Yalu102: Are just the correct offsets needed to support other devices

[andrewwiik]

I was just wondering if just the correct offsets are needed for other devices or if other things are needed as well. A straight forward answer will suffice, thanks.

[ninjaprawn]

afaik only the offsets

[drake90001]

Offsets will help, I believe. allproc and rootvnode. If you have 10.2 IPSW and can find those, feel free to contribute them for other devices. Also, make sure to make a case for it and not override defaults.

[andrewwiik]

But are they the only other things needed, I have the IPSW and hopper+IDA

[oncheonche]

Take the ipsw decompress the kernelcache, find allproc with IDA
Then find rootvnode with nm decompressed_kernel | grep rootvnode

[drake90001]

You'll need to calculate rootvnode

[darkplace]

iPhone SE N69uAP using correct offsets:
allproc_offset = 0x5a8438;
fffffff0075b20b8 S _rootvnode

finish with:

2017-01-26 04:10:28.316701 yalu102[243:4678] enabled patches
2017-01-26 04:10:28.318011 yalu102[243:4678] remounting: -1
2017-01-26 04:10:28.318234 yalu102[243:4678] done

[andrewwiik]

calculate as in math?

[kpwn]

remounting: -1 -> rootvnode is wrong.

[drake90001]

yes math, as in hex - hex

-1 means you didn't convert it right

[andrewwiik]

got a twitter? @drake90001

[drake90001]

yes it's edit removed twitter, getting spammed now haha

[darkplace]

(Using same kernelcache.decompressed to find allproc_offset)

DarkPlace:extractor darkplace$ nm kernelcache.decompressed | grep rootvnode
fffffff0075b20b8 S _rootvnode
fffffff0071d3eac S _vfs_rootvnode

using: rootvnode_offset = 0x5b20b8;

returning remounting: -1

[nullpixel]

the SE offsets are the same as https://github.com/kpwn/yalu102/pull/18

[darkplace]

cool, seems returning a wrong rootvnode offset, with 5ae0b8 works perfectly. tftp working correctly.

[oncheonche]

Yes, you have to subtract the __TEXT:HEADER value from rootvnode just like allproc

[nullpixel]

@darkplace to confirm, #18 is working fully on the SE for you?

[darkplace]

I need to install Cydia, let me check.

[darkplace]

@nullpixel1 @kpwn working on SE N69uAP
allproc 0x5a8438 / rootvnode 0x5ae0b8 (same as 6S)

[nullpixel]

Awesome! 👍

[DarknesGaming]

Wow. I didn't know Luca would go so far as to get help for his next Yalu release. Something tells me he's not going to keep working on iOS 10.1.1 anymore.
Still searching for offsets for iPhone 6. Went crazy disassembling the broken beta. Aren't you disappointed, qwertyoruiop? I disassembled your code because I'm crazy and I know almost zero Objective-C.

[lucid727]

Will these offsets open the ip7 on 10.2 to be able to jailbreak?? Just wondering what it would take for the iPhone 7 on 10.2 to be jail broken..thanks for the help..

[B0ngL0rd]

As a iPhone 7 plus 10.2 user DOOOOMED

[B0ngL0rd]

sysname: Darwin
nodename: iPhone
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:08 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T8010
machine: iPhone9,4
missing offset, prob crashing
2017-01-26 14:20:23.272130 yalu102[230:7770] found corruption 38503

[liudayu]

@lucid727 @B0ngL0rd No. NO jailbreak for 10.2 iPhone 7.