mirror of
https://github.com/palera1n/palera1n.git
synced 2026-10-21 17:57:01 +02:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
1c7daf8959 | ||
|
|
706dd94b55 | ||
|
|
0c5c108f87 | ||
|
|
6817bc0162 | ||
|
|
09fef292b2 | ||
|
|
070c181a91 | ||
|
|
dc2ce0f947 | ||
|
|
269b3dc81f | ||
|
|
d65a570726 | ||
|
|
3d29bb8dc5 |
No files matched your search
+3
-12
@@ -1,12 +1,12 @@
|
||||
.\"-
|
||||
.\" Copyright (c) 2026 Nick Chan
|
||||
.\" Copyright (c) 2024 Nick Chan
|
||||
.\" SPDX-License-Identifier: MIT
|
||||
.\"
|
||||
.Dd "23 December 2024"
|
||||
.Dt palera1n 1
|
||||
.Sh NAME
|
||||
.Nm palera1n
|
||||
.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool
|
||||
.Nd arm64 iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 jailbreaking tool
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Op Fl cCdDEfhIlLnpRsSTvV
|
||||
@@ -18,10 +18,9 @@
|
||||
.Op Fl i Ar checkra1n file
|
||||
.Op Fl -version
|
||||
.Op Fl -force-revert
|
||||
.Op Fl -override-libcheckra1nhelper Ar hook dylib
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device,
|
||||
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 device,
|
||||
utilizing the
|
||||
.Em checkm8
|
||||
bootROM exploit.
|
||||
@@ -169,10 +168,6 @@ Proceed in rootful mode. Despite its name, this applies to both full, partial fa
|
||||
Prints help text.
|
||||
.It Fl i , -checkra1n-file Ar checkra1n file
|
||||
Specify the path to a custom checkra1n file.
|
||||
On Apple platforms this will disable the built-in checkra1n helper.
|
||||
A custom one may still be specified with
|
||||
.Fl -override-libcheckra1nhelper
|
||||
\[char46]
|
||||
.It Fl k , -override-pongo Ar pongo file
|
||||
Override PongoOS image. The raw image, named
|
||||
.Em Pongo.bin
|
||||
@@ -227,10 +222,6 @@ Enable debug logging. The option may be repeated for extra verbosity.
|
||||
Boots the device in verbose mode, allowing boot logs to be seen.
|
||||
.It Fl I , -device-info
|
||||
Prints info about device and exits.
|
||||
.It Fl -override-libcheckra1nhelper Ar hook dylib
|
||||
(Apple platforms only) Specify a custom dylib to insert into checkra1n via
|
||||
.Em DYLD_INSERT_LIBRARIES
|
||||
\[char46]
|
||||
.El
|
||||
.Sh ENVIRONMENTAL VARIABLES
|
||||
.Bl -tag -width -indent
|
||||
|
||||
@@ -4,11 +4,7 @@
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#ifdef DEV_BUILD
|
||||
#define dprintf(...) printf(__VA_ARGS__)
|
||||
#else
|
||||
#define dprintf(...)
|
||||
#endif
|
||||
|
||||
extern uint8_t t7000_bin[];
|
||||
extern uint32_t t7000_bin_len;
|
||||
|
||||
+2
-4
@@ -78,7 +78,7 @@ static int usage(int e, char* prog_name)
|
||||
#endif
|
||||
"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
|
||||
"Copyright (C) 2024, palera1n team, All Rights Reserved.\n\n"
|
||||
"iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 arm64 jailbreaking tool\n\n"
|
||||
"iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 arm64 jailbreaking tool\n\n"
|
||||
"\t--version\t\t\t\tPrint version\n"
|
||||
"\t--force-revert\t\t\t\tRemove jailbreak\n"
|
||||
#ifdef DEV_BUILD
|
||||
@@ -122,9 +122,6 @@ static int usage(int e, char* prog_name)
|
||||
#ifdef TUI
|
||||
"\t-t, --tui\t\t\t\tForce interactive TUI\n"
|
||||
"\t--cli\t\t\t\t\tForce cli mode\n"
|
||||
#endif
|
||||
#if defined(__APPLE__)
|
||||
"\t--override-libcheckra1nhelper <file>\tCustom checkra1n hook dylib\n"
|
||||
#endif
|
||||
"\nEnvironmental variables:\n"
|
||||
"\tTMPDIR\t\ttemporary diretory (path the built-in checkra1n will be extracted to)\n"
|
||||
@@ -332,6 +329,7 @@ int optparse(int argc, char* argv[]) {
|
||||
palerain_flags |= palerain_option_palerain_version;
|
||||
break;
|
||||
case palerain_option_case_libcheckra1nhelper_path:
|
||||
printf("meow\n");
|
||||
gOverrideLibcheckra1nHelper = calloc(1, strlen(optarg) + 1);
|
||||
if (!gOverrideLibcheckra1nHelper) {
|
||||
return -1;
|
||||
|
||||
+6
-6
@@ -31,7 +31,7 @@ extern uint32_t t8012_bin_len;
|
||||
} \
|
||||
} while (0)
|
||||
|
||||
const uint8_t elf_header[] = {0x7f, 'E', 'L', 'F'};
|
||||
const char elf_header[] = {0x7f, 'E', 'L', 'F'};
|
||||
|
||||
// elf64_ptr_to_va
|
||||
// elf_va_to_ptr
|
||||
@@ -127,13 +127,13 @@ static void patch_arm64(void *elf, uint32_t *stream, const uint8_t *payload,
|
||||
printf("patched: 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2]);
|
||||
}
|
||||
|
||||
const uint8_t linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
|
||||
const char linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
|
||||
0xbe, 0x20, 0x54, 0x20, 0x00, 0xba,
|
||||
0xa4, 0x0a, 0x00, 0x00};
|
||||
const uint8_t linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
|
||||
const char linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
|
||||
0xbe, 0xe0, 0x95, 0x20, 0x00, 0xba,
|
||||
0xf4, 0x0c, 0x00, 0x00};
|
||||
const uint8_t linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
|
||||
const char linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
|
||||
0xbe, 0x10, 0xb0, 0x20, 0x00, 0xba,
|
||||
0xb8, 0x0a, 0x00, 0x00};
|
||||
|
||||
@@ -163,7 +163,7 @@ int parse_checkra1n64(void *c1) {
|
||||
Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
|
||||
char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
|
||||
|
||||
Elf64_Half text_idx = 0, kpf_idx = 0;
|
||||
Elf64_Half text_idx, kpf_idx;
|
||||
|
||||
for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
|
||||
if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
|
||||
@@ -262,7 +262,7 @@ int parse_checkra1n32(void *c1) {
|
||||
Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
|
||||
char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
|
||||
|
||||
Elf32_Half text_idx = 0, kpf_idx = 0;
|
||||
Elf32_Half text_idx, kpf_idx;
|
||||
|
||||
for (Elf32_Half i = 0; i < hdr->e_shnum; i++) {
|
||||
if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
|
||||
|
||||
Reference in new issue
Block a user