Compare commits

..
2 Commits
Author SHA1 Message Date
Nick Chan 71240fb719 Accept --cli in CLI only builds for compatibility 2024-07-22 14:01:42 +08:00
Nick Chan 006518db3d actions: Remove TUI=1 from make 2024-07-22 01:44:01 +08:00
13 changed files with 82 additions and 99 deletions

No files matched your search

+1 -1
View File
@@ -1,6 +1,6 @@
name: No Template
description: Create a standard issue, no template involved.
labels: [palera1n help]
labels: [palera1n]
body:
- type: textarea
id: description
+1 -1
View File
@@ -1,6 +1,6 @@
name: Feature Request
description: Request a feature in palera1n!
labels: [enhancement]
labels: [enhancement, palera1n]
body:
- type: textarea
id: feature-request
+7 -1
View File
@@ -1,6 +1,12 @@
name: Create Issue
description: Ask help for palera1n regarding support or generally how it works!
labels: [palera1n help]
labels: [palera1n]
assignees:
- khcrysalis
- asdfugil
- elliessurviving
- hg13bs
- afastaudir8
body:
- type: input
id: device
+6 -6
View File
@@ -72,7 +72,7 @@ jobs:
gnu_triple: aarch64-apple-darwin
os: iphoneos
minos: 7.0
runs-on: macos-15
runs-on: macos-12
env:
MBEDTLS_VERSION: 3.5.2
READLINE_VERSION: 8.2
@@ -91,7 +91,7 @@ jobs:
- name: Install dependencies (packages)
run: |
sudo /usr/local/bin/pip3 install jsonschema jinja2
brew install make autoconf automake pkg-config gnu-sed gettext libtool
brew install make autoconf automake pkg-config gnu-sed gettext
sudo rm -rf /usr/local/Frameworks/Python*
curl -LO https://github.com/ProcursusTeam/ldid/releases/download/v2.1.5-procursus7/ldid_macosx_x86_64
sudo install -m755 ldid_macosx_x86_64 /usr/local/bin/ldid
@@ -102,7 +102,7 @@ jobs:
- name: Select correct Xcode
run: |
sudo xcode-select -s /Applications/Xcode_16.2.app
sudo xcode-select -s /Applications/Xcode_14.2.app
- name: Setup environment
run: |
@@ -114,9 +114,9 @@ jobs:
echo "CC=$(xcrun --find cc)" >> $GITHUB_ENV
echo "CXX=$(xcrun --find c++)" >> $GITHUB_ENV
echo "CPP=$(xcrun --find cc) -E" >> $GITHUB_ENV
echo "CFLAGS=-g -Os -isystem ${{ env.SDK }}/usr/include/c++/v1 -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isysroot ${{ env.SDK }} -isystem $(pwd)/sysroot/usr/local/include -Os -g -flto=full -Wl,-object_path_lto,lto.o -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" >> $GITHUB_ENV
echo "CPPFLAGS=-g -Os -isystem ${{ env.SDK }}/usr/include/c++/v1 -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isysroot ${{ env.SDK }} -isystem $(pwd)/sysroot/usr/local/include -Wno-error-implicit-function-declaration -Os -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" >> $GITHUB_ENV
echo "CXXFLAGS=-stdlib=libc++ -g -Os -isystem$(TARGET_SYSROOT)/usr/include/c++/v1 -isysroot ${{ env.SDK }} -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isystem $(pwd)/sysroot/usr/local/include -Os -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" >> $GITHUB_ENV
echo "CFLAGS=-g -Os -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isysroot ${{ env.SDK }} -isystem $(pwd)/sysroot/usr/local/include -Os -g -flto=full -Wl,-object_path_lto,lto.o -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" >> $GITHUB_ENV
echo "CPPFLAGS=-g -Os -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isysroot ${{ env.SDK }} -isystem $(pwd)/sysroot/usr/local/include -Wno-error-implicit-function-declaration -Os -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" >> $GITHUB_ENV
echo "CXXFLAGS=-stdlib=libc++ -g -Os -isysroot ${{ env.SDK }} -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isystem $(pwd)/sysroot/usr/local/include -Os -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" >> $GITHUB_ENV
echo "LDFLAGS=-g -Wl,-dead_strip -arch ${{ matrix.arch }} -isysroot ${{ env.SDK }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -L$(pwd)/sysroot/usr/local/lib" >> $GITHUB_ENV
echo "CFLAGS_FOR_BUILD=-arch $(uname -m) -isysroot $(xcrun -sdk macosx --show-sdk-path) -Os" >> $GITHUB_ENV
echo "CXXFLAGS_FOR_BUILD=-stdlib=libc++ -arch $(uname -m) -isysroot $(xcrun -sdk macosx --show-sdk-path) -Os" >> $GITHUB_ENV
+5 -2
View File
@@ -3,7 +3,7 @@ DEP = $(SRC)/dep_root
STRIP = strip
CC ?= cc
CFLAGS += -isystem $(DEP)/include -I$(SRC)/include -I$(SRC) -D_XOPEN_SOURCE=500
CFLAGS += -Wall -Wextra -Wno-unused-parameter -DPALERAIN_VERSION=\"2.1\" -DHAVE_LIBIMOBILEDEVICE
CFLAGS += -Wall -Wextra -Wno-unused-parameter -DPALERAIN_VERSION=\"2.0\" -DHAVE_LIBIMOBILEDEVICE
CFLAGS += -Wno-unused-variable -I$(SRC)/src -std=c99 -pedantic-errors -D_C99_SOURCE -D_POSIX_C_SOURCE=200112L
LIBS += $(DEP)/lib/libimobiledevice-1.0.a $(DEP)/lib/libirecovery-1.0.a $(DEP)/lib/libusbmuxd-2.0.a
LIBS += $(DEP)/lib/libimobiledevice-glue-1.0.a $(DEP)/lib/libplist-2.0.a -pthread -lm
@@ -59,12 +59,15 @@ ifneq ($(BAKERAIN_DEVELOPE_R),)
CFLAGS += -DBAKERAIN_DEVELOPE_R="\"$(BAKERAIN_DEVELOPE_R)\""
endif
BUILD_DATE := $(shell LANG=C date)
BUILD_NUMBER := $(shell git rev-list --count HEAD)
BUILD_TAG := $(shell git describe --dirty --tags --abbrev=7)
BUILD_WHOAMI := $(shell whoami)
BUILD_BRANCH := $(shell git rev-parse --abbrev-ref HEAD)
BUILD_COMMIT := $(shell git rev-parse HEAD)
CFLAGS += -DBUILD_STYLE="\"$(BUILD_STYLE)\"" -DBUILD_TAG="\"$(BUILD_TAG)\""
CFLAGS += -DBUILD_STYLE="\"$(BUILD_STYLE)\"" -DBUILD_DATE="\"$(BUILD_DATE)\""
CFLAGS += -DBUILD_WHOAMI="\"$(BUILD_WHOAMI)\"" -DBUILD_TAG="\"$(BUILD_TAG)\""
CFLAGS += -DBUILD_NUMBER="\"$(BUILD_NUMBER)\"" -DBUILD_BRANCH="\"$(BUILD_BRANCH)\""
CFLAGS += -DBUILD_COMMIT="\"$(BUILD_COMMIT)\""
+4 -33
View File
@@ -15,6 +15,9 @@ Jailbreak for A8 through A11, T2 devices, on iOS/iPadOS/tvOS 15.0, bridgeOS 5.0
## Device Support
> [!NOTE]
> Apple TV & iBridge support are not currently in the beta releases of palera1n, ETA s0n
<!--- Mobile --->
| iPhone(s) | iPad(s) | iPod(s) | Apple TV(s) |
@@ -75,44 +78,12 @@ Jailbreak for A8 through A11, T2 devices, on iOS/iPadOS/tvOS 15.0, bridgeOS 5.0
> USB-C port on Apple Silicon Macs *may* require manual unplugging and replugging of the lightning cable after checkm8 exploit. This problem may be solved by connecting via USB hub, though extensions can vary.
## Usage
```
Usage: palera1n [-DEhpvVdsSLRnPI] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]
--version Print version
--force-revert Remove jailbreak
-d, --demote Demote
-D, --dfuhelper Exit after entering DFU
-e, --boot-args <boot arguments> XNU boot arguments
-E, --enter-recovery Enter recovery mode
-h, --help Show this help
-i, --override-checkra1n <file> Override checkra1n
-k, --override-pongo <file> Override Pongo image
-K, --override-kpf <file> Override kernel patchfinder
-L, --jbinit-log-to-file Make jbinit log to /cores/jbinit.log (can be read from sandbox while jailbroken)
-n, --exit-recovery Exit recovery mode
-I, --device-info Print info about the connected device
-o, --override-overlay <file> Override overlay
-p, --pongo-shell Boots to PongoOS shell
-P, --pongo-full Boots to a PongoOS shell with default images already uploaded
-r, --override-ramdisk <file> Override ramdisk
-R, --reboot-device Reboot connected device in normal mode
-s, --safe-mode Enter safe mode
-S, --no-colors Disable colors on the command line
-v, --debug-logging Enable debug logging
This option can be repeated for extra verbosity.
-V, --verbose-boot Verbose boot
Environmental variables:
TMPDIR temporary diretory (path the built-in checkra1n will be extracted to)
```
## Installing
Visit https://palera.in
## Disclaimers
We are **NOT** responsible for any data loss, or the result of a device being bricked. When using palera1n, the user should accept responsibility if anything happens to their device during the process.
- If your device is stuck in recovery, please run futurerestore `--exit-recovery`, or use `irecovery -n`, or `palera1n -n`.
- If your device is stuck in recovery, please run futurerestore `--exit-recovery`, or use `irecovery -n`.
- If you're unable to get out of recovery via these methods please restore with iTunes or Finder.
- palera1n **will not work** in VirtualBox, VMware or any virtual machine that doesn't support PCI passthrough.
+27 -24
View File
@@ -2,11 +2,11 @@
.\" Copyright (c) 2024 Nick Chan
.\" SPDX-License-Identifier: MIT
.\"
.Dd "23 December 2024"
.Dd "30 March 2024"
.Dt palera1n 1
.Sh NAME
.Nm palera1n
.Nd arm64 iOS/iPadOS/tvOS 15.0-18.3, bridgeOS 5.0-9.3 jailbreaking tool
.Nd arm64 iOS/iPadOS/tvOS 15.0-18.0, bridgeOS 5.0-9.0 jailbreaking tool
.Sh SYNOPSIS
.Nm
.Op Fl cCdDEfhIlLnpRsSTvV
@@ -20,21 +20,19 @@
.Op Fl -force-revert
.Sh DESCRIPTION
.Nm
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15.0-18.2, bridgeOS 5.0-9.2 device,
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15.0-18.0, bridgeOS 5.0-9.0 device,
utilizing the
.Em checkm8
bootROM exploit.
.Pp
.Nm
provides rootful and rootless jailbreak modes.
On iOS/iPadOS 15.0 and later and on tvOS 18.2 or later,
On iOS/iPadOS,
.Nm
is able to jailbreak the device in fakefs-rootful mode, where /
is writable, as well as rootless mode, where / cannot be written to.
On tvOS and bridgeOS,
only rootful is supported. On versions where fakefs-rootful is not
applicable, palera1n modifies the actual root filesystem instead
of making a fakefs
only rootful is supported, and it uses the actual filesystem instead of a fakefs.
.Pp
Due to the nature of the
.Em checkm8
@@ -103,7 +101,9 @@ list of supported devicecs:
.It Apple T2 MacBookPro15,3
.It Apple T2 MacBookAir8,1
.It Apple T2 MacBookPro15,4
.It iBridge2,11 (Unknown Mac)
.It Apple T2 MacBookAir8,2
.It iBridge2,13 (Unknown Mac)
.It Apple T2 MacBookPro16,1
.It Apple T2 MacBookAir9,1
.It Apple T2 MacBookPro16,2
@@ -139,14 +139,12 @@ Like
but the size of the created fakefs is smaller at the expense of having unwritable
parts in rarely-written paths. When jailbreaking 16 GB devices, this option must be used
when setting up fakefs for rootful, as they do not have enough storage for full fakefs.
This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they
require fakefs for rootful.
This flag is only supported on iOS/iPadOS.
.It Fl c , -setup-fakefs
When used with
.Fl f , -fakefs ,
creates the new APFS volume required for rootful. Will fail if one already exists.
This flag is supported on iOS/iPadOS 15.0 or later and tvOS 18.2 or later, as they
require fakefs for rootful.
This flag is only supported on iOS/iPadOS.
.It Fl C , -clean-fakefs
This option is not currently supported and is a no-operation in this version of
.Nm
@@ -157,13 +155,17 @@ Set the effective production fuse to 0, so as to enable hardware debugging featu
Execute the DFU helper to guide the user into putting the device into DFU mode
then exit.
.It Fl e , -boot-args Ar boot arguments
Specify custom XNU kernel command line. Additionally, the
Specify custom XNU kernel command line. The
.Em rootdev=md0
argument is used by
.Nm
and cannot be overriden. Additionally, the
.Em wdt=-1
argument is used during fakefs setup.
.It Fl E , -enter-recovery
Exit after entering recovery mode.
.It Fl f , -fakefs
Proceed in rootful mode. Despite its name, this applies to both full, partial fakefs, as well as realfs, and it still applies even when trying to force revert.
Proceed in rootful mode. This applies to both full, partial fakefs, as well as realfs.
.It Fl h , -help
Prints help text.
.It Fl i , -checkra1n-file Ar checkra1n file
@@ -181,6 +183,10 @@ command. If in doubt, use
iOS15 branch or your own fork of it.
.It Fl l , -rootless
Proceed in rootless mode. This option is only supported on iOS/iPadOS.
.It Fl L , -jbinit-log-to-file
This option is not currently supported and is a no-operation in this version of
.Nm
\[char46]
.It Fl n , -exit-recovery
Exit recovery mode and exit.
.It Fl o , -override-overlay Ar overlay file
@@ -235,13 +241,13 @@ is extracted and executed here. When not set, /tmp is used.
.Sh EXAMPLES
To (re-)jailbreak in rootless mode:
.Pp
.Dl "palera1n -l"
.Dl "palera1n"
.Pp
To setup fakefs for rootful mode:
.Pp
.Dl "palera1n -fc"
.Pp
After the device has rebooted into recovery mode, follow the following example.
After the device has rebooted, follow the following example.
.Pp
To re-jailbreak in rootful mode:
.Pp
@@ -298,7 +304,7 @@ option might cause some versions for tvOS to crash and not boot.
Offical Apple USB-C cables as well as some other USB-C cables cannot be used to enter DFU mode.
USB-A cable with male USB-C to female USB-A adapter works fine.
.Sh POST INSTALLATION (iOS/iPadOS)
The palera1n loader app will take up to 1 minute to appear on the homescreen after the
The palera1n loader app will take up to 30 seconds to appear on the homescreen after the
device has booted. If it does not appear, you can try using the shortcut:
.Pp
.Lk https://www.icloud.com/shortcuts/8cd5f489c8854ee0ab9ee38f2e62f87d
@@ -326,7 +332,7 @@ loader app to install additional jailbreak files.
.Bl -tag -width "/var/jb/Library/LaunchDaemons"
.It Pa /cores
The location of the temporary filesystem where jailbreak files are stashed during boot.
The location of the temporary filesystem where jailbreak files are stash during boot.
.It Pa /Library/LaunchDaemons
The directory where jailbreak-specific
.Xr launchd.plist 5
@@ -346,17 +352,14 @@ has been mounted.
.El
.Sh BUGS
.Nm
may crash if the machine it is running on has non-compliant USB devices plugged in.
may crash if the machine it is running on:
.Pp
.Nm
will fail to initialize on Linux when there are no USB devices plugged in.
Usually this is not a problem on PCs since the built-in root hubs are also
USB devices. However, on platforms such as Apple Silicon Macs in Linux, since
there are no built-in USB hubs, at least one USB device needs to be manually
plugged in for palera1n to be initialized.
.Dl "- Has non-compliant USB devices plugged in"
.Pp
The exploit may also work less reliably on some hosts, like AMD desktops, or some MediaTek devices.
.Pp
The device may randomly crash and reboot due to launchd using too much memory.
.Pp
The built-in SSH server might be not accessible with password after bootstrapping rootful,
since the bootstrap uses a custom crypt() function that is not supported
by the built-in SSH server.
+1 -1
View File
@@ -72,7 +72,7 @@ usb_ret_t USBBulkUpload(usb_device_handle_t handle, void *data, uint32_t len);
#endif
#ifndef PALERAIN_VERSION
#define PALERAIN_VERSION "2.1"
#define PALERAIN_VERSION "2.0"
#endif
#if defined(__APPLE__)
+1 -1
View File
@@ -68,7 +68,7 @@ BUILD_OPTIONS += TUI
CFLAGS += -DTUI
endif
CHECKRA1N_VERSION ?= 0.1337.3
CHECKRA1N_VERSION ?= 0.1337.2
LIPO = lipo
LDID = ldid
+14 -22
View File
@@ -67,30 +67,13 @@ int connected_normal_mode(const usbmuxd_device_info_t *usbmuxd_device) {
LOG(LOG_ERROR, "Unable to get device information");
return 0;
}
if (strcmp(dev.CPUArchitecture, "arm64")) {
if (strncmp(dev.CPUArchitecture, "arm64", strlen("arm64"))) {
devinfo_free(&dev);
LOG(LOG_WARNING, "Ignoring non-arm64 device...");
LOG(LOG_WARNING, "palera1n doesn't and never will work on A12+ (arm64e)");
return -1;
}
if ((palerain_flags & palerain_option_device_info)) {
printf("Mode: normal\n");
printf("ProductType: %s\n", dev.productType);
printf("Architecture: %s\n", dev.CPUArchitecture);
printf("Version: %s\n", dev.productVersion);
printf("DisplayName: %s\n", dev.displayName);
device_has_booted = true;
set_spin(0);
unsubscribe_cmd();
return 0;
}
/* For Booting Linux etc */
if (!getenv("PALERA1N_BYPASS_PASSCODE_CHECK") &&
!strncmp(dev.productType, "iPhone10,", strlen("iPhone10,")
)) {
if (!strncmp(dev.productType, "iPhone10,", strlen("iPhone10,"))) {
if (!(palerain_flags & palerain_option_device_info))
LOG(LOG_VERBOSE2, "Product %s requires passcode to be disabled", dev.productType);
unsigned char passcode_state = 0;
@@ -108,10 +91,19 @@ int connected_normal_mode(const usbmuxd_device_info_t *usbmuxd_device) {
return -1;
}
}
if (getenv("PALERA1N_BYPASS_PASSCODE_CHECK"))
LOG(LOG_WARNING, "Bypassed passcode check");
if ((palerain_flags & palerain_option_device_info)) {
printf("Mode: normal\n");
printf("ProductType: %s\n", dev.productType);
printf("Architecture: %s\n", dev.CPUArchitecture);
printf("Version: %s\n", dev.productVersion);
printf("DisplayName: %s\n", dev.displayName);
device_has_booted = true;
set_spin(0);
unsubscribe_cmd();
return 0;
}
if (verbose > 1) {
/* (LOG_VERBOSE - 3) or below*/
LOG(LOG_INFO, "Telling device with udid %s to enter recovery mode immediately", usbmuxd_device->udid);
-2
View File
@@ -148,8 +148,6 @@ int palera1n(int argc, char *argv[], char *envp[]) {
palerain_option_device_info)
) || device_has_booted)
goto normal_exit;
pthread_cancel(pongo_thread);
pthread_join(pongo_thread, NULL);
if (exec_checkra1n()) goto cleanup;
if ((palerain_flags & (palerain_option_pongo_exit | palerain_option_demote)))
+15 -2
View File
@@ -19,6 +19,7 @@
#endif
uint64_t* palerain_flags_p = &palerain_flags;
static bool force_use_verbose_boot = false;
char* gOverrideLibcheckra1nHelper = NULL;
static struct option longopts[] = {
@@ -77,7 +78,7 @@ static int usage(int e, char* prog_name)
#endif
"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
"Copyright (C) 2024, palera1n team, All Rights Reserved.\n\n"
"iOS/iPadOS/tvOS 15.0-18.1, bridgeOS 5.0-9.1 arm64 jailbreaking tool\n\n"
"iOS/iPadOS/tvOS 15.0-17.5, bridgeOS 5.0-8.3 arm64 jailbreaking tool\n\n"
"\t--version\t\t\t\tPrint version\n"
"\t--force-revert\t\t\t\tRemove jailbreak\n"
#ifdef DEV_BUILD
@@ -147,9 +148,11 @@ int optparse(int argc, char* argv[]) {
case 'B':
palerain_flags |= palerain_option_setup_partial_root;
palerain_flags |= palerain_option_setup_rootful;
palerain_flags |= palerain_option_verbose_boot;
break;
case 'c':
palerain_flags |= palerain_option_setup_rootful;
palerain_flags |= palerain_option_verbose_boot;
break;
case 'C':
palerain_flags |= palerain_option_clean_fakefs;
@@ -172,12 +175,16 @@ int optparse(int argc, char* argv[]) {
break;
case 'V':
palerain_flags |= palerain_option_verbose_boot;
force_use_verbose_boot = true;
#ifdef TUI
tui_options_verbose_boot = true;
#endif
break;
case 'e':
if (strlen(optarg) > (sizeof(xargs_cmd) - 0x20)) {
if (strstr(optarg, "rootdev=") != NULL) {
LOG(LOG_FATAL, "The boot arg rootdev= is already used by palera1n and cannot be overriden");
return -1;
} else if (strlen(optarg) > (sizeof(xargs_cmd) - 0x20)) {
LOG(LOG_FATAL, "Boot arguments too long");
return -1;
}
@@ -344,8 +351,10 @@ int optparse(int argc, char* argv[]) {
printf(
"palera1n " PALERAIN_VERSION "\n"
BUILD_COMMIT " " BUILD_NUMBER " (" BUILD_BRANCH ")\n\n"
"Build date: " BUILD_DATE "\n"
"Build style: " BUILD_STYLE "\n"
"Build tag: " BUILD_TAG "\n"
"Built by: " BUILD_WHOAMI "\n"
#ifdef USE_LIBUSB
"USB backend: libusb\n"
#else
@@ -360,6 +369,10 @@ int optparse(int argc, char* argv[]) {
LOG(LOG_WARNING, "telnetd is enabled, this is a security hole");
}
if ((strstr(xargs_cmd, "serial=") != NULL) && !force_use_verbose_boot && (palerain_flags & palerain_option_setup_rootful)) {
palerain_flags &= ~palerain_option_verbose_boot;
}
if ((palerain_flags & (palerain_option_tui)) && (palerain_flags & (palerain_option_cli))) {
LOG(LOG_FATAL, "cannot specify both --tui and --cli");
return -1;
-3
View File
@@ -42,9 +42,6 @@ void *pongo_usb_callback(stuff_t *arg) {
}
#endif
LOG(LOG_INFO, "Found PongoOS USB Device");
if (palerain_flags & palerain_option_pongo_exit)
goto done;
usb_device_handle_t handle = arg->handle;
#ifdef TUI
if (tui_is_jailbreaking) {