1.4.1

hiii

.gitignore

@@ -13,7 +13,10 @@ tweaksinstalled
 logs
 dump.raw
 other/rootfs/jbin/loader.app
+other/rootfs/jbin/jb*
+other/rootfs/jbin/launchd
 .rd_in_progress
 logs
 .disclaimeragree
 .fs-*
+other/rootfs/jbin/binpack

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.4.1
+- ibot.patched fix
+- Use payload on the X
+- Other random changes/fixes
+
 ## 1.4.0
 
 - Does not mount user data partition for iPhone X compatibility, isn't even really needed anymore

README.md

@@ -2,7 +2,7 @@
     <img src="https://avatars.githubusercontent.com/u/114239186?s=100&v=4" alt="palera1n logo">
     <p>palera1n</p>
 </h1>
-<h3 align="center">An iOS 15.0-15.7.1 work-in-progress, (semi-)tethered checkm8 jailbreak.</h3>
+<h3 align="center">An iOS 15.0-16.2 work-in-progress, (semi-)tethered checkm8 jailbreak.</h3>
 <p align="center">
     <strong><a href="CHANGELOG.md">Change Log</a></strong>
     •
@@ -36,6 +36,7 @@ Thank you so much to our Patreons that make the future development possible! You
 <a href="https://github.com/samh06"><img width=64 src="https://user-images.githubusercontent.com/18669106/206333607-881d7ca1-f3bf-4e18-b620-25de0c527315.png"></img></a>
 <a href="https://havoc.app"><img width=64 src="https://docs.havoc.app/img/standard_icon.png"></img></a>
 <a href="https://twitter.com/yyyyyy_public"><img width=64 src="https://pbs.twimg.com/profile_images/1429332550112079876/dQQgsURc_400x400.jpg"></img></a>
+<a href="https://twitter.com/0xSp00kyb0t"><img width=64 src="https://pbs.twimg.com/profile_images/1603601553226620935/1t4yD1bD_400x400.jpg"></img></a>
 
 # Warning
 - We are **NOT** responsible for any data loss. The user of this program accepts responsibility should something happen to their device. While nothing should happen, jailbreaking has risks in itself. **If your device is stuck in recovery, please run one of the following:**
@@ -43,13 +44,14 @@ Thank you so much to our Patreons that make the future development possible! You
    - irecovery -n
 
 # Prerequisites
-- A checkm8 vulnerable iOS device on iOS 15 (A8-A11)
-  - The device must be on iOS 15.0-15.7.1
+- A checkm8 vulnerable iOS device on iOS 15 or 16 (A8-A11)
+  - The device must be on iOS 15.0-16.2
 - Linux or macOS computer
   - Python 3 must be installed.
 
 ### A10 and A11 devices
 - On A10 and A11, **you must disable your passcode while in the jailbroken state**.
+  - On iOS 16 A10+, if you EVER enabled a passcode on 16, you have to reset through the settings app/restore with a computer
   - On A10, this can be fixed in the future by implementing blackbird.
   - On A11, we don't have a SEP exploit yet.
 
@@ -93,10 +95,11 @@ If you want to make a rootless repo, use the official [palera1n repo](https://gi
 - [m1sta](https://github.com/m1stadev) for [pyimg4](https://github.com/m1stadev/PyIMG4)
 - [tihmstar](https://github.com/tihmstar) for [pzb](https://github.com/tihmstar/partialZipBrowser)/original [iBoot64Patcher](https://github.com/tihmstar/iBoot64Patcher)/original [liboffsetfinder64](https://github.com/tihmstar/liboffsetfinder64)/[img4tool](https://github.com/tihmstar/img4tool)
 - [Tom](https://github.com/guacaplushy) for a couple patches and bugfixes
+    - For maintaining [Kernel64Patcher](https://github.com/palera1n/Kernel64Patcher)
 - [xerub](https://github.com/xerub) for [img4lib](https://github.com/xerub/img4lib) and [restored_external](https://github.com/xerub/sshrd) in the ramdisk
 - [Cryptic](https://github.com/Cryptiiiic) for [iBoot64Patcher](https://github.com/Cryptiiiic/iBoot64Patcher) fork, and [liboffsetfinder64](https://github.com/Cryptiiiic/liboffsetfinder64) fork
 - [libimobiledevice](https://github.com/libimobiledevice) for several tools used in this project (irecovery, ideviceenterrecovery etc), and [nikias](https://github.com/nikias) for keeping it up to date
 - [Nick Chan](https://github.com/asdfugil) general help with patches and iBoot payload stuff
-- [Dora](https://github.com/dora2ios) for iBoot payload and iBootpatcher2
+- [Dora](https://github.com/dora2-iOS) for iBoot payload and iBootpatcher2
 - [Sam Bingner](https://github.com/sbingner) for [Substitute](https://github.com/sbingner/substitute)
 - [Serena](https://github.com/SerenaKit) for helping with boot ramdisk.

other/rootfs/jbin/post.sh

@@ -1,10 +1,8 @@
 binpack=/jbin/binpack
 
 # uicache loader app
-$binpack/bin/mkdir -p /var/.palera1n
 $binpack/bin/rm -rf /var/.palera1n/loader.app
-$binpack/bin/cp -R /jbin/loader.app /var/.palera1n
-$binpack/usr/bin/uicache -p /var/.palera1n/loader.app
+$binpack/usr/bin/uicache -p /jbin/loader.app
 
 # respring
 $binpack/usr/bin/killall -9 SpringBoard

palera1n.sh

@@ -1,7 +1,12 @@
 #!/usr/bin/env bash
 
 mkdir -p logs
-set -e
+set -e 
+
+log="$(date +%T)"-"$(date +%F)"-"$(uname)"-"$(uname -r)".log
+cd logs
+touch "$log"
+cd ..
 
 {
 
@@ -11,7 +16,7 @@ echo "[*] Command ran:`if [ $EUID = 0 ]; then echo " sudo"; fi` ./palera1n.sh $@
 # Variables
 # =========
 ipsw="" # IF YOU WERE TOLD TO PUT A CUSTOM IPSW URL, PUT IT HERE. YOU CAN FIND THEM ON https://appledb.dev
-version="1.4.0"
+version="1.4.1"
 os=$(uname)
 dir="$(pwd)/binaries/$os"
 commit=$(git rev-parse --short HEAD)
@@ -290,13 +295,11 @@ _exit_handler() {
     [ $? -eq 0 ] && exit
     echo "[-] An error occurred"
 
-    cd logs
-    for file in *.log; do
-        if [[ "$file" != "SUCCESS_"* ]] || [[ "$file" != "FAIL_"* ]]; then 
-            mv "$file" FAIL_${file}
-        fi
-    done
-    cd ..
+    if [ -d "logs" ]; then
+        cd logs
+        mv "$log" FAIL_${log}
+        cd ..
+    fi
 
     echo "[*] A failure log has been made. If you're going ask for help, please attach the latest log."
 }
@@ -452,7 +455,7 @@ if [ "$(get_device_mode)" = "ramdisk" ]; then
 fi
 
 if [ "$(get_device_mode)" = "normal" ]; then
-    version=$(_info normal ProductVersion)
+    version=${version:-$(_info normal ProductVersion)}
     arch=$(_info normal CPUArchitecture)
     if [ "$arch" = "arm64e" ]; then
         echo "[-] palera1n doesn't, and never will, work on non-checkm8 devices"
@@ -562,10 +565,10 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
     
     if [ "$tweaks" = "1" ]; then
         echo "[*] Testing for baseband presence"
-        if [ "$(remote_cmd "/usr/bin/mgask HasBaseband | grep -E 'true|false'")" = "true" ] && [ "${cpid}" == *"0x700"* ]; then
+        if [ "$(remote_cmd "/usr/bin/mgask HasBaseband | grep -E 'true|false'")" = "true" ] && [[ "${cpid}" == *"0x700"* ]]; then
             disk=7
         elif [ "$(remote_cmd "/usr/bin/mgask HasBaseband | grep -E 'true|false'")" = "false" ]; then
-            if [ "${cpid}" == *"0x700"* ]; then
+            if [[ "${cpid}" == *"0x700"* ]]; then
                 disk=6
             else
                 disk=7
@@ -581,6 +584,8 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
         else
             fs=disk0s1s$disk
         fi
+
+        echo "$disk" > .fs-"$deviceid"
     fi
 
     # mount filesystems, no user data partition
@@ -598,7 +603,9 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
 
     if [ "$restorerootfs" = "1" ]; then
         echo "[*] Removing Jailbreak"
-        remote_cmd "/sbin/apfs_deletefs $fs > /dev/null || true"
+        if [ ! "$fs" = "disk1s1" ] || [ ! "$fs" = "disk0s1s1" ]; then
+            remote_cmd "/sbin/apfs_deletefs $fs > /dev/null || true"
+        fi
         remote_cmd "rm -f /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.im4p /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcachd"
         remote_cmd "mv /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache || true"
         remote_cmd "/bin/sync"
@@ -619,14 +626,13 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
     if [ "$semi_tethered" = "1" ]; then
         if [ -z "$skip_fakefs" ]; then
             echo "[*] Creating fakefs, this may take a while (up to 10 minutes)"
-            remote_cmd "/sbin/newfs_apfs -A -D -o role=r -v System /dev/disk0s1" && {
-                sleep 2
-                remote_cmd "/sbin/mount_apfs /dev/$fs /mnt8"
-                
-                sleep 1
-                remote_cmd "cp -a /mnt1/. /mnt8/"
-                sleep 1
-                echo "[*] fakefs created, continuing..."
+            remote_cmd "/sbin/newfs_apfs -A -D -o role=r -v Xystem /dev/disk0s1" && {
+            sleep 2
+            remote_cmd "/sbin/mount_apfs /dev/$fs /mnt8"
+            sleep 1
+            remote_cmd "cp -a /mnt1/. /mnt8/"
+            sleep 1
+            echo "[*] fakefs created, continuing..."
             } || echo "[*] Using the old fakefs, run restorerootfs if you need to clean it" 
         fi
     fi
@@ -647,11 +653,7 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
     echo "[*] Patching the kernel"
     remote_cmd "rm -f /mnt6/$active/kpf"
     if [[ "$version" == *"16"* ]]; then
-        if [ "$semi_tethered" = "1" ]; then
-            remote_cp binaries/Kernel16Patcher-nolivefs.ios root@localhost:/mnt6/$active/kpf
-        else
-            remote_cp binaries/Kernel16Patcher.ios root@localhost:/mnt6/$active/kpf
-        fi
+        remote_cp binaries/Kernel16Patcher.ios root@localhost:/mnt6/$active/kpf
     else
         remote_cp binaries/Kernel15Patcher.ios root@localhost:/mnt6/$active/kpf
     fi
@@ -663,7 +665,7 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
         if [ "$semi_tethered" = "1" ]; then
             remote_cmd "cp /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak"
         else
-            remote_cmd "mv /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak"
+            remote_cmd "mv /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache.bak || true"
         fi
     fi
     sleep 1
@@ -688,9 +690,9 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
     remote_cp root@localhost:/mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched work/
     if [ "$tweaks" = "1" ]; then
         if [[ "$version" == *"16"* ]]; then
-            "$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -e -a -o -u -l -t -h
+            "$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -e -o -u -l -t -h -d
         else
-            "$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -e -a -l
+            "$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -e -l
         fi
     else
         "$dir"/Kernel64Patcher work/kcache.patched work/kcache.patched2 -a
@@ -726,6 +728,7 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
         fi
 
         if [[ "$version" == *"16"* ]]; then
+            remote_cmd "rm -rf /mnt$di/System/Library/Caches/com.apple.dyld"
             remote_cmd "ln -s /System/Cryptexes/OS/System/Library/Caches/com.apple.dyld /mnt$di/System/Library/Caches/"
         fi
 
@@ -780,6 +783,10 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
         rm rfs.zip rootfs.zip
         cd ../../..
 
+        # download binpack
+        mkdir -p other/rootfs/jbin/binpack
+        curl -L https://static.palera.in/binpack.tar -o other/rootfs/jbin/binpack/binpack.tar
+
         sleep 1
         remote_cp -r other/rootfs/* root@localhost:/mnt$di
         {
@@ -799,8 +806,6 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
         remote_cmd "rm /mnt$di/jbin/binpack/binpack.tar"
     fi
 
-    echo "$di" > .fs-"$deviceid"
-
     rm -rf work BuildManifest.plist
     mkdir work
     rm .rd_in_progress
@@ -825,7 +830,7 @@ if [ ! -f blobs/"$deviceid"-"$version".der ]; then
         "$dir"/ideviceenterrecovery $(_info normal UniqueDeviceID)
     fi
     _wait recovery
-    _dfuhelper
+    _dfuhelper "$cpid"
     sleep 2
 fi
 
@@ -848,7 +853,7 @@ else
     boot_args="-v"
 fi
 
-if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10"* ]]; then
+if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10,"* ]]; then
     if [ ! -f boot-"$deviceid"/.payload ]; then
         rm -rf boot-"$deviceid"
     fi
@@ -867,8 +872,8 @@ if [ ! -f boot-"$deviceid"/ibot.img4 ]; then
     #"$dir"/img4tool -e -s $(pwd)/blobs/"$deviceid"-"$version".shsh2 -m work/IM4M
     cd work
 
-    # Do payload if on iPhone 7-10
-    if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10"* ]]; then
+    # Do payload if on iPhone 7-X
+    if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10,"* ]]; then
         if [[ "$version" == "16.0"* ]] || [[ "$version" == "15"* ]]; then
             newipswurl="$ipswurl"
         else
@@ -953,7 +958,7 @@ sleep 2
 _pwn
 _reset
 echo "[*] Booting device"
-if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10"* ]]; then
+if [[ "$deviceid" == iPhone9,[1-4] ]] || [[ "$deviceid" == "iPhone10,"* ]]; then
     sleep 1
     "$dir"/irecovery -f boot-"$deviceid"/ibot.img4
     sleep 3
@@ -982,28 +987,27 @@ else
         sleep 4
         "$dir"/irecovery -f boot-"$deviceid"/ibot.img4
     fi
-fi
 
-if [ -z "$semi_tethered" ]; then
-    sleep 2
-    "$dir"/irecovery -c fsboot
-fi
-
-cd logs
-for file in *.log; do 
-    if [[ "$file" != "SUCCESS_"* ]]; then 
-        mv "$file" SUCCESS_${file}
+    if [ -z "$semi_tethered" ]; then
+       sleep 2
+       "$dir"/irecovery -c fsboot
     fi
-done
-cd ..
+fi
+
+if [ -d "logs" ]; then
+    cd logs
+     mv "$log" SUCCESS_${log}
+    cd ..
+fi
 
 rm -rf work rdwork
 echo ""
 echo "Done!"
 echo "The device should now boot to iOS"
-echo "If this is your first time jailbreaking, open the Pogo app and then press Install"
-echo "Otherwise, open the Pogo app and press Do All in the Tools section"
+echo "When you unlock the device, it will respring about 30 seconds after"
+echo "If this is your first time jailbreaking, open the new palera1n app, then press Install"
+echo "Otherwise, press Do All in the settings section of the app"
 echo "If you have any issues, please join the Discord server and ask for help: https://dsc.gg/palera1n"
 echo "Enjoy!"
 
-} | tee logs/"$(date +%T)"-"$(date +%F)"-"$(uname)"-"$(uname -r)".log
+} 2>&1 | tee logs/${log}