update help and documentation

docs/palera1n.1

@@ -1,12 +1,12 @@
 .\"-
-.\" Copyright (c) 2024 Nick Chan
+.\" Copyright (c) 2026 Nick Chan
 .\" SPDX-License-Identifier: MIT
 .\"
 .Dd "23 December 2024"
 .Dt palera1n 1
 .Sh NAME
 .Nm palera1n
-.Nd arm64 iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 jailbreaking tool
+.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool
 .Sh SYNOPSIS
 .Nm
 .Op Fl cCdDEfhIlLnpRsSTvV
@@ -18,9 +18,10 @@
 .Op Fl i Ar checkra1n file
 .Op Fl -version
 .Op Fl -force-revert
+.Op Fl -override-libcheckra1nhelper Ar hook dylib
 .Sh DESCRIPTION
 .Nm
-jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 device,
+jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device,
 utilizing the
 .Em checkm8
 bootROM exploit.
@@ -168,6 +169,10 @@ Proceed in rootful mode. Despite its name, this applies to both full, partial fa
 Prints help text.
 .It Fl i , -checkra1n-file Ar checkra1n file
 Specify the path to a custom checkra1n file.
+On Apple platforms this will disable the built-in checkra1n helper.
+A custom one may still be specified with
+.Fl -override-libcheckra1nhelper
+\[char46]
 .It Fl k , -override-pongo Ar pongo file
 Override PongoOS image. The raw image, named
 .Em Pongo.bin
@@ -222,6 +227,10 @@ Enable debug logging. The option may be repeated for extra verbosity.
 Boots the device in verbose mode, allowing boot logs to be seen.
 .It Fl I , -device-info
 Prints info about device and exits.
+.It Fl -override-libcheckra1nhelper Ar hook dylib
+(Apple platforms only) Specify a custom dylib to insert into checkra1n via
+.Em DYLD_INSERT_LIBRARIES
+\[char46]
 .El
 .Sh ENVIRONMENTAL VARIABLES
 .Bl -tag -width -indent

src/helper/phookra1n.h

@@ -4,7 +4,11 @@
 #include <stdint.h>
 #include <stdio.h>
 
+#ifdef DEV_BUILD
 #define dprintf(...) printf(__VA_ARGS__)
+#else
+#define dprintf(...)
+#endif
 
 extern uint8_t t7000_bin[];
 extern uint32_t t7000_bin_len;

src/optparse.c

@@ -78,7 +78,7 @@ static int usage(int e, char* prog_name)
 #endif
 			"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
 			"Copyright (C) 2024, palera1n team, All Rights Reserved.\n\n"
-			"iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 arm64 jailbreaking tool\n\n"
+			"iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 arm64 jailbreaking tool\n\n"
 			"\t--version\t\t\t\tPrint version\n"
 			"\t--force-revert\t\t\t\tRemove jailbreak\n"
 #ifdef DEV_BUILD
@@ -122,6 +122,9 @@ static int usage(int e, char* prog_name)
 #ifdef TUI
 			"\t-t, --tui\t\t\t\tForce interactive TUI\n"
 			"\t--cli\t\t\t\t\tForce cli mode\n"
+#endif
+#if defined(__APPLE__)
+			"\t--override-libcheckra1nhelper <file>\tCustom checkra1n hook dylib\n"
 #endif
 		"\nEnvironmental variables:\n"
 		"\tTMPDIR\t\ttemporary diretory (path the built-in checkra1n will be extracted to)\n"
@@ -329,7 +332,6 @@ int optparse(int argc, char* argv[]) {
 			palerain_flags |= palerain_option_palerain_version;
 			break;
 		case palerain_option_case_libcheckra1nhelper_path:
-			printf("meow\n");
 			gOverrideLibcheckra1nHelper = calloc(1, strlen(optarg) + 1);
 			if (!gOverrideLibcheckra1nHelper) {
 				return -1;

src/tools/patcher.c

@@ -31,7 +31,7 @@ extern uint32_t t8012_bin_len;
     }                                                                          \
   } while (0)
 
-const char elf_header[] = {0x7f, 'E', 'L', 'F'};
+const uint8_t elf_header[] = {0x7f, 'E', 'L', 'F'};
 
 // elf64_ptr_to_va
 // elf_va_to_ptr
@@ -127,13 +127,13 @@ static void patch_arm64(void *elf, uint32_t *stream, const uint8_t *payload,
   printf("patched: 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2]);
 }
 
-const char linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
+const uint8_t linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
                                         0xbe, 0x20, 0x54, 0x20, 0x00, 0xba,
                                         0xa4, 0x0a, 0x00, 0x00};
-const char linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
+const uint8_t linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
                                         0xbe, 0xe0, 0x95, 0x20, 0x00, 0xba,
                                         0xf4, 0x0c, 0x00, 0x00};
-const char linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
+const uint8_t linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
                                         0xbe, 0x10, 0xb0, 0x20, 0x00, 0xba,
                                         0xb8, 0x0a, 0x00, 0x00};
 
@@ -163,7 +163,7 @@ int parse_checkra1n64(void *c1) {
   Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
   char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
 
-  Elf64_Half text_idx, kpf_idx;
+  Elf64_Half text_idx = 0, kpf_idx = 0;
 
   for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
     if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
@@ -262,7 +262,7 @@ int parse_checkra1n32(void *c1) {
   Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
   char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
 
-  Elf32_Half text_idx, kpf_idx;
+  Elf32_Half text_idx = 0, kpf_idx = 0;
 
   for (Elf32_Half i = 0; i < hdr->e_shnum; i++) {
     if (strcmp(&strings[sections[i].sh_name], ".text") == 0)