Fix DFU button guidance for iPod 9,1 (#766)

Signed-off-by: Nick Chan <[email protected]>

.github/workflows/build.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install dependencies (packages)
         run: |
@@ -45,7 +45,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ github.event_name != 'pull_request' }}
-        uses: wangyucode/sftp-upload-action@v1.4.8
+        uses: wangyucode/sftp-upload-action@v3
         with:
           host: ${{ secrets.NICKCHAN_FTP_HOST }}
           port: ${{ secrets.NICKCHAN_FTP_PORT }}
@@ -84,7 +84,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -336,7 +336,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ github.event_name != 'pull_request' }}
-        uses: wangyucode/sftp-upload-action@v1.4.8
+        uses: wangyucode/sftp-upload-action@v3
         with:
           host: ${{ secrets.NICKCHAN_FTP_HOST }}
           port: ${{ secrets.NICKCHAN_FTP_PORT }}
@@ -383,7 +383,7 @@ jobs:
     needs: build-darwin
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -508,7 +508,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ github.event_name != 'pull_request' }}
-        uses: wangyucode/sftp-upload-action@v1.4.8
+        uses: wangyucode/sftp-upload-action@v3
         with:
           host: ${{ secrets.NICKCHAN_FTP_HOST }}
           port: ${{ secrets.NICKCHAN_FTP_PORT }}
@@ -542,7 +542,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -848,7 +848,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ github.event_name != 'pull_request' }}
-        uses: wangyucode/sftp-upload-action@v1.4.8
+        uses: wangyucode/sftp-upload-action@v3
         with:
           host: ${{ secrets.NICKCHAN_FTP_HOST }}
           port: ${{ secrets.NICKCHAN_FTP_PORT }}
@@ -861,7 +861,7 @@ jobs:
 
       - name: Upload usbmuxd artifact
         if: ${{ github.event_name != 'pull_request' }}
-        uses: wangyucode/sftp-upload-action@v1.4.8
+        uses: wangyucode/sftp-upload-action@v3
         with:
           host: ${{ secrets.NICKCHAN_FTP_HOST }}
           port: ${{ secrets.NICKCHAN_FTP_PORT }}
@@ -883,7 +883,7 @@ jobs:
     needs: [build-docs, build-darwin, darwin-dist, build-Linux]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Get branch name
         id: branch-name

docs/palera1n.1

@@ -1,12 +1,12 @@
 .\"-
-.\" Copyright (c) 2024 Nick Chan
+.\" Copyright (c) 2026 Nick Chan
 .\" SPDX-License-Identifier: MIT
 .\"
 .Dd "23 December 2024"
 .Dt palera1n 1
 .Sh NAME
 .Nm palera1n
-.Nd arm64 iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 jailbreaking tool
+.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool
 .Sh SYNOPSIS
 .Nm
 .Op Fl cCdDEfhIlLnpRsSTvV
@@ -18,16 +18,18 @@
 .Op Fl i Ar checkra1n file
 .Op Fl -version
 .Op Fl -force-revert
+.Op Fl -force-enable-ssv
+.Op Fl -override-libcheckra1nhelper Ar hook dylib
 .Sh DESCRIPTION
 .Nm
-jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 device,
+jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device,
 utilizing the
 .Em checkm8
 bootROM exploit.
 .Pp
 .Nm
 provides rootful and rootless jailbreak modes.
-On iOS/iPadOS 15.0 and later and on tvOS 18.2 or later,
+On iOS/iPadOS 15.0 and later,
 .Nm
 is able to jailbreak the device in fakefs-rootful mode, where /
 is writable, as well as rootless mode, where / cannot be written to.
@@ -133,6 +135,19 @@ files. As a result, using the loader app to install the jailbreak environment
 is not supported when this option is used together with
 .Fl f , -fakefs
 \[char46]
+.It Fl -force-enable-ssv
+Force the jailbreak to detect Signed System Volume (SSV) as being required on
+the system. This option provides compatibility with previous version of palera1n
+that incorrectly detect SSV as being required on tvOS 18.2 and above. When using
+this option with
+.Fl f , -fakefs ,
+the jailbreak will behave as if fakefs is required, which allows the user to boot
+into fakefs possibly created by previous versions of palera1n, or remove it if
+the
+.Fl -force-revert
+option is specified as well.
+(It is technically possible to setup fakefs using this option as well, but this
+is not a supported scenario)
 .It Fl B , -setup-fakefs-partial
 Like
 .Fl c , -setup-fakefs
@@ -168,6 +183,10 @@ Proceed in rootful mode. Despite its name, this applies to both full, partial fa
 Prints help text.
 .It Fl i , -checkra1n-file Ar checkra1n file
 Specify the path to a custom checkra1n file.
+On Apple platforms this will disable the built-in checkra1n helper.
+A custom one may still be specified with
+.Fl -override-libcheckra1nhelper
+\[char46]
 .It Fl k , -override-pongo Ar pongo file
 Override PongoOS image. The raw image, named
 .Em Pongo.bin
@@ -222,6 +241,10 @@ Enable debug logging. The option may be repeated for extra verbosity.
 Boots the device in verbose mode, allowing boot logs to be seen.
 .It Fl I , -device-info
 Prints info about device and exits.
+.It Fl -override-libcheckra1nhelper Ar hook dylib
+(Apple platforms only) Specify a custom dylib to insert into checkra1n via
+.Em DYLD_INSERT_LIBRARIES
+\[char46]
 .El
 .Sh ENVIRONMENTAL VARIABLES
 .Bl -tag -width -indent

include/palerain.h

@@ -26,6 +26,8 @@
 #define palerain_option_case_force_revert palerain_option_case(1)
 #define palerain_option_case_libcheckra1nhelper_path palerain_option_case(2)
 #define palerain_option_case_cli		  palerain_option_case(3)
+#define palerain_option_case_force_enable_ssv		  palerain_option_case(4)
+
 
 
 #ifdef USE_LIBUSB

src/dfuhelper.c

@@ -30,7 +30,7 @@
 #define FORMAT_KEY_VALUE 1
 #define FORMAT_XML 2
 
-#define NO_PHYSICAL_HOME_BUTTON (cpid == 0x8015 || (cpid == 0x8010 && (bdid == 0x08 || bdid == 0x0a || bdid == 0x0c || bdid == 0x0e)))
+#define USES_VOLUME_DOWN_FOR_DFU (cpid == 0x8015 || (cpid == 0x8010 && (bdid == 0x08 || bdid == 0x0a || bdid == 0x0c || bdid == 0x0e || bdid == 0x16)))
 #define IS_APPLE_TV_HD (cpid == 0x7000 && bdid == 0x34)
 #define IS_APPLE_TV_4K (cpid == 0x8011 && bdid == 0x02)
 #define IS_APPLE_HOME1 (cpid == 0x7000 && bdid == 0x38)
@@ -192,7 +192,7 @@ static void* connected_recovery_mode(struct irecv_device_info* info) {
 			step(4, 0, "Put device upside down orientation", conditional, ecid);
 		}
 	} else if (cpid != 0x8012) {
-		if (NO_PHYSICAL_HOME_BUTTON)
+		if (USES_VOLUME_DOWN_FOR_DFU)
 			step(4, 2, "Hold volume down + side button", NULL, 0);
 		else
 			step(4, 2, "Hold home + power button", NULL, 0);
@@ -204,7 +204,7 @@ static void* connected_recovery_mode(struct irecv_device_info* info) {
 			return NULL;
 		}
 		printf("\r\033[K");
-		if (NO_PHYSICAL_HOME_BUTTON) {
+		if (USES_VOLUME_DOWN_FOR_DFU) {
 			step(2, 0, "Hold volume down + side button", NULL, 0);
 			step(10, 0, "Hold volume down button", conditional, ecid);
 		} else {

src/helper/phookra1n.h

@@ -4,7 +4,11 @@
 #include <stdint.h>
 #include <stdio.h>
 
+#ifdef DEV_BUILD
 #define dprintf(...) printf(__VA_ARGS__)
+#else
+#define dprintf(...)
+#endif
 
 extern uint8_t t7000_bin[];
 extern uint32_t t7000_bin_len;

src/optparse.c

@@ -37,6 +37,7 @@ static struct option longopts[] = {
 	{"rootless", no_argument, NULL, 'l'},
 	{"demote", no_argument, NULL, 'd'},
 	{"force-revert", no_argument, NULL, palerain_option_case_force_revert},
+	{"force-enable-ssv", no_argument, NULL, palerain_option_case_force_enable_ssv},
 	{"no-colors", no_argument, NULL, 'S'},
 	{"safe-mode", no_argument, NULL, 's'},
 	{"telnetd", no_argument, NULL, 'T'},
@@ -78,9 +79,10 @@ static int usage(int e, char* prog_name)
 #endif
 			"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
 			"Copyright (C) 2024, palera1n team, All Rights Reserved.\n\n"
-			"iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 arm64 jailbreaking tool\n\n"
+			"iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 arm64 jailbreaking tool\n\n"
 			"\t--version\t\t\t\tPrint version\n"
 			"\t--force-revert\t\t\t\tRemove jailbreak\n"
+			"\t--force-enable-ssv\t\t\tForce SSV detection to result in YES\n"
 #ifdef DEV_BUILD
 			"\t-1, --test1\t\t\t\tSet palerain_option_test1\n"
 			"\t-2, --test2\t\t\t\tSet palerain_option_test2\n"
@@ -122,6 +124,9 @@ static int usage(int e, char* prog_name)
 #ifdef TUI
 			"\t-t, --tui\t\t\t\tForce interactive TUI\n"
 			"\t--cli\t\t\t\t\tForce cli mode\n"
+#endif
+#if defined(__APPLE__)
+			"\t--override-libcheckra1nhelper <file>\tCustom checkra1n hook dylib\n"
 #endif
 		"\nEnvironmental variables:\n"
 		"\tTMPDIR\t\ttemporary diretory (path the built-in checkra1n will be extracted to)\n"
@@ -329,13 +334,15 @@ int optparse(int argc, char* argv[]) {
 			palerain_flags |= palerain_option_palerain_version;
 			break;
 		case palerain_option_case_libcheckra1nhelper_path:
-			printf("meow\n");
 			gOverrideLibcheckra1nHelper = calloc(1, strlen(optarg) + 1);
 			if (!gOverrideLibcheckra1nHelper) {
 				return -1;
 			}
 			snprintf(gOverrideLibcheckra1nHelper, strlen(optarg) + 1, "%s", optarg);
 			break;
+		case palerain_option_case_force_enable_ssv:
+			palerain_flags |= palerain_option_ssv;
+			break;
 		default:
 			usage(1, argv[0]);
 			break;

src/tools/patcher.c

@@ -31,7 +31,7 @@ extern uint32_t t8012_bin_len;
     }                                                                          \
   } while (0)
 
-const char elf_header[] = {0x7f, 'E', 'L', 'F'};
+const uint8_t elf_header[] = {0x7f, 'E', 'L', 'F'};
 
 // elf64_ptr_to_va
 // elf_va_to_ptr
@@ -127,13 +127,13 @@ static void patch_arm64(void *elf, uint32_t *stream, const uint8_t *payload,
   printf("patched: 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2]);
 }
 
-const char linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
+const uint8_t linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
                                         0xbe, 0x20, 0x54, 0x20, 0x00, 0xba,
                                         0xa4, 0x0a, 0x00, 0x00};
-const char linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
+const uint8_t linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
                                         0xbe, 0xe0, 0x95, 0x20, 0x00, 0xba,
                                         0xf4, 0x0c, 0x00, 0x00};
-const char linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
+const uint8_t linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
                                         0xbe, 0x10, 0xb0, 0x20, 0x00, 0xba,
                                         0xb8, 0x0a, 0x00, 0x00};
 
@@ -163,7 +163,7 @@ int parse_checkra1n64(void *c1) {
   Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
   char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
 
-  Elf64_Half text_idx, kpf_idx;
+  Elf64_Half text_idx = 0, kpf_idx = 0;
 
   for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
     if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
@@ -262,7 +262,7 @@ int parse_checkra1n32(void *c1) {
   Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
   char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
 
-  Elf32_Half text_idx, kpf_idx;
+  Elf32_Half text_idx = 0, kpf_idx = 0;
 
   for (Elf32_Half i = 0; i < hdr->e_shnum; i++) {
     if (strcmp(&strings[sections[i].sh_name], ".text") == 0)