mirror of
https://github.com/palera1n/palera1n.git
synced 2026-10-23 18:49:48 +02:00
GeoSn0w
f491e02898
I'd say it's much easier this way for the user to understand what output comes from PaleRa1n and it's easier to copy and paste logs in case of bugs. Feel free to dismiss.
664 lines
27 KiB
Bash
Executable File
664 lines
27 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
printf "\033c"
|
||
mkdir -p logs
|
||
set -e
|
||
|
||
{
|
||
|
||
# =========
|
||
# Variables
|
||
# =========
|
||
ipsw="" # IF YOU WERE TOLD TO PUT A CUSTOM IPSW URL, PUT IT HERE. YOU CAN FIND THEM ON https://appledb.dev
|
||
version="1.1.0"
|
||
os=$(uname)
|
||
dir="$(pwd)/binaries/$os"
|
||
commit=$(git rev-parse --short HEAD)
|
||
|
||
# =========
|
||
# Functions
|
||
# =========
|
||
step() {
|
||
for i in $(seq "$1" -1 1); do
|
||
printf '\r\e[1;36m%s (%d) ' "$2" "$i"
|
||
sleep 1
|
||
done
|
||
printf '\r\e[0m%s (0)\n' "$2"
|
||
}
|
||
|
||
_wait() {
|
||
if [ "$1" = 'normal' ]; then
|
||
if [ "$os" = 'Darwin' ]; then
|
||
if ! (system_profiler SPUSBDataType 2> /dev/null | grep 'Manufacturer: Apple Inc.' >> /dev/null); then
|
||
echo "[*] Waiting for device in normal mode"
|
||
fi
|
||
|
||
while ! (system_profiler SPUSBDataType 2> /dev/null | grep 'Manufacturer: Apple Inc.' >> /dev/null); do
|
||
sleep 1
|
||
done
|
||
else
|
||
if ! (lsusb 2> /dev/null | grep ' Apple, Inc.' >> /dev/null); then
|
||
echo "[*] Waiting for device in normal mode"
|
||
fi
|
||
|
||
while ! (lsusb 2> /dev/null | grep ' Apple, Inc.' >> /dev/null); do
|
||
sleep 1
|
||
done
|
||
fi
|
||
elif [ "$1" = 'recovery' ]; then
|
||
if [ "$os" = 'Darwin' ]; then
|
||
if ! (system_profiler SPUSBDataType 2> /dev/null | grep ' Apple Mobile Device (Recovery Mode):' >> /dev/null); then
|
||
echo "[*] Waiting for device to reconnect in recovery mode"
|
||
fi
|
||
|
||
while ! (system_profiler SPUSBDataType 2> /dev/null | grep ' Apple Mobile Device (Recovery Mode):' >> /dev/null); do
|
||
sleep 1
|
||
done
|
||
else
|
||
if ! (lsusb 2> /dev/null | grep 'Recovery Mode' >> /dev/null); then
|
||
echo "[*] Waiting for device to reconnect in recovery mode"
|
||
fi
|
||
|
||
while ! (lsusb 2> /dev/null | grep 'Recovery Mode' >> /dev/null); do
|
||
sleep 1
|
||
done
|
||
fi
|
||
if [[ ! $1 == *"--tweaks"* ]]; then
|
||
"$dir"/irecovery -c "setenv auto-boot true"
|
||
"$dir"/irecovery -c "saveenv"
|
||
fi
|
||
|
||
fi
|
||
}
|
||
|
||
_check_dfu() {
|
||
if [ "$os" = 'Darwin' ]; then
|
||
if ! (system_profiler SPUSBDataType 2> /dev/null | grep ' Apple Mobile Device (DFU Mode):' >> /dev/null); then
|
||
echo "[-] Device didn't go in DFU mode, please rerun the script and try again"
|
||
exit
|
||
fi
|
||
else
|
||
if ! (lsusb 2> /dev/null | grep 'DFU Mode' >> /dev/null); then
|
||
echo "[-] Device didn't go in DFU mode, please rerun the script and try again"
|
||
exit
|
||
fi
|
||
fi
|
||
}
|
||
|
||
_info() {
|
||
if [ "$1" = 'recovery' ]; then
|
||
echo $("$dir"/irecovery -q | grep "$2" | sed "s/$2: //")
|
||
elif [ "$1" = 'normal' ]; then
|
||
echo $("$dir"/ideviceinfo | grep "$2: " | sed "s/$2: //")
|
||
fi
|
||
}
|
||
|
||
_pwn() {
|
||
pwnd=$(_info recovery PWND)
|
||
if [ "$pwnd" = "" ]; then
|
||
echo "[*] Pwning device"
|
||
"$dir"/gaster pwn
|
||
sleep 2
|
||
#"$dir"/gaster reset
|
||
#sleep 1
|
||
fi
|
||
}
|
||
|
||
_dfuhelper() {
|
||
echo "[*] Press any key when ready for DFU mode"
|
||
read -n 1 -s
|
||
step 3 "Get ready"
|
||
step 4 "Hold volume down + side button" &
|
||
sleep 3
|
||
"$dir"/irecovery -c "reset"
|
||
step 1 "Keep holding"
|
||
step 10 'Release side button, but keep holding volume down'
|
||
sleep 1
|
||
|
||
_check_dfu
|
||
echo "[*] Device entered DFU!"
|
||
}
|
||
|
||
_kill_if_running() {
|
||
if (pgrep -u root -xf "$1" &> /dev/null > /dev/null); then
|
||
# yes, it's running as root. kill it
|
||
sudo killall $1
|
||
else
|
||
if (pgrep -x "$1" &> /dev/null > /dev/null); then
|
||
killall $1
|
||
fi
|
||
fi
|
||
}
|
||
|
||
_beta_url() {
|
||
json=$(curl -s https://raw.githubusercontent.com/littlebyteorg/appledb/main/osFiles/iOS/19x%20-%2015.x/19B5060d.json)
|
||
sources=$(echo "$json" | $dir/jq -r '.sources')
|
||
beta_url=$(echo "$sources" | $dir/jq -r --arg deviceid "$deviceid" '.[] | select(.type == "ota" and (.deviceMap | index($deviceid))) | .links[0].url')
|
||
echo "$beta_url"
|
||
}
|
||
|
||
_exit_handler() {
|
||
if [ "$os" = 'Darwin' ]; then
|
||
if [ ! "$1" = '--dfu' ]; then
|
||
defaults write -g ignore-devices -bool false
|
||
defaults write com.apple.AMPDevicesAgent dontAutomaticallySyncIPods -bool false
|
||
killall Finder
|
||
fi
|
||
fi
|
||
[ $? -eq 0 ] && exit
|
||
echo "[-] An error occurred"
|
||
|
||
cd logs
|
||
for file in *.log; do
|
||
mv "$file" FAIL_${file}
|
||
done
|
||
cd ..
|
||
|
||
echo "[*] A failure log has been made. If you're going to make a GitHub issue, please attach the latest log."
|
||
}
|
||
trap _exit_handler EXIT
|
||
|
||
# ===========
|
||
# Fixes
|
||
# ===========
|
||
|
||
# Prevent Finder from complaning
|
||
if [ "$os" = 'Darwin' ]; then
|
||
defaults write -g ignore-devices -bool true
|
||
defaults write com.apple.AMPDevicesAgent dontAutomaticallySyncIPods -bool true
|
||
killall Finder
|
||
fi
|
||
|
||
# ===========
|
||
# Subcommands
|
||
# ===========
|
||
|
||
if [ "$1" = 'clean' ]; then
|
||
rm -rf boot* work
|
||
rm -rf .tweaksinstalled
|
||
echo "[*] Removed the created boot files"
|
||
exit
|
||
elif [ "$1" = 'dfuhelper' ]; then
|
||
echo "[*] Running DFU helper"
|
||
_dfuhelper
|
||
exit
|
||
fi
|
||
|
||
# ============
|
||
# Dependencies
|
||
# ============
|
||
|
||
# Download gaster
|
||
if [ ! -e "$dir"/gaster ]; then
|
||
curl -sLO https://nightly.link/verygenericname/gaster/workflows/makefile/main/gaster-"$os".zip
|
||
unzip gaster-"$os".zip
|
||
mv gaster "$dir"/
|
||
rm -rf gaster gaster-"$os".zip
|
||
fi
|
||
|
||
# Check for pyimg4
|
||
if ! python3 -c 'import pkgutil; exit(not pkgutil.find_loader("pyimg4"))'; then
|
||
echo '[-] pyimg4 not installed. Press any key to install it, or press ctrl + c to cancel'
|
||
read -n 1 -s
|
||
python3 -m pip install pyimg4
|
||
fi
|
||
|
||
# ============
|
||
# Prep
|
||
# ============
|
||
|
||
# Update submodules
|
||
git submodule update --init --recursive
|
||
|
||
# Re-create work dir if it exists, else, make it
|
||
if [ -e work ]; then
|
||
rm -rf work
|
||
mkdir work
|
||
else
|
||
mkdir work
|
||
fi
|
||
|
||
chmod +x "$dir"/*
|
||
#if [ "$os" = 'Darwin' ]; then
|
||
# xattr -d com.apple.quarantine "$dir"/*
|
||
#fi
|
||
|
||
# ============
|
||
# Start
|
||
# ============
|
||
|
||
echo "palera1n | Version $version-$commit"
|
||
echo "Written by Nebula and Mineek | Some code and ramdisk from Nathan | Loader app by Amy"
|
||
echo ""
|
||
|
||
if [ "$1" = '--tweaks' ]; then
|
||
_check_dfu
|
||
fi
|
||
|
||
if [ "$1" = '--tweaks' ] && [ ! -e ".tweaksinstalled" ] && [ ! -e ".disclaimeragree" ]; then
|
||
echo "!!! WARNING WARNING WARNING !!!"
|
||
echo "This flag will add tweak support BUT WILL BE TETHERED."
|
||
echo "THIS ALSO MEANS THAT YOU'LL NEED A PC EVERY TIME TO BOOT."
|
||
echo "THIS ONLY WORKS ON 15.0-15.3.1"
|
||
echo "DO NOT GET ANGRY AT US IF UR DEVICE IS BORKED, IT'S YOUR OWN FAULT AND WE WARNED YOU"
|
||
echo "DO YOU UNDERSTAND? TYPE 'Yes, do as I say' TO CONTINUE"
|
||
read -r answer
|
||
if [ "$answer" = 'Yes, do as I say' ]; then
|
||
echo "Are you REALLY sure? WE WARNED YOU!"
|
||
echo "Type 'Yes, I am sure' to continue"
|
||
read -r answer
|
||
if [ "$answer" = 'Yes, I am sure' ]; then
|
||
echo "[*] Enabling tweaks"
|
||
tweaks=1
|
||
touch .disclaimeragree
|
||
else
|
||
echo "[*] Disabling tweaks"
|
||
tweaks=0
|
||
fi
|
||
else
|
||
echo "[*] Disabling tweaks"
|
||
tweaks=0
|
||
fi
|
||
fi
|
||
|
||
# Get device's iOS version from ideviceinfo if in normal mode
|
||
if [ "$1" = '--dfu' ] || [ "$1" = '--tweaks' ]; then
|
||
if [ -z "$2" ]; then
|
||
echo "[-] When using --dfu, please pass the version you're device is on"
|
||
exit
|
||
else
|
||
version=$2
|
||
fi
|
||
else
|
||
_wait normal
|
||
version=$(_info normal ProductVersion)
|
||
arch=$(_info normal CPUArchitecture)
|
||
if [ "$arch" = "arm64e" ]; then
|
||
echo "[-] palera1n doesn't, and never will, work on non-checkm8 devices"
|
||
exit
|
||
fi
|
||
echo "Hello, $(_info normal ProductType) on $version!"
|
||
fi
|
||
|
||
# Put device into recovery mode, and set auto-boot to true
|
||
if [ ! "$1" = '--dfu' ] && [ ! "$1" = '--tweaks' ]; then
|
||
echo "[*] Switching device into recovery mode..."
|
||
"$dir"/ideviceenterrecovery $(_info normal UniqueDeviceID)
|
||
_wait recovery
|
||
fi
|
||
|
||
# Grab more info
|
||
echo "[*] Getting device info..."
|
||
cpid=$(_info recovery CPID)
|
||
model=$(_info recovery MODEL)
|
||
deviceid=$(_info recovery PRODUCT)
|
||
if [ ! "$ipsw" = "" ]; then
|
||
ipswurl=$ipsw
|
||
else
|
||
ipswurl=$(curl -sL "https://api.ipsw.me/v4/device/$deviceid?type=ipsw" | "$dir"/jq '.firmwares | .[] | select(.version=="'"$version"'") | .url' --raw-output)
|
||
fi
|
||
|
||
# Have the user put the device into DFU
|
||
if [ ! "$1" = '--dfu' ] && [ ! "$1" = '--tweaks' ]; then
|
||
_dfuhelper
|
||
fi
|
||
sleep 2
|
||
|
||
# if the user specified --restorerootfs, execute irecovery -n
|
||
if [ "$1" = '--restorerootfs' ]; then
|
||
echo "[*] Restoring rootfs..."
|
||
"$dir"/irecovery -n
|
||
sleep 2
|
||
echo "[*] Done, your device will boot into iOS now."
|
||
# clean the boot files bcs we don't need them anymore
|
||
rm -rf boot*
|
||
rm -rf work
|
||
rm -rf .tweaksinstalled
|
||
exit
|
||
fi
|
||
|
||
# ============
|
||
# Ramdisk
|
||
# ============
|
||
|
||
# Dump blobs, and install pogo if needed
|
||
if [ ! -f blobs/"$deviceid"-"$version".shsh2 ]; then
|
||
mkdir -p blobs
|
||
cd ramdisk
|
||
|
||
chmod +x sshrd.sh
|
||
echo "[*] Creating ramdisk"
|
||
./sshrd.sh "$version"
|
||
|
||
echo "[*] Booting ramdisk"
|
||
./sshrd.sh boot
|
||
cd ..
|
||
# if known hosts file exists, remove it
|
||
if [ -f ~/.ssh/known_hosts ]; then
|
||
rm ~/.ssh/known_hosts
|
||
fi
|
||
|
||
# Execute the commands once the rd is booted
|
||
if [ "$os" = 'Linux' ]; then
|
||
sudo "$dir"/iproxy 2222 22 &
|
||
else
|
||
"$dir"/iproxy 2222 22 &
|
||
fi
|
||
|
||
if ! ("$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "echo connected" &> /dev/null); then
|
||
echo "[*] Waiting for the ramdisk to finish booting"
|
||
fi
|
||
|
||
while ! ("$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "echo connected" &> /dev/null); do
|
||
sleep 1
|
||
done
|
||
|
||
echo "[*] Dumping blobs and installing Pogo"
|
||
sleep 1
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "cat /dev/rdisk1" | dd of=dump.raw bs=256 count=$((0x4000))
|
||
"$dir"/img4tool --convert -s blobs/"$deviceid"-"$version".shsh2 dump.raw
|
||
rm dump.raw
|
||
|
||
# blobs validation by iam-theKid
|
||
if [[ ! "$@" == *"--no-blob-validation"* ]]; then
|
||
dumpedBlobs="blobs/"$deviceid"-"$version".shsh2"
|
||
|
||
blobsBuildID=$(curl -sL "https://api.ipsw.me/v4/device/$deviceid?type=ipsw" | "$dir"/jq '.firmwares | .[] | select(.version=="'"$version"'") | .buildid' --raw-output)
|
||
blobsipswURL=$(curl -sL "https://api.ipsw.me/v4/device/$deviceid?type=ipsw" | "$dir"/jq '.firmwares | .[] | select(.version=="'"$version"'") | .url' --raw-output)
|
||
blobsotaURL=$(curl -sL "https://api.ipsw.me/v4/device/$deviceid?type=ota" | "$dir"/jq '.firmwares | .[] | select(.buildid=="'"$blobsBuildID"'") | .url' --raw-output)
|
||
|
||
"$dir"/pzb -g BuildManifest.plist "$blobsipswURL"
|
||
mv BuildManifest.plist work/BuildManifest\_IPSW\_$deviceid\_$version\_$blobsBuildID.plist
|
||
|
||
"$dir"/pzb -g AssetData/boot/BuildManifest.plist $blobsotaURL
|
||
mv BuildManifest.plist work/BuildManifest\_OTA\_$deviceid\_$version\_$blobsBuildID.plist
|
||
|
||
echo "[*] Validating dumped blobs..."
|
||
if [[ "$($dir/img4tool --verify work/BuildManifest\_OTA\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'APTicket' | cut -d ' ' -f4)" == "GOOD\!" ]]; then
|
||
"$dir"/img4tool --verify work/BuildManifest\_OTA\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'APTicket' > $out
|
||
"$dir"/img4tool --verify work/BuildManifest\_OTA\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'IM4M is valid\|BuildNumber\|\|DeiviceClass\|RestoreBehavior\|Variant\|SHSH2' > $out
|
||
echo "[*] Dumped blobs are valid!"
|
||
elif [[ "$($dir/img4tool --verify BuildManifest\_IPSW\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'APTicket' | cut -d ' ' -f4)" == "GOOD\!" ]]; then
|
||
"$dir"/img4tool --verify work/BuildManifest\_IPSW\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'APTicket' > $out
|
||
"$dir"/img4tool --verify work/BuildManifest\_IPSW\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'IM4M is valid\|BuildNumber\|\|DeiviceClass\|RestoreBehavior\|Variant\|SHSH2' > $out
|
||
echo "[*] Dumped blobs are valid!"
|
||
else
|
||
echo "[*] Dumped blobs are NOT valid! Trying again..."
|
||
rm "$dumpedBlobs"
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "cat /dev/rdisk1" | dd of=dump.raw bs=256 count=$((0x4000))
|
||
"$dir"/img4tool --convert -s blobs/"$deviceid"-"$version".shsh2 dump.raw
|
||
rm dump.raw
|
||
|
||
if [[ "$($dir/img4tool --verify work/BuildManifest\_OTA\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'APTicket' | cut -d ' ' -f4)" == "GOOD\!" ]]; then
|
||
"$dir"/img4tool --verify work/BuildManifest\_OTA\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'APTicket' > $out
|
||
"$dir"/img4tool --verify work/BuildManifest\_OTA\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'IM4M is valid\|BuildNumber\|\|DeiviceClass\|RestoreBehavior\|Variant\|SHSH2' > $out
|
||
echo "[*] Dumped blobs are valid!"
|
||
elif [[ "$($dir/img4tool --verify BuildManifest\_IPSW\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'APTicket' | cut -d ' ' -f4)" == "GOOD\!" ]]; then
|
||
"$dir"/img4tool --verify work/BuildManifest\_IPSW\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'APTicket' > $out
|
||
"$dir"/img4tool --verify work/BuildManifest\_IPSW\_$deviceid\_$version\_$blobsBuildID.plist -s $dumpedBlobs | grep 'IM4M is valid\|BuildNumber\|\|DeiviceClass\|RestoreBehavior\|Variant\|SHSH2' > $out
|
||
echo "[*] Dumped blobs are valid!"
|
||
else
|
||
echo "[*] Blobs are still invalid... once your device reboots, retry"
|
||
rm "$dumpedBlobs"
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/sbin/reboot"
|
||
sleep 1
|
||
_kill_if_running iproxy
|
||
exit
|
||
fi
|
||
fi
|
||
fi
|
||
|
||
if [[ ! "$@" == *"--no-install"* ]]; then
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/usr/bin/mount_filesystems"
|
||
sleep 1
|
||
tipsdir=$("$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/usr/bin/find /mnt2/containers/Bundle/Application/ -name 'Tips.app'" 2> /dev/null)
|
||
sleep 1
|
||
if [ $tipsdir = "" ]; then
|
||
echo "[*] Tips is not installed. Once your device reboots, install Tips from the App Store and retry"
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/sbin/reboot"
|
||
sleep 1
|
||
_kill_if_running iproxy
|
||
exit
|
||
fi
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/bin/cp -rf /usr/local/bin/loader.app/* $tipsdir"
|
||
sleep 1
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/usr/sbin/chown 33 $tipsdir/Tips"
|
||
sleep 1
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/bin/chmod 755 $tipsdir/Tips $tipsdir/PogoHelper"
|
||
sleep 1
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/usr/sbin/chown 0 $tipsdir/PogoHelper"
|
||
fi
|
||
|
||
if [[ $1 == *"--tweaks"* ]]; then
|
||
# execute nvram boot-args="-v keepsyms=1 debug=0x2014e launchd_unsecure_cache=1 launchd_missing_exec_no_panic=1 amfi=0xff amfi_allow_any_signature=1 amfi_get_out_of_my_way=1 amfi_allow_research=1 amfi_unrestrict_task_for_pid=1 amfi_unrestricted_local_signing=1 cs_enforcement_disable=1 pmap_cs_allow_modified_code_pages=1 pmap_cs_enforce_coretrust=0 pmap_cs_unrestrict_pmap_cs_disable=1 -unsafe_kernel_text dtrace_dof_mode=1 panic-wait-forever=1 -panic_notify cs_debug=1 PE_i_can_has_debugger=1 wdt=-1"
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/usr/sbin/nvram boot-args=\"-v keepsyms=1 debug=0x2014e launchd_unsecure_cache=1 launchd_missing_exec_no_panic=1 amfi=0xff amfi_allow_any_signature=1 amfi_get_out_of_my_way=1 amfi_allow_research=1 amfi_unrestrict_task_for_pid=1 amfi_unrestricted_local_signing=1 cs_enforcement_disable=1 pmap_cs_allow_modified_code_pages=1 pmap_cs_enforce_coretrust=0 pmap_cs_unrestrict_pmap_cs_disable=1 -unsafe_kernel_text dtrace_dof_mode=1 panic-wait-forever=1 -panic_notify cs_debug=1 PE_i_can_has_debugger=1 wdt=-1\""
|
||
# execute nvram allow-root-hash-mismatch=1
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/usr/sbin/nvram allow-root-hash-mismatch=1"
|
||
# execute nvram root-live-fs=1
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/usr/sbin/nvram root-live-fs=1"
|
||
# execute nvram auto-boot=false
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/usr/sbin/nvram auto-boot=false"
|
||
fi
|
||
sleep 2
|
||
echo "[*] Done! Rebooting your device"
|
||
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "/sbin/reboot"
|
||
sleep 1
|
||
_kill_if_running iproxy
|
||
|
||
# Switch into recovery, and set auto-boot to true
|
||
if [ "$1" = "--tweaks" ]; then
|
||
_wait recovery
|
||
else
|
||
_wait normal
|
||
sleep 2
|
||
|
||
echo "[*] Switching device into recovery mode..."
|
||
"$dir"/ideviceenterrecovery $(_info normal UniqueDeviceID)
|
||
_wait recovery
|
||
fi
|
||
sleep 10
|
||
_dfuhelper
|
||
sleep 2
|
||
fi
|
||
|
||
# ============
|
||
# Boot create
|
||
# ============
|
||
|
||
# Actually create the boot files
|
||
if [ ! -e boot-"$deviceid" ]; then
|
||
_pwn
|
||
|
||
# if tweaks, set ipswurl to a custom one
|
||
if [ "$1" = "--tweaks" ]; then
|
||
ipswurl=$(_beta_url)
|
||
fi
|
||
|
||
# Downloading files, and decrypting iBSS/iBEC
|
||
mkdir boot-"$deviceid"
|
||
|
||
echo "[*] Converting blob"
|
||
"$dir"/img4tool -e -s $(pwd)/blobs/"$deviceid"-"$version".shsh2 -m work/IM4M
|
||
cd work
|
||
|
||
echo "[*] Downloading BuildManifest"
|
||
"$dir"/pzb -g AssetData/boot/BuildManifest.plist "$ipswurl"
|
||
|
||
echo "[*] Downloading and decrypting iBSS"
|
||
"$dir"/pzb -g AssetData/boot/"$(awk "/""$cpid""/{x=1}x&&/iBSS[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/RELEASE/DEVELOPMENT/')" "$ipswurl"
|
||
"$dir"/gaster decrypt "$(awk "/""$cpid""/{x=1}x&&/iBSS[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]dfu[/]//' | sed 's/RELEASE/DEVELOPMENT/')" iBSS.dec
|
||
|
||
echo "[*] Downloading and decrypting iBEC"
|
||
# download ibec and replace RELEASE with DEVELOPMENT
|
||
"$dir"/pzb -g AssetData/boot/"$(awk "/""$cpid""/{x=1}x&&/iBEC[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/RELEASE/DEVELOPMENT/')" "$ipswurl"
|
||
"$dir"/gaster decrypt "$(awk "/""$cpid""/{x=1}x&&/iBEC[.]/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]dfu[/]//' | sed 's/RELEASE/DEVELOPMENT/')" iBEC.dec
|
||
|
||
echo "[*] Downloading DeviceTree"
|
||
"$dir"/pzb -g AssetData/boot/Firmware/all_flash/DeviceTree."$model".im4p "$ipswurl"
|
||
|
||
echo "[*] Downloading trustcache"
|
||
if [ "$os" = 'Darwin' ]; then
|
||
"$dir"/pzb -g AssetData/boot/"$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."StaticTrustCache"."Info"."Path" xml1 -o - BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | head -1)" "$ipswurl"
|
||
else
|
||
"$dir"/pzb -g AssetData/boot/"$("$dir"/PlistBuddy BuildManifest.plist -c "Print BuildIdentities:0:Manifest:StaticTrustCache:Info:Path" | sed 's/"//g')" "$ipswurl"
|
||
fi
|
||
|
||
echo "[*] Downloading kernelcache"
|
||
if [[ $1 == *"--tweaks"* ]]; then
|
||
"$dir"/pzb -g AssetData/boot/"$(awk "/""$cpid""/{x=1}x&&/kernelcache.release/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/release/development/')" "$ipswurl"
|
||
else
|
||
"$dir"/pzb -g "$(awk "/""$cpid""/{x=1}x&&/kernelcache.release/{print;exit}" BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" "$ipswurl"
|
||
fi
|
||
|
||
echo "[*] Patching and signing iBSS/iBEC"
|
||
"$dir"/iBoot64Patcher iBSS.dec iBSS.patched
|
||
if [[ $1 == *"--tweaks"* ]]; then
|
||
"$dir"/iBoot64Patcher iBEC.dec iBEC.patched
|
||
else
|
||
"$dir"/iBoot64Patcher iBEC.dec iBEC.patched -b '-v keepsyms=1 debug=0x2014e panic-wait-forever=1 wdt=-1'
|
||
fi
|
||
cd ..
|
||
"$dir"/img4 -i work/iBSS.patched -o boot-"$deviceid"/iBSS.img4 -M work/IM4M -A -T ibss
|
||
"$dir"/img4 -i work/iBEC.patched -o boot-"$deviceid"/iBEC.img4 -M work/IM4M -A -T ibec
|
||
|
||
echo "[*] Patching and signing kernelcache"
|
||
if [[ "$deviceid" == "iPhone8"* ]] || [[ "$deviceid" == "iPad6"* ]] && [[ ! $1 == *"--tweaks"* ]]; then
|
||
python3 -m pyimg4 im4p extract -i work/"$(awk "/""$model""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" -o work/kcache.raw --extra work/kpp.bin
|
||
elif [[ ! $1 == *"--tweaks"* ]]; then
|
||
python3 -m pyimg4 im4p extract -i work/"$(awk "/""$model""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1)" -o work/kcache.raw
|
||
fi
|
||
|
||
if [[ $1 == *"--tweaks"* ]]; then
|
||
modelwithoutap=$(echo "$model" | sed 's/ap//')
|
||
bpatchfile=$(find patches -name "$modelwithoutap".bpatch)
|
||
"$dir"/img4 -i work/kernelcache.development.* -o boot-"$deviceid"/kernelcache.img4 -M work/IM4M -T rkrn -P "$bpatchfile" `if [ "$os" = 'Linux' ]; then echo "-J"; fi`
|
||
else
|
||
"$dir"/Kernel64Patcher work/kcache.raw work/kcache.patched -a -o
|
||
fi
|
||
|
||
if [[ "$deviceid" == *'iPhone8'* ]] || [[ "$deviceid" == *'iPad6'* ]] && [[ ! $1 == *"--tweaks"* ]]; then
|
||
python3 -m pyimg4 im4p create -i work/kcache.patched -o work/krnlboot.im4p --extra work/kpp.bin -f rkrn --lzss
|
||
elif [[ ! $1 == *"--tweaks"* ]]; then
|
||
python3 -m pyimg4 im4p create -i work/kcache.patched -o work/krnlboot.im4p -f rkrn --lzss
|
||
fi
|
||
|
||
if [[ ! $1 == *"--tweaks"* ]]; then
|
||
python3 -m pyimg4 img4 create -p work/krnlboot.im4p -o boot-"$deviceid"/kernelcache.img4 -m work/IM4M
|
||
fi
|
||
|
||
echo "[*] Signing DeviceTree"
|
||
"$dir"/img4 -i work/"$(awk "/""$model""/{x=1}x&&/DeviceTree[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | sed 's/Firmware[/]all_flash[/]//')" -o boot-"$deviceid"/devicetree.img4 -M work/IM4M -T rdtr
|
||
|
||
echo "[*] Patching and signing trustcache"
|
||
if [ "$os" = 'Darwin' ]; then
|
||
"$dir"/img4 -i work/"$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."StaticTrustCache"."Info"."Path" xml1 -o - work/BuildManifest.plist | grep '<string>' | cut -d\> -f2 | cut -d\< -f1 | head -1 | sed 's/Firmware\///')" -o boot-"$deviceid"/trustcache.img4 -M work/IM4M -T rtsc
|
||
else
|
||
"$dir"/img4 -i work/"$("$dir"/PlistBuddy work/BuildManifest.plist -c "Print BuildIdentities:0:Manifest:StaticTrustCache:Info:Path" | sed 's/"//g'| sed 's/Firmware\///')" -o boot-"$deviceid"/trustcache.img4 -M work/IM4M -T rtsc
|
||
fi
|
||
|
||
"$dir"/img4 -i other/bootlogo.im4p -o boot-"$deviceid"/bootlogo.img4 -M work/IM4M -A -T rlgo
|
||
fi
|
||
|
||
# ============
|
||
# Boot device
|
||
# ============
|
||
|
||
sleep 2
|
||
_pwn
|
||
echo "[*] Booting device"
|
||
"$dir"/irecovery -f boot-"$deviceid"/iBSS.img4
|
||
sleep 1
|
||
"$dir"/irecovery -f boot-"$deviceid"/iBSS.img4
|
||
sleep 2
|
||
"$dir"/irecovery -f boot-"$deviceid"/iBEC.img4
|
||
sleep 1
|
||
if [[ "$cpid" == *"0x80"* ]]; then
|
||
"$dir"/irecovery -c "go"
|
||
sleep 2
|
||
fi
|
||
"$dir"/irecovery -f boot-"$deviceid"/bootlogo.img4
|
||
"$dir"/irecovery -c "setpicture 0x1"
|
||
"$dir"/irecovery -f boot-"$deviceid"/devicetree.img4
|
||
"$dir"/irecovery -c "devicetree"
|
||
"$dir"/irecovery -f boot-"$deviceid"/trustcache.img4
|
||
"$dir"/irecovery -c "firmware"
|
||
"$dir"/irecovery -f boot-"$deviceid"/kernelcache.img4
|
||
sleep 2
|
||
"$dir"/irecovery -c "bootx"
|
||
|
||
if [ "$os" = 'Darwin' ]; then
|
||
if [ ! "$1" = '--dfu' ]; then
|
||
defaults write -g ignore-devices -bool false
|
||
defaults write com.apple.AMPDevicesAgent dontAutomaticallySyncIPods -bool false
|
||
killall Finder
|
||
fi
|
||
fi
|
||
|
||
if [ $1 = '--tweaks' ] && [ ! -f ".tweaksinstalled" ]; then
|
||
echo "[*] Tweaks enabled, running postinstall."
|
||
echo "[!] Please install OpenSSH, curl, and wget from Sileo (repo is mineek.github.io/repo). Then, press any key to continue"
|
||
read -n 1 -s
|
||
echo "[*] Installing tweak support, please follow the instructions 100% or unexpected errors may occur"
|
||
"$dir"/iproxy 2222 22 &
|
||
if [ -f ~/.ssh/known_hosts ]; then
|
||
rm ~/.ssh/known_hosts
|
||
fi
|
||
echo "[!] If asked for a password, enter 'alpine'."
|
||
# ssh into device and copy over the preptweaks.sh script from the binaries folder
|
||
scp -P2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=QUIET binaries/preptweaks.sh mobile@localhost:~/preptweaks.sh
|
||
# run the preptweaks.sh script as root
|
||
"$dir"/sshpass -p 'alpine' ssh -p2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=QUIET mobile@localhost "echo 'alpine' | sudo -S sh ~/preptweaks.sh"
|
||
# now tell the user to install preferenceloader from bigboss repo and newterm2
|
||
echo "[*] Please install PreferenceLoader from BigBoss repo and NewTerm 2. Then, press any key to continue"
|
||
read -n 1 -s
|
||
# now run sbreload
|
||
"$dir"/sshpass -p alpine ssh -o StrictHostKeyChecking=no root@localhost -p 2222 "sbreload"
|
||
echo "[*] Tweak support installed, you can freely use Sileo now."
|
||
touch .tweaksinstalled
|
||
fi
|
||
|
||
if [ -f ".tweaksinstalled" ]; then
|
||
# if known hosts file exists, delete it
|
||
if [ -f ~/.ssh/known_hosts ]; then
|
||
rm ~/.ssh/known_hosts
|
||
fi
|
||
|
||
# run postboot.sh script
|
||
if [[ "$@" == *"--safe-mode"* ]]; then
|
||
if [ -f binaries/postbootnosub.sh ]; then
|
||
echo "[*] Running postboot without Substitute"
|
||
"$dir"/iproxy 2222 22 &
|
||
scp -P2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=QUIET binaries/postboot.sh mobile@localhost:~/postbootnosub.sh
|
||
"$dir"/sshpass -p 'alpine' ssh -p2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=QUIET mobile@localhost "echo 'alpine' | sudo -S sh ~/postbootnosub.sh"
|
||
fi
|
||
else
|
||
if [ -f binaries/postboot.sh ]; then
|
||
echo "[*] Running postboot"
|
||
"$dir"/iproxy 2222 22 &
|
||
scp -P2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=QUIET binaries/postboot.sh mobile@localhost:~/postboot.sh
|
||
"$dir"/sshpass -p 'alpine' ssh -p2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=QUIET mobile@localhost "echo 'alpine' | sudo -S sh ~/postboot.sh"
|
||
fi
|
||
fi
|
||
|
||
# if known hosts file exists, delete it
|
||
if [ -f ~/.ssh/known_hosts ]; then
|
||
rm ~/.ssh/known_hosts
|
||
fi
|
||
|
||
_kill_if_running iproxy
|
||
fi
|
||
|
||
cd logs
|
||
for file in *.log; do
|
||
mv "$file" SUCCESS_${file}
|
||
done
|
||
cd ..
|
||
|
||
rm -rf work rdwork
|
||
echo ""
|
||
echo "Done!"
|
||
echo "The device should now boot to iOS"
|
||
echo "If you already have ran palera1n, click Do All in the tools section of Pogo"
|
||
echo "If not, Pogo should be installed to Tips"
|
||
|
||
} | tee logs/"$(date +%T)"-"$(date +%F)"-"$(uname)"-"$(uname -r)".log
|