACH, pid, NULL, 0);
+
+	if (ret)
+		LOG(LOG_WARNING, "Cannot ptrace(PT_DETACH): %d (%s)", errno, strerror(errno));
+#endif
+#endif
 	sleep(2);
 	if (ext_checkra1n == NULL) {
 		unlink(checkra1n_path);
@@ -188,12 +202,12 @@ setenv_ra1n:
 		checkra1n_path = NULL;
 	}
 	waitpid(pid, NULL, 0);
-		if (!external_pongo && pongo_path != NULL) {
+	if (!external_pongo && pongo_path != NULL) {
 		unlink(pongo_path);
 	}
 	if (pongo_path != NULL) free(pongo_path);
 	pongo_path = NULL;
-#if defined(__APPLE__) && defined(__arm64__) && (TARGET_OS_IPHONE || defined(FORCE_HELPER))
+#if defined(__APPLE__)
 	if (libcheckra1nhelper_dylib_path != NULL) {
 		if (!gOverrideLibcheckra1nHelper) unlink(libcheckra1nhelper_dylib_path);
 		unsetenv("DYLD_INSERT_LIBRARIES");

src/helper/Makefile

@@ -0,0 +1,29 @@
+C_SRC = $(wildcard *.c)
+C_OBJS = $(patsubst %,../$(OBJDIR)/%,$(C_SRC:.c=.c.o))
+
+S_SRC = $(wildcard *.S)
+S_OBJS = $(patsubst %,../$(OBJDIR)/%,$(S_SRC:.S=.S.o))
+
+CFLAGS += -fvisibility=hidden
+
+C_OBJS += ../$(GENDIR)/gen-payload-t7000.c.o ../$(GENDIR)/gen-payload-t8011.c.o ../$(GENDIR)/gen-payload-t8012.c.o
+
+all: ../$(RESOURCES_DIR)/libcheckra1nhelper.dylib
+
+../$(OBJDIR)/%.c.o: %.c
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+../$(OBJDIR)/%.S.o: %.S
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+../$(RESOURCES_DIR)/libcheckra1nhelper.dylib: $(C_OBJS) $(S_OBJS) $(wildcard *.h)
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared $(C_OBJS) $(S_OBJS) -o $@
+	$(STRIP) -x $@
+	codesign -fs - $@
+
+../$(GENDIR)/gen-payload-%.c: payloads/%.bin
+	echo '#include <stdint.h>' > $@
+	cd payloads && xxd -iC $$(echo $< | cut -d/ -f2) | sed -e 's/unsigned int/uint32_t/' -e 's/unsigned char/uint8_t/' >> ../$@
+
+../$(GENDIR)/gen-payload-%.c.o: ../$(GENDIR)/gen-payload-%.c
+	$(CC) $(CFLAGS) -c -o $@ $<

src/helper/chkstk.S

@@ -1,3 +1,7 @@
+#include <TargetConditionals.h>
+
+#if defined(__APPLE__) && defined(__arm64__) && TARGET_OS_IPHONE
+
 #define _PTHREAD_STRUCT_DIRECT_STACKADDR_OFFSET   -48
 #define _PTHREAD_STRUCT_DIRECT_STACKBOTTOM_OFFSET -40
 
@@ -63,3 +67,4 @@ Lend:
         sub     x10, x10, x9
         ldr     x11, [x10]
         b       Lexit
+#endif

src/helper/helper.c

@@ -0,0 +1,88 @@
+#include <mach-o/loader.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <string.h>
+#include <mach-o/dyld.h>
+#include <sys/ptrace.h>
+#include <spawn.h>
+#include <unistd.h>
+#include <string.h>
+#include <limits.h>
+#include <TargetConditionals.h>
+
+#include "phookra1n.h"
+
+extern char **environ;
+extern char ***_NSGetArgv(void);
+extern int *_NSGetArgc(void);
+
+#define	CS_OPS_STATUS		0
+#define CS_DEBUGGED 0x10000000
+
+int csops(pid_t pid, unsigned int ops, void *useraddr, size_t usersize);
+
+__attribute__((constructor)) void ctor(void)
+{
+    char ***argvp = _NSGetArgv();
+    int *argcp = _NSGetArgc();
+
+    assert(argvp);
+    assert(argcp);
+
+    int argc = *argcp;
+    char **argv = *argvp;
+
+#if TARGET_OS_IPHONE && !TARGET_OS_SIMULATOR
+    assert(ptrace(PT_TRACE_ME, 0, 0, 0) == 0);
+    uint32_t csflags;
+    assert(csops(getpid(), CS_OPS_STATUS, &csflags, sizeof(csflags)) == 0);
+
+    if (!(csflags & CS_DEBUGGED))
+        printf("WARNING: CS_DEBUGGED is not set (0x%x)\n", csflags);
+#endif
+
+    char *c1_path = getenv("LIBCHECKRA1NHELPER_CHECKRA1N_PATH");
+
+    assert(c1_path);
+
+    dprintf("Welcome to Checkra1n Hook!\n");
+
+    int c1_image_index = 0;
+    for (uint32_t i = 0; i < _dyld_image_count(); i++) {
+        if(!strcmp(_dyld_get_image_name(i), c1_path)) {
+            c1_image_index = i;
+            break;
+        }
+    }
+    intptr_t slide = _dyld_get_image_vmaddr_slide(c1_image_index);
+    struct mach_header_64 *mach_header = (struct mach_header_64*)_dyld_get_image_header(c1_image_index);
+
+    uintptr_t cmd_current = (uintptr_t)(mach_header + 1);
+    uintptr_t cmd_end = cmd_current + mach_header->sizeofcmds;
+
+    const struct segment_command_64 *__TEXT = NULL;
+
+    for (uint32_t i = 0; i < mach_header->ncmds && cmd_current <= cmd_end; i++) {
+        const struct segment_command_64 *cmd;
+
+        cmd = (struct segment_command_64*)cmd_current;
+        cmd_current += cmd->cmdsize;
+
+        if (cmd->cmd != LC_SEGMENT_64 || strcmp(cmd->segname, "__TEXT")) {
+            continue;
+        }
+        __TEXT = cmd;
+    }
+
+    assert(__TEXT);
+
+#if defined(__x86_64__)
+    assert(__TEXT->vmsize == 0x28000);
+    setup_hooks_x86_64((void*)(__TEXT->vmaddr + slide));
+#elif defined(__arm64__)
+    assert(__TEXT->vmsize == 0x24000);
+    setup_hooks_arm64((void*)(__TEXT->vmaddr + slide));
+#endif
+}
+

src/helper/hook_arm64.c

@@ -0,0 +1,69 @@
+#include <stdio.h>
+#include <assert.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <mach/mach.h>
+#include <mach/error.h>
+#include <mach/vm_prot.h>
+#include <libkern/OSCacheControl.h>
+#include "phookra1n.h"
+
+#if defined(__arm64__)
+
+static void patch(uint32_t *stream, const uint8_t *payload, const uint32_t payload_len)
+{
+    uint64_t from = (uint64_t)stream;
+    uint64_t to = (uint64_t)payload;
+
+    uint32_t adrp_off = ((to & ~0xfff) - (from & ~0xfff)) >> 12;
+    uint32_t add_off = to & 0xfff;
+
+    dprintf("from 0x%llx to 0x%llx 0x%llx 0x%x\n", from, to, ((from & ~0xfff) + (adrp_off << 12)), add_off);
+
+    uint8_t adrp_reg = stream[0] & 0x1f;
+    uint8_t add_reg  = stream[1] & 0x1f;
+    uint8_t mov1_reg = stream[2] & 0x1f;
+    uint8_t mov2_reg = stream[3] & 0x1f;
+
+    uint8_t immlo = adrp_off & 0x3;
+    uint8_t immhi = (adrp_off >> 2) & 0x7ffff;
+
+    stream[0] = 0x90000000 | adrp_reg | immlo << 29 | (immhi << 5);
+    stream[1] = 0x91000000 | add_reg | add_reg << 5 | (add_off & 0xfff) << 10;
+    stream[2] = 0x52800000 | mov1_reg | ((payload_len & 0xffff) << 5);
+    stream[3] = 0x52800000 | mov2_reg | ((payload_len & 0xffff) << 5);
+
+    dprintf("patched: 0x%x 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2], stream[3]);
+}
+
+void setup_hooks_arm64(void *stream)
+{
+    uint32_t 
+        *t8011_patch_base = (uint32_t*)((char*)stream + 0x102E0),
+        *t7000_patch_base = (uint32_t*)((char*)stream + 0x102F4),
+        *t8012_patch_base = (uint32_t*)((char*)stream + 0x10290);
+
+    vm_address_t page = (vm_address_t)((char*)stream + 0x10000);
+
+    assert(*t8011_patch_base == 0x90000081); // T8011
+    assert(*t7000_patch_base == 0x90000061); // T7000
+    assert(*t8012_patch_base == 0xd0000081); // T8012
+
+    assert(vm_protect(mach_task_self(), page, 0x4000, false, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY) == 0);
+
+    uint32_t t7000_shared_len = 0xaa4; // shared with T7001
+    if (t7000_bin_len > t7000_shared_len)
+        t7000_shared_len = t7000_bin_len;
+
+    patch(t7000_patch_base, t7000_bin, t7000_shared_len);
+    patch(t8011_patch_base, t8011_bin, t8011_bin_len);
+    patch(t8012_patch_base, t8012_bin, t8012_bin_len);
+
+    assert(vm_protect(mach_task_self(), page, 0x4000, false, VM_PROT_READ | VM_PROT_EXECUTE) == 0);
+
+    sys_icache_invalidate((void*)page, 0x4000);
+
+    dprintf("patched checkra1n\n");
+}
+
+#endif

src/helper/hook_x86_64.c

@@ -0,0 +1,74 @@
+#include <stdio.h>
+#include <assert.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <string.h>
+#include <mach/mach.h>
+#include <mach/error.h>
+#include <mach/vm_prot.h>
+#include <libkern/OSCacheControl.h>
+#include "phookra1n.h"
+
+#if defined(__x86_64__)
+// A8
+const char lea_rsi_0x100021060[] = {0x48, 0x8d, 0x35, 0x51, 0xdb, 0x00, 0x00};
+
+// A10x
+const char lea_rsi_0x100025220[] = {0x48, 0x8d, 0x35, 0x2a, 0x1d, 0x01, 0x00};
+
+// T2
+const char lea_rsi_0x100026c50[] = {0x48, 0x8d, 0x35, 0xbe, 0x37, 0x01, 0x00};
+
+static void patch(char *stream, const uint8_t *payload, const uint32_t payload_len)
+{
+    char *s = stream;
+
+    uint64_t from = (uint64_t)stream;
+    uint64_t to = (uint64_t)payload;
+
+    uint32_t lea_off = to - from - 7;
+    dprintf("from 0x%llx to 0x%llx 0x%llx size 0x%x\n", from, to, from + lea_off + 7, payload_len);
+
+    void *lea_imm32 = stream + 3;
+    void *mov1_imm32 = stream + 8;
+    void *mov2_imm32 = stream + 19;
+
+    memcpy(lea_imm32, &lea_off, sizeof(uint32_t));
+    memcpy(mov1_imm32, &payload_len, sizeof(uint32_t));
+    memcpy(mov2_imm32, &payload_len, sizeof(uint32_t));
+
+    dprintf("patched: lea=%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx, mov1=%02hhx%02hhx%02hhx%02hhx%02hhx, mov2=%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx\n",
+            s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7], s[8], s[9], s[10],
+            s[11], s[17], s[18], s[19], s[20], s[21], s[22]);
+}
+
+void setup_hooks_x86_64(void *stream)
+{
+    void 
+        *t8011_patch_base = (void*)((char*)stream + 0x134EF),
+        *t7000_patch_base = (void*)((char*)stream + 0x13508),
+        *t8012_patch_base = (void*)((char*)stream + 0x1348B);
+
+    vm_address_t page = (vm_address_t)((char*)stream + 0x13000);
+
+    assert(memcmp(t7000_patch_base, lea_rsi_0x100021060, sizeof(lea_rsi_0x100021060)) == 0);
+    assert(memcmp(t8011_patch_base, lea_rsi_0x100025220, sizeof(lea_rsi_0x100025220)) == 0);
+    assert(memcmp(t8012_patch_base, lea_rsi_0x100026c50, sizeof(lea_rsi_0x100026c50)) == 0);
+
+    assert(vm_protect(mach_task_self(), page, 0x1000, false, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY) == 0);
+
+    uint32_t t7000_shared_len = 0xaa4; // shared with T7001
+    if (t7000_bin_len > t7000_shared_len)
+        t7000_shared_len = t7000_bin_len;
+
+    patch(t7000_patch_base, t7000_bin, t7000_shared_len);
+    patch(t8011_patch_base, t8011_bin, t8011_bin_len);
+    patch(t8012_patch_base, t8012_bin, t8012_bin_len);
+
+    assert(vm_protect(mach_task_self(), page, 0x1000, false, VM_PROT_READ | VM_PROT_EXECUTE) == 0);
+
+    sys_icache_invalidate((void*)page, 0x1000);
+
+    dprintf("patched checkra1n\n");
+}
+#endif

src/helper/phookra1n.h

@@ -0,0 +1,28 @@
+#ifndef PALERA1N_CHECKRA1N_HELPER_H
+#define PALERA1N_CHECKRA1N_HELPER_H
+
+#include <stdint.h>
+#include <stdio.h>
+
+#ifdef DEV_BUILD
+#define dprintf(...) printf(__VA_ARGS__)
+#else
+#define dprintf(...)
+#endif
+
+extern uint8_t t7000_bin[];
+extern uint32_t t7000_bin_len;
+
+extern uint8_t t8011_bin[];
+extern uint32_t t8011_bin_len;
+
+extern uint8_t t8012_bin[];
+extern uint32_t t8012_bin_len;
+
+#if defined(__x86_64__)
+void setup_hooks_x86_64(void *stream);
+#elif defined(__arm64__)
+void setup_hooks_arm64(void *stream);
+#endif
+
+#endif

src/optparse.c

@@ -78,7 +78,7 @@ static int usage(int e, char* prog_name)
 #endif
 			"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
 			"Copyright (C) 2024, palera1n team, All Rights Reserved.\n\n"
-			"iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 arm64 jailbreaking tool\n\n"
+			"iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 arm64 jailbreaking tool\n\n"
 			"\t--version\t\t\t\tPrint version\n"
 			"\t--force-revert\t\t\t\tRemove jailbreak\n"
 #ifdef DEV_BUILD
@@ -122,6 +122,9 @@ static int usage(int e, char* prog_name)
 #ifdef TUI
 			"\t-t, --tui\t\t\t\tForce interactive TUI\n"
 			"\t--cli\t\t\t\t\tForce cli mode\n"
+#endif
+#if defined(__APPLE__)
+			"\t--override-libcheckra1nhelper <file>\tCustom checkra1n hook dylib\n"
 #endif
 		"\nEnvironmental variables:\n"
 		"\tTMPDIR\t\ttemporary diretory (path the built-in checkra1n will be extracted to)\n"
@@ -329,7 +332,6 @@ int optparse(int argc, char* argv[]) {
 			palerain_flags |= palerain_option_palerain_version;
 			break;
 		case palerain_option_case_libcheckra1nhelper_path:
-			printf("meow\n");
 			gOverrideLibcheckra1nHelper = calloc(1, strlen(optarg) + 1);
 			if (!gOverrideLibcheckra1nHelper) {
 				return -1;

src/tools/Makefile

@@ -0,0 +1,32 @@
+C_SRC = $(wildcard *.c)
+C_OBJS = $(patsubst %,$(OBJDIR)/%,$(C_SRC:.c=.c.o))
+
+PWD != pwd
+
+OBJDIR = $(PWD)/obj
+GENDIR = $(PWD)/gen
+
+C_OBJS += $(GENDIR)/gen-payload-t7000.c.o $(GENDIR)/gen-payload-t8011.c.o $(GENDIR)/gen-payload-t8012.c.o
+
+all: dirs checkra1npatcher
+
+dirs:
+	mkdir -p $(OBJDIR) $(GENDIR)
+
+$(OBJDIR)/%.c.o: %.c
+	$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) -c -o $@ $<
+
+checkra1npatcher: $(C_OBJS) $(wildcard *.h)
+	$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(C_OBJS) $(S_OBJS) -o $@
+
+$(GENDIR)/gen-payload-%.c: payloads/%.bin
+	echo '#include <stdint.h>' > $@
+	cd payloads && xxd -iC $$(echo $< | cut -d/ -f2) | sed -e 's/unsigned int/uint32_t/' -e 's/unsigned char/uint8_t/' >> $@
+
+$(GENDIR)/gen-payload-%.c.o: $(GENDIR)/gen-payload-%.c
+	$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) -c -o $@ $<
+
+clean:
+	rm -f $(OBJDIR)/*.o $(GENDIR)/*.*
+
+.PHONY: dirs

src/tools/patcher.c

@@ -0,0 +1,436 @@
+#if __has_include(<elf.h>)
+#include <elf.h>
+#else
+#include "counterfeit_elf.h"
+#endif
+#include <errno.h>
+#include <fcntl.h>
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+extern uint8_t t7000_bin[];
+extern uint32_t t7000_bin_len;
+
+extern uint8_t t8011_bin[];
+extern uint32_t t8011_bin_len;
+
+extern uint8_t t8012_bin[];
+extern uint32_t t8012_bin_len;
+
+#define elf_assert(cond)                                                       \
+  do {                                                                         \
+    if (!(cond)) {                                                             \
+      fprintf(stderr, "Unsupported ELF file: %s:%d\n", __FILE__, __LINE__);    \
+      return -1;                                                               \
+    }                                                                          \
+  } while (0)
+
+const uint8_t elf_header[] = {0x7f, 'E', 'L', 'F'};
+
+// elf64_ptr_to_va
+// elf_va_to_ptr
+
+bool elf_check(const void *elf) {
+  const Elf64_Ehdr *hdr = elf;
+  if (memcmp(hdr->e_ident, elf_header, 4) != 0) {
+    fprintf(stderr, "Invalid ELF\n");
+    return false;
+  }
+  return true;
+}
+
+Elf64_Addr elf64_ptr_to_va(const void *elf, const void *p) {
+  if (!elf_check(elf))
+    return -1;
+
+  const Elf64_Ehdr *hdr = elf;
+
+  Elf64_Off off = (Elf64_Off)((uint8_t *)p - (uint8_t *)elf);
+
+  Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)elf + hdr->e_shoff);
+
+  for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
+    if (sections[i].sh_type == SHT_NOBITS)
+      continue;
+    if (off >= sections[i].sh_offset &&
+        off < (sections[i].sh_offset + sections[i].sh_size)) {
+      Elf64_Off section_off = off - sections[i].sh_offset;
+      if (!sections[i].sh_addr)
+        return 0;
+
+      return sections[i].sh_addr + section_off;
+    }
+  }
+  return 0;
+}
+
+Elf32_Addr elf32_ptr_to_va(const void *elf, const void *p) {
+  if (!elf_check(elf))
+    return -1;
+
+  const Elf32_Ehdr *hdr = elf;
+
+  Elf32_Off off = (Elf32_Off)((uint8_t *)p - (uint8_t *)elf);
+
+  Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)elf + hdr->e_shoff);
+
+  for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
+    if (sections[i].sh_type == SHT_NOBITS)
+      continue;
+    if (off >= sections[i].sh_offset &&
+        off < (sections[i].sh_offset + sections[i].sh_size)) {
+      Elf32_Off section_off = off - sections[i].sh_offset;
+      if (!sections[i].sh_addr)
+        return 0;
+
+      return sections[i].sh_addr + section_off;
+    }
+  }
+  return 0;
+}
+
+static void patch_arm64(void *elf, uint32_t *stream, const uint8_t *payload,
+                        const uint32_t payload_len) {
+  int64_t from = elf64_ptr_to_va(elf, stream);
+  int64_t to = elf64_ptr_to_va(elf, payload);
+
+  printf("from %" PRIx64 " to %" PRIx64 " size %" PRId32 "\n", from, to,
+         payload_len);
+
+  int64_t diff = to - from;
+
+  // printf("diff: %" PRIx64 "\n", diff);
+
+  if (diff > 0xfffff || diff < -0xfffff) {
+    fprintf(stderr, "%s: diff too large 0x%" PRIx64 " -> 0x%" PRIx64 "\n",
+            __func__, from, to);
+    return;
+  }
+
+  int32_t immlo = diff & 0x3;
+  int32_t immhi = (diff >> 2) & 0x7ffff;
+
+  uint8_t adr_reg = stream[0] & 0x1f;
+  uint8_t mov1_reg = stream[1] & 0x1f;
+  uint8_t mov2_reg = stream[2] & 0x1f;
+
+  stream[0] = 0x10000000 | (immlo << 29) | (immhi << 5) | adr_reg;
+  stream[1] = 0x52800000 | mov1_reg | ((payload_len & 0xffff) << 5);
+  stream[2] = 0x52800000 | mov2_reg | ((payload_len & 0xffff) << 5);
+
+  printf("patched: 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2]);
+}
+
+const uint8_t linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
+                                        0xbe, 0x20, 0x54, 0x20, 0x00, 0xba,
+                                        0xa4, 0x0a, 0x00, 0x00};
+const uint8_t linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
+                                        0xbe, 0xe0, 0x95, 0x20, 0x00, 0xba,
+                                        0xf4, 0x0c, 0x00, 0x00};
+const uint8_t linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
+                                        0xbe, 0x10, 0xb0, 0x20, 0x00, 0xba,
+                                        0xb8, 0x0a, 0x00, 0x00};
+
+static int patch_x86_64(void *elf, uint8_t *stream, const uint8_t *payload,
+                        const uint32_t payload_len) {
+
+  Elf64_Addr payload_to = elf64_ptr_to_va(elf, payload);
+  elf_assert(payload_to < UINT32_MAX);
+  uint32_t payload_to32 = payload_to;
+
+  memcpy(stream + 2, &payload_len, 4);
+  memcpy(stream + 7, &payload_to32, 4);
+  memcpy(stream + 12, &payload_len, 4);
+
+  printf("patched: 0x%" PRIx64 " 0x%" PRIx64 "\n", elf64_ptr_to_va(elf, stream),
+         payload_to);
+
+  return 0;
+}
+
+int parse_checkra1n64(void *c1) {
+  Elf64_Ehdr *hdr = c1;
+
+  elf_assert(hdr->e_shnum != 0);
+  elf_assert(hdr->e_shstrndx != SHN_UNDEF);
+
+  Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
+  char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
+
+  Elf64_Half text_idx = 0, kpf_idx = 0;
+
+  for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
+    if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
+      text_idx = i;
+    if (strcmp(&strings[sections[i].sh_name], ".const_kpf") == 0)
+      kpf_idx = i;
+  }
+  elf_assert(text_idx);
+  elf_assert(kpf_idx);
+  elf_assert(sections[text_idx].sh_type == SHT_PROGBITS);
+  elf_assert(sections[kpf_idx].sh_type == SHT_PROGBITS);
+  elf_assert(sections[text_idx].sh_offset);
+  elf_assert(sections[kpf_idx].sh_offset);
+  elf_assert(sections[text_idx].sh_addr);
+  elf_assert(sections[kpf_idx].sh_addr);
+
+  void *t7000_dst = (uint8_t *)c1 + 0x100 + sections[kpf_idx].sh_offset;
+
+  memcpy(t7000_dst, t7000_bin, t7000_bin_len);
+
+  void *t8011_dst = (uint8_t *)t7000_dst + t7000_bin_len;
+
+  memcpy(t8011_dst, t8011_bin, t8011_bin_len);
+
+  void *t8012_dst = (uint8_t *)t8011_dst + t8011_bin_len;
+
+  memcpy(t8012_dst, t8012_bin, t8012_bin_len);
+
+  uint8_t *stream = (uint8_t *)c1 + sections[text_idx].sh_offset;
+
+  uint32_t t7000_shared_len = 0xaa4; // shared with T7001
+  if (t7000_bin_len > t7000_shared_len)
+    t7000_shared_len = t7000_bin_len;
+
+  if (hdr->e_machine == EM_AARCH64) {
+    uint32_t *t8011_patch_base = (uint32_t *)(stream + 0x53fc),
+             *t7000_patch_base = (uint32_t *)(stream + 0x5410),
+             *t8012_patch_base = (uint32_t *)(stream + 0x53ac);
+
+    elf_assert(t8011_patch_base[0] == 0x10c5c621);
+    elf_assert(t8012_patch_base[0] == 0x10c69961);
+    elf_assert(t7000_patch_base[0] == 0x10c3b861);
+
+    patch_arm64(c1, t8011_patch_base, t8011_dst, t8011_bin_len);
+    patch_arm64(c1, t8012_patch_base, t8012_dst, t8012_bin_len);
+    patch_arm64(c1, t7000_patch_base, t7000_dst, t7000_shared_len);
+  } else if (hdr->e_machine == EM_X86_64) {
+    uint8_t *t8011_patch_base = stream + 0x3fe9,
+         *t7000_patch_base = stream + 0x3ffb,
+         *t8012_patch_base = stream + 0x3fa1;
+
+    elf_assert(memcmp(t8011_patch_base, linux_x86_64_t8011_inst,
+                      sizeof(linux_x86_64_t8011_inst)) == 0);
+    elf_assert(memcmp(t7000_patch_base, linux_x86_64_t7000_inst,
+                      sizeof(linux_x86_64_t7000_inst)) == 0);
+    elf_assert(memcmp(t8012_patch_base, linux_x86_64_t8012_inst,
+                      sizeof(linux_x86_64_t8012_inst)) == 0);
+
+    elf_assert(patch_x86_64(c1, t8011_patch_base, t8011_dst, t8011_bin_len) ==
+               0);
+    elf_assert(patch_x86_64(c1, t8012_patch_base, t8012_dst, t8012_bin_len) ==
+               0);
+    elf_assert(
+        patch_x86_64(c1, t7000_patch_base, t7000_dst, t7000_shared_len) == 0);
+  } else {
+    elf_assert(0);
+  }
+
+  return 0;
+}
+
+static int patch_i486(void *elf, uint8_t *stream, const uint8_t *payload,
+                      const uint32_t payload_len) {
+  Elf32_Addr payload_to = elf32_ptr_to_va(elf, payload);
+
+  elf_assert(stream[0] == 0x68);
+  elf_assert(stream[5] == 0x68);
+  elf_assert(stream[19] == 0xbf);
+
+  memcpy(stream + 1, &payload_len, 4);
+  memcpy(stream + 6, &payload_to, 4);
+  memcpy(stream + 20, &payload_len, 4);
+
+  printf("patched: 0x%" PRIx32 " 0x%" PRIx32 " 0x%" PRIx32 "\n", elf32_ptr_to_va(elf, stream),
+         payload_to, payload_len);
+
+  return 0;
+}
+
+int parse_checkra1n32(void *c1) {
+  Elf32_Ehdr *hdr = c1;
+
+  elf_assert(hdr->e_shnum != 0);
+  elf_assert(hdr->e_shstrndx != SHN_UNDEF);
+
+  Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
+  char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
+
+  Elf32_Half text_idx = 0, kpf_idx = 0;
+
+  for (Elf32_Half i = 0; i < hdr->e_shnum; i++) {
+    if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
+      text_idx = i;
+    if (strcmp(&strings[sections[i].sh_name], ".const_kpf") == 0)
+      kpf_idx = i;
+  }
+
+  elf_assert(text_idx);
+  elf_assert(kpf_idx);
+  elf_assert(sections[text_idx].sh_type == SHT_PROGBITS);
+  elf_assert(sections[kpf_idx].sh_type == SHT_PROGBITS);
+  elf_assert(sections[text_idx].sh_offset);
+  elf_assert(sections[kpf_idx].sh_offset);
+  elf_assert(sections[text_idx].sh_addr);
+  elf_assert(sections[kpf_idx].sh_addr);
+
+  void *t7000_dst = (uint8_t *)c1 + 0x100 + sections[kpf_idx].sh_offset;
+
+  memcpy(t7000_dst, t7000_bin, t7000_bin_len);
+
+  void *t8011_dst = (uint8_t *)t7000_dst + t7000_bin_len;
+
+  memcpy(t8011_dst, t8011_bin, t8011_bin_len);
+
+  void *t8012_dst = (uint8_t *)t8011_dst + t8011_bin_len;
+
+  memcpy(t8012_dst, t8012_bin, t8012_bin_len);
+
+  uint8_t *stream = (uint8_t *)c1 + sections[text_idx].sh_offset;
+
+  if (hdr->e_machine == EM_ARM) {
+    elf_assert(*(uint32_t *)(stream + 0x6024) == 0x13050); // T7000
+    elf_assert(*(uint32_t *)(stream + 0x600c) == 0x17200); // T8011
+    elf_assert(*(uint32_t *)(stream + 0x6008) == 0x18c20); // T8012
+
+    *(uint32_t *)(stream + 0x6024) = elf32_ptr_to_va(c1, t7000_dst);
+    *(uint32_t *)(stream + 0x600c) = elf32_ptr_to_va(c1, t8011_dst);
+    *(uint32_t *)(stream + 0x6008) = elf32_ptr_to_va(c1, t8012_dst);
+
+    const uint16_t orr_rN_rN_0x_M00[] = {
+        0x0000, 0x0c01, 0x0c02, 0x0c03, 0x0b01, 0x0c05, 0x0c06, 0x0c07,
+        0x0b02, 0x0c09, 0x0c0a, 0x0c0b, 0x0b03, 0x0c0d, 0x0c0e, 0x0c0f};
+
+    elf_assert(t7000_bin_len < 0xfff);
+    elf_assert(t8011_bin_len < 0xfff);
+    elf_assert(t8012_bin_len < 0xfff);
+
+    // T8011
+
+    uint8_t mov_reg = (*(uint32_t *)(stream + 0x5988) >> 12) & 0xf;
+    uint8_t orr_reg = (*(uint32_t *)(stream + 0x5990) >> 12) & 0xf;
+
+    *(uint32_t *)(stream + 0x5988) =
+        0xe3a00000 | mov_reg << 12 | (t8011_bin_len & 0xff);
+    *(uint32_t *)(stream + 0x5990) = 0xe3800000 |
+                                     orr_rN_rN_0x_M00[t8011_bin_len >> 8] |
+                                     orr_reg << 12 | orr_reg << 16;
+
+    // T8012, T7000 and T7001 length is shared
+    uint16_t shared_length = 0xaa4; // T7001
+    if (t8012_bin_len > shared_length && t8012_bin_len > t7000_bin_len)
+      shared_length = t8012_bin_len;
+
+    if (t7000_bin_len > shared_length && t7000_bin_len > t8012_bin_len)
+      shared_length = t7000_bin_len;
+
+    elf_assert(shared_length >= 0x8a4);
+    elf_assert(shared_length >= t8012_bin_len);
+    elf_assert(shared_length >= t7000_bin_len);
+
+    *(uint32_t *)(stream + 0x59a0) =
+        0xe3a00000 | mov_reg << 12 | (shared_length & 0xff);
+    *(uint32_t *)(stream + 0x5950) =
+        0xe3a00000 | mov_reg << 12 | (shared_length & 0xff);
+    *(uint32_t *)(stream + 0x59a4) = 0xe3800000 |
+                                     orr_rN_rN_0x_M00[t8011_bin_len >> 8] |
+                                     orr_reg << 12 | orr_reg << 16;
+
+    printf("patched: 0x%" PRIx32 " mov reg %d\n",
+           elf32_ptr_to_va(c1, stream + 0x5950), mov_reg);
+
+  } else if (hdr->e_machine == EM_386) {
+    uint8_t *t7000_patch_base = (stream + 0x4f0f),
+         *t8011_patch_base = (stream + 0x4def),
+         *t8012_patch_base = (stream + 0x4d6f);
+
+    uint32_t t7000_shared_len = 0xaa4; // shared with T7001
+    if (t7000_bin_len > t7000_shared_len)
+      t7000_shared_len = t7000_bin_len;
+    elf_assert(patch_i486(c1, t7000_patch_base, t7000_dst, t7000_shared_len) ==
+               0);
+    elf_assert(patch_i486(c1, t8011_patch_base, t8011_dst, t8011_bin_len) ==
+               0);
+    elf_assert(patch_i486(c1, t8012_patch_base, t8012_dst, t8012_bin_len) ==
+               0);
+  } else {
+    elf_assert(0);
+  }
+  return 0;
+}
+
+int parse_checkra1n(void *c1) {
+  if (!elf_check(c1))
+    return -1;
+
+  if (*((uint8_t *)c1 + EI_CLASS) == ELFCLASS32) {
+    return parse_checkra1n32(c1);
+  } else if (*((uint8_t *)c1 + EI_CLASS) == ELFCLASS64) {
+    return parse_checkra1n64(c1);
+  } else {
+    elf_assert(0);
+  }
+}
+
+int main(int argc, const char *argv[]) {
+  int retval = -1;
+
+  if (argc < 3) {
+    fprintf(stderr, "Usage: %s <checkra1n file> <out checkra1n>\n", argv[0]);
+    return -1;
+  }
+
+  int fd = open(argv[1], O_RDWR);
+  if (fd == -1) {
+    fprintf(stderr, "Could not open %s: %d (%s)\n", argv[1], errno,
+            strerror(errno));
+    return -1;
+  }
+
+  off_t size = lseek(fd, 0, SEEK_END);
+
+  if (size == -1) {
+    fprintf(stderr, "Could not seek checkra1n: %d (%s)\n", errno,
+            strerror(errno));
+    goto out_close_fd;
+  }
+
+  void *c1 =
+      mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_FILE | MAP_PRIVATE, fd, 0);
+  if (c1 == MAP_FAILED) {
+    fprintf(stderr, "Could not map checkra1n: %d (%s)\n", errno,
+            strerror(errno));
+    goto out_close_fd;
+  }
+
+  parse_checkra1n(c1);
+
+  int out_fd = open(argv[2], O_CREAT | O_WRONLY, 0755);
+  if (out_fd == -1) {
+    fprintf(stderr, "Could not open %s: %d (%s)\n", argv[2], errno,
+            strerror(errno));
+    goto out_munmap;
+  }
+
+  ssize_t wrote = write(out_fd, c1, size);
+  if (wrote != size) {
+    fprintf(stderr, "Could not write %s: %d (%s)\n", argv[2], errno,
+            strerror(errno));
+    goto out_close_out_fd;
+  }
+
+  retval = 0;
+out_close_out_fd:
+  close(out_fd);
+out_munmap:
+  munmap(c1, size);
+out_close_fd:
+  close(fd);
+  return retval;
+}

src/tools/payloads

@@ -0,0 +1 @@
+../helper/payloads

src/usb.xml

@@ -3,6 +3,8 @@
 <dict>
 	<key>platform-application</key>
 	<true/>
+	<key>get-task-allow</key>
+	<true/>
 	<key>com.apple.private.security.no-container</key>
 	<true/>
 	<key>com.apple.security.iokit-user-client-class</key>