rootful real part 1

* add lto and debug symbols so we can generate the .DSYM

* add lto and debug symbols so we can generate the .DSYM

* fix pythonplayer moment

.github/workflows/build.yml

@@ -11,6 +11,14 @@ on:
       - 'CMakeLists.txt'
       - '.github/workflows/build.yml'
   pull_request:
+    paths:
+        - 'src/**'
+        - 'docs/**'
+        - 'patches/**'
+        - 'include/**'
+        - 'Makefile'
+        - 'CMakeLists.txt'
+        - '.github/workflows/build.yml'
   workflow_dispatch:
 
 jobs:
@@ -120,7 +128,7 @@ jobs:
           echo "CC=$(xcrun --find cc)" >> $GITHUB_ENV
           echo "CXX=$(xcrun --find c++)" >> $GITHUB_ENV
           echo "CPP=$(xcrun --find cc) -E" >> $GITHUB_ENV
-          echo "CFLAGS=-g -Os -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isysroot ${{ env.SDK }} -isystem $(pwd)/sysroot/usr/local/include -Os" >> $GITHUB_ENV
+          echo "CFLAGS=-g -Os -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isysroot ${{ env.SDK }} -isystem $(pwd)/sysroot/usr/local/include -Os -g -flto=full -Wl,-object_path_lto,lto.o" >> $GITHUB_ENV
           echo "CPPFLAGS=-g -Os -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isysroot ${{ env.SDK }} -isystem $(pwd)/sysroot/usr/local/include -Wno-error-implicit-function-declaration -Os" >> $GITHUB_ENV
           echo "CXXFLAGS=-stdlib=libc++ -g -Os -isysroot ${{ env.SDK }} -arch ${{ matrix.arch }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -isystem $(pwd)/sysroot/usr/local/include -Os" >> $GITHUB_ENV
           echo "LDFLAGS=-g -Wl,-dead_strip -arch ${{ matrix.arch }} -isysroot ${{ env.SDK }} -m${{ matrix.os }}-version-min=${{ matrix.minos }} -L$(pwd)/sysroot/usr/local/lib" >> $GITHUB_ENV
@@ -384,7 +392,7 @@ jobs:
       - name: Build debs
         run: |
           make -j$(sysctl -n hw.ncpu) docs
-          version=$(git describe --dirty --tags --abbrev=7 | sed 's|^v||')
+          version=$(git describe --dirty --tags --abbrev=7 | sed 's|^v||' | sed 's|-beta|~beta|')
 
           # Darwin x86_64
           mkdir -p stage/DEBIAN
@@ -399,7 +407,7 @@ jobs:
           ginstall -Dm644 docs/palera1n.1 stage/opt/procursus/usr/share/man/man1/palera1n.1
           chmod +x stage/opt/procursus/bin/palera1n
 
-          dpkg-deb -b stage palera1n_$version_darwin-amd64.deb
+          dpkg-deb -Zzstd -b stage palera1n_darwin-amd64.deb
           mv palera1n*.deb ready/
           rm -rf stage
 
@@ -416,7 +424,7 @@ jobs:
           ginstall -Dm644 docs/palera1n.1 stage/opt/procursus/usr/share/man/man1/palera1n.1
           chmod +x stage/opt/procursus/bin/palera1n
 
-          dpkg-deb -b stage palera1n_$version_darwin-arm64.deb
+          dpkg-deb -Zzstd -b stage palera1n_darwin-arm64.deb
           mv palera1n*.deb ready/
           rm -rf stage
 
@@ -433,7 +441,7 @@ jobs:
           ginstall -Dm644 docs/palera1n.1 stage/usr/share/man/man1/palera1n.1
           chmod +x stage/usr/bin/palera1n
 
-          dpkg-deb -b stage palera1n_$version_iphoneos-arm.deb
+          dpkg-deb -Zzstd -b stage palera1n_iphoneos-arm.deb
           mv palera1n*.deb ready/
           rm -rf stage
 
@@ -450,7 +458,7 @@ jobs:
           ginstall -Dm644 docs/palera1n.1 stage/var/jb/usr/share/man/man1/palera1n.1
           chmod +x stage/var/jb/usr/bin/palera1n
 
-          dpkg-deb -b stage palera1n_$version_iphoneos-arm64.deb
+          dpkg-deb -Zzstd -b stage palera1n_iphoneos-arm64.deb
           mv palera1n*.deb ready/
           rm -rf stage
 
@@ -744,7 +752,7 @@ jobs:
 
       - name: Build debs
         run: |
-          version=$(git describe --dirty --tags --abbrev=7 | sed 's|^v||')
+          version=$(git describe --dirty --tags --abbrev=7 | sed 's|^v||' | sed 's|-beta|~beta|')
 
           make -j$(nproc) docs
           mkdir -p stage/DEBIAN
@@ -759,7 +767,7 @@ jobs:
           install -Dm644 docs/palera1n.1 stage/usr/share/man/man1/palera1n.1
           chmod +x stage/usr/bin/palera1n
 
-          dpkg-deb -b stage palera1n_$version_${{ env.ARCH_NAME }}.deb
+          dpkg-deb -b stage palera1n_${{ env.ARCH_NAME }}.deb
           mv palera1n*.deb ready/
           rm -rf stage
 

.gitignore

@@ -22,3 +22,4 @@ src/*.dmg.c
 .idea
 src/stage2/
 src/libcheckra1nhelper.dylib*
+src/Pongo.bin

Makefile

@@ -1,4 +1,4 @@
-NAME = Tumbleweed
+NAME = bakepale
 
 SRC = $(shell pwd)
 DEP = $(SRC)/dep_root
@@ -6,7 +6,7 @@ STRIP = strip
 CC ?= cc
 CFLAGS += -I$(DEP)/include -I$(SRC)/include -I$(SRC)
 CFLAGS += -Wall -Wextra -DPALERAIN_VERSION=\"2.0.0\" -Wall -Wextra -Wno-unused-parameter
-CFLAGS += -Wno-unused-variable -I$(SRC)/src -std=c99 -pedantic-errors -D_C99_SOURCE -D_POSIX_C_SOURCE=200112L -D_DARWIN_C_SOURCE
+CFLAGS += -Wno-unused-variable -I$(SRC)/src -std=c99 -pedantic-errors -D_C99_SOURCE -D_POSIX_C_SOURCE=200112L
 LIBS += $(DEP)/lib/libimobiledevice-1.0.a $(DEP)/lib/libirecovery-1.0.a $(DEP)/lib/libusbmuxd-2.0.a
 LIBS += $(DEP)/lib/libimobiledevice-glue-1.0.a $(DEP)/lib/libplist-2.0.a -pthread
 ifeq ($(TARGET_OS),)
@@ -25,11 +25,13 @@ LDFLAGS += -static -no-pie -Wl,--gc-sections
 endif
 LIBS += $(DEP)/lib/libmbedtls.a $(DEP)/lib/libmbedcrypto.a $(DEP)/lib/libmbedx509.a $(DEP)/lib/libreadline.a
 
-ifeq ($(DEV_BUILD),1)
+ifeq ($(TUI),1)
 LIBS += $(DEP)/lib/libnewt.a $(DEP)/lib/libpopt.a $(DEP)/lib/libslang.a
 ifeq ($(TARGET_OS),Linux)
 LIBS += $(DEP)/lib/libgpm.a
 endif
+endif
+ifeq ($(DEV_BUILD),1)
 CFLAGS += -O0 -g -DDEV_BUILD -fno-omit-frame-pointer
 ifeq ($(ASAN),1)
 BUILD_STYLE=ASAN
@@ -74,13 +76,13 @@ clean:
 	$(MAKE) -C docs clean
 
 download-deps:
-	$(MAKE) -C src checkra1n-macos checkra1n-linux-arm64 checkra1n-linux-armel checkra1n-linux-x86 checkra1n-linux-x86_64 checkra1n-kpf-pongo ramdisk.dmg binpack.dmg
+	$(MAKE) -C src checkra1n-macos checkra1n-linux-arm64 checkra1n-linux-armel checkra1n-linux-x86 checkra1n-linux-x86_64 checkra1n-kpf-pongo ramdisk.dmg binpack.dmg Pongo.bin
 
 docs:
 	$(MAKE) -C docs
 
 distclean: clean
-	rm -rf palera1n-* palera1n*.dSYM src/checkra1n-* src/checkra1n-kpf-pongo src/ramdisk.dmg src/binpack.dmg
+	rm -rf palera1n-* palera1n*.dSYM src/checkra1n-* src/checkra1n-kpf-pongo src/ramdisk.dmg src/binpack.dmg src/Pongo.bin
 
 .PHONY: all palera1n clean docs distclean
 

README.md

@@ -1,5 +1,8 @@
-<img align="left" height="120" src="https://cdn.discordapp.com/attachments/1017854329887129611/1073858292159352862/thing.png" alt="palera1n logo" style="float: left;"/>
-<h3 align="right">An iOS 15.0-16.3.1 work-in-progress, <br>semi-tethered checkm8 jailbreak</h3> 
+<picture>
+	<source media="(prefers-color-scheme: light)" srcset="https://cdn.discordapp.com/attachments/1028398976640229380/1088049124441604136/IMG_0033.png">
+	<img align="left" height="120" src="https://cdn.discordapp.com/attachments/1017854329887129611/1073858292159352862/thing.png" alt="palera1n logo" style="float: left;"/>
+</picture>
+<h3 align="right">An iOS 15.0-16.4 work-in-progress, <br>semi-tethered checkm8 jailbreak</h3> 
 
 <p align="right" >
   <strong><a href="https://cdn.nickchan.lol/palera1n/c-rewrite/releases/v2.0.0-beta.4/palera1n.1.html">Usage</a></strong>
@@ -12,6 +15,8 @@
 </p>
 <div class="clear"></div>
 
+## If you want a jailbreak, you should read the [guide](https://palera.in).
+
 ### You can obtain v2.0.0 beta [here](https://github.com/palera1n/palera1n/releases).
 If you need an older v2.0.0 beta, please get it [here](https://github.com/palera1n/palera1n-c/releases/tag/v2.0.0-beta.4).
 
@@ -47,7 +52,7 @@ Make sure you provide full details on your device, such as:
 
 Using `-V` and `-v` would help with debugging.
 
-Join the [Support Discord](https://dsc.gg/palera1n), and find the palera1n-c thread under #jailbreak [here](https://discord.com/channels/1028398973452570725/1074251283143344180).
+Join the [Support Discord](https://dsc.gg/palera1n), and create a thread in [#support](https://discord.com/channels/1028398973452570725/1028730487700738130) or ask in [#general](https://discord.com/channels/1028398973452570725/1028398976640229380).
 
 # Credits
 <details><summary>palera1n-c Contributors and Credits</summary>
@@ -81,5 +86,6 @@ Thank you so much to our Patreons that make the future development possible! You
 <a href="https://github.com/beast9265"><img width=64 style="border-radius: 25%;" src="https://avatars.githubusercontent.com/u/79794946?v=4"></img></a>
 <a href="https://twitter.com/0x7FF7"><img width=64 style="border-radius: 25%;" src="https://pbs.twimg.com/profile_images/1630818481191919618/8MWaJ1F7_400x400.jpg"></img></a>
 <a href="https://sideloadly.io/"><img width=64 style="border-radius: 25%;" src="https://sideloadly.io/icon.png"></img></a>
-<a href="https://blog.stevesec.com/"><img width=64 style="border-radius: 25%;"  src="https://blog.stevesec.com/img/avatar.jpg"></img></a>
+<a href="https://blog.stevesec.com/"><img width=64 style="border-radius: 25%;" src="https://blog.stevesec.com/img/avatar.jpg"></img>
+<a href="https://github.com/0xilis/"><img width=64 style="border-radius: 25%;" src="https://github.com/0xilis.png"></img></a>
 </p>

docs/palera1n.1

@@ -6,7 +6,7 @@
 .Dt palera1n 1
 .Sh NAME
 .Nm palera1n
-.Nd iOS 15.0-16.3.1 arm64 iOS/iPadOS jailbreaking tool
+.Nd iOS 15.0-16.4 arm64 iOS/iPadOS jailbreaking tool
 .Sh SYNOPSIS
 .Nm
 .Op Fl cCdDEfhIlLnpRsSvV
@@ -16,9 +16,11 @@
 .Op Fl r Ar ramdisk file
 .Op Fl K Ar KPF file
 .Op Fl i Ar checkra1n file
+.Op Fl -version
+.Op Fl -force-revert
 .Sh DESCRIPTION
 .Nm
-jailbreaks any iOS/iPadOS device with an arm64 (arm64e excluded) on iOS 15.0-16.3.1,
+jailbreaks any iOS/iPadOS device with an arm64 (arm64e excluded) on iOS 15.0-16.4,
 utilizing the
 .Em checkm8
 bootROM exploit.
@@ -50,7 +52,7 @@ In the remainder of this document, the term "iOS" and "iPadOS" will be used inte
 as the difference is negligible as far as the jailbreak is concerened.
 .Pp
 .Sh SUPPORTED DEVICES
-As described above, arm64 iOS 15.0-16.3.1 devices are supported, here is an explicit
+As described above, arm64 iOS 15.0-16.4 devices are supported, here is an explicit
 list of supported devicecs:
 
 .Bl -tag -compact
@@ -94,11 +96,11 @@ Remove the jailbreak while keeping user data. Some jailbreak files may remain
 after running this command. Additionally, jailbreak apps will remain on the 
 home screen on for a while even when the files are deleted as the icon cache
 still has their icons. When used with
-.Fl f , -fakefs ,
+.Fl f , -rootful ,
 this will actually boot the device in rootless mode then delete the jailbreak
 files. As a result, using the loader app to install the jailbreak environment
 is not supported when this option is used together with
-.Fl f , -fakefs
+.Fl f , -rootful
 \[char46]
 .It Fl B , -setup-fakefs-partial
 Like
@@ -109,8 +111,8 @@ when setting up fakefs for rootful, as they do not have enough storage for full
 This option currently does not work on iOS 16.
 .It Fl c , -setup-fakefs
 When used with
-.Fl f , -fakefs ,
-creates the new APFS volume required for rootful. Will fail if one already exists.
+.Fl f , -rootful ,
+creates the new APFS volume required for rootful on iOS/iPadOS. Will fail if one already exists.
 .It Fl d , -demote
 Set the effective production fuse to 0, so as to enable hardware debugging features.
 .It Fl D , -dfuhelper
@@ -126,7 +128,7 @@ and cannot be overriden. Additionally, the
 argument is used during fakefs setup.
 .It Fl E , -enter-recovery
 Exit after entering recovery mode.
-.It Fl f , -fakefs
+.It Fl f , -rootful
 Proceed in rootful mode. This applies to both full fakefs and partial fakefs.
 .It Fl h , -help
 Prints help text.
@@ -147,7 +149,7 @@ iOS15 branch or your own fork of it.
 Proceed in rootless mode, this is the default when neither
 .Fl l , -rootless
 and
-.Fl f , -fakefs
+.Fl f , -rootful
 is specified.
 .Fl L , -jbinit-log-to-file
 Makes jbinit log to
@@ -257,7 +259,7 @@ before they can be ran on a device jailbroken with
 \[char46]
 .Pp
 When using rootful mode, the
-.Fl f , -fakefs
+.Fl f , -rootful
 flag must be specified at all times. It does not matter whether you want to create fakefs,
 create partial fakefs, rejailbreak or remove jailbreak.
 .Sh POST INSTALLATION
@@ -309,8 +311,7 @@ may crash if the machine it is running on:
 .Pp
 The exploit may also work less reliably on some hosts, like AMD desktops, or some MediaTek devices.
 .Pp
-.Fl B , -setup-fakefs-partial
-does not work on iOS 16.
+The device may randomly crash and reboot due to launchd receiving signal 7 (SIGEMT).
 .Sh NOTES
 .Nm
 injects a dylib into launchd to allow the

include/kerninfo.h

@@ -60,6 +60,10 @@
 #define palerain_option_setup_rootful_forced (1 << 3) /* create fakefs over an existing one */
 #define palerain_option_setup_partial_root   (1 << 4) /* fakefs creating should be partial */
 #define palerain_option_checkrain_is_clone   (1 << 5) /* supplied checkra1n is checkra1n clone */
+#define palerain_option_rootless_livefs      (1 << 6) /* mount root livefs on rootless */
+#define palerain_option_no_ssv               (1 << 7) /* no signed system volume */
+#define palerain_option_force_fakefs         (1 << 8) /* force fakefs, even without SSV */
+#define palerain_option_rootless             (1 << 9) /* rootless jailbreak */
 
 #ifdef DEV_BUILD
 #define palerain_option_test1               (1 << 29)
@@ -69,7 +73,7 @@
 // palerain host options
 #define host_option_dfuhelper_only       (1 << 0) /* dfuhelper only */
 #define host_option_pongo_exit           (1 << 1) /* boot to clean pongo shell */
-#ifdef DEV_BUILD
+#ifdef TUI
 #define host_option_tui                  (1 << 2) /* use terminal user interface */
 #else
 #define host_option_res1                 (1 << 2) /* reserved */

include/palerain.h

@@ -2,7 +2,7 @@
 #define PALERAIN_H
 
 #if defined(__APPLE__)
-#define _DARWIN_C_SOURCE 1
+#define NSIG	__DARWIN_NSIG
 #endif
 
 #include "xxd-embedded.h"
@@ -22,8 +22,14 @@
 #define CMD_LEN_MAX 512
 #define OVERRIDE_MAGIC 0xd803b376
 
-#define palerain_option_case_version      palerain_option_case(0)
-#define palerain_option_case_force_revert palerain_option_case(1)
+#define palerain_option_case_version           palerain_option_case(0)
+#define palerain_option_case_force_revert      palerain_option_case(1)
+#ifdef DEV_BUILD
+#define palerain_option_case_ignore_ssv        palerain_option_case(2)
+#define palerain_option_case_force_fakefs      palerain_option_case(3)
+#define palerain_option_case_rootless_livefs   palerain_option_case(4)
+#endif
+
 
 #ifdef USE_LIBUSB
 #include <libusb-1.0/libusb.h>
@@ -149,7 +155,7 @@ typedef unsigned char niarelap_file_t[];
 extern unsigned int verbose;
 
 extern char* pongo_path;
-#ifdef DEV_BUILD
+#ifdef TUI
 extern bool tui_started;
 #endif
 
@@ -226,7 +232,7 @@ void io_stop(stuff_t *stuff);
 
 void print_credits(void);
 
-#ifdef DEV_BUILD
+#ifdef TUI
 #include <newt.h>
 newtComponent get_tui_log();
 newtComponent set_tui_log(newtComponent co);

include/tui.h

@@ -11,6 +11,7 @@
 #include <locale.h>
 #include <unistd.h>
 #include <newt.h>
+#include <kerninfo.h>
 
 #define WIDTH 76
 #define HEIGHT 19

include/xxd-embedded.h

@@ -17,6 +17,9 @@ extern unsigned int ramdisk_dmg_len;
 extern unsigned char binpack_dmg[];
 extern unsigned int binpack_dmg_len;
 
+extern unsigned char Pongo_bin[];
+extern unsigned int Pongo_bin_len;
+
 #if defined(__APPLE__) && (TARGET_OS_IPHONE || defined(DEV_BUILD))
 extern unsigned char libcheckra1nhelper_dylib[];
 extern unsigned int libcheckra1nhelper_dylib_len;

packaging/control

@@ -8,7 +8,7 @@ Depends: usbmuxd
 Section: Utilities
 Priority: optional
 Homepage: https://palera.in
-Description: iOS 15.0-16.3.1 semi-tethered checkm8 jailbreak
+Description: iOS 15.0-16.4 semi-tethered checkm8 jailbreak
  palera1n is an iOS/iPadOS 15.0-15.3.1 semi tethered jailbreak
  based on the checkm8 exploit.
  .

packaging/control.macosx

@@ -7,7 +7,7 @@ Author: palera1n team
 Section: Utilities
 Priority: optional
 Homepage: https://palera.in
-Description: iOS 15.0-16.3.1 semi-tethered checkm8 jailbreak
+Description: iOS 15.0-16.4 semi-tethered checkm8 jailbreak
  palera1n is an iOS/iPadOS 15.0-15.3.1 semi tethered jailbreak
  based on the checkm8 exploit.
  .

src/Makefile

@@ -14,32 +14,46 @@ endif
 ifeq ($(FORCE_HELPER),1)
 OBJECTS += xxd-libcheckra1nhelper.dylib.o
 CFLAGS += -DFORCE_HELPER
+BUILD_OPTIONS += FORCE_HELPER
 endif
 
 ifneq ($(NO_RAMDISK),1)
 OBJECTS += xxd-ramdisk.dmg.o
 else
 CFLAGS += -DNO_RAMDISK
+BUILD_OPTIONS += NO_RAMDISK
 endif
 ifneq ($(NO_KPF),1)
 OBJECTS += xxd-checkra1n-kpf-pongo.o
 else
 CFLAGS += -DNO_KPF
+BUILD_OPTIONS += NO_KPF
 endif
-ifneq ($(NO_BINPACK),1)
+ifneq ($(NO_OVERLAY),1)
 OBJECTS += xxd-binpack.dmg.o
 else
-CFLAGS += -DNO_BINPACK
+CFLAGS += -DNO_OVERLAY
+BUILD_OPTIONS += NO_OVERLAY
 endif
 ifneq ($(NO_CHECKRAIN),1)
 OBJECTS += xxd-checkra1n.o
 else
 CFLAGS += -DNO_CHECKRAIN
+BUILD_OPTIONS += NO_CHECKRAIN
 endif
 
-ifeq ($(DEV_BUILD),1)
+ifneq ($(NO_CUSTOM_PONGO),1)
+OBJECTS += xxd-Pongo.bin.o
+else
+CFLAGS += -DNO_CUSTOM_PONGO
+BUILD_OPTIONS += NO_CUSTOM_PONGO
+endif
+
+ifeq ($(TUI),1)
 OBJECTS += tui_screen_enter_recovery.o tui_screen_enter_dfu.o tui_main.o
 OBJECTS += tui_screen_jailbreak.o tui_screen_main.o tui_screen_options.o
+BUILD_OPTIONS += TUI
+CFLAGS += -DTUI
 endif
 
 CHECKRA1N_VERSION ?= 0.1337.1
@@ -51,7 +65,11 @@ ifneq ($(USE_LIBUSB),1)
 OBJECTS += usb_iokit.o
 else
 LIBS += -framework SystemConfiguration -framework Security
+BUILD_OPTIONS += USE_LIBUSB
 endif
+# add lto and debug symbols for lto
+CFLAGS += -flto=full -g
+LDFLAGS += -Wl,-object_path_lto,lto.o
 else
 USE_LIBUSB = 1
 endif
@@ -62,6 +80,17 @@ CFLAGS += -DUSE_LIBUSB=1
 LIBS += $(DEP)/lib/libusb-1.0.a
 endif
 
+ifneq ($(ROOTFUL),0)
+CFLAGS += -DROOTFUL=1
+BUILD_OPTIONS += ROOTFUL
+endif
+
+ifeq ($(BUILD_OPTIONS),)
+BUILD_OPTIONS = (none)
+endif
+
+CFLAGS += -DBUILD_OPTIONS=\""$(BUILD_OPTIONS)"\"
+
 checkra1n-%:
 	curl -LO https://assets.checkra.in/downloads/preview/$(CHECKRA1N_VERSION)/$@
 	chmod 755 $@
@@ -116,6 +145,9 @@ ramdisk.dmg:
 binpack.dmg:
 	curl -LO https://cdn.nickchan.lol/palera1n/c-rewrite/deps/binpack.dmg
 
+Pongo.bin:
+	curl -LO https://cdn.nickchan.lol/palera1n/artifacts/kpf/Pongo.bin
+
 clean:
 	rm -rf *.o palera1n checkra1n checkra1n.c palera1n.dSYM libcheckra1nhelper.dylib
 

src/dfuhelper.c

@@ -71,7 +71,7 @@ int connected_normal_mode(const usbmuxd_device_info_t *usbmuxd_device) {
 		if (passcode_state) {
 			LOG(LOG_ERROR, "Passcode must be disabled on this device");
 			if (!checkrain_option_enabled(host_flags, host_option_device_info))
-				LOG(LOG_ERROR, "Additionally, passcode must never be set since restore on iOS 16+");
+				LOG(LOG_ERROR, "Additionally, passcode must never be set since a restore on iOS 16+");
 			devinfo_free(&dev);
 			return -1;
 		}

src/exec_checkra1n.c

@@ -26,37 +26,65 @@ extern char **environ;
 #include <palerain.h>
 #include <xxd-embedded.h>
 char* pongo_path = NULL;
+bool external_pongo = false;
 char* ext_checkra1n = NULL;
 
 #define tmpdir getenv("TMPDIR") == NULL ? "/tmp" : getenv("TMPDIR")
 
 int exec_checkra1n(void) {
 	LOG(LOG_INFO, "About to execute checkra1n");
-	int fd, ret;
+	int fd_checkra1n, fd_pongo, ret;
 	char* checkra1n_path = NULL;
 	if (ext_checkra1n != NULL) {
 		checkra1n_path = ext_checkra1n;
 		goto checkra1n_exec;
 	}
+#ifndef NO_CUSTOM_PONGO
+	if (pongo_path == NULL) {
+		pongo_path = malloc(strlen(tmpdir) + 20);
+		snprintf(pongo_path, strlen(tmpdir) + 20, "%s/Pongo.bin.XXXXXX", tmpdir);
+		fd_pongo = mkstemp(pongo_path);
+		if (fd_pongo == -1) {
+			LOG(LOG_FATAL, "Cannot open temporary file %s: %d (%s)", pongo_path, errno, strerror(errno));
+			free(pongo_path);
+			return -1;
+		}
+		ssize_t didWrite_Pongo_bin = write(fd_pongo, Pongo_bin, Pongo_bin_len);
+		if (didWrite_Pongo_bin != (ssize_t)Pongo_bin_len) {
+			LOG(LOG_FATAL, "Size written to %s does not match expected: %lld != %d: %d (%s)", pongo_path, didWrite_Pongo_bin, Pongo_bin_len, errno, strerror(errno));
+			close(fd_pongo);
+			unlink(pongo_path);
+			free(pongo_path);
+			pongo_path = NULL;
+			return -1;
+		}
+	} else external_pongo = true;
+#endif
 	checkra1n_path = malloc(strlen(tmpdir) + 20);
 	snprintf(checkra1n_path, strlen(tmpdir) + 20, "%s/checkra1n.XXXXXX", tmpdir);
-	fd = mkstemp(checkra1n_path);
-	if (fd == -1) {
-		LOG(LOG_FATAL, "Cannot open temporary file: %d (%s)", errno, strerror(errno));
+	fd_checkra1n = mkstemp(checkra1n_path);
+	if (fd_checkra1n == -1) {
+		LOG(LOG_FATAL, "Cannot open temporary file %s: %d (%s)", checkra1n_path, errno, strerror(errno));
+		free(checkra1n_path);
+		checkra1n_path = NULL;
 		return -1;
 	}
-	ssize_t didWrite = write(fd, checkra1n, checkra1n_len);
-	if (didWrite != (ssize_t)checkra1n_len) {
-		LOG(LOG_FATAL, "Size written does not match expected: %lld != %d: %d (%s)", didWrite, checkra1n_len, errno, strerror(errno));
-		close(fd);
+	ssize_t didWrite_checkra1n = write(fd_checkra1n, checkra1n, checkra1n_len);
+	if (didWrite_checkra1n != (ssize_t)checkra1n_len) {
+		LOG(LOG_FATAL, "Size written to %s does not match expected: %lld != %d: %d (%s)", checkra1n_path, didWrite_checkra1n, checkra1n_len, errno, strerror(errno));
+		close(fd_checkra1n);
 		unlink(checkra1n_path);
+		free(checkra1n_path);
+		checkra1n_path = NULL;
 		return -1;
 	}
-	close(fd);
+	close(fd_checkra1n);
 	ret = chmod(checkra1n_path, 0700);
 	if (ret) {
 		LOG(LOG_FATAL, "Cannot chmod %s: %d (%s)", checkra1n_path, errno, strerror(errno));
 		unlink(checkra1n_path);
+		free(checkra1n_path);
+		checkra1n_path = NULL;
 		return -1;
 	}
 #if defined(__APPLE__) && defined(__arm64__) && (TARGET_OS_IPHONE || defined(FORCE_HELPER))
@@ -76,9 +104,9 @@ int exec_checkra1n(void) {
 				LOG(LOG_FATAL, "Cannot open temporary file: %d (%s)", errno, strerror(errno));
 				return -1;
 			}
-			ssize_t didWrite = write(helper_fd, libcheckra1nhelper_dylib, libcheckra1nhelper_dylib_len);
-			if ((unsigned int)didWrite != libcheckra1nhelper_dylib_len) {
-				LOG(LOG_FATAL, "Size written does not match expected: %lld != %d: %d (%s)", didWrite, libcheckra1nhelper_dylib_len, errno, strerror(errno));
+			ssize_t didWrite_libcheckra1nhelper = write(helper_fd, libcheckra1nhelper_dylib, libcheckra1nhelper_dylib_len);
+			if ((unsigned int)didWrite_libcheckra1nhelper != libcheckra1nhelper_dylib_len) {
+				LOG(LOG_FATAL, "Size written does not match expected: %lld != %d: %d (%s)", didWrite_libcheckra1nhelper, libcheckra1nhelper_dylib_len, errno, strerror(errno));
 				close(helper_fd);
 				unlink(libcheckra1nhelper_dylib_path);
 				return -1;
@@ -106,17 +134,24 @@ checkra1n_exec: {};
 	} else {
 		strncat(args, "R", 0xf);
 	}
-	if (pongo_path != NULL) strncat(args, "k", 0xf); // keep this at last
+	LOG(LOG_VERBOSE5, args);
+	if (pongo_path != NULL) LOG(LOG_VERBOSE5, pongo_path);
 	pid_t pid;
-	char* checkra1n_argv[] = {
-		checkra1n_path,
-		args,
-		pongo_path,
-		NULL
-	};
-	ret = posix_spawn(&pid, checkra1n_path, NULL, NULL, checkra1n_argv, environ);
-	if (pongo_path != NULL) free(pongo_path);
-	pongo_path = NULL;
+	if (pongo_path != NULL) {
+		ret = posix_spawn(&pid, checkra1n_path, NULL, NULL, (char* []){
+			checkra1n_path,
+			args,
+			"-k",
+			pongo_path,
+			NULL
+		}, environ);
+	} else {
+		ret = posix_spawn(&pid, checkra1n_path, NULL, NULL, (char* []){
+			checkra1n_path,
+			args,
+			NULL
+		}, environ);
+	}
 	if (ret) {
 		LOG(LOG_FATAL, "Cannot posix spawn %s: %d (%s)", checkra1n_path, errno, strerror(errno));
 		if (ext_checkra1n != NULL) unlink(checkra1n_path);
@@ -129,6 +164,12 @@ checkra1n_exec: {};
 		free(checkra1n_path);
 		checkra1n_path = NULL;
 	}
+	waitpid(pid, NULL, 0);
+		if (!external_pongo && pongo_path != NULL) {
+		unlink(pongo_path);
+	}
+	if (pongo_path != NULL) free(pongo_path);
+	pongo_path = NULL;
 #if defined(__APPLE__) && defined(__arm64__) && (TARGET_OS_IPHONE || defined(FORCE_HELPER))
 	if (libcheckra1nhelper_dylib_path != NULL) {
 		unlink(libcheckra1nhelper_dylib_path);
@@ -138,6 +179,5 @@ checkra1n_exec: {};
 		libcheckra1nhelper_dylib_path = NULL;
 	}
 #endif
-	waitpid(pid, NULL, 0);
 	return 0;
 }

src/fake_embedded.c

@@ -15,7 +15,12 @@ unsigned char* checkra1n = NULL;
 unsigned int checkra1n_len = 0;
 #endif
 
-#ifdef NO_BINPACK
+#ifdef NO_OVERLAY
 unsigned char* binpack_dmg = NULL;
 unsigned int binpack_dmg_len = 0;
 #endif
+
+#ifdef NO_CUSTOM_PONGO
+unsigned char* Pongo_bin = NULL;
+unsigned int Pongo_bin_len = 0;
+#endif

src/lock_vars.c

@@ -30,7 +30,7 @@
 #include <kerninfo.h>
 
 pthread_mutex_t spin_mutex, found_pongo_mutex, ecid_dfu_wait_mutex;
-#ifdef DEV_BUILD
+#ifdef TUI
 #include <newt.h>
 pthread_mutex_t tui_log_mutex;
 newtComponent tui_log_output = NULL;
@@ -89,7 +89,7 @@ uint64_t set_ecid_wait_for_dfu(uint64_t ecid) {
     return ecid;
 }
 
-#ifdef DEV_BUILD
+#ifdef TUI
 newtComponent get_tui_log() {
     pthread_mutex_lock(&tui_log_mutex);
     newtComponent ret = tui_log_output;

src/log.c

@@ -11,7 +11,7 @@
 int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxname, const char *__restrict format, ...)
 {
     if (verbose >= 5 
-#ifdef DEV_BUILD
+#ifdef TUI
 	&& !checkrain_option_enabled(host_flags, host_option_tui)
 #endif
 	) fprintf(stderr, "p1_log: loglevel %d from %s:%d:%s()\n", loglevel, fname, lineno, fxname);
@@ -23,7 +23,7 @@ int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxna
 	va_start(args, format);
 	if (verbose < (loglevel - 3) && loglevel > LOG_INFO) {
         if (verbose >= 5
-#ifdef DEV_BUILD
+#ifdef TUI
 		&& !tui_started
 #endif
 ) fprintf(stderr, "p1_log: hid log with high log level (%d < %d)\n", verbose, loglevel - 3);
@@ -61,7 +61,7 @@ int p1_log(log_level_t loglevel, const char *fname, int lineno, const char *fxna
 		colour[0] = '\0';
 		colour_bold[0] = '\0';
 	}
-#ifdef DEV_BUILD
+#ifdef TUI
 	if (checkrain_option_enabled(host_flags, host_option_tui) && tui_started) {
 		newtComponent co = get_tui_log();
 		if (co == NULL) {

src/main.c

@@ -74,7 +74,6 @@ int build_checks(void) {
 	}
 	if (boyermoore_horspool_memmem(&checkra1n[0], checkra1n_len, (const unsigned char*)"[ra1npoc15-part] thanks to", strlen("[ra1npoc15-part] thanks to")) != NULL) {
 		host_flags |= palerain_option_checkrain_is_clone;
-		LOG(LOG_WARNING, "Do not distribute!");
 	}
 #endif
 #ifndef NO_KPF
@@ -94,7 +93,7 @@ int build_checks(void) {
 	return 0;
 }
 
-#ifdef DEV_BUILD
+#ifdef TUI
 bool tui_started = false;
 #endif
 
@@ -115,7 +114,7 @@ int palera1n(int argc, char *argv[]) {
 	if ((ret = optparse(argc, argv))) goto cleanup;
 	if (!checkrain_option_enabled(host_flags, host_option_device_info))
 	if (checkrain_option_enabled(host_flags, host_option_palerain_version)) goto normal_exit;
-#ifdef DEV_BUILD
+#ifdef TUI
 	if (checkrain_option_enabled(host_flags, host_option_tui)) {
 		ret = tui();
 		if (ret) goto cleanup;

src/optparse.c

@@ -16,10 +16,13 @@
 
 checkrain_option_t host_flags = 0;
 checkrain_option_p host_flags_p = &host_flags;
+static bool force_use_verbose_boot = false;
 
 static struct option longopts[] = {
+#ifdef ROOTFUL
 	{"setup-partial-fakefs", no_argument, NULL, 'B'},
 	{"setup-fakefs", no_argument, NULL, 'c'},
+#endif
 	{"dfuhelper", no_argument, NULL, 'D'},
 	{"help", no_argument, NULL, 'h'},
 	{"pongo-shell", no_argument, NULL, 'p'},
@@ -27,7 +30,9 @@ static struct option longopts[] = {
 	{"debug-logging", no_argument, NULL, 'v'},
 	{"verbose-boot", no_argument, NULL, 'V'},
 	{"boot-args", required_argument, NULL, 'e'},
+#ifdef ROOTFUL
 	{"fakefs", no_argument, NULL, 'f'},
+#endif
 	{"rootless", no_argument, NULL, 'l'},
 	{"jbinit-log-to-file", no_argument, NULL, 'L'},
 	{"demote", no_argument, NULL, 'd'},
@@ -47,6 +52,11 @@ static struct option longopts[] = {
 #ifdef DEV_BUILD
 	{"test1", no_argument, NULL, '1'},
 	{"test2", no_argument, NULL, '2'},
+	{"ignore-ssv", no_argument, NULL, palerain_option_case_ignore_ssv},
+	{"rootless-livefs", no_argument, NULL, palerain_option_case_rootless_livefs},
+	{"force-fakefs", no_argument, NULL, palerain_option_case_force_fakefs},
+#endif
+#ifdef TUI
 	{"tui", no_argument, NULL, 't'},
 #endif
 	{NULL, 0, NULL, 0}
@@ -55,32 +65,45 @@ static struct option longopts[] = {
 static int usage(int e, char* prog_name)
 {
 	fprintf(stderr,
+	"Usage: %s [-"
+	"DEhpvVldsSLRnPI"
 #ifdef DEV_BUILD
-			"Usage: %s [-12cCdDEfhIlLnOpRsStvV]"
-#else
-			"Usage: %s [-cCdDEfhIlLnOpRsSvV]"
+			"12"
 #endif
-			" [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
+#ifdef ROOTFUL
+			"cfB"
+#endif
+#ifdef TUI
+			"t"
+#endif
+			"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
 			"Copyright (C) 2023, palera1n team, All Rights Reserved.\n\n"
-			"iOS/iPadOS 15.0-16.3.1 arm64 jailbreaking tool\n\n"
+			"iOS/iPadOS 15.0-16.4 arm64 jailbreaking tool\n\n"
 			"\t--version\t\t\t\tPrint version\n"
 			"\t--force-revert\t\t\t\tRemove jailbreak\n"
 #ifdef DEV_BUILD
+			"\t--ignore-ssv\t\t\t\tAssume the platform has no SSV\n"
+			"\t--force-fakefs\t\t\t\tAllow fakefs to be created and used even on platforms without SSV\n"
+			"\t--rootless-livefs\t\t\t\tMount the root livefs on rootless\n"
 			"\t-1, --test1\t\t\t\tSet palerain_option_test1\n"
 			"\t-2, --test2\t\t\t\tSet palerain_option_test2\n"
 #endif
+#ifdef ROOTFUL
 			"\t-B, --setup-partial-fakefs\t\tSetup partial fakefs\n"
 			"\t-c, --setup-fakefs\t\t\tSetup fakefs\n"
+#endif
 			"\t-d, --demote\t\t\t\tDemote\n"
-			"\t-D, --dfuhelper\t\t\tExit after entering DFU\n"
+			"\t-D, --dfuhelper\t\t\t\tExit after entering DFU\n"
 			"\t-e, --boot-args <boot arguments>\tXNU boot arguments\n"
 			"\t-E, --enter-recovery\t\t\tEnter recovery mode\n"
-			"\t-f, --fakefs \t\t\t\tBoots fakefs\n"
+#ifdef ROOTFUL
+			"\t-f, --rootful \t\t\t\tSet jailbreak mode to rootful.\n"
+#endif
 			"\t-h, --help\t\t\t\tShow this help\n"
 			"\t-i, --override-checkra1n <file>\t\tOverride checkra1n\n"
 			"\t-k, --override-pongo <file>\t\tOverride Pongo image\n"
 			"\t-K, --override-kpf <file>\t\tOverride kernel patchfinder\n"
-			"\t-l, --rootless\t\t\t\tBoots rootless. This is the default\n"
+			"\t-l, --rootless\t\t\t\tSet jailbreak mode to rootless.\n"
 			"\t-L, --jbinit-log-to-file\t\tMake jbinit log to /cores/jbinit.log (can be read from sandbox while jailbroken)\n"
 			"\t-n, --exit-recovery\t\t\tExit recovery mode\n"
 			"\t-I, --device-info\t\t\tPrint info about the connected device\n"
@@ -90,12 +113,12 @@ static int usage(int e, char* prog_name)
 			"\t-r, --override-ramdisk <file>\t\tOverride ramdisk\n"
 			"\t-R, --reboot-device\t\t\tReboot connected device in normal mode\n"
 			"\t-s, --safe-mode\t\t\t\tEnter safe mode\n"
-			"\t-S, --no-colors\t\t\tDisable colors on the command line\n"
+			"\t-S, --no-colors\t\t\t\tDisable colors on the command line\n"
 			"\t-v, --debug-logging\t\t\tEnable debug logging\n"
 			"\t\tThis option can be repeated for extra verbosity.\n"
 			"\t-V, --verbose-boot\t\t\tVerbose boot\n"
 
-#ifdef DEV_BUILD
+#ifdef TUI
 			"\t-t, --tui\t\t\t\tTerminal user interface\n"
 #endif
 		"\nEnvironmental variables:\n"
@@ -108,15 +131,18 @@ static int usage(int e, char* prog_name)
 int optparse(int argc, char* argv[]) {
 	int opt;
 	int index;
-	while ((opt = getopt_long(argc, argv, 
+	while ((opt = getopt_long(argc, argv,
+	"DEhpvVldsSLtRnPIe:o:r:K:k:i:"
 #ifdef DEV_BUILD
-	"12BcDEhpvVldsSLftRnPIe:o:r:K:k:i:", 
-#else
-	"BcDEhpvVldsSLfRnPIe:o:r:K:k:i:", 
+	"12"
 #endif
-	longopts, NULL)) != -1)
+#ifdef ROOTFUL
+	"fcB"
+#endif
+	,longopts, NULL)) != -1)
 	{
 		switch (opt) {
+#ifdef ROOTFUL
 		case 'B':
 			palerain_flags |= palerain_option_setup_partial_root;
 			palerain_flags |= palerain_option_setup_rootful;
@@ -126,6 +152,7 @@ int optparse(int argc, char* argv[]) {
 			palerain_flags |= palerain_option_setup_rootful;
 			kpf_flags |= checkrain_option_verbose_boot;
 			break;
+#endif
 		case 'p':
 			host_flags |= host_option_pongo_exit;
 			break;
@@ -143,6 +170,7 @@ int optparse(int argc, char* argv[]) {
 			break;
 		case 'V':
 			kpf_flags |= checkrain_option_verbose_boot;
+			force_use_verbose_boot = true;
 			break;
 		case 'e':
 			if (strstr(optarg, "rootdev=") != NULL) {
@@ -154,13 +182,17 @@ int optparse(int argc, char* argv[]) {
             }
 			snprintf(xargs_cmd, sizeof(xargs_cmd), "xargs %s", optarg);
 			break;
+#ifdef ROOTFUL
 		case 'f':
 			snprintf(rootfs_cmd, sizeof(rootfs_cmd), "rootfs %s", optarg);
 			snprintf(dtpatch_cmd, 0x20, "dtpatch %s", optarg);
 			palerain_flags |= palerain_option_rootful;
 			break;
+#endif
 		case 'l':
-			palerain_flags &= ~palerain_option_rootful;
+#ifdef ROOTFUL
+			palerain_flags |= palerain_option_rootless;
+#endif
 			break;
 		case 'L':
 			palerain_flags |= palerain_option_jbinit_log_to_file;
@@ -213,7 +245,7 @@ int optparse(int argc, char* argv[]) {
 			} else if (!(st.st_mode & S_IXUSR) && !(st.st_mode & S_IXGRP) && !(st.st_mode & S_IXOTH)) {
 				LOG(LOG_FATAL, "%s is not executable", optarg);
 				return -1;
-			} else if (!(st.st_mode & S_IFREG)) {
+			} else if (!S_ISREG(st.st_mode)) {
 				LOG(LOG_FATAL, "%s is not a regular file", optarg);
 				return -1;
 			}
@@ -258,16 +290,27 @@ int optparse(int argc, char* argv[]) {
 		case 'S':
 			host_flags |= host_option_no_colors;
 			break;
-#ifdef DEV_BUILD
+#ifdef TUI
 		case 't':
 			host_flags |= host_option_tui;
 			break;
+#endif
+#ifdef DEV_BUILD
 		case '1':
 			palerain_flags |= palerain_option_test1;
 			break;
 		case '2':
 			palerain_flags |= palerain_option_test2;
 			break;
+		case palerain_option_case_force_fakefs:
+			palerain_flags |= palerain_option_case_force_fakefs;
+			break;
+		case palerain_option_case_rootless_livefs:
+			palerain_flags |= palerain_option_case_rootless_livefs;
+			break;
+		case palerain_option_case_ignore_ssv:
+			palerain_flags |= palerain_option_no_ssv;
+			break;
 #endif
 		case palerain_option_case_force_revert:
 			checkrain_flags |= checkrain_option_force_revert;
@@ -293,10 +336,15 @@ int optparse(int argc, char* argv[]) {
 #else
 			"USB backend: IOKit\n"
 #endif
+			"Build options: " BUILD_OPTIONS "\n"
 		);
 		return 0;
 	}
 
+	if ((strstr(xargs_cmd, "serial=") != NULL) && !force_use_verbose_boot && checkrain_option_enabled(palerain_flags, palerain_option_setup_rootful)) {
+		kpf_flags &= ~checkrain_option_verbose_boot;
+	}
+    
 	snprintf(checkrain_flags_cmd, 0x20, "checkra1n_flags 0x%x", checkrain_flags);
 	snprintf(palerain_flags_cmd, 0x20, "palera1n_flags 0x%x", palerain_flags);
 	snprintf(kpf_flags_cmd, 0x20, "kpf_flags 0x%x", kpf_flags);
@@ -317,6 +365,17 @@ int optparse(int argc, char* argv[]) {
 		LOG(LOG_VERBOSE4, "overlay override ptr %p -> %p", override_overlay.orig_ptr, **overlay_to_upload);
 	}
 
+	if (checkrain_option_enabled(palerain_flags, palerain_option_rootful) && checkrain_option_enabled(palerain_flags, palerain_option_rootless)) {
+		LOG(LOG_FATAL, "cannot have rootful and rootless at the same time");
+		return -1;
+	}
+
+	if (!checkrain_option_enabled(palerain_flags, palerain_option_rootful) && !checkrain_option_enabled(palerain_flags, palerain_option_rootless)) {
+		LOG(LOG_FATAL, "must have either rootful or rootless, use --help for help");
+		return -1;
+	}
+
+
 	if (!checkrain_option_enabled(palerain_flags, palerain_option_rootful)) {
 		if (checkrain_option_enabled(palerain_flags, palerain_option_setup_rootful) || checkrain_option_enabled(palerain_flags, palerain_option_setup_rootful_forced)) {
 			LOG(LOG_FATAL, "Cannot setup rootful when rootless is requested. Use -f to enable rootful mode.");
@@ -364,8 +423,10 @@ int optparse(int argc, char* argv[]) {
 		}
 	}
 	if (verbose >= 2) setenv("LIBUSB_DEBUG", "1", 1);
+
 	if (verbose >= 3)
 	{
+		libusbmuxd_set_debug_level(verbose - 2);
 		irecv_set_debug_level(1);
 		setenv("LIBUSB_DEBUG", "2", 1);
 	}

src/pongo_helper.c

@@ -58,7 +58,7 @@ void *pongo_usb_callback(void *arg) {
 		upload_pongo_file(handle, **ramdisk_to_upload, ramdisk_dmg_len);
 		issue_pongo_command(handle, "ramdisk");
 	}
-#ifdef NO_BINPACK
+#ifdef NO_OVERLAY
 	if (binpack_dmg_len != 0)
 #endif
 	{