Yalu102: Ipad air 2 All offsets

[ghost]

iPad Air 2 10.2
————————————
kernelcache.release.j81

"Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7001"

_rootvnode: 5c20b8
allprocoffset: 5bc528
———————————-
kernelcache.release.j82

"Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7001"

_rootvnode: 5c20b8
allprocoffset: 5bc528
————————————
kernelcache.release.j85m

"Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_S5L8960X"

_rootvnode: 5b60b8
allprocoffset: 5b0418
————————————
kernelcache.release.j86m

"Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_S5L8960X"

_rootvnode: 5b60b8
allprocoffset: 5b0418
————————————
kernelcache.release.j87m

"Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_S5L8960X"

_rootvnode: 5b60b8
allprocoffset: 5b0418
————————————
kernelcache.release.j96

"Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:08 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7000"

_rootvnode: 5c20b8
allprocoffset: 5bc468
————————————
kernelcache.release.j97

"Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:08 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7000"

_rootvnode: 5c20b8
allprocoffset: 5bc468
————————————

I don't know if these offsets have already been found but here you go @kpwn I will be adding 10.1.1 offsets later.

[ghost]

Hey, correct me if I'm wrong but these are the offsets I got on 10.2 for the iPad Air 2 WiFi
} else if (strcmp(u.version, "Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7001") == 0) {
allproc_offset = 0x5b8528;
procoff = 0x360; // iPad air 2 (wifi), 10.2, @nicogibbons (github)
rootvnode_offset = 0x5be0b8;

[ghost]

@nicogibbons I said i dint know if they had been found already

[ghost]

I know but your results suggest that one of us is wrong?

[ghost]

@nicogibbons No but i dint find your offsets in my ipsw. wierd

[ghost]

I'll look again :) @CrypticGit

[ghost]

tell me if you want this @nicogibbons

[ghost]

I get _allproc 0x5b8528 and _kernproc 0x5be0e0

[ghost]

@nicogibbons For what kernelcache?

[ghost]

j81ap 10.2

[ghost]

If you scroll up i dont have that kernelcache. is it for ipad pro or air2 ?

[ghost]

Air 2 WiFi

[ghost]

Same thats the the one i got from ipsw.me

"iPad_64bit_TouchID_10.2_14C92_Restore.ipsw"

[ghost]

All of your offsets are wrong for me

[ghost]

Yeah

[ghost]

Wierd

[ghost]

How exactly did you work out rootvnode?

[ghost]

Also we will see when 4K support is added :)

[ghost]

I just search for it in hopper or terminal

[jtv7]

rootvnode should be: nm kernelcache.decrypted | grep rootvnode

[ghost]

@jtv7 what about allproc?

[ghost]

These results don't look right @CrypticGit

[ghost]

Mine? or yours?

[ghost]

I'm really not sure. How did you get allproc?

[jtv7]

Send me the decrypted kernel and I can check

[ghost]

Okay

[ghost]

I have slow internet it will take a minute @jtv7

[ghost]

@jtv7 https://www.dropbox.com/s/qr34704reauf23p/Kernels.zip?dl=0

[ghost]

kernelcache.decompressed.j81.zip
Hopefully compression didn't destroy file.

[ghost]

j81 is what we are looking at

[ghost]

@nicogibbons fffffff0075c20b8 S _rootvnode
fffffff0071e1258 S _vfs_rootvnode

To clarify is it vfs or normal one?

[jtv7]

Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7001

_allproc: 0x5b8528
_rootvnode: 0x5c20b8

[ghost]

@nicogibbons
I got this for allproc

[ghost]

@jtv7 whats the best method for allproc?

[jtv7]

@CrypticGit This project seems very good: https://gist.github.com/jndok/2a01a5885552571a69341a9700ac1bb0

[ghost]

@jtv7 what's the correct j81 offset?

[jtv7]

@nicogibbons I just posted what I got for j81. How are you getting the rootvnode?

[ghost]

@drake90001 got the rootvnode for me

[ghost]

How did you work it out?

[jtv7]

@nicogibbons This command: nm kernelcache.decompressed.j81 | grep rootvnode

[ghost]

yeah but how did you shorten the rootvnode

[ghost]

fffffff0075c20b8 S _rootvnode
fffffff0071e1258 S _vfs_rootvnode

[ghost]

no don't you have to subtract to get the rootvnode?

[jtv7]

@nicogibbons My results are confirmed by looking at the disassembly

[ghost]

so rootvnode is 5c20b8?

[jtv7]

@nicogibbons To the best of my knowledge, yes.

[ghost]

I'll try 0x5be0b8 when 4K support is added we'll know if it's wrong.

[ghost]

@jtv7 are the offsets different in 10.1.1

[ghost]

@CrypticGit Yes

[ghost]

@nicogibbons Ill find them. btw you dont have to @ me on my own issue.

[ghost]

@jtv7 how do i compile? with gcc?

[jtv7]

The instructions are provided on the page, but just cd into the directory and run 'make'

[ghost]

I would make a pull request with these but I believe some of the allprocs are incorrect

[ghost]

@nicogibbons Mine?

[ghost]

Yeah

[ghost]

@nicogibbons K im having trouble trying to find how to compile autooffset

[ghost]

There is a guide on the Jailbreak Reddit: https://www.reddit.com/r/jailbreak/comments/5iv8gy/tutorial_auto_offsets_finder_for_ian_beers_exploit/

[ghost]

@nicogibbons I figured it out i just had to cd to he folder then compile

[NicholasLAranda]

Guys, what don't you understand about all the offsets have been found already?

A better thing to do would be to tell us exactly which device is being targeted by what specific offset and not just keep posting all the same offsets that are already in the offsets.c file?

[ghost]

@RypeDub420 Wait so we dont need to find any more offsets for ipad, ipod, iphone on 10.0-10.2

[NicholasLAranda]

All the offsets in the current offsets.c file include THE ONLY offsets you'll ever need.

If you look at my specific changes where I list what devices they are targeting, you'll notice that for some of the offsets: they target multiple devices, since they share the same SoC processor.

Please close this.

[NicholasLAranda]

@CrypticGit exactly.

[ghost]

@RypeDub420 yet people on reddit tell me i wrong when i talk about how easy it is "reverse engeneer" and they keep saying the devices aren't supported when they are. Excluding 4k devices and iphone 7.

[NicholasLAranda]

https://twitter.com/uroboro845/status/810633491641679873

[NicholasLAranda]

People on Reddit are literally retards and are not programmers nor developers.

They do not know what they are talking about, you should ignore them and stop seeking support there.

[NicholasLAranda]

https://github.com/uroboro/mach_portal/blob/master/mach_portal/offsets.c

[masbog]

i try use rootvnode_offset = 0x5c20b8; and allproc_offset = 0x5B8528; then always got found corruption x(random number)

[ghost]

@masbog are you trying to jailbreak your air2 ?

[masbog]

@CrypticGit yes...

[ghost]

@masbog 4K devices haven't been added yet

[masbog]

@CrypticGit just wanna to know how to remount system-fs as writeable :(

[ghost]

Wym?

[masbog]

@CrypticGit using mach_portal manual extract the bootstrap.tar 😔

[ghost]

@masbog wait till Monday iPad Air 2 will probly be supported

[masbog]

always monitoring this github ☺️

[Mila432]

@RypeDub420 yet people on reddit tell me i wrong when i talk about how easy it is "reverse engeneer" and they keep saying the devices aren't supported when they are. Excluding 4k devices and iphone 7.

@CrypticGit all of your offsets are wrong .. go back to reddit

@kpwn please close

[masbog]

http://newosxbook.com/Articles/10-10.12.html

[jtv7]

@Mila432 Can you double check the offset you got for rootvnode for "Darwin Kernel Version 16.1.0: Thu Sep 29 21:56:11 PDT 2016; root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X" ? I get 0x5ae0b8

[Mila432]

@jtv7

[jtv7]

@Mila432 Yes, so I believe it is 0x5ae0b8. The output of this command should also give you that: nm kernelcache.decrypted | grep rootvnode

[jtv7]

@Mila432 It is confirmed by this disassembly:

[Mila432]

@jtv7 its not 0x5ae0b8..

its 0x5aa0b8

[jtv7]

@Mila432 I didn'get it from Hopper, I got it from the command @kpwn in #15 mentioned.

[Mila432]

@jtv7 maybe wrong kernel then

[jtv7]

@Mila432 Nope, same kernel. Unless you have a better explanation, seems like you should go back to a free tool (Terminal) or a cheaper tool (Hopper), and stay away from IDA until you know how to use it :)

[Mila432]

@jtv7 what ever floats your boat keep on living with your idea of 0x5ae0b8 is the right offset for Darwin Kernel Version 16.1.0: Thu Sep 29 21:56:11 PDT 2016; root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X

[masbog]

@jtv7 try on your terminal like @Mila432 do...

i got this address from hopper (iPad Air 2) kernel for example, find Labels "_rootvnode"

and you will get like this...

and on your terminal like this... ( _rootvnode-address - 0xfffffff007004000 )

thanks

[Mila432]

@masbog wrong kernel

[masbog]

@Mila432 so which kernel number to be?

[Mila432]

@masbog we are talking about 10.1.1.. not 10.2

[masbog]

@Mila432 ops sorry... 😅 now downloading the ipsw for 10.1.1

[jtv7]

@masbog I get what you are doing, you are subtracting the kernel base to get the offset, but it seemed like that didn't have to be done with what was mentioned in #15