Add baseband dumping/stitching

requires `--disable-bbupdate` to be enabled for baseband tar to be added to custom ipsw
This commit is contained in:
LukeZGD 2023-06-26 17:35:06 +08:00
parent 6bbe22b45a
commit 616c299aea

View File

@ -667,11 +667,11 @@ device_get_info() {
esac
# disable baseband update for ipad 2 cellular devices
case $device_type in
iPad2,[23] ) device_disable_bbupdate=$device_type;;
iPad2,[23] ) device_disable_bbupdate="$device_type";;
esac
# disable baseband update if var is set to 1 (manually disabled w/ --disable-bbupdate arg)
if [[ $device_disable_bbupdate == 1 ]]; then
device_disable_bbupdate=$device_type
device_disable_bbupdate="$device_type"
fi
# if latest vers is not set, copy use vers to latest
if [[ -z $device_latest_vers || -z $device_latest_build ]]; then
@ -1579,12 +1579,15 @@ ipsw_prepare_jailbreak() {
cp -R ../resources/firmware/FirmwareBundles .
fi
if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
ExtraArgs+=" -bbupdate"
fi
if [[ $ipsw_memory == 1 ]]; then
ExtraArgs+=" -memory"
fi
if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
ExtraArgs+=" -bbupdate"
elif [[ $device_type == "$device_disable_bbupdate" && $device_type == "iPhone"* ]]; then
device_dumpbaseband
ExtraArgs+=" ../saved/$device_type/baseband.tar"
fi
log "Preparing custom IPSW: $ipsw $ipsw_path.ipsw temp.ipsw $ExtraArgs ${JBFiles[*]}"
"$ipsw" "$ipsw_path.ipsw" temp.ipsw $ExtraArgs ${JBFiles[@]}
@ -1871,12 +1874,15 @@ ipsw_prepare_32bit() {
ipsw_prepare_bundle
if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
ExtraArgs+=" -bbupdate"
fi
if [[ $ipsw_memory == 1 ]]; then
ExtraArgs+=" -memory"
fi
if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
ExtraArgs+=" -bbupdate"
elif [[ $device_type == "$device_disable_bbupdate" && $device_type == "iPhone"* ]]; then
device_dumpbaseband
ExtraArgs+=" ../saved/$device_type/baseband.tar"
fi
if [[ $ipsw_jailbreak == 1 ]]; then
case $device_target_vers in
7.1* ) JBFiles+=("panguaxe.tar");;
@ -2025,12 +2031,15 @@ ipsw_prepare_powder2() {
if [[ $ipsw_jailbreak == 1 ]]; then
cp ../resources/jailbreak/freeze.tar .
fi
if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
ExtraArgs+=" -bbupdate"
fi
if [[ $ipsw_memory == 1 ]]; then
ExtraArgs+=" -memory"
fi
if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
ExtraArgs+=" -bbupdate"
elif [[ $device_type == "$device_disable_bbupdate" && $device_type == "iPhone"* ]]; then
device_dumpbaseband
ExtraArgs+=" ../saved/$device_type/baseband.tar"
fi
log "Preparing custom IPSW: $dir/powdersn0w $ipsw_path.ipsw temp.ipsw -base $ipsw_base_path.ipsw $ExtraArgs"
"$dir/powdersn0w" "$ipsw_path.ipsw" temp.ipsw -base "$ipsw_base_path.ipsw" $ExtraArgs
@ -2720,7 +2729,7 @@ device_ramdisk() {
sleep 20
case $1 in
"nvram" | "jailbreak" )
"nvram" | "jailbreak" | "baseband" )
log "Running iproxy for SSH..."
$iproxy 2222 22 >/dev/null &
iproxy_pid=$!
@ -2729,6 +2738,20 @@ device_ramdisk() {
;;
esac
case $1 in
"baseband" )
local baseband="../saved/$device_type/baseband.tar"
log "Mounting root filesystem"
$ssh -p 2222 root@127.0.0.1 "mount.sh root"
sleep 2
log "Creating baseband.tar"
$ssh -p 2222 root@127.0.0.1 "cd /mnt1; tar -cvf baseband.tar usr/standalone"
log "Copying baseband.tar"
$scp -P 2222 root@127.0.0.1:/mnt1/baseband.tar .
cp baseband.tar $baseband
$ssh -p 2222 root@127.0.0.1 "rm /mnt1/baseband.tar; reboot_bak"
return
;;
"jailbreak" )
local vers
local build
@ -2829,8 +2852,8 @@ device_ramdisk() {
$ssh -p 2222 root@127.0.0.1 "nvram -c; reboot_bak"
log "Done! Your device should reboot now."
print "* If the device did not connect, SSH to the device manually."
kill $iproxy_pid
;;
* ) log "Device should now be in SSH ramdisk mode.";;
esac
echo
@ -2947,7 +2970,8 @@ menu_print_info() {
print "* This $device_type is an old bootrom model"
fi
if [[ $de_bbupdate == 1 ]]; then
warn "Disable bbupdate flag detected, baseband update is disabled."
warn "Disable bbupdate flag detected, baseband update is disabled. Proceed with caution"
print "* For iPhones, current baseband will be dumped and stitched to custom IPSW"
fi
print "* iOS Version: $device_vers"
print "* ECID: $device_ecid"
@ -3495,15 +3519,14 @@ menu_other() {
else
menu_items+=("Send Pwned iBSS")
fi
menu_items+=("SSH Ramdisk")
if [[ $device_type == "iPhone"* ]]; then
menu_items+=("Dump Baseband")
fi
menu_items+=("SSH Ramdisk" "Clear NVRAM")
fi
if [[ $device_type == "iPhone3,1" ]]; then
menu_items+=("Disable/Enable Exploit")
fi
if (( device_proc < 7 )); then
menu_items+=("Clear NVRAM")
fi
if [[ $device_type == "iPhone2,1" ]]; then
elif [[ $device_type == "iPhone2,1" ]]; then
menu_items+=("Install alloc8 Exploit")
fi
menu_items+=("Attempt Activation")
@ -3529,6 +3552,7 @@ menu_other() {
"(Re-)Install Dependencies" ) install_depends;;
"Attempt Activation" ) mode="activate";;
"Install alloc8 Exploit" ) mode="alloc8";;
"Dump Baseband" ) mode="baseband";;
"Go Back" ) back=1;;
esac
done
@ -3561,6 +3585,40 @@ device_jailbreakrd() {
device_ramdisk jailbreak
}
device_dumpbaseband() {
local baseband="../saved/$device_type/baseband.tar"
if [[ -e $baseband ]]; then
log "Found existing dumped baseband: $baseband"
return
fi
if [[ $device_mode == "Recovery" ]]; then
device_enter_mode pwnDFU
fi
if [[ $device_mode == "Normal" ]]; then
print "* Make sure to have installed the requirements from Cydia."
print "* Only proceed if you have followed the steps in the GitHub wiki."
print "* You will be prompted to enter the root password of your iOS device."
print "* The default root password is \"alpine\""
log "Running iproxy for SSH..."
$iproxy 2222 22 >/dev/null &
iproxy_pid=$!
sleep 2
device_sshpass
log "Creating baseband.tar"
$ssh -p 2222 root@127.0.0.1 "tar -cvf /tmp/baseband.tar /usr/standalone"
log "Copying baseband.tar"
$scp -P 2222 root@127.0.0.1:/tmp/baseband.tar .
cp baseband.tar $baseband
elif [[ $device_mode == "DFU" ]]; then
device_ramdisk baseband
fi
kill $iproxy_pid
if [[ ! -e $baseband ]]; then
error "Failed to dump baseband from device. Please run the script again"
fi
log "Dumping baseband done: $baseband"
}
main() {
clear
print " *** Legacy iOS Kit ***"
@ -3626,6 +3684,7 @@ main() {
"activate" ) $ideviceactivation activate;;
"alloc8" ) device_alloc8;;
"jailbreak" ) device_jailbreakrd;;
"baseband" ) device_dumpbaseband;;
* ) :;;
esac
@ -3669,6 +3728,10 @@ if [[ $no_color != 1 ]]; then
color_N=$(tput sgr0)
fi
if [[ $device_disable_bbupdate != "iPad2,3" ]]; then
de_bbupdate=1
fi
main
popd >/dev/null