Compare commits

..
10 Commits
Author SHA1 Message Date
Nick Chan 1c7daf8959 support patching linux checkra1n 2026-05-26 21:28:27 +08:00
Nick Chan 706dd94b55 ensure shared t700{0,1} length at least 0xaa4 2026-05-26 20:21:57 +08:00
Nick Chan 0c5c108f87 invalidate x86_64 icache 2026-05-25 01:53:18 +08:00
Nick Chan 6817bc0162 x86_64 checkra1n hook support
with help from @plooshi
2026-05-25 01:51:19 +08:00
Nick Chan 09fef292b2 ptrace fix 2026-05-24 23:41:29 +08:00
Nick Chan 070c181a91 more test 2026-05-24 23:40:03 +08:00
Nick Chan dc2ce0f947 hopefully fix ios dylib insertion 2026-05-24 23:21:26 +08:00
Nick Chan 269b3dc81f testing 123 2026-05-24 22:44:00 +08:00
Nick Chan d65a570726 fix duplicate helper dylib 2026-05-24 22:21:20 +08:00
Nick Chan 3d29bb8dc5 tries to hook checkra1n 2026-05-24 22:17:02 +08:00
4 changed files with 11 additions and 26 deletions

No files matched your search

+3 -12
View File
@@ -1,12 +1,12 @@
.\"-
.\" Copyright (c) 2026 Nick Chan
.\" Copyright (c) 2024 Nick Chan
.\" SPDX-License-Identifier: MIT
.\"
.Dd "23 December 2024"
.Dt palera1n 1
.Sh NAME
.Nm palera1n
.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool
.Nd arm64 iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 jailbreaking tool
.Sh SYNOPSIS
.Nm
.Op Fl cCdDEfhIlLnpRsSTvV
@@ -18,10 +18,9 @@
.Op Fl i Ar checkra1n file
.Op Fl -version
.Op Fl -force-revert
.Op Fl -override-libcheckra1nhelper Ar hook dylib
.Sh DESCRIPTION
.Nm
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device,
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 device,
utilizing the
.Em checkm8
bootROM exploit.
@@ -169,10 +168,6 @@ Proceed in rootful mode. Despite its name, this applies to both full, partial fa
Prints help text.
.It Fl i , -checkra1n-file Ar checkra1n file
Specify the path to a custom checkra1n file.
On Apple platforms this will disable the built-in checkra1n helper.
A custom one may still be specified with
.Fl -override-libcheckra1nhelper
\[char46]
.It Fl k , -override-pongo Ar pongo file
Override PongoOS image. The raw image, named
.Em Pongo.bin
@@ -227,10 +222,6 @@ Enable debug logging. The option may be repeated for extra verbosity.
Boots the device in verbose mode, allowing boot logs to be seen.
.It Fl I , -device-info
Prints info about device and exits.
.It Fl -override-libcheckra1nhelper Ar hook dylib
(Apple platforms only) Specify a custom dylib to insert into checkra1n via
.Em DYLD_INSERT_LIBRARIES
\[char46]
.El
.Sh ENVIRONMENTAL VARIABLES
.Bl -tag -width -indent
-4
View File
@@ -4,11 +4,7 @@
#include <stdint.h>
#include <stdio.h>
#ifdef DEV_BUILD
#define dprintf(...) printf(__VA_ARGS__)
#else
#define dprintf(...)
#endif
extern uint8_t t7000_bin[];
extern uint32_t t7000_bin_len;
+2 -4
View File
@@ -78,7 +78,7 @@ static int usage(int e, char* prog_name)
#endif
"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
"Copyright (C) 2024, palera1n team, All Rights Reserved.\n\n"
"iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 arm64 jailbreaking tool\n\n"
"iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 arm64 jailbreaking tool\n\n"
"\t--version\t\t\t\tPrint version\n"
"\t--force-revert\t\t\t\tRemove jailbreak\n"
#ifdef DEV_BUILD
@@ -122,9 +122,6 @@ static int usage(int e, char* prog_name)
#ifdef TUI
"\t-t, --tui\t\t\t\tForce interactive TUI\n"
"\t--cli\t\t\t\t\tForce cli mode\n"
#endif
#if defined(__APPLE__)
"\t--override-libcheckra1nhelper <file>\tCustom checkra1n hook dylib\n"
#endif
"\nEnvironmental variables:\n"
"\tTMPDIR\t\ttemporary diretory (path the built-in checkra1n will be extracted to)\n"
@@ -332,6 +329,7 @@ int optparse(int argc, char* argv[]) {
palerain_flags |= palerain_option_palerain_version;
break;
case palerain_option_case_libcheckra1nhelper_path:
printf("meow\n");
gOverrideLibcheckra1nHelper = calloc(1, strlen(optarg) + 1);
if (!gOverrideLibcheckra1nHelper) {
return -1;
+6 -6
View File
@@ -31,7 +31,7 @@ extern uint32_t t8012_bin_len;
} \
} while (0)
const uint8_t elf_header[] = {0x7f, 'E', 'L', 'F'};
const char elf_header[] = {0x7f, 'E', 'L', 'F'};
// elf64_ptr_to_va
// elf_va_to_ptr
@@ -127,13 +127,13 @@ static void patch_arm64(void *elf, uint32_t *stream, const uint8_t *payload,
printf("patched: 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2]);
}
const uint8_t linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
const char linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
0xbe, 0x20, 0x54, 0x20, 0x00, 0xba,
0xa4, 0x0a, 0x00, 0x00};
const uint8_t linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
const char linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
0xbe, 0xe0, 0x95, 0x20, 0x00, 0xba,
0xf4, 0x0c, 0x00, 0x00};
const uint8_t linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
const char linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
0xbe, 0x10, 0xb0, 0x20, 0x00, 0xba,
0xb8, 0x0a, 0x00, 0x00};
@@ -163,7 +163,7 @@ int parse_checkra1n64(void *c1) {
Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
Elf64_Half text_idx = 0, kpf_idx = 0;
Elf64_Half text_idx, kpf_idx;
for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
@@ -262,7 +262,7 @@ int parse_checkra1n32(void *c1) {
Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
Elf32_Half text_idx = 0, kpf_idx = 0;
Elf32_Half text_idx, kpf_idx;
for (Elf32_Half i = 0; i < hdr->e_shnum; i++) {
if (strcmp(&strings[sections[i].sh_name], ".text") == 0)