dfuhelper: detect ios 14 and below via normal mode

.github/workflows/build.yml

@@ -74,7 +74,7 @@ jobs:
             minos: 7.0
     runs-on: macos-12
     env:
-      MBEDTLS_VERSION: 3.5.2
+      MBEDTLS_VERSION: 3.4.0
       READLINE_VERSION: 8.2
       SLANG_VERSION: 2.3.3
       NEWT_VERSION: 0.52.23
@@ -344,7 +344,7 @@ jobs:
           forceUpload: true
           dryRun: false
           localDir: 'ready/'
-          remoteDir: "/palera1n/artifacts/c-rewrite/${{ steps.branch-name.outputs.ref_branch || github.ref_name }}/${{ github.run_number }}"
+          remoteDir: "/palera1n/artifacts/c-rewrite/${{ steps.branch-name.outputs.ref_branch || github.ref }}/${{ github.run_number }}"
 
       - name: Upload ${{ matrix.os }} thin ${{ matrix.arch }} build
         if: ${{ github.event_name != 'pull_request' }}
@@ -377,7 +377,7 @@ jobs:
         with:
           packages: sed coreutils
           cache: true
-          mirror: 'https://apt.procurs.us/'
+          mirror: 'https://procursus.itsnebula.net/'
 
       - name: Download all Darwin artifacts
         uses: actions/download-artifact@v3
@@ -494,7 +494,7 @@ jobs:
           forceUpload: true
           dryRun: false
           localDir: 'ready/'
-          remoteDir: "/palera1n/artifacts/c-rewrite/${{ steps.branch-name.outputs.ref_branch || github.ref_name }}/${{ github.run_number }}"
+          remoteDir: "/palera1n/artifacts/c-rewrite/${{ steps.branch-name.outputs.ref_branch || github.ref }}/${{ github.run_number }}"
 
   build-Linux:
     strategy:
@@ -506,7 +506,7 @@ jobs:
         - aarch64-linux-musl
     runs-on: ubuntu-latest
     env:
-      MBEDTLS_VERSION: 3.5.2
+      MBEDTLS_VERSION: 3.4.0
       LIBUSB_VERSION: 1.0.26
       READLINE_VERSION: 8.2
       SLANG_VERSION: 2.3.3
@@ -601,14 +601,12 @@ jobs:
           git clone --depth=1 https://github.com/libimobiledevice/libirecovery
           git clone --depth=1 https://github.com/libimobiledevice/libusbmuxd
           git clone --depth=1 https://github.com/libimobiledevice/libimobiledevice
-          git clone --depth=1 https://github.com/libimobiledevice/usbmuxd
 
       - name: Build Mbed TLS
         run: |
           cd mbedtls-${{ env.MBEDTLS_VERSION }}
           cat ../patches/mbedtls/0001-Allow-empty-x509-cert-issuer.patch | patch -sN -d . -p1
           mkdir build
-          if [ "${{ matrix.triple }}" = "i486-linux-musl" ]; then sed -i '/define MBEDTLS_AESNI_C/d' include/mbedtls/mbedtls_config.h; fi
           cd build
           cmake .. \
             -DCMAKE_BUILD_TYPE=Release \
@@ -752,25 +750,9 @@ jobs:
           sudo rm /usr/local
           sudo mv /usr/local.bak /usr/local
 
-      - name: Build usbmuxd
-        run: |
-          cd usbmuxd
-          autoreconf -fiv
-          ./configure ${{ env.CONFIGURE_ARGS }} --without-systemd
-          ${{ matrix.triple }}-gcc ${{ env.CFLAGS }} -I${{ env.DESTDIR }}/${{ env.PREFIX }}/include/libusb-1.0 src/*.c \
-            -DHAVE_CONFIG_H -no-pie \
-            -I. -static ${{ env.LDFLAGS }}} -limobiledevice-1.0 -lusbmuxd-2.0 -limobiledevice-glue-1.0  \
-            -lplist-2.0 -lusb-1.0 -lmbedtls -lmbedcrypto -lmbedx509 -lpthread -o usbmuxd
-          mkdir -p ${{ env.DESTDIR }}/${{ env.PREFIX }}/sbin
-          ${{ matrix.triple }}-objcopy --only-keep-debug usbmuxd usbmuxd.debug
-          ${{ matrix.triple }}-strip --strip-debug --strip-unneeded usbmuxd
-          ${{ matrix.triple }}-objcopy --add-gnu-debuglink=usbmuxd.debug usbmuxd
-          install -m755 usbmuxd usbmuxd.debug ${{ env.DESTDIR }}/${{ env.PREFIX }}/sbin
-          cd ..
-
       - name: Build palera1n
         run: |
-          cp -a ${{ env.DESTDIR }}/${{ env.PREFIX }}/{include,lib} dep_root
+          cp -a sysroot/${{ env.PREFIX }}/{include,lib} dep_root
           find dep_root -name '*.so' -delete
           find dep_root -name '*.la' -delete
           CC="${{ matrix.triple }}-gcc" make -j$(nproc)
@@ -781,15 +763,13 @@ jobs:
           ${{ matrix.triple }}-strip --strip-debug --strip-unneeded src/palera1n
           ${{ matrix.triple }}-objcopy --add-gnu-debuglink=palera1n.debug src/palera1n
           chmod -x palera1n.debug
-
+      
       - name: Prepare artifact
         run: |
-          mkdir ready usbmuxd-static
+          mkdir ready
           mv palera1n.debug ready/palera1n-${{ env.CHECKRA1N_NAME }}.debug
           mv src/palera1n ready/palera1n-${{ env.CHECKRA1N_NAME }}
           tar -zcf ready/dep_root_${{ matrix.triple }}.tgz dep_root
-          install -m755 sysroot/${{ env.PREFIX }}/sbin/usbmuxd usbmuxd-static/usbmuxd-${{ env.CHECKRA1N_NAME }}
-          install -m755 sysroot/${{ env.PREFIX }}/sbin/usbmuxd.debug usbmuxd-static/usbmuxd-${{ env.CHECKRA1N_NAME }}.debug
 
       - name: Build debs
         run: |
@@ -827,20 +807,7 @@ jobs:
           forceUpload: true
           dryRun: false
           localDir: 'ready/'
-          remoteDir: "/palera1n/artifacts/c-rewrite/${{ steps.branch-name.outputs.ref_branch || github.ref_name }}/${{ github.run_number }}"
-
-      - name: Upload usbmuxd artifact
-        if: ${{ github.event_name != 'pull_request' }}
-        uses: wangyucode/[email protected]
-        with:
-          host: ${{ secrets.NICKCHAN_FTP_HOST }}
-          port: ${{ secrets.NICKCHAN_FTP_PORT }}
-          username: palera1n
-          password: ${{ secrets.NICKCHAN_FTP_PASS }}
-          forceUpload: true
-          dryRun: false
-          localDir: 'usbmuxd-static/'
-          remoteDir: "/palera1n/artifacts/usbmuxd-static"
+          remoteDir: "/palera1n/artifacts/c-rewrite/${{ steps.branch-name.outputs.ref_branch || github.ref }}/${{ github.run_number }}"
 
   finish-build:
     runs-on: ubuntu-latest

.gitignore

@@ -11,7 +11,6 @@ src/palera1n
 !xxd-embedded.h
 src/binpack.dmg
 src/ramdisk.dmg
-src/ramdisk.dmg.lzma
 src/xxd-*.c
 .DS_Store
 !palera1n.1

Makefile

@@ -1,3 +1,5 @@
+NAME = Dusk
+
 SRC = $(shell pwd)
 DEP = $(SRC)/dep_root
 STRIP = strip
@@ -62,7 +64,7 @@ CFLAGS += -DBUILD_WHOAMI="\"$(BUILD_WHOAMI)\"" -DBUILD_TAG="\"$(BUILD_TAG)\""
 CFLAGS += -DBUILD_NUMBER="\"$(BUILD_NUMBER)\"" -DBUILD_BRANCH="\"$(BUILD_BRANCH)\""
 CFLAGS += -DBUILD_COMMIT="\"$(BUILD_COMMIT)\""
 
-export SRC DEP CC CFLAGS LDFLAGS LIBS SHELL TARGET_OS DEV_BUILD BUILD_DATE BUILD_TAG BUILD_WHOAMI BUILD_STYLE BUILD_NUMBER BUILD_BRANCH
+export SRC DEP CC CFLAGS LDFLAGS LIBS TARGET_OS DEV_BUILD BUILD_DATE BUILD_TAG BUILD_WHOAMI BUILD_STYLE BUILD_NUMBER BUILD_BRANCH
 
 all: palera1n
 

README.md

@@ -51,4 +51,4 @@ Make sure you provide full details on your device, such as:
 
 Using `-VvL` would help with debugging.
 
-Join the [Support Discord](https://dsc.gg/palera1n)
+Join the [Support Discord](https://dsc.gg/palera1n), and create a thread in [#support](https://discord.com/channels/1028398973452570725/1028730487700738130) or ask in [#general](https://discord.com/channels/1028398973452570725/1028398976640229380).

docs/palera1n.1

@@ -2,11 +2,11 @@
 .\" Copyright (c) 2023 Nick Chan
 .\" SPDX-License-Identifier: MIT
 .\"
-.Dd "26 October 2023"
+.Dd "2 July 2023"
 .Dt palera1n 1
 .Sh NAME
 .Nm palera1n
-.Nd iOS 15.0-17.4 arm64 iOS/iPadOS jailbreaking tool
+.Nd iOS 15.0-16.5.1 arm64 iOS/iPadOS jailbreaking tool
 .Sh SYNOPSIS
 .Nm
 .Op Fl dDEhILnpRsSvV
@@ -124,6 +124,13 @@ iOS15 branch or your own fork of it.
 Makes jbinit log to
 .Em /cores/jbinit.log
 This file may be viewed from sandboxed applications while jailbroken.
+.It Fl l , -rootless
+Proceed in rootless mode, this is the default when neither
+.Fl l , -rootless
+and
+.Fl f , -fakefs
+is specified.
+>>>>>>> a8e6075 (paleinfo v2)
 .It Fl n , -exit-recovery
 Exit recovery mode and exit.
 .It Fl o , -override-overlay Ar overlay file
@@ -267,5 +274,4 @@ December 13, 2022. Later, the first attempt to rewrite palera1n into C begins on
 01 2023. The
 .Nm
 utility described here is the second attempt, which first started on January 16, 2023,
-using checkra1n 1337 and a custom KPF.
-Something happened on August 15, 2023.
+using checkra1n 1337 and the plush KPF.

include/xxd-embedded.h

@@ -11,8 +11,8 @@ extern unsigned int checkra1n_len;
 extern unsigned char checkra1n_kpf_pongo[];
 extern unsigned int checkra1n_kpf_pongo_len;
 
-extern unsigned char ramdisk_dmg_lzma[];
-extern unsigned int ramdisk_dmg_lzma_len;
+extern unsigned char ramdisk_dmg[];
+extern unsigned int ramdisk_dmg_len;
 
 extern unsigned char binpack_dmg[];
 extern unsigned int binpack_dmg_len;

packaging/control

@@ -8,15 +8,10 @@ Depends: usbmuxd
 Section: Utilities
 Priority: optional
 Homepage: https://palera.in
-Description: iOS 15.0+ semi-tethered checkm8 jailbreak
- palera1n is an iOS/iPadOS 15.0+ semi tethered jailbreak
+Description: iOS 15.0-16.5.1 semi-tethered checkm8 jailbreak
+ palera1n is an iOS/iPadOS 15.0-16.5.1 semi tethered jailbreak
  based on the checkm8 exploit.
  .
  palera1n is able to jailbreak the device in fakefs-rootful mode,
  where / is writable, as well as rootless mode, where / cannot be
  written to.
- .
- IMPORTANT: This does NOT make palera1n untethered or allow you to
- jailbreak your current device without a computer. It just allows
- you to jailbreak another iDevice using this device, given you have
- an appropriate cable. Also, the success rate is likely to be bad.

packaging/control.macosx

@@ -7,8 +7,8 @@ Author: palera1n team
 Section: Utilities
 Priority: optional
 Homepage: https://palera.in
-Description: iOS 15.0+ semi-tethered checkm8 jailbreak
- palera1n is an iOS/iPadOS 15.0+ semi tethered jailbreak
+Description: iOS 15.0-16.5 semi-tethered checkm8 jailbreak
+ palera1n is an iOS/iPadOS 15.0-16.5 semi tethered jailbreak
  based on the checkm8 exploit.
  .
  palera1n is able to jailbreak the device in fakefs-rootful mode,

src/Makefile

@@ -18,9 +18,9 @@ BUILD_OPTIONS += FORCE_HELPER
 endif
 
 ifneq ($(NO_RAMDISK),1)
-OBJECTS += xxd-ramdisk.dmg.lzma.o
+OBJECTS += xxd-ramdisk.dmg.o
 else
-CFLAGS += -DNO_RAMDISK -DRAMDISK_COMPRESSED_SIZE=\"0\"
+CFLAGS += -DNO_RAMDISK
 BUILD_OPTIONS += NO_RAMDISK
 endif
 ifneq ($(NO_KPF),1)
@@ -122,14 +122,6 @@ endif
 xxd-%.c: %
 	xxd -iC $< > $@
 
-ifneq ($(NO_RAMDISK),1)
-pongo_helper.o: pongo_helper.c $(wildcard ../include/*.h) ramdisk.dmg
-	$(CC) -c $(CFLAGS) -DRAMDISK_UNCOMPRESSED_SIZE="\"$$(wc -c < ramdisk.dmg | tr -d ' ')\"" $<
-else
-pongo_helper.o: pongo_helper.c $(wildcard ../include/*.h)
-	$(CC) -c $(CFLAGS) $<
-endif
-
 %.o: %.c $(wildcard ../include/*.h)
 	$(CC) -c $(CFLAGS) $<
 
@@ -145,21 +137,18 @@ libcheckra1nhelper.dylib: chkstk.S
 	$(CC) $(CFLAGS) $(LDFLAGS) -shared chkstk.S -o libcheckra1nhelper.dylib
 
 checkra1n-kpf-pongo:
-	curl -LO https://cdn.nickchan.lol/palera1n/artifacts/kpf/b8-fixes/checkra1n-kpf-pongo
-
-ramdisk.dmg.lzma: ramdisk.dmg
-	xz --format=lzma -vf6ekT 0 ramdisk.dmg
+	curl -LO https://cdn.nickchan.lol/palera1n/artifacts/kpf/checkra1n-kpf-pongo
 
 ramdisk.dmg:
-	curl -LO https://cdn.nickchan.lol/palera1n/c-rewrite/deps/b8/ramdisk.dmg
+	curl -LO https://cdn.nickchan.lol/palera1n/c-rewrite/deps/ramdisk.dmg
 
 binpack.dmg:
-	curl -LO https://cdn.nickchan.lol/palera1n/c-rewrite/deps/b8/binpack.dmg
+	curl -LO https://cdn.nickchan.lol/palera1n/c-rewrite/deps/binpack.dmg
 
 Pongo.bin:
-	curl -LO https://cdn.nickchan.lol/palera1n/artifacts/kpf/b8-fixes/Pongo.bin
+	curl -LO https://cdn.nickchan.lol/palera1n/artifacts/kpf/Pongo.bin
 
 clean:
-	rm -rf *.o palera1n checkra1n checkra1n.c palera1n.dSYM ramdisk.dmg.lzma libcheckra1nhelper.dylib
+	rm -rf *.o palera1n checkra1n checkra1n.c palera1n.dSYM libcheckra1nhelper.dylib
 
 .PHONY: all clean

src/credits.c

@@ -12,8 +12,8 @@
 #define B stderr
 #define L ,
 #define E "# == palera1n-c == \n#\n"
-#define M "# Made by: Nick Chan, " THE_PLUSH ", Samara, Mineek, staturnz, " BAKERAIN_DEVELOPE_R " \n#\n"
-#define A "# Thanks to: pythonplayer123, llsc12, Nebula, tihmstar, nikias\n"
+#define M "# Made by: Nick Chan, " THE_PLUSH ", Samara, Nebula, staturnz, " BAKERAIN_DEVELOPE_R " \n#\n"
+#define A "# Thanks to: pythonplayer123, llsc12, Mineek, tihmstar, nikias\n"
 #define K "# (libimobiledevice), checkra1n team (Siguza, axi0mx, littlelailo\n"
 #define I "# et al.), Procursus Team (Hayden Seay, Cameron Katri, Keto et.al)\n\n"
 #define N )

src/dfuhelper.c

@@ -56,6 +56,7 @@ void step(int time, int time2, char *text, bool (*cond)(uint64_t), uint64_t cond
 int connected_normal_mode(const usbmuxd_device_info_t *usbmuxd_device) {
 	devinfo_t dev;
 	int ret;
+    int version;
 	ret = devinfo_cmd(&dev, usbmuxd_device->udid);
 	if (ret != 0) {
 		LOG(LOG_ERROR, "Unable to get device information");
@@ -67,6 +68,19 @@ int connected_normal_mode(const usbmuxd_device_info_t *usbmuxd_device) {
 		LOG(LOG_WARNING, "palera1n doesn't and never will work on A12+ (arm64e)");
 		return -1;
 	}
+    
+    ret = sscanf(dev.productVersion, "%d.", &version);
+    if (ret != 1) {
+        LOG(LOG_ERROR, "Failed to get device version");
+        devinfo_free(&dev);
+        return -1;
+    }
+    if (version <= 14) {
+        LOG(LOG_ERROR, "palera1n doesn't support devices below iOS 15");
+        devinfo_free(&dev);
+        return -1;
+    }
+    
 	if (!strncmp(dev.productType, "iPhone10,", strlen("iPhone10,"))) {
 		if (!(palerain_flags & palerain_option_device_info))
 			LOG(LOG_VERBOSE2, "Product %s requires passcode to be disabled", dev.productType);
@@ -79,8 +93,8 @@ int connected_normal_mode(const usbmuxd_device_info_t *usbmuxd_device) {
 		}
 		if (passcode_state) {
 			LOG(LOG_ERROR, "Passcode must be disabled on this device");
-			if (!(palerain_flags & palerain_option_device_info))
-				LOG(LOG_ERROR, "Additionally, passcode must never be set since a restore on iOS 16+");
+			if (!(palerain_flags & palerain_option_device_info) && (version == 16))
+				LOG(LOG_ERROR, "Additionally, passcode must never be set since a restore on iOS 16");
 			devinfo_free(&dev);
 			return -1;
 		}

src/fake_embedded.c

@@ -6,8 +6,8 @@ unsigned int checkra1n_kpf_pongo_len = 0;
 #endif
 
 #ifdef NO_RAMDISK
-unsigned char* ramdisk_dmg_lzma = NULL;
-unsigned int ramdisk_dmg_lzma_len = 0;
+unsigned char* ramdisk_dmg = NULL;
+unsigned int ramdisk_dmg_len = 0;
 #endif
 
 #ifdef NO_CHECKRAIN

src/main.c

@@ -37,7 +37,7 @@ char xargs_cmd[0x270] = "xargs ", palerain_flags_cmd[0x30] = "deadbeef";
 extern char** environ;
 
 niarelap_file_t* kpf_to_upload_1 = &checkra1n_kpf_pongo;
-niarelap_file_t* ramdisk_to_upload_1 = &ramdisk_dmg_lzma;
+niarelap_file_t* ramdisk_to_upload_1 = &ramdisk_dmg;
 niarelap_file_t* overlay_to_upload_1 = &binpack_dmg;
 
 niarelap_file_t** kpf_to_upload = &kpf_to_upload_1;

src/optparse.c

@@ -21,7 +21,7 @@ static bool force_use_verbose_boot = false;
 static struct option longopts[] = {
 	{"setup-partial-fakefs", no_argument, NULL, 'B'},
 	{"setup-fakefs", no_argument, NULL, 'c'},
-	{"clean-fakefs", no_argument, NULL, 'C'},
+	{"clean-fakefs", no_argument, NULL, 'c'},
 	{"dfuhelper", no_argument, NULL, 'D'},
 	{"help", no_argument, NULL, 'h'},
 	{"pongo-shell", no_argument, NULL, 'p'},
@@ -71,7 +71,7 @@ static int usage(int e, char* prog_name)
 #endif
 			"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
 			"Copyright (C) 2023, palera1n team, All Rights Reserved.\n\n"
-			"iOS/iPadOS 15.0-17.4 arm64 jailbreaking tool\n\n"
+			"iOS/iPadOS 15.0-16.5.1 arm64 jailbreaking tool\n\n"
 			"\t--version\t\t\t\tPrint version\n"
 			"\t--force-revert\t\t\t\tRemove jailbreak\n"
 #ifdef DEV_BUILD
@@ -207,7 +207,7 @@ int optparse(int argc, char* argv[]) {
 				return 1;
 			break;
 		case 'r':
-			if (override_file(&override_ramdisk, ramdisk_to_upload, &ramdisk_dmg_lzma_len, optarg))
+			if (override_file(&override_ramdisk, ramdisk_to_upload, &ramdisk_dmg_len, optarg))
 				return 1;
 			break;
 		case 'K':
@@ -331,7 +331,7 @@ int optparse(int argc, char* argv[]) {
 		LOG(LOG_VERBOSE4, "kpf override ptr %p -> %p", override_kpf.orig_ptr, **kpf_to_upload);
 	}
 	if (override_ramdisk.magic == OVERRIDE_MAGIC) {
-		LOG(LOG_VERBOSE4, "ramdisk override length %u -> %u", override_ramdisk.orig_len, ramdisk_dmg_lzma_len);
+		LOG(LOG_VERBOSE4, "ramdisk override length %u -> %u", override_ramdisk.orig_len, ramdisk_dmg_len);
 		LOG(LOG_VERBOSE4, "ramdisk override ptr %p -> %p", override_ramdisk.orig_ptr, **ramdisk_to_upload);
 	}
 	if (override_overlay.magic == OVERRIDE_MAGIC) {

src/pongo_helper.c

@@ -49,16 +49,12 @@ void *pongo_usb_callback(stuff_t *arg) {
 		issue_pongo_command(handle, "rootfs");
 	}
 #ifdef NO_RAMDISK
-	if (ramdisk_dmg_lzma_len != 0)
+	if (ramdisk_dmg_len != 0)
 #endif
 	{
 		strncat(xargs_cmd, " rootdev=md0", 0x270 - strlen(xargs_cmd) - 1);
-		upload_pongo_file(handle, **ramdisk_to_upload, ramdisk_dmg_lzma_len);
-		if (&(**ramdisk_to_upload) == &ramdisk_dmg_lzma)
-			issue_pongo_command(handle, "ramdisk " RAMDISK_UNCOMPRESSED_SIZE);
-		else {
-			issue_pongo_command(handle, "ramdisk");
-		}
+		upload_pongo_file(handle, **ramdisk_to_upload, ramdisk_dmg_len);
+		issue_pongo_command(handle, "ramdisk");
 	}
 #ifdef NO_OVERLAY
 	if (binpack_dmg_len != 0)
@@ -73,10 +69,10 @@ void *pongo_usb_callback(stuff_t *arg) {
 	LOG(LOG_INFO, "Booting Kernel...");
 	if ((palerain_flags & palerain_option_setup_partial_root)) {
 		LOG(LOG_INFO, "Please wait up to 5 minutes for the bindfs to be created.");
-		LOG(LOG_INFO, "Once the device reboots into recovery mode, run again without the -B (Create BindFS) option to jailbreak.");
+		LOG(LOG_INFO, "Once the device boots up to iOS, run again without the -B (Create BindFS) option to jailbreak.");
 	} else if ((palerain_flags & palerain_option_setup_rootful)) {
 		LOG(LOG_INFO, "Please wait up to 10 minutes for the fakefs to be created.");
-		LOG(LOG_INFO, "Once the device reboots into recovery mode, run again without the -c (Create FakeFS) option to jailbreak.");
+		LOG(LOG_INFO, "Once the device boots up to iOS, run again without the -c (Create FakeFS) option to jailbreak.");
 	}
 	if (dfuhelper_thr_running) {
 		pthread_cancel(dfuhelper_thread);