From 760af27d9486f70a6de7ba0c0a42d86c1e445c66 Mon Sep 17 00:00:00 2001 From: LukeZGD <26163116+LukeZGD@users.noreply.github.com> Date: Sat, 26 Nov 2022 21:38:37 +0800 Subject: [PATCH] Fix #228 and other updates --- .gitignore | 1 - resources/depends.sh | 7 +-- resources/device.sh | 49 ++++++++---------- .../firmware/src/target/n90/11D257/exploit | Bin 0 -> 524288 bytes resources/ipsw.sh | 4 -- restore.sh | 14 ++--- 6 files changed, 34 insertions(+), 41 deletions(-) create mode 100644 resources/firmware/src/target/n90/11D257/exploit diff --git a/.gitignore b/.gitignore index 208381d..5b2b7eb 100644 --- a/.gitignore +++ b/.gitignore @@ -9,7 +9,6 @@ *.shsh2 *.txt Cydia* -exploit first_run iP*Custom*/ iP*Restore/ diff --git a/resources/depends.sh b/resources/depends.sh index 1c4e714..8fac1f7 100755 --- a/resources/depends.sh +++ b/resources/depends.sh @@ -97,10 +97,11 @@ SetToolPaths() { fi elif [[ $platform == "win" ]]; then ping="ping -n 1" - Log "WARNING - Using iOS-OTA-Downgrader on Windows is highly discouraged." + Log "WARNING - Using iOS-OTA-Downgrader on Windows is HIGHLY DISCOURAGED." Echo "* Please use it on Linux or macOS instead." Echo "* You may still continue, but you might encounter problems with restoring the device." - sleep 3 + Echo "* You have been warned." + sleep 10 Input "Press Enter/Return to continue anyway (or press Ctrl+C to cancel)" read -s fi @@ -190,7 +191,7 @@ InstallDepends() { sudo apt install -y bsdiff curl libimobiledevice6 openssh-client python2 python3 unzip usbmuxd usbutils xmlstarlet xxd zenity sudo systemctl enable --now udev systemd-udevd usbmuxd 2>/dev/null - elif [[ $ID == "fedora" ]] && (( VERSION_ID >= 36 )); then + elif [[ $ID == "fedora" || $ID == "nobara" ]] && (( VERSION_ID >= 36 )); then ln -sf /usr/lib64/libbz2.so.1.* ../resources/lib/libbz2.so.1.0 sudo dnf install -y bsdiff ca-certificates libimobiledevice openssl python2 python3 systemd udev usbmuxd vim-common xmlstarlet zenity sudo ln -sf /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-certificates.crt diff --git a/resources/device.sh b/resources/device.sh index 17b1221..56641f7 100755 --- a/resources/device.sh +++ b/resources/device.sh @@ -104,7 +104,7 @@ GetDeviceValues() { Baseband=0 BasebandURL=$(cat $Firmware/13G37/url 2>/dev/null) LatestVer="9.3.6" - + if [[ $ProductType == "iPad2,2" ]]; then BasebandURL=$(cat $Firmware/13G36/url) Baseband="ICE3_04.12.09_BOOT_02.13.Release.bbfw" @@ -413,45 +413,42 @@ kDFU() { [[ ! $kloader ]] && kloader="kloader" Log "Running iproxy for SSH..." - $iproxy 2222 22 & + $iproxy 2222 22 >/dev/null & iproxyPID=$! sleep 2 - echo - Log "Copying stuff to device via SSH..." - Echo "* Make sure OpenSSH/Dropbear is installed on the device and running!" - Echo "* Dropbear is only needed for devices on iOS 10" - Echo "* To make sure that SSH is successful, try these steps:" - Echo "* Reinstall OpenSSH/Dropbear, reboot and rejailbreak, then reinstall them again" - echo - Input "Enter the root password of your iOS device when prompted." - Echo "* Note that you will be prompted twice. Do not worry that your input is not visible, it is still being entered." - Echo "* The default password is \"alpine\"" + Log "Please read the message below:" + Echo "1. Make sure to have installed the requirements from Cydia." + Echo " - Only proceed if you have followed Section 2 (and 2.1 for iOS 10) in the GitHub wiki." + Echo " - You will be prompted to enter the root password of your iOS device twice." + Echo " - If you have not changed it, the default password is \"alpine\"" + Echo " - Do not worry that your input is not visible, it is still being entered." + Echo "2. Afterwards, the device will disconnect and its screen will stay black." + Echo " - Proceed to either press the TOP/HOME button, or unplug and replug the device." + sleep 3 + Input "Press Enter/Return to continue (or press Ctrl+C to cancel)" + read -s + Log "Entering kDFU mode..." $SCP -P 2222 resources/tools/$kloader tmp/pwnediBSS root@127.0.0.1:/tmp if [[ $? == 0 ]]; then $SSH -p 2222 root@127.0.0.1 "chmod +x /tmp/$kloader; /tmp/$kloader /tmp/pwnediBSS" & else - Log "Cannot connect to device via USB SSH." - Echo "* Please try the steps above to make sure that SSH is successful" - Echo "* Alternatively, you may use kDFUApp by tihmstar (from my repo, see \"Troubleshooting\" wiki page)" - Input "Press Enter/Return to continue anyway (or press Ctrl+C to cancel and try again)" + Log "Failed to connect to device via USB SSH." + Echo "* For Linux users, try running \"sudo systemctl restart usbmuxd\" before retrying USB SSH." + Input "Press Enter/Return to try again with Wi-Fi SSH (or press Ctrl+C to cancel and try again)" read -s Log "Will try again with Wi-Fi SSH..." - Echo "* Make sure that the device and your PC/Mac are on the same network!" - Echo "* You can check for your device's IP Address in: Settings > WiFi/WLAN > tap the 'i' next to your network name" + Echo "* Make sure that your iOS device and PC/Mac are on the same network." + Echo "* To get your device's IP Address, go to: Settings -> Wi-Fi/WLAN -> tap the 'i' next to your network name" read -p "$(Input 'Enter the IP Address of your device:')" IPAddress - Log "Copying stuff to device via SSH..." $SCP resources/tools/$kloader tmp/pwnediBSS root@$IPAddress:/tmp - if [[ $? == 1 ]]; then - Error "Cannot connect to device via SSH." \ - "Please try the steps above to make sure that SSH is successful" + if [[ $? != 0 ]]; then + Log "Failed to connect to device via Wi-Fi SSH." + Echo "* Alternatively, you may use kDFUApp by tihmstar from my repo (see \"Troubleshooting\" wiki page for details)" + Error "Failed to connect to device via SSH, cannot continue." fi $SSH root@$IPAddress "chmod +x /tmp/$kloader; /tmp/$kloader /tmp/pwnediBSS" & fi - - Log "Entering kDFU mode..." - Echo "* Press TOP or HOME button when the device disconnects and its screen goes black" - Echo "* You may also try to unplug and replug your device" FindDevice "DFU" } diff --git a/resources/firmware/src/target/n90/11D257/exploit b/resources/firmware/src/target/n90/11D257/exploit new file mode 100644 index 0000000000000000000000000000000000000000..8d26921159fbfe5f59f777f6c29eea0636000209 GIT binary patch literal 524288 zcmeI*U5s33eZb*&)*BOCR6E|-i7G%RF)A3$VmmFW+6dXPy87?CA1}O?(VNrwvvdXG!2xR+z z&&;mJHu-W)NR#IzXU}|{bKdhi&pYe8P06Bw0&mpZ=McIyx31{colJ9OdP zj$Qr7<+c)!M^hTsmIgEyaF| zdEW!E##qa3Y_4xvTYDjP+?IE~Io892ZGQfmm!~IxaP;t<&#j*P<8Y`*tLtKamp0Co@4e-ZSYY(-VvUD`=1+O)O1x{$Zt>-amSH^d0eq60;)Dj<|@J6&I^Z9~(_S{ihgoar=q1 zxKh3QA6KeFhdP+A*rI>}3Mim}0tzUgfC36Apun58z}8FYQhGT3>6`WXT$ch0D4>7> z3Mim}0tzUgfC36Apnw7jD4>7>3Mim}0tzUgfC36Apnw7jD4>7>3Mim}0tzUgfC36A zpnw7jD4>7>3Mim}0tzUgfC36Apnw7jD4>7>3Mim}0tzUgfC36Apnw7jD4>7>3Mim} z0tzUgfC36Apnw7jD4>7>3Mim}0tzUgfC4wNz>%w#lpc9u_@$9_$D`%H`KR=!xKAt{( zJbiNH?7uFbsHW*^ny;qbzf{wwtLbyq^k_AGDV}_}n!Zv^k5$vTc=ALweZ88Fjir^f z_nck6yLfzgfB$nd4q1u&pSSt0TwjeWnpkXto!4g?P+I>q8(DlV?6Wm-)xL%JUtjcJE;{vXXE{=M;be( zu^Twje7u)gDo<7pSN=TxNBU~oGxYagN6Pzu?flPkb6rJ$R_1HX%V_!fSowJKE57a& z-!A!h>-&|v`|-LKSWJ`Y?zA_(r@a5=H*w7W{B4{c{~?^`Z-*P}eBDrgM!w3~_o{wJ z^s8jA*LAMg?+v$9rqchWf4^e>zv0GcK(Awg(ZRp}Uel~f?~DY`BE|6?$q`-+uiXkTRuM1>=xbj$=;b-r%}Y?>1MarX-=K) zHKvQxt?5Rm=*={WlkM5r_L*kuRMBg6=DJ0#HC@!(t?6bj&YF+2Z@joa-f4F8Fye*x z?b}@(?d1d39;!8GYg4oNAe~~q(|oAbYZRxujbdscj&0eiMV7dFj z+1VJ`=}x`T-BYxu{=QM~#e*~L&V#XO^y=e7i!?=)(? zID7oR@u6P)s$7TDRNi=%KG5kk8*!PZYRy)+f4ZU3D{^f1dtv+MV}yi}{WCahkt)`P0m`r<*66aUuCm4xMvP zKGD@Djp{Fd)-8997l$@Tly|ViRp0OzR~UDwJY!kt@|g3j$ZyS^j)JxM`9>}7Rja6l zfY?3fjRM`~saA}+UTgJ=`F2!~`&P71mN$4^a7Y>-A1{uc95jyI8V}FMP432&D9@Mg zWqIu(B+r=m#Kz^v^F8@+tt&qgwEDZg*qj)e3B_dlOyi+O=W?>&dz1DQ3+>Yzx4j(D z!WBcwcz+L+JcVM;1lwA--HNNtOv}vc1=gi*T+|iwct~b{KDOGe57ygrbB#{DS(`1V zWxF-I(6<^H^DxWV6Zfr%Z-YF0n-4Y0X&9f*yf@BVPPdpm-E!>1ry5*tzPruVOdRE! zd6H*bupOK+e>+@x*vr#<_-kqS97V6aKGJry3onCjwR}tCdtm)(A6d+_!AM@bPc6O; z^A*P@)_0Ck{^joCVBCSB7VB>gP9Fm-yJWp_yUJNRU^+bB`05zU{_afv=(TgdRhtGVYh{P|UBljJiIQY>cRt*?nfB^;=V1NMz z7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|Xg zfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_ z1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;= zV1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~ z0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz z7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|Xg zfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_ z1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;= zV1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~ z0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz z7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|Xg zfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_ z1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;= zV1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~ z0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz z7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|Xg zfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_ z1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;= zV1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~ z0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz z7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|Xg zfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_ z1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;= zV1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~ z0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz z7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|Xg zfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_ z1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;= zV1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~ z0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz z7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|Xg zfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_ z1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;= zV1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~ z0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz z7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|Xg zfB^;=V1NMz7+`<_1{h#~0R|XgfB^;=V1NMz7+`<_1{h#~0R|XgfB^>HDh8580R