Yalu102: Got iPhone 6 Offsets but after multiple reboots and runs Cydia isn't appearing

[andrewwiik]

What Xcode outputs

sysname: Darwin
nodename: Andrews-iPhone
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:08 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7000
machine: iPhone7,2
2017-01-25 23:08:40.822432 yalu102[226:4153] found corruption d07
2017-01-25 23:08:43.421386 yalu102[226:4153] found kernel text at fffffff012404000
2017-01-25 23:08:43.423499 yalu102[226:4153] got tfp0 -> e07
2017-01-25 23:08:43.425650 yalu102[226:4153] found procs at fffffff1174f68b0
2017-01-25 23:08:43.429818 yalu102[226:4153] seg: __TEXT
2017-01-25 23:08:43.429903 yalu102[226:4153] seg: __DATA_CONST
2017-01-25 23:08:43.429940 yalu102[226:4153] seg: __TEXT_EXEC
2017-01-25 23:08:43.429978 yalu102[226:4153] seg: __KLD
2017-01-25 23:08:43.430012 yalu102[226:4153] seg: __LAST
2017-01-25 23:08:43.430044 yalu102[226:4153] seg: __DATA
2017-01-25 23:08:43.430078 yalu102[226:4153] seg: __PRELINK_TEXT
2017-01-25 23:08:43.430173 yalu102[226:4153] seg: __PLK_TEXT_EXEC
2017-01-25 23:08:43.430227 yalu102[226:4153] seg: __PRELINK_DATA
2017-01-25 23:08:43.430264 yalu102[226:4153] seg: __PLK_DATA_CONST
2017-01-25 23:08:43.430298 yalu102[226:4153] seg: __PLK_LINKEDIT
2017-01-25 23:08:43.430332 yalu102[226:4153] seg: __PRELINK_INFO
2017-01-25 23:08:43.430366 yalu102[226:4153] seg: __LINKEDIT
2017-01-25 23:08:43.430478 yalu102[226:4153] fffffff0114cc000 - fffffff012c94000
2017-01-25 23:08:43.486675 yalu102[226:4153] ffffffff03d98000
2017-01-25 23:08:43.533917 yalu102[226:4153] fffffff0124715a0
2017-01-25 23:08:43.572392 yalu102[226:4153] pmap: fffffff012920850
2017-01-25 23:08:43.611367 yalu102[226:4153] got phys at 0 for virt fffffff002f78000
2017-01-25 23:08:43.611499 yalu102[226:4153] found cpu 0
2017-01-25 23:08:43.611533 yalu102[226:4153] found physz: fffffff012493000
2017-01-25 23:08:43.611570 yalu102[226:4153] found cpu 1
2017-01-25 23:08:43.611599 yalu102[226:4153] found physz: fffffff012493000
2017-01-25 23:08:43.611645 yalu102[226:4153] fffffff012593574 - fffffff0125933a8
2017-01-25 23:08:43.612986 yalu102[226:4153] ttbr0: 802ab9000 fffffff012471590
2017-01-25 23:08:43.613362 yalu102[226:4153] got a cpacr

[liudayu]

Same here, except I got one extra line of
2017-01-26 14:15:35.424367 yalu102[270:6875] got a cpacr
2017-01-26 14:15:35.424931 yalu102[270:6875] breakup!

[ghost]

Trying here now, wait for response.

[ninjaprawn]

The jailbreak hasn't actually completed. Usually means bad rootvnode (at least for me)

[andrewwiik]

but I worked with @drake90001 to get that

[berkeelevent]

It's not even gets close to rootvnode, If rootvnode is wrong, there should be -1 on mounting section, which is we can't even get to, I guess

[iKilledAppl3]

similar issues with the iPod touch 6
https://ghostbin.com/paste/rfdh3

[kpwn]

this is for 16k devices (6s, ipad pro) only at this moment. i won't have the ability to test on a 4k device until the weekend.

[iKilledAppl3]

@kpwn ok thanks for the info. keep up the hard work

[andrewwiik]

@kpwn I guess that answers my question on whether offsets are the only thing needed to support other devices

[tangalbert919]

Ok. Thanks for the update @kpwn.
One question: What's a 4k device in your terms?
EDIT: Sorry if this bothers you. I can't speak the hacker's version of English.

[mmhobi7]

Iphone 6 and under

[berkeelevent]

@frankthedead you do not put that code into somewhere. It's already in the code but kpwn just not using it right now

[drake90001]

if someone can send me kernel version for ipad pro that'd be great

[ghost]

@drake90001 I have iPad Air 2 Wifi offsets but don't know how to format rootvnode correctly. Here they are.
_allproc: 0x5b8528
_kernproc: 0x5be0e0
fffffff0075c20b8 S _rootvnode
fffffff0071e1258 S _vfs_rootvnode

[tangalbert919]

@nicogibbons, your rootvnode offset is 0x3e0e60

[drake90001]

@tangalbert919 it's 0x5be0b8

[tangalbert919]

I must've calculated it incorrectly. I'm not sure how to do the rootvnode either, but I'm trying.

[DarknesGaming]

@tangalbert919 I know you're trying here.
You didn't use the kernel base. You used the vfs_rootvnode to get the offset. xD
Trying to do some calculations, but macOS on VMware is taking a long time to log me in. This was not a problem when I used Ubuntu Linux, and I don't have money to get an Apple computer, so...

[6e757275706f]

Wait, so what would the rootvnode offset be for "_rootvnode 0x5c20b8" and "_vfs_rootvnode 0x1e1034"

[DarknesGaming]

You just need "_rootvnode", @SparksCatcher. The whole hexadecimal.

[6e757275706f]

So the offset would be 0x5c20b8?

[drake90001]

@SparksCatcher 0x5ba0b8

[6e757275706f]

Thanks

[DarknesGaming]

Wow. @drake90001 is fast.
Still stuck on the login screen. I don't have an Apple Computer, so I use VMware to get Apple Development done.

[MTACS]

@SparksCatcher still getting cpacr

[DarknesGaming]

What device do you have?

[DarknesGaming]

VMware runs macOS so slow on Microsoft Windows NT, but on Ubuntu Linux, it ran a lot faster. Should've bought an Apple computer instead of a normal PC with Windows on it.
Seriously, @mtactheming. What device do you have?

[DarknesGaming]

@kpvn I have an iPhone 6, and I was so obsessed about your jailbreak, you blocked me on Twitter for it.
This weekend, can I help you with 4k device testing? I'm bored, so...

[drake90001]

Does anyone own an iPad pro?

[liudayu]

@drake90001 I reckon you better off ask on /jailbreak

[liudayu]

@frankthedead CAN YOU PLEASE READ WHAT kpwn REPLIED IN THIS ISSUE FIRST PLEASE
"this is for 16k devices (6s, ipad pro) only at this moment. i won't have the ability to test on a 4k device until the weekend."

[DarknesGaming]

@liudayu you do realize that @drake90001 contributed to this, right? @frankthedead is trying to help in some way. What do you have to help with this?

[ghost]

@liudayu Man, I just posted my log here. I did not ask to him to fix now.

[liudayu]

@DarknesGaming What? @drake90001 asked for "if someone can send me kernel version for iPad Pro that'd be great" and since there's no one has an iPad Pro / replying what he needed, therefore I suggested to ask on /jailbreak.
What @frankthedead posted is the same log as Andrew posted, Kernel Version 16.3.0 with iPhone7,2 (iPhone 6) which is not helping @drake90001 at "if someone can send me kernel version for iPad Pro that'd be great" as kpwn clearly said that iPhone 6 currently is NOT supported.

[ghost]

@liudayu Do you even read both logs? There are differences. It's not the same.

[drake90001]

@frankthedead it is the same :\

[ghost]

Even if the kernel number is different? Sorry, my bad. Deleted the log. @drake90001

[DarknesGaming]

I can just decompress the kernel of an IPSW and get the offsets from there by using a disassembler. I can get both the 12.9-inch and 9.7-inch IPSW files for it right now, unless both kernels for it are in the same IPSW. That's Apple's new tactic to save space on their machines (or get more downloads per IPSW). Who knows?
@drake90001 wouldn't decompressing the kernel and then performing a hexdump be faster?

[drake90001]

@frankthedead It's okay!

@DarknesGaming i have the offsets just need the kernel version for ipad pro

[DarknesGaming]

I would try TheiPhoneWiki or disassembling the kernel.

[drake90001]

@DarknesGaming iphone wiki only has one kernel version posted and "other kernel version vary by compile time and processor", ill look around in the kern

[liudayu]

@DarknesGaming He needs the kernel version for iPad Pro so he could add to the codes to identify each device

[DarknesGaming]

That would require being able to decompress and disassemble the kernel. At least Apple shoves more than one kernel into the same IPSW now, provided that the devices barely have anything different from each other.

[drake90001]

yalu spits out the kernel version when you click go, assuming you are debugging

[DarknesGaming]

I know. The whole disassembly thing is if you can't find anyone with an iPad Pro. It comes in handy if you can't keep waiting.

[drake90001]

Got it, thank you.

[drake90001]

6s and ipad pro kernel versions/offsets look the same, can you confirm @DarknesGaming?

[DarknesGaming]

No, I cannot confirm that. I can't even run macOS properly on VMware on Windows.
The iPhone 6s should have the N71 or N71M kernel, and the iPad Pro should be J98, J99, J127, and J128. And this is without the "AP" part.
The N71 and N71M kernels, most likely the same offsets. iPad Pro, that's a different story.
Still don't know what you mean by subtracting the header from the rootvnode from another issue that I was reading.

[DarknesGaming]

I'm just going to turn off my Windows PC and sleep because I'm tired (mostly from Windows being slow).

[drake90001]

@DarknesGaming mkay, well according to the ipad pro kernel it's the same, weirdly enough, so i've put a pull request, im sure luca will confirm/deny when he sees. im off to bed too lol

edit: guess I'm not going to sleep with the newest commit :)

[tomlube]

Same issue here even on the newest commit

[liudayu]

@tomlube
IF you LOOK through the comment section you will find that "this is for 16k devices (6s, ipad pro) only at this moment. i won't have the ability to test on a 4k device until the weekend.", thank you

[mwoolweaver]

for those that cant find what @liudayu is talking about here's a link

https://github.com/kpwn/yalu102/issues/28#issuecomment-275305581

[KILLCAMPER]

I see Luca has posted a IPA on twitter more stable no more devices add as we all no lot of good feedback from users top marks to all involved

[B0ngL0rd]

I have the 7 plus getting offsets for you now gsm version too

[KILLCAMPER]

@B0ngLOrd This exploit will not work on iPhone 7 only on 10.1.1 not higher as burnt exploit after that

[B0ngL0rd]

How do I go about creating an exploit around the extra memory

[ghost]

orlly?

[msamuel002]

hey @kpwn have you gotten 4k devices yet?

[meyer9]

no, we haven't finished. there is an issue for this.