Compare commits

..
10 Commits
Author SHA1 Message Date
Nick Chan 1c7daf8959 support patching linux checkra1n 2026-05-26 21:28:27 +08:00
Nick Chan 706dd94b55 ensure shared t700{0,1} length at least 0xaa4 2026-05-26 20:21:57 +08:00
Nick Chan 0c5c108f87 invalidate x86_64 icache 2026-05-25 01:53:18 +08:00
Nick Chan 6817bc0162 x86_64 checkra1n hook support
with help from @plooshi
2026-05-25 01:51:19 +08:00
Nick Chan 09fef292b2 ptrace fix 2026-05-24 23:41:29 +08:00
Nick Chan 070c181a91 more test 2026-05-24 23:40:03 +08:00
Nick Chan dc2ce0f947 hopefully fix ios dylib insertion 2026-05-24 23:21:26 +08:00
Nick Chan 269b3dc81f testing 123 2026-05-24 22:44:00 +08:00
Nick Chan d65a570726 fix duplicate helper dylib 2026-05-24 22:21:20 +08:00
Nick Chan 3d29bb8dc5 tries to hook checkra1n 2026-05-24 22:17:02 +08:00
4 changed files with 11 additions and 26 deletions

No files matched your search

+3 -12
View File
@@ -1,12 +1,12 @@
.\"- .\"-
.\" Copyright (c) 2026 Nick Chan .\" Copyright (c) 2024 Nick Chan
.\" SPDX-License-Identifier: MIT .\" SPDX-License-Identifier: MIT
.\" .\"
.Dd "23 December 2024" .Dd "23 December 2024"
.Dt palera1n 1 .Dt palera1n 1
.Sh NAME .Sh NAME
.Nm palera1n .Nm palera1n
.Nd arm64 iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 jailbreaking tool .Nd arm64 iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 jailbreaking tool
.Sh SYNOPSIS .Sh SYNOPSIS
.Nm .Nm
.Op Fl cCdDEfhIlLnpRsSTvV .Op Fl cCdDEfhIlLnpRsSTvV
@@ -18,10 +18,9 @@
.Op Fl i Ar checkra1n file .Op Fl i Ar checkra1n file
.Op Fl -version .Op Fl -version
.Op Fl -force-revert .Op Fl -force-revert
.Op Fl -override-libcheckra1nhelper Ar hook dylib
.Sh DESCRIPTION .Sh DESCRIPTION
.Nm .Nm
jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 device, jailbreaks an arm64 (arm64e excluded) iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 device,
utilizing the utilizing the
.Em checkm8 .Em checkm8
bootROM exploit. bootROM exploit.
@@ -169,10 +168,6 @@ Proceed in rootful mode. Despite its name, this applies to both full, partial fa
Prints help text. Prints help text.
.It Fl i , -checkra1n-file Ar checkra1n file .It Fl i , -checkra1n-file Ar checkra1n file
Specify the path to a custom checkra1n file. Specify the path to a custom checkra1n file.
On Apple platforms this will disable the built-in checkra1n helper.
A custom one may still be specified with
.Fl -override-libcheckra1nhelper
\[char46]
.It Fl k , -override-pongo Ar pongo file .It Fl k , -override-pongo Ar pongo file
Override PongoOS image. The raw image, named Override PongoOS image. The raw image, named
.Em Pongo.bin .Em Pongo.bin
@@ -227,10 +222,6 @@ Enable debug logging. The option may be repeated for extra verbosity.
Boots the device in verbose mode, allowing boot logs to be seen. Boots the device in verbose mode, allowing boot logs to be seen.
.It Fl I , -device-info .It Fl I , -device-info
Prints info about device and exits. Prints info about device and exits.
.It Fl -override-libcheckra1nhelper Ar hook dylib
(Apple platforms only) Specify a custom dylib to insert into checkra1n via
.Em DYLD_INSERT_LIBRARIES
\[char46]
.El .El
.Sh ENVIRONMENTAL VARIABLES .Sh ENVIRONMENTAL VARIABLES
.Bl -tag -width -indent .Bl -tag -width -indent
-4
View File
@@ -4,11 +4,7 @@
#include <stdint.h> #include <stdint.h>
#include <stdio.h> #include <stdio.h>
#ifdef DEV_BUILD
#define dprintf(...) printf(__VA_ARGS__) #define dprintf(...) printf(__VA_ARGS__)
#else
#define dprintf(...)
#endif
extern uint8_t t7000_bin[]; extern uint8_t t7000_bin[];
extern uint32_t t7000_bin_len; extern uint32_t t7000_bin_len;
+2 -4
View File
@@ -78,7 +78,7 @@ static int usage(int e, char* prog_name)
#endif #endif
"] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n" "] [-e boot arguments] [-k Pongo image] [-o overlay file] [-r ramdisk file] [-K KPF file] [-i checkra1n file]\n"
"Copyright (C) 2024, palera1n team, All Rights Reserved.\n\n" "Copyright (C) 2024, palera1n team, All Rights Reserved.\n\n"
"iOS/iPadOS/tvOS 15-26, bridgeOS 5-10 arm64 jailbreaking tool\n\n" "iOS/iPadOS/tvOS 15.0-26.0, bridgeOS 5.0-10.0 arm64 jailbreaking tool\n\n"
"\t--version\t\t\t\tPrint version\n" "\t--version\t\t\t\tPrint version\n"
"\t--force-revert\t\t\t\tRemove jailbreak\n" "\t--force-revert\t\t\t\tRemove jailbreak\n"
#ifdef DEV_BUILD #ifdef DEV_BUILD
@@ -122,9 +122,6 @@ static int usage(int e, char* prog_name)
#ifdef TUI #ifdef TUI
"\t-t, --tui\t\t\t\tForce interactive TUI\n" "\t-t, --tui\t\t\t\tForce interactive TUI\n"
"\t--cli\t\t\t\t\tForce cli mode\n" "\t--cli\t\t\t\t\tForce cli mode\n"
#endif
#if defined(__APPLE__)
"\t--override-libcheckra1nhelper <file>\tCustom checkra1n hook dylib\n"
#endif #endif
"\nEnvironmental variables:\n" "\nEnvironmental variables:\n"
"\tTMPDIR\t\ttemporary diretory (path the built-in checkra1n will be extracted to)\n" "\tTMPDIR\t\ttemporary diretory (path the built-in checkra1n will be extracted to)\n"
@@ -332,6 +329,7 @@ int optparse(int argc, char* argv[]) {
palerain_flags |= palerain_option_palerain_version; palerain_flags |= palerain_option_palerain_version;
break; break;
case palerain_option_case_libcheckra1nhelper_path: case palerain_option_case_libcheckra1nhelper_path:
printf("meow\n");
gOverrideLibcheckra1nHelper = calloc(1, strlen(optarg) + 1); gOverrideLibcheckra1nHelper = calloc(1, strlen(optarg) + 1);
if (!gOverrideLibcheckra1nHelper) { if (!gOverrideLibcheckra1nHelper) {
return -1; return -1;
+6 -6
View File
@@ -31,7 +31,7 @@ extern uint32_t t8012_bin_len;
} \ } \
} while (0) } while (0)
const uint8_t elf_header[] = {0x7f, 'E', 'L', 'F'}; const char elf_header[] = {0x7f, 'E', 'L', 'F'};
// elf64_ptr_to_va // elf64_ptr_to_va
// elf_va_to_ptr // elf_va_to_ptr
@@ -127,13 +127,13 @@ static void patch_arm64(void *elf, uint32_t *stream, const uint8_t *payload,
printf("patched: 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2]); printf("patched: 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2]);
} }
const uint8_t linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00, const char linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
0xbe, 0x20, 0x54, 0x20, 0x00, 0xba, 0xbe, 0x20, 0x54, 0x20, 0x00, 0xba,
0xa4, 0x0a, 0x00, 0x00}; 0xa4, 0x0a, 0x00, 0x00};
const uint8_t linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00, const char linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
0xbe, 0xe0, 0x95, 0x20, 0x00, 0xba, 0xbe, 0xe0, 0x95, 0x20, 0x00, 0xba,
0xf4, 0x0c, 0x00, 0x00}; 0xf4, 0x0c, 0x00, 0x00};
const uint8_t linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00, const char linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
0xbe, 0x10, 0xb0, 0x20, 0x00, 0xba, 0xbe, 0x10, 0xb0, 0x20, 0x00, 0xba,
0xb8, 0x0a, 0x00, 0x00}; 0xb8, 0x0a, 0x00, 0x00};
@@ -163,7 +163,7 @@ int parse_checkra1n64(void *c1) {
Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)c1 + hdr->e_shoff); Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset; char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
Elf64_Half text_idx = 0, kpf_idx = 0; Elf64_Half text_idx, kpf_idx;
for (Elf64_Half i = 0; i < hdr->e_shnum; i++) { for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
if (strcmp(&strings[sections[i].sh_name], ".text") == 0) if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
@@ -262,7 +262,7 @@ int parse_checkra1n32(void *c1) {
Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)c1 + hdr->e_shoff); Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset; char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
Elf32_Half text_idx = 0, kpf_idx = 0; Elf32_Half text_idx, kpf_idx;
for (Elf32_Half i = 0; i < hdr->e_shnum; i++) { for (Elf32_Half i = 0; i < hdr->e_shnum; i++) {
if (strcmp(&strings[sections[i].sh_name], ".text") == 0) if (strcmp(&strings[sections[i].sh_name], ".text") == 0)