Yalu102: 4k devices support - Part 2

[meyer9]

Old thread was getting long

[ghost]

:). I think we are going to need Luca's help to figure this one out. @meyer9

[0x0luke]

I read about the "WriteAnywhere64(ReadAnywhere64(find_kernel_pmap()), level1_table);" algorithm you wrote about in the last post, so i attempted some debugging myself, it seems that line of code is sometimes ran sucessfully and sometimes it causes a kernel panic, I think its due to the amount of Virtual memory the devices have like you wrote in the original post. I also noticed that if i had apps open in the background (using virtual memory) that section of the code never got ran successfully. I'm just going to leave it down to you guys however as i'm not really a expert when it comes down to stuff like this. Just thought i should drop my 2 cents into the bucket.

[meyer9]

that's interesting, so maybe it's filling up the page since the page is smaller...

[Shade-Zepheri]

so the issue is in the difference in page sizes between 16k and 4k devices?

[meyer9]

yes, it looks like we're trying to overwrite the iOS kernel pmap. We the need a valid pmap to start which should be at the memory offset 0xfffffff022b9a868ish.

[0x0luke]

@meyer9 I think as were dealing with a smaller page size, that is the issue. I don't know about getting around and fixing it though. In my testing, i've been able to use NSLog() to get to different places in the code each run, There doesn't seem to be any consistency to when it crashes in the code, which tells me the page size is the limiting factor.

[meyer9]

it crashes consistently here: WriteAnywhere64(ReadAnywhere64(find_kernel_pmap()), level1_table);. It just runs for an extra couple of seconds, so the logs look like it completes that step.

[0x0luke]

@meyer9 Are you using a fully stock version of 10.2 or do you have apps installed?

[meyer9]

I have apps.

[meyer9]

So, with a couple debug statements, I see we're replacing the value 0xfffffff00d8b9000 with 0xffffffe80ae00000. This is consistent and if I write that value instead of the level1_table, it will not kernel panic, meaning out level1_table value is wrong.

This is some progress. I have a feeling we'll be able to fix this.

So, we're remapping physical memory addresses to virtual ones in our own way to bypass KPP I'm guessing.

[msamuel002]

@meyer9 what devices are you testing on? iPhone 6 or iPhone 5S or both? thanks

[meyer9]

I only have a 6, but it should work on the 5s when ready.

[ghost]

I'm surprised the Air 2 is a 4k device

[meyer9]

Ok, so here is some more data, current pmap: 0xfffffff00bab9000, replacing with: 0xffffffe809000000 on iPhone 7,2

[CemreSuler]

If we have the offsets, why are 4K devices still not supported?

[ghost]

@Mila432 Fails at same place as iPhone 6 when running Yalu from Xcode? This is my iPad Air 2 WiFi model anyway

[Mila432]

@nicogibbons your device should fail here https://github.com/kpwn/yalu102/issues/40#issuecomment-275769214

[ninjaprawn]

@cemre2002 In case you haven't been following, the reason why 4k devices aren't supported is because the structure of the lower-level bits this code is playing around is different on 4k devices compared to 16k devices. AFAIK, it's a size difference, meaning that the target location we are looking for will be at a different place

[ghost]

Wait is Air 2 a 16K device? @Mila432

[ghost]

Ah thought so :p @meyer9

[KILLCAMPER]

Is the Air pad 2 cellular 4K ? Or 16k

[0x0luke]

@KILLCAMPER its 16k

[oncheonche]

Apple TV 4 is a 4k device I think as it has a A8 chip.
If anyone wants me to test something on this device, no problem.

[KILLCAMPER]

@0x0luke thank you so souprt will be easier then 4K at mo . As I was in the mentally it was a 4K thanks bud

[akelly5]

i got iPhone 6 I can test for you guys

[msamuel002]

@meyer9 same with @akelly5 i have an iphone 6 tell me if you need anything to be tested

[msamuel002]

also, @meyer9 what happened after you changed the pmap?

[Dennisbonke]

iPhone 6 here as well, will test anything you throw at me

[AppleBetas]

@0x0luke iPad Air 2 is actually a 4k device.

[tangalbert919]

@AppleBetas is correct because any device with an A8 or A8X CPU or something older is a 4k device.
Anything with an A9, A9X or something newer is 16k.
This is memory management we are talking about. If you don't know Objective-C or C (like me), let's try not to ask questions because the answers are hard to understand in terms of "programming".

[tangalbert919]

The weekend has started, so I'll be waiting for testing.
That is a tough thing to say because I'm on an Android device right now.

[Dennisbonke]

Please explain to me what this memory issue would be on a A8 or lower chip, as I am pretty interested in OS development, I should know my C code :)

[tangalbert919]

According to @kpwn, anything that isn't the iPhone 7, 6s, SE, or the iPad Pro is a 4k device. And honestly, I need to grab a book to learn C.

[meyer9]

Essentially the memory is structured differently on 4k devices. The number of pages per block is 4096 instead of 16384. Since it's a 4k device, the pmap should be different since it maps pages in virtual memory to pages in physical memory.

[akelly5]

if anyone needs help hmu on twitter aidan_kelly5

[Dennisbonke]

@meyer9 thanks for the information!

[msamuel002]

@meyer9 have you gotten anywhere in terms of support for iphone 6?

[0x0luke]

@AppleBetas I believe the Wifi is 4k and the cellcular is 16k but im not sure.

[meyer9]

I have not gotten much farther, but it should be solvable.

[msamuel002]

@meyer9 thanks for your hard work, and btw, I alongside @Dennisbonke and @akelly5 have iPhone 6 in case you need anyhing to test we can help out

[uwu2234]

I also have an iPhone 6.

[meyer9]

Shouldn't be a problem. I have one as well.

[Nikostito]

Guys have you seen in Reddit that a user announced to have succesfully jailbroken his ipad mini 2? No proof is provided but maybe could be of help to all?

[meyer9]

Setting the last arg of this to 4 instead of 2 allows me to reach breakup!:

#define RemapPage(address) \
    pagestuff_64((address) & (~PMK), ^(vm_address_t tte_addr, int addr) {\
        uint64_t tte = ReadAnywhere64(tte_addr);\
        if (!(TTE_GET(tte, TTE_IS_TABLE_MASK))) {\
            NSLog(@"breakup!");\
            uint64_t fakep = physalloc(PSZ);\
            uint64_t realp = TTE_GET(tte, TTE_PHYS_VALUE_MASK);\
            TTE_SETB(tte, TTE_IS_TABLE_MASK);\
            for (int i = 0; i < PSZ/8; i++) {\
                TTE_SET(tte, TTE_PHYS_VALUE_MASK, realp + i * PSZ);\
                WriteAnywhere64(fakep+i*8, tte);\
            }\
            TTE_SET(tte, TTE_PHYS_VALUE_MASK, findphys_real(fakep));\
            WriteAnywhere64(tte_addr, tte);\
        }\
        uint64_t newt = physalloc(PSZ);\
        copyin(bbuf, TTE_GET(tte, TTE_PHYS_VALUE_MASK) - gPhysBase + gVirtBase, PSZ);\
        copyout(newt, bbuf, PSZ);\
        TTE_SET(tte, TTE_PHYS_VALUE_MASK, findphys_real(newt));\
        TTE_SET(tte, TTE_BLOCK_ATTR_UXN_MASK, 0);\
        TTE_SET(tte, TTE_BLOCK_ATTR_PXN_MASK, 0);\
        WriteAnywhere64(tte_addr, tte);\
        NSLog(@"level %llx - %llx", tte_addr,              TTE_GET(tte, TTE_PHYS_VALUE_MASK));\
    }, level1_table, 4);

[ghost]

@meyer9 What is breakup? Is that closer to solving the issue?

[mmhobi7]

Is pagestuff_64 closed source?

[ghost]

@Aaahh No its not i saw someone decompile it on the 4k support original issue thread.

[uwu2234]

@TheMerkyShadow if you decompile something it means that 1) you're blind and you didn't look for the source if it existed or 2) it was closed source and mainly its number 2 that is the reason.

[ghost]

@FNCxPro
I was just answering a question.

[Mila432]

@TheMerkyShadow @Aaahh its open source..

[coolstar]

I asked someone with an SE to run the fork of yalu102 (so we have working output to compare against): https://ghostbin.com/paste/cm5nx

looks like it shouldn't be saying "breakup!", so we definitely need to fix the TTE code

[mmhobi7]

@coolstar right on 👍
https://github.com/kpwn/yalu102/blob/master/yalu102/pte_stuff.h
Setting that int to 4? Would help for?
Whats the line commented out for
Also this was used before

[andrewwiik]

when ran with both values being 4:

sysname: Darwin
nodename: Andrews-iPhone
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:08 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7000
machine: iPhone7,2
2017-01-28 14:41:06.565222 yalu102[732:175610] found corruption 38203
2017-01-28 14:41:09.152904 yalu102[732:175610] found kernel text at fffffff011a04000
2017-01-28 14:41:09.155099 yalu102[732:175610] got tfp0 -> f07
2017-01-28 14:41:09.156256 yalu102[732:175610] found procs at fffffff116526428
2017-01-28 14:41:09.160369 yalu102[732:175610] seg: __TEXT
2017-01-28 14:41:09.160441 yalu102[732:175610] seg: __DATA_CONST
2017-01-28 14:41:09.160476 yalu102[732:175610] seg: __TEXT_EXEC
2017-01-28 14:41:09.160508 yalu102[732:175610] seg: __KLD
2017-01-28 14:41:09.160540 yalu102[732:175610] seg: __LAST
2017-01-28 14:41:09.160572 yalu102[732:175610] seg: __DATA
2017-01-28 14:41:09.160666 yalu102[732:175610] seg: __PRELINK_TEXT
2017-01-28 14:41:09.160744 yalu102[732:175610] seg: __PLK_TEXT_EXEC
2017-01-28 14:41:09.160787 yalu102[732:175610] seg: __PRELINK_DATA
2017-01-28 14:41:09.160820 yalu102[732:175610] seg: __PLK_DATA_CONST
2017-01-28 14:41:09.160852 yalu102[732:175610] seg: __PLK_LINKEDIT
2017-01-28 14:41:09.160884 yalu102[732:175610] seg: __PRELINK_INFO
2017-01-28 14:41:09.160935 yalu102[732:175610] seg: __LINKEDIT
2017-01-28 14:41:09.160988 yalu102[732:175610] fffffff010acc000 - fffffff012294000
2017-01-28 14:41:09.219666 yalu102[732:175610] ffffffff03d90000
2017-01-28 14:41:09.267973 yalu102[732:175610] fffffff011a715a0
2017-01-28 14:41:09.308160 yalu102[732:175610] pmap: fffffff011f20850
2017-01-28 14:41:09.348321 yalu102[732:175610] debug: test point 1
2017-01-28 14:41:09.348444 yalu102[732:175610] debug: test point 2
2017-01-28 14:41:09.348467 yalu102[732:175610] debug: test point 3
2017-01-28 14:41:09.348529 yalu102[732:175610] debug: test point 4
2017-01-28 14:41:09.348564 yalu102[732:175610] debug: test point 5
2017-01-28 14:41:09.348591 yalu102[732:175610] debug: test point 6
2017-01-28 14:41:09.348617 yalu102[732:175610] debug: test point 7
2017-01-28 14:41:09.348638 yalu102[732:175610] Indentified 4k device
2017-01-28 14:41:09.348667 yalu102[732:175610] calling back 0 4
2017-01-28 14:41:09.348746 yalu102[732:175610] calling back 2
2017-01-28 14:41:09.348805 yalu102[732:175610] calling back 3
2017-01-28 14:41:09.348874 yalu102[732:175610] got phys at 0 for virt fffffff0008ab000
2017-01-28 14:41:09.348946 yalu102[732:175610] found cpu 0
2017-01-28 14:41:09.348975 yalu102[732:175610] found physz: fffffff011a93000
2017-01-28 14:41:09.349010 yalu102[732:175610] found cpu 1
2017-01-28 14:41:09.349038 yalu102[732:175610] found physz: fffffff011a93000
2017-01-28 14:41:09.349211 yalu102[732:175610] fffffff011b93574 - fffffff011b933a8
2017-01-28 14:41:09.350745 yalu102[732:175610] ttbr0: 802ab9000 fffffff011a71590
2017-01-28 14:41:09.350798 yalu102[732:175610] debug: test point 8
2017-01-28 14:41:09.350834 yalu102[732:175610] debug: test point 9
2017-01-28 14:41:09.350884 yalu102[732:175610] debug: test point 10
2017-01-28 14:41:09.350907 yalu102[732:175610] Indentified 4k device
2017-01-28 14:41:09.350930 yalu102[732:175610] calling back 0 4
2017-01-28 14:41:09.350959 yalu102[732:175610] calling back 2
2017-01-28 14:41:09.351028 yalu102[732:175610] calling back 3
2017-01-28 14:41:09.351052 yalu102[732:175610] debug: test point 11
2017-01-28 14:41:09.351688 yalu102[732:175610] debug: test point 12
2017-01-28 14:41:09.351824 yalu102[732:175610] debug: test point 13
2017-01-28 14:41:09.351954 yalu102[732:175610] debug: test point 14
2017-01-28 14:41:09.351987 yalu102[732:175610] debug: test point 15
2017-01-28 14:41:09.352016 yalu102[732:175610] debug: test point 16
2017-01-28 14:41:09.352104 yalu102[732:175610] debug: test point 17
2017-01-28 14:41:09.352149 yalu102[732:175610] Indentified 4k device
2017-01-28 14:41:09.352175 yalu102[732:175610] calling back 0 4
2017-01-28 14:41:09.352208 yalu102[732:175610] calling back 2
2017-01-28 14:41:09.352235 yalu102[732:175610] calling back 3
2017-01-28 14:41:09.352256 yalu102[732:175610] debug: test point 18
2017-01-28 14:41:09.352412 yalu102[732:175610] got a cpacr at 4462
2017-01-28 14:41:09.352435 yalu102[732:175610] debug ---
2017-01-28 14:41:09.352455 yalu102[732:175610] debug: test point 18z1
2017-01-28 14:41:09.352475 yalu102[732:175610] debug: test point 18z2
2017-01-28 14:41:09.431925 yalu102[732:175610] 18446744005291649128, 266338304
2017-01-28 14:41:09.472047 yalu102[732:175610] debug: test point 19
2017-01-28 14:41:09.472158 yalu102[732:175610] debug: test point 19a
2017-01-28 14:41:09.472181 yalu102[732:175610] debug 18*
2017-01-28 14:41:09.472208 yalu102[732:175610] Indentified 4k device
2017-01-28 14:41:09.472236 yalu102[732:175610] calling bac

[coolstar]

@Aaahh please click on the line number at the left before copying the URL when referencing specific lines. It's rather vague what you're talking about considering there's a lot of stuff in that header

[andrewwiik]

He means the int on:

uint64_t findphys_real(uint64_t virtaddr) {
    __block uint64_t physvar = 0;
    pagestuff_64(virtaddr, ^(vm_address_t tte_addr, int addr) {
        uint64_t tte = ReadAnywhere64(tte_addr);
        if (addr == 3) {\
            physvar = TTE_GET(tte, TTE_PHYS_VALUE_MASK);
        }
    }, level1_table, 4);

[andrewwiik]

may be useful, bother ints set to 4 and un commented the TTE logs:

sysname: Darwin
nodename: Andrews-iPhone
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:08 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7000
machine: iPhone7,2
2017-01-28 14:45:32.662313 yalu102[229:4722] found corruption 37b03
2017-01-28 14:45:38.570313 yalu102[229:4722] found kernel text at fffffff020204000
2017-01-28 14:45:38.572453 yalu102[229:4722] got tfp0 -> 1007
2017-01-28 14:45:38.574133 yalu102[229:4722] found procs at fffffff004e0fcb8
2017-01-28 14:45:38.578455 yalu102[229:4722] seg: __TEXT
2017-01-28 14:45:38.578547 yalu102[229:4722] seg: __DATA_CONST
2017-01-28 14:45:38.578582 yalu102[229:4722] seg: __TEXT_EXEC
2017-01-28 14:45:38.578621 yalu102[229:4722] seg: __KLD
2017-01-28 14:45:38.578653 yalu102[229:4722] seg: __LAST
2017-01-28 14:45:38.578684 yalu102[229:4722] seg: __DATA
2017-01-28 14:45:38.578716 yalu102[229:4722] seg: __PRELINK_TEXT
2017-01-28 14:45:38.578748 yalu102[229:4722] seg: __PLK_TEXT_EXEC
2017-01-28 14:45:38.578866 yalu102[229:4722] seg: __PRELINK_DATA
2017-01-28 14:45:38.578911 yalu102[229:4722] seg: __PLK_DATA_CONST
2017-01-28 14:45:38.578950 yalu102[229:4722] seg: __PLK_LINKEDIT
2017-01-28 14:45:38.578982 yalu102[229:4722] seg: __PRELINK_INFO
2017-01-28 14:45:38.579014 yalu102[229:4722] seg: __LINKEDIT
2017-01-28 14:45:38.579045 yalu102[229:4722] fffffff01f2cc000 - fffffff020a94000
2017-01-28 14:45:38.634142 yalu102[229:4722] ffffffff03d8c000
2017-01-28 14:45:38.680263 yalu102[229:4722] fffffff0202715a0
2017-01-28 14:45:38.719158 yalu102[229:4722] pmap: fffffff020720850
2017-01-28 14:45:38.757786 yalu102[229:4722] debug: test point 1
2017-01-28 14:45:38.757904 yalu102[229:4722] debug: test point 2
2017-01-28 14:45:38.757926 yalu102[229:4722] debug: test point 3
2017-01-28 14:45:38.757986 yalu102[229:4722] debug: test point 4
2017-01-28 14:45:38.758020 yalu102[229:4722] debug: test point 5
2017-01-28 14:45:38.758047 yalu102[229:4722] debug: test point 6
2017-01-28 14:45:38.758073 yalu102[229:4722] debug: test point 7
2017-01-28 14:45:38.758094 yalu102[229:4722] Indentified 4k device
2017-01-28 14:45:38.758130 yalu102[229:4722] TTE physaddr: 0000000000000000
2017-01-28 14:45:38.758255 yalu102[229:4722] TTE table: 0
2017-01-28 14:45:38.758286 yalu102[229:4722] TTE valid: 0
2017-01-28 14:45:38.758308 yalu102[229:4722] TTE userland eXecute Never: 0
2017-01-28 14:45:38.758329 yalu102[229:4722] TTE privileged eXecute Never: 0
2017-01-28 14:45:38.758366 yalu102[229:4722] TTE contiguous: 0
2017-01-28 14:45:38.758405 yalu102[229:4722] TTE not global: 0
2017-01-28 14:45:38.758431 yalu102[229:4722] TTE access flag: 0
2017-01-28 14:45:38.758477 yalu102[229:4722] TTE shareable: 0
2017-01-28 14:45:38.758512 yalu102[229:4722] TTE access permissions: Read/Write
2017-01-28 14:45:38.758549 yalu102[229:4722] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-28 14:45:38.758579 yalu102[229:4722] calling back 0 4
2017-01-28 14:45:38.758612 yalu102[229:4722] calling back 2
2017-01-28 14:45:38.758633 yalu102[229:4722] calling back 3
2017-01-28 14:45:38.758799 yalu102[229:4722] got phys at 0 for virt fffffff000850000
2017-01-28 14:45:38.758929 yalu102[229:4722] found cpu 0
2017-01-28 14:45:38.758962 yalu102[229:4722] found physz: fffffff020293000
2017-01-28 14:45:38.758995 yalu102[229:4722] found cpu 1
2017-01-28 14:45:38.759075 yalu102[229:4722] found physz: fffffff020293000
2017-01-28 14:45:38.759122 yalu102[229:4722] fffffff020393574 - fffffff0203933a8
2017-01-28 14:45:38.760646 yalu102[229:4722] ttbr0: 802ab9000 fffffff020271590
2017-01-28 14:45:38.760690 yalu102[229:4722] debug: test point 8
2017-01-28 14:45:38.760739 yalu102[229:4722] debug: test point 9
2017-01-28 14:45:38.760773 yalu102[229:4722] debug: test point 10
2017-01-28 14:45:38.760793 yalu102[229:4722] Indentified 4k device
2017-01-28 14:45:38.760822 yalu102[229:4722] TTE physaddr: 0000000000000000
2017-01-28 14:45:38.760843 yalu102[229:4722] TTE table: 0
2017-01-28 14:45:38.760864 yalu102[229:4722] TTE valid: 0
2017-01-28 14:45:38.760884 yalu102[229:4722] TTE userland eXecute Never: 0
2017-01-28 14:45:38.760905 yalu102[229:4722] TTE privileged eXecute Never: 0
2017-01-28 14:45:38.760926 yalu102[229:4722] TTE contiguous: 0
2017-01-28 14:45:38.760946 yalu102[229:4722] TTE not global: 0
2017-01-28 14:45:38.760966 yalu102[229:4722] TTE access flag: 0
2017-01-28 14:45:38.760986 yalu102[229:4722] TTE shareable: 0
2017-01-28 14:45:38.761012 yalu102[229:4722] TTE access permissions: Read/Write
2017-01-28 14:45:38.761094 yalu102[229:4722] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-28 14:45:38.761122 yalu102[229:4722] calling back 0 4
2017-01-28 14:45:38.761149 yalu102[229:4722] calling back 2
2017-01-28 14:45:38.761169 yalu102[229:4722] calling back 3
2017-01-28 14:45:38.761189 yalu102[229:4722] debug: test point 11
2017-01-28 14:45:38.761284 yalu102[229:4722] debug: test point 12
2017-01-28 14:45:38.761387 yalu102[229:4722] debug: test point 13
2017-01-28 14:45:38.761604 yalu102[229:4722] debug: test point 14
2017-01-28 14:45:38.761671 yalu102[229:4722] debug: test point 15
2017-01-28 14:45:38.761701 yalu102[229:4722] debug: test point 16
2017-01-28 14:45:38.761757 yalu102[229:4722] debug: test point 17
2017-01-28 14:45:38.761796 yalu102[229:4722] Indentified 4k device
2017-01-28 14:45:38.761827 yalu102[229:4722] TTE physaddr: 0000000000000000
2017-01-28 14:45:38.761849 yalu102[229:4722] TTE table: 0
2017-01-28 14:45:38.761869 yalu102[229:4722] TTE valid: 0
2017-01-28 14:45:38.761951 yalu102[229:4722] TTE userland eXecute Never: 0
2017-01-28 14:45:38.761991 yalu102[229:4722] TTE privileged eXecute Never: 0
2017-01-28 14:45:38.762011 yalu102[229:4722] TTE contiguous: 0
2017-01-28 14:45:38.762031 yalu102[229:4722] TTE not global: 0
2017-01-28 14:45:38.762051 yalu102[229:4722] TTE access flag: 0
2017-01-28 14:45:38.762071 yalu102[229:4722] TTE shareable: 0
2017-01-28 14:45:38.762100 yalu102[229:4722] TTE access permissions: Read/Write
2017-01-28 14:45:38.762209 yalu102[229:4722] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-28 14:45:38.762245 yalu102[229:4722] calling back 0 4
2017-01-28 14:45:38.762292 yalu102[229:4722] calling back 2
2017-01-28 14:45:38.762330 yalu102[229:4722] calling back 3
2017-01-28 14:45:38.762351 yalu102[229:4722] debug: test point 18
2017-01-28 14:45:38.762564 yalu102[229:4722] got a cpacr at 4462
2017-01-28 14:45:38.762589 yalu102[229:4722] debug ---
2017-01-28 14:45:38.762628 yalu102[229:4722] debug: test point 18z1
2017-01-28 14:45:38.762716 yalu102[229:4722] debug: test point 18z2
2017-01-28 14:45:38.840135 yalu102[229:4722] 18446744005534918760, 509607936
2017-01-28 14:45:38.878784 yalu102[229:4722] debug: test point 19
2017-01-28 14:45:38.878906 yalu102[229:4722] debug: test point 19a
2017-01-28 14:45:38.878966 yalu102[229:4722] debug 18*
2017-01-28 14:45:38.878994 yalu102[229:4722] Indentified 4k device
2017-01-28 14:45:38.879033 yalu102[229:4722] TTE physaddr: 0000000000000000
2017-01-28 14:45:38.879055 yalu102[229:4722] TTE table: 0
2017-01-28 14:45:38.879076 yalu102[229:4722] TTE valid: 0
2017-01-28 14:45:38.879096 yalu102[229:4722] TTE userland eXecute Never: 0
2017-01-28 14:45:38.879117 yalu102[229:4722] TTE privileged eXecute Never: 0
2017-01-28 14:45:38.879137 yalu102[229:4722] TTE contiguous: 0
2017-01-28 14:45:38.879157 yalu102[229:4722] TTE not global: 0
2017-01-28 14:45:38.879203 yalu102[229:4722] TTE access flag: 0
2017-01-28 14:45:38.879257 yalu102[229:4722] TTE shareable: 0
2017-01-28 14:45:38.879315 yalu102[229:4722] TTE access permissions: Read/Write
2017-01-28 14:45:38.879365 yalu102[229:4722] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-28 14:45:38.879393 yalu102[229:4722] calling back 0 4

[felipejfc]

"got phys at 0 for virt fffffff0008ab000" -> game over already

[felipejfc]

@meyer9 if the code was documented then maybe you would realise why it does not many any sense to set "level" argument of "pagestuff_64" to 4... as a hint, take a look at the switch case inside it...

[tangalbert919]

@felipejfc We get it. The code is not documented, so it's hard to read for many people (except for those who know C or Objective-C or both in their heads), but the documentation would take a long time. The developers have to explain what the methods do, how it works, and why exactly does that method need to allocate these bytes and offsets to this portion of the memory that requires elevated privileges to read and write into. It's a very long (and painful) process.
If you really think this should be documented, you should start. Meanwhile, @meyer9 and @andrewwiik will bend over backwards, hit their heads on a wall, and cry a bit to finally add 4k support while @kpwn sleeps because he's in Europe (and during the time of this writing, he's probably asleep, but I'm not sure because he admitted to not having normal sleep routines, but nobody has normal sleeping routines or everyone in Italy would pass out and sleep at the exact same time, and wake up at the exact same time).

[andrei085]

or maybe he is working at adding support for 4k devices

[tangalbert919]

Maybe he is doing that, but he needs a 4k device to test it on.
In @felipejfc's last comment, he could be right. And I say "could" because of my obvious lack of C knowledge, so I'm not sure. Maybe @meyer9 could set the "level" argument of "pagestuff_64" to '1', unless they already tried that and that didn't work.
I don't know. I was looking at the switch (level) cases.

[felipejfc]

@tangalbert919 the docs are not for those who dont know c but for those who knows, the documentation im talking about is a high level documentation, like, "this piece of code grabs a leaked mach port" and so on... and I Just commented it here because the very same person who was against docs now is here trying to pass 4 as argument for a function that is not meant to receive more than 3 on it...

[jordaonet]

Just to clarify that at the moment in Europe, it's not that late...
I'm in Portugal and it's 21:22 right now. In Italy its 22:22...

[sa3dn97]

Did you get the code that will support iphone 6 ?? @tangalbert919

[jordaonet]

Furthermore, I have iPhone 6+ and will spend the next 3 or 4 hours trying my luck with xCode. So just ring me if something's need to be tested.

[mmhobi7]

Yeah @felipejfc is right and thats what i was trying to say earlier right before cool star and then being ignored

[tangalbert919]

Now I understand that whole documentation thing. Also, @felipejfc is right about the int not being 4, because that's not a case.
@sa3dn97 I did not get the code that supports the iPhone 6 yet. I will later.
@jordaonet Good luck.

[KILLCAMPER]

So is the iPad air2 cellular 4k or 16 as every one say one thing then another thanks

[AppleBetas]

iPad Air 2 is 4k, @KILLCAMPER.

[KILLCAMPER]

@AppleBetas thank you as am getting mixed answers thank you so much

[jordaonet]

@tangalbert919
When you get it can you send it to me as well?
Thx in advance.

[ghost]

Just for reference this is an iPad Air 2 (iPad5,3) WiFi's result when running from the latest commit. Nothing has been changed or added to code. I also noticed that it doesn't get phys at 0.

sysname: Darwin
nodename: iPad53
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7001
machine: iPad5,3
2017-01-29 11:07:13.692447 yalu102[330:20243] found corruption 38b03
2017-01-29 11:07:20.430544 yalu102[330:20243] found kernel text at fffffff026a04000
2017-01-29 11:07:20.432453 yalu102[330:20243] got tfp0 -> d07
2017-01-29 11:07:20.433985 yalu102[330:20243] found procs at fffffff002c6c890
2017-01-29 11:07:20.437693 yalu102[330:20243] seg: __TEXT
2017-01-29 11:07:20.437758 yalu102[330:20243] seg: __DATA_CONST
2017-01-29 11:07:20.437791 yalu102[330:20243] seg: __TEXT_EXEC
2017-01-29 11:07:20.437823 yalu102[330:20243] seg: __KLD
2017-01-29 11:07:20.437855 yalu102[330:20243] seg: __LAST
2017-01-29 11:07:20.437891 yalu102[330:20243] seg: __DATA
2017-01-29 11:07:20.437924 yalu102[330:20243] seg: __PRELINK_TEXT
2017-01-29 11:07:20.437954 yalu102[330:20243] seg: __PLK_TEXT_EXEC
2017-01-29 11:07:20.437984 yalu102[330:20243] seg: __PRELINK_DATA
2017-01-29 11:07:20.438049 yalu102[330:20243] seg: __PLK_DATA_CONST
2017-01-29 11:07:20.438089 yalu102[330:20243] seg: __PLK_LINKEDIT
2017-01-29 11:07:20.438121 yalu102[330:20243] seg: __PRELINK_INFO
2017-01-29 11:07:20.438153 yalu102[330:20243] seg: __LINKEDIT
2017-01-29 11:07:20.438202 yalu102[330:20243] fffffff025a70000 - fffffff0272a0000
2017-01-29 11:07:20.472863 yalu102[330:20243] ffffffff0499c000
2017-01-29 11:07:20.509011 yalu102[330:20243] fffffff026a715a0
2017-01-29 11:07:20.544794 yalu102[330:20243] pmap: fffffff026f20850
2017-01-29 11:07:20.580964 yalu102[330:20243] got phys at 81f200000 for virt fffffff002080000
2017-01-29 11:07:20.581076 yalu102[330:20243] found cpu 0
2017-01-29 11:07:20.581109 yalu102[330:20243] found physz: fffffff026a93000
2017-01-29 11:07:20.581146 yalu102[330:20243] found cpu 1
2017-01-29 11:07:20.581177 yalu102[330:20243] found physz: fffffff026a93000
2017-01-29 11:07:20.581210 yalu102[330:20243] found cpu 2
2017-01-29 11:07:20.581254 yalu102[330:20243] found physz: fffffff026a93000
2017-01-29 11:07:20.581294 yalu102[330:20243] fffffff026b93714 - fffffff026b93548
2017-01-29 11:07:20.582571 yalu102[330:20243] ttbr0: 802ac5000 fffffff026a71590
2017-01-29 11:07:20.583012 yalu102[330:20243] got a cpacr
2017-01-29 11:07:20.618821 yalu102[330:20243] breakup!

[meyer9]

I understand why you would think we shouldn't set the value to 4. I was just trying to test with the base address instead of modifying it. Unless you know exactly what that function does, I don't see a problem setting it to 4 since it's a recursive function that increases anyway and handles the default case, so the function is not unable to receive a 4.

I definitely see your point though. I wonder if we could get a 6S to do the commented logs since then we could compare. You are probably right @felipejfc.

[0x0luke]

Getting similar results to @andrewwiik now, this is my debugger output. The line below 19a is "RemapPage(gadget_base + cpacr_idx);". It seems to be stuck in some sort of loop though.

sysname: Darwin
nodename: iPhone
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:08 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7000
machine: iPhone7,1
2017-01-29 00:35:51.435836 yalu102[259:6545] found corruption 38203
2017-01-29 00:35:52.374885 yalu102[259:6545] found kernel text at fffffff00b004000
2017-01-29 00:35:52.377238 yalu102[259:6545] got tfp0 -> 38303
2017-01-29 00:35:52.377813 yalu102[259:6545] found procs at fffffff10dfaa040
2017-01-29 00:35:52.383007 yalu102[259:6545] seg: __TEXT
2017-01-29 00:35:52.383079 yalu102[259:6545] seg: __DATA_CONST
2017-01-29 00:35:52.383143 yalu102[259:6545] seg: __TEXT_EXEC
2017-01-29 00:35:52.383197 yalu102[259:6545] seg: __KLD
2017-01-29 00:35:52.383231 yalu102[259:6545] seg: __LAST
2017-01-29 00:35:52.383263 yalu102[259:6545] seg: __DATA
2017-01-29 00:35:52.383363 yalu102[259:6545] seg: __PRELINK_TEXT
2017-01-29 00:35:52.383416 yalu102[259:6545] seg: __PLK_TEXT_EXEC
2017-01-29 00:35:52.383449 yalu102[259:6545] seg: __PRELINK_DATA
2017-01-29 00:35:52.383481 yalu102[259:6545] seg: __PLK_DATA_CONST
2017-01-29 00:35:52.383512 yalu102[259:6545] seg: __PLK_LINKEDIT
2017-01-29 00:35:52.383611 yalu102[259:6545] seg: __PRELINK_INFO
2017-01-29 00:35:52.383646 yalu102[259:6545] seg: __LINKEDIT
2017-01-29 00:35:52.383676 yalu102[259:6545] fffffff00a0cc000 - fffffff00b894000
2017-01-29 00:35:52.438878 yalu102[259:6545] ffffffff03e38000
2017-01-29 00:35:52.486451 yalu102[259:6545] fffffff00b0715a0
2017-01-29 00:35:52.527721 yalu102[259:6545] pmap: fffffff00b520850
2017-01-29 00:35:52.568554 yalu102[259:6545] debug: test point 1
2017-01-29 00:35:52.568708 yalu102[259:6545] debug: test point 2
2017-01-29 00:35:52.568806 yalu102[259:6545] debug: test point 3
2017-01-29 00:35:52.568909 yalu102[259:6545] debug: test point 4
2017-01-29 00:35:52.569172 yalu102[259:6545] debug: test point 5
2017-01-29 00:35:52.569210 yalu102[259:6545] debug: test point 6
2017-01-29 00:35:52.569269 yalu102[259:6545] debug: test point 7
2017-01-29 00:35:52.569502 yalu102[259:6545] Indentified 4k device
2017-01-29 00:35:52.569556 yalu102[259:6545] TTE physaddr: 0000fff00beb9000
2017-01-29 00:35:52.569612 yalu102[259:6545] TTE table: 0
2017-01-29 00:35:52.569873 yalu102[259:6545] TTE valid: 0
2017-01-29 00:35:52.569995 yalu102[259:6545] TTE userland eXecute Never: 1
2017-01-29 00:35:52.570112 yalu102[259:6545] TTE privileged eXecute Never: 1
2017-01-29 00:35:52.570245 yalu102[259:6545] TTE contiguous: 1
2017-01-29 00:35:52.570362 yalu102[259:6545] TTE not global: 0
2017-01-29 00:35:52.570481 yalu102[259:6545] TTE access flag: 0
2017-01-29 00:35:52.570587 yalu102[259:6545] TTE shareable: 0
2017-01-29 00:35:52.570731 yalu102[259:6545] TTE access permissions: Read/Write
2017-01-29 00:35:52.570893 yalu102[259:6545] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-29 00:35:52.571026 yalu102[259:6545] calling back 18446744005190062112 2
2017-01-29 00:35:52.571208 yalu102[259:6545] calling back 2
2017-01-29 00:35:52.571328 yalu102[259:6545] calling back 3
2017-01-29 00:35:52.571426 yalu102[259:6545] calling back 4
2017-01-29 00:35:52.571542 yalu102[259:6545] Indentified 4k device
2017-01-29 00:35:52.571656 yalu102[259:6545] TTE physaddr: 0000fff00beb9000
2017-01-29 00:35:52.571765 yalu102[259:6545] TTE table: 0
2017-01-29 00:35:52.571872 yalu102[259:6545] TTE valid: 0
2017-01-29 00:35:52.571991 yalu102[259:6545] TTE userland eXecute Never: 1
2017-01-29 00:35:52.572097 yalu102[259:6545] TTE privileged eXecute Never: 1
2017-01-29 00:35:52.572215 yalu102[259:6545] TTE contiguous: 1
2017-01-29 00:35:52.572399 yalu102[259:6545] TTE not global: 0
2017-01-29 00:35:52.572665 yalu102[259:6545] TTE access flag: 0
2017-01-29 00:35:52.572866 yalu102[259:6545] TTE shareable: 0
2017-01-29 00:35:52.573082 yalu102[259:6545] TTE access permissions: Read/Write
2017-01-29 00:35:52.573152 yalu102[259:6545] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-29 00:35:52.573377 yalu102[259:6545] calling back 18446744005190115824 3
2017-01-29 00:35:52.573443 yalu102[259:6545] calling back 2
2017-01-29 00:35:52.573640 yalu102[259:6545] calling back 3
2017-01-29 00:35:52.573710 yalu102[259:6545] calling back 5
2017-01-29 00:35:52.574152 yalu102[259:6545] got phys at 0 for virt fffffff00083e000
2017-01-29 00:35:52.574797 yalu102[259:6545] found cpu 0
2017-01-29 00:35:52.575288 yalu102[259:6545] found physz: fffffff00b093000
2017-01-29 00:35:52.575528 yalu102[259:6545] found cpu 1
2017-01-29 00:35:52.575633 yalu102[259:6545] found physz: fffffff00b093000
2017-01-29 00:35:52.575801 yalu102[259:6545] fffffff00b193574 - fffffff00b1933a8
2017-01-29 00:35:52.577202 yalu102[259:6545] ttbr0: 802ab9000 fffffff00b071590
2017-01-29 00:35:52.577244 yalu102[259:6545] debug: test point 8
2017-01-29 00:35:52.577326 yalu102[259:6545] debug: test point 9
2017-01-29 00:35:52.577521 yalu102[259:6545] debug: test point 10
2017-01-29 00:35:52.577585 yalu102[259:6545] Indentified 4k device
2017-01-29 00:35:52.577714 yalu102[259:6545] TTE physaddr: 0000fff00beb9000
2017-01-29 00:35:52.577810 yalu102[259:6545] TTE table: 0
2017-01-29 00:35:52.577969 yalu102[259:6545] TTE valid: 0
2017-01-29 00:35:52.578029 yalu102[259:6545] TTE userland eXecute Never: 1
2017-01-29 00:35:52.578143 yalu102[259:6545] TTE privileged eXecute Never: 1
2017-01-29 00:35:52.578241 yalu102[259:6545] TTE contiguous: 1
2017-01-29 00:35:52.578347 yalu102[259:6545] TTE not global: 0
2017-01-29 00:35:52.578473 yalu102[259:6545] TTE access flag: 0
2017-01-29 00:35:52.578574 yalu102[259:6545] TTE shareable: 0
2017-01-29 00:35:52.578711 yalu102[259:6545] TTE access permissions: Read/Write
2017-01-29 00:35:52.578841 yalu102[259:6545] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-29 00:35:52.578974 yalu102[259:6545] calling back 18446744005190062112 2
2017-01-29 00:35:52.579092 yalu102[259:6545] calling back 2
2017-01-29 00:35:52.579207 yalu102[259:6545] calling back 3
2017-01-29 00:35:52.579340 yalu102[259:6545] calling back 4
2017-01-29 00:35:52.579437 yalu102[259:6545] Indentified 4k device
2017-01-29 00:35:52.579547 yalu102[259:6545] TTE physaddr: 0000fff00beb9000
2017-01-29 00:35:52.579654 yalu102[259:6545] TTE table: 0
2017-01-29 00:35:52.579765 yalu102[259:6545] TTE valid: 0
2017-01-29 00:35:52.579880 yalu102[259:6545] TTE userland eXecute Never: 1
2017-01-29 00:35:52.579979 yalu102[259:6545] TTE privileged eXecute Never: 1
2017-01-29 00:35:52.580092 yalu102[259:6545] TTE contiguous: 1
2017-01-29 00:35:52.580207 yalu102[259:6545] TTE not global: 0
2017-01-29 00:35:52.580357 yalu102[259:6545] TTE access flag: 0
2017-01-29 00:35:52.580406 yalu102[259:6545] TTE shareable: 0
2017-01-29 00:35:52.580554 yalu102[259:6545] TTE access permissions: Read/Write
2017-01-29 00:35:52.580664 yalu102[259:6545] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-29 00:35:52.580804 yalu102[259:6545] calling back 18446744005190115848 3
2017-01-29 00:35:52.580913 yalu102[259:6545] calling back 2
2017-01-29 00:35:52.581035 yalu102[259:6545] calling back 3
2017-01-29 00:35:52.581135 yalu102[259:6545] calling back 5
2017-01-29 00:35:52.581254 yalu102[259:6545] debug: test point 11
2017-01-29 00:35:52.581635 yalu102[259:6545] debug: test point 12
2017-01-29 00:35:52.581894 yalu102[259:6545] debug: test point 13
2017-01-29 00:35:52.582009 yalu102[259:6545] debug: test point 14
2017-01-29 00:35:52.582241 yalu102[259:6545] debug: test point 15
2017-01-29 00:35:52.582335 yalu102[259:6545] debug: test point 16
2017-01-29 00:35:52.582525 yalu102[259:6545] debug: test point 17
2017-01-29 00:35:52.582574 yalu102[259:6545] Indentified 4k device
2017-01-29 00:35:52.582605 yalu102[259:6545] TTE physaddr: 0000fff00beb9000
2017-01-29 00:35:52.582627 yalu102[259:6545] TTE table: 0
2017-01-29 00:35:52.582648 yalu102[259:6545] TTE valid: 0
2017-01-29 00:35:52.582729 yalu102[259:6545] TTE userland eXecute Never: 1
2017-01-29 00:35:52.582760 yalu102[259:6545] TTE privileged eXecute Never: 1
2017-01-29 00:35:52.582781 yalu102[259:6545] TTE contiguous: 1
2017-01-29 00:35:52.582801 yalu102[259:6545] TTE not global: 0
2017-01-29 00:35:52.582821 yalu102[259:6545] TTE access flag: 0
2017-01-29 00:35:52.582842 yalu102[259:6545] TTE shareable: 0
2017-01-29 00:35:52.582959 yalu102[259:6545] TTE access permissions: Read/Write
2017-01-29 00:35:52.583003 yalu102[259:6545] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-29 00:35:52.583043 yalu102[259:6545] calling back 18446744005190062112 2
2017-01-29 00:35:52.583157 yalu102[259:6545] calling back 2
2017-01-29 00:35:52.583270 yalu102[259:6545] calling back 3
2017-01-29 00:35:52.583293 yalu102[259:6545] calling back 4
2017-01-29 00:35:52.583312 yalu102[259:6545] Indentified 4k device
2017-01-29 00:35:52.583335 yalu102[259:6545] TTE physaddr: 0000fff00beb9000
2017-01-29 00:35:52.583356 yalu102[259:6545] TTE table: 0
2017-01-29 00:35:52.583429 yalu102[259:6545] TTE valid: 0
2017-01-29 00:35:52.583544 yalu102[259:6545] TTE userland eXecute Never: 1
2017-01-29 00:35:52.583568 yalu102[259:6545] TTE privileged eXecute Never: 1
2017-01-29 00:35:52.583588 yalu102[259:6545] TTE contiguous: 1
2017-01-29 00:35:52.583608 yalu102[259:6545] TTE not global: 0
2017-01-29 00:35:52.583628 yalu102[259:6545] TTE access flag: 0
2017-01-29 00:35:52.583711 yalu102[259:6545] TTE shareable: 0
2017-01-29 00:35:52.583831 yalu102[259:6545] TTE access permissions: Read/Write
2017-01-29 00:35:52.583875 yalu102[259:6545] TTE access permissions: EL0 (Userland) cannot access this page
2017-01-29 00:35:52.583916 yalu102[259:6545] calling back 18446744005190115856 3
2017-01-29 00:35:52.583947 yalu102[259:6545] calling back 2
2017-01-29 00:35:52.583972 yalu102[259:6545] calling back 3
2017-01-29 00:35:52.583992 yalu102[259:6545] calling back 5
2017-01-29 00:35:52.584011 yalu102[259:6545] debug: test point 18
2017-01-29 00:35:52.584171 yalu102[259:6545] got a cpacr at 4462
2017-01-29 00:35:52.584192 yalu102[259:6545] debug ---
2017-01-29 00:35:52.584274 yalu102[259:6545] debug: test point 18z1
2017-01-29 00:35:52.584364 yalu102[259:6545] debug: test point 18z2
2017-01-29 00:35:52.662229 yalu102[259:6545] 18446744005180500072, 18446743970785525760
2017-01-29 00:35:52.701344 yalu102[259:6545] debug: test point 19
2017-01-29 00:35:52.701420 yalu102[259:6545] debug: test point 19a
2017-01-29 00:35:52.701442 yalu102[259:6545] debug 18*
2017-01-29 00:35:52.701464 yalu102[259:6545] Indentified 4k device
2017-01-29 00:35:52.701524 yalu102[259:6545] TTE physaddr: 0000ffe809400000
2017-01-29 00:35:52.701561 yalu102[259:6545] TTE table: 0
2017-01-29 00:35:52.701584 yalu102[259:6545] TTE valid: 0
2017-01-29 00:35:52.701604 yalu102[259:6545] TTE userland eXecute Never: 1
2017-01-29 00:35:52.701625 yalu102[259:6545] TTE privileged eXecute Never: 1
2017-01-29 00:35:52.701646 yalu102[259:6545] TTE contiguous: 1
2017-01-29 00:35:52.701666 yalu102[259:6545] TTE not global: 0
2017-01-29 00:35:52.701685 yalu102[259:6545] TTE access flag: 0
2017-01-29 00:35:52.701706 yalu102[259:6545] TTE shareable: 0

[kpwn]

expected behaviour (and reason behind this failing): pagetable layout is different on 4k devices.

[kpwn]

2017-01-29 00:35:52.582605 yalu102[259:6545] TTE physaddr: 0000fff00beb9000

invalid physaddr, looks like a virtual address.

[meyer9]

yeah that's pretty expected since findphys_real seems to be broken.

[kpwn]

.. no, this is related to but unrelated with findphys. this is simply invalid pagetable usage.

level1_table may not be a l1 table, and layout has to be looked into.

try to eg. dump all ttes from level1_table and log them down. repeat until you find something good. member that you're looking for physaddr: gPhysBase + x for a tte representing gVirtBase + x: that's the l3 tte

[meyer9]

Sorry if I'm being dumb, but I added a line to nslog the level_1table and the value it was replacing if that helps:

iPhone 6

1. current pmap: 0xfffffff00bab9000, replacing with: 0xffffffe809000000
2. current pmap: 0xfffffff0270b9000, replacing with: 0xfffffff042c00000
3. current pmap: 0xfffffff01a2b9000, replacing with: 0xfffffff041000000

but level1_table is generated by reading that value, so it is being modified either by the kernel before I read it again, or between those two

level1_table = ReadAnywhere64(ReadAnywhere64(find_kernel_pmap()));

NSLog(@"current pmap: %llu, replacing with: %llu", ReadAnywhere64(ReadAnywhere64(find_kernel_pmap())), level1_table);

Adding parse_block_tte(level1_table); gives:

2017-01-28 16:53:16.853545 yalu102[392:63677] TTE physaddr: 0000fff043e00000
2017-01-28 16:53:16.853570 yalu102[392:63677] TTE table: 0
2017-01-28 16:53:16.853591 yalu102[392:63677] TTE valid: 0
2017-01-28 16:53:16.853675 yalu102[392:63677] TTE userland eXecute Never: 1
2017-01-28 16:53:16.853703 yalu102[392:63677] TTE privileged eXecute Never: 1
2017-01-28 16:53:16.853757 yalu102[392:63677] TTE contiguous: 1
2017-01-28 16:53:16.854171 yalu102[392:63677] TTE not global: 0
2017-01-28 16:53:16.854198 yalu102[392:63677] TTE access flag: 0
2017-01-28 16:53:16.854220 yalu102[392:63677] TTE shareable: 0
2017-01-28 16:53:16.854255 yalu102[392:63677] TTE access permissions: Read/Write
2017-01-28 16:53:16.854406 yalu102[392:63677] TTE access permissions: EL0 (Userland) cannot access this page

that's definitely not a physaddr.

[0x0luke]

@meyer9 Does your output start looping like mine did?

Also Q did you manage to get access to a 4k?

[meyer9]

no mine doesn't start looping. what device you using?

[0x0luke]

6+

[meyer9]

I'm using a 6

[0x0luke]

Weird, i thought the 6 and 6+ used the same internals, maybe I'm accidentally causing a loop somewhere.

Edit: Found the issue and removed it :)

[kpwn]

FWIW I am restoring a 6 to 10.2 right now.

[meyer9]

awesome. hopefully you'll be able to solve it. I really want to see how you do it.

[Iam2smart]

I have a ipod touch 6 it does the exact same thing the iphone 6 does

[kpwn]

news at 11

[coolstar]

awesome. I'd also love to see how you do it as well

[meyer9]

not the place buddy. make a new issue if its not common and you are on a supported device.

[Iam2smart]

what

[0x0luke]

Your device is a 4k, Q is going to start working on 4k hopefully now. Just wait patiently (:

[Iam2smart]

Ok

[andrewwiik]

@kpwn 11 my time, your time, we never know where you are lol

[kpwn]

yall tripping smh

[andrewwiik]

Can't wait to see the code though, I wanna see what all of us couldn't figure out.

[meyer9]

we are tripping... I have no idea what I'm doing

[kpwn]

ok, got it working up to some point. it crashes after a while, but i managed to patch the kernel and run tar.

[meyer9]

of course you did haha

[stal888]

dank

[andrewwiik]

How long was that, less than 30 minutes? the rest of us are on what? over 50+ hours, knew we should of quit lol

[Nikostito]

When you leave the public scene it will be a sad day for all of us....
I've been reading these 2 threads(1&2) since the beggining. I was hoping that @meyer9 will reach somewhere and make sth work. But you entered the thread and in half an hour made what evryone was coping to do for 2 days now... Amazing things luca...

[ghost]

I wouldn't think like that @andrewwiik :) You tried to fix a problem that many other people wouldn't of even tried to fix. You and @meyer9 are truely amazing and if there where as many helpful people in the community as you it would be a great one. I notice the work all these people do in the community and wish they got the thanks they deserved. A little off topic but eh

[andrewwiik]

We attempt, in metaphor we were randomly smashing our heads on the keyboard hoping something would work while qwerty was actually typing haha, thanks though.

[meyer9]

I learned a lot. That's for sure. I didn't even know about physical vs. virtual memory going into this or anything about how the kernel worked. Hopefully I can find exploits like Luca.

[ghost]

@adi2k17 please leave.

[meyer9]

he doesn't. it should work on 5s with minimal if no changes.

[0x0luke]

@meyer9 Same here, i feel like i've learned so much just from messing around with the different sections of the code. I'm glad he gave all of us a chance to learn something.

[andrewwiik]

@meyer9 I think we need a third issue for this lol, @Iam2smart he got it partially working, it isn't fully working yet

[coolstar]

@meyer9 one doesn't find exploits :P one writes exploits for vulnerabilities that are found

[kpwn]

iam2fuckingretarded

[kpwn]

i think that's a name that better fits @Iam2smart

[ghost]

Oh haha, roasted.

[meyer9]

savage

[Nikostito]

Rekt

[andrewwiik]

Off-topic: @kpwn at some point can i be unblocked on twitter lol "@andywiik"

[GodzExploit]

Bro He got rosted by Luca HAHHAAHA

[0x0luke]

Github needs a "ban from repo" feature.

[stal888]

github needs custom reacts

[coolstar]

https://help.github.com/articles/blocking-a-user-from-your-personal-account/

This can be done by @kpwn to keep idiots out

[meyer9]

is kdev qwertyoruiop? if not, what's kdevs twitter. gonna follow that man

[andrewwiik]

kdev is qwerty

[meyer9]

ok neat

[akelly5]

anyone need me to test anything idc about fucking up my old Iphone

[meyer9]

nope, we'll let you know if we need anything. thanks :)

[akelly5]

ok

[akelly5]

hows it looking?

[GodzExploit]

@meyer9 Leave

[beanjo55]

@adi2k17 i dont see you putting any effort towards this, unlike @meyer9

[akelly5]

lol 5 dislikes in 10 seconds

[akelly5]

^^

[kpwn]

OK, so my first fix worked, but it turns out 4k devices are incompatible with 157e94f7c41ec34327d84f1b5e1e0d762f3a84f6. I am about to commit a fix for 4k devices, but remember that right now it has a performance impact that is more significant than it is for 16k. I believe this can be fixed.

[GodzExploit]

thanks

[liudayu]

Yay making a backup now and gonna test on my 6!! Thank you @kpwn !!!

[NoMod-Programming]

Thank you @kpwn! I'm so glad you stuck with us after everything we have done

[andrewwiik]

@kpwn just wanted to confirm It worked on my iphone 6 on 10.2