Yalu102: iPad Air 2 WiFi 4K Fail Logs

[ghost]

sysname: Darwin
nodename: iPad53
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7001
machine: iPad5,3
2017-01-29 13:43:19.984491 yalu102[220:3927] found corruption 38603
2017-01-29 13:43:25.774638 yalu102[220:3927] found kernel text at fffffff021a04000
2017-01-29 13:43:25.776572 yalu102[220:3927] got tfp0 -> d07
2017-01-29 13:43:25.778007 yalu102[220:3927] found procs at fffffff00565cc18
2017-01-29 13:43:25.781407 yalu102[220:3927] seg: __TEXT
2017-01-29 13:43:25.781464 yalu102[220:3927] seg: __DATA_CONST
2017-01-29 13:43:25.781501 yalu102[220:3927] seg: __TEXT_EXEC
2017-01-29 13:43:25.781533 yalu102[220:3927] seg: __KLD
2017-01-29 13:43:25.781565 yalu102[220:3927] seg: __LAST
2017-01-29 13:43:25.781598 yalu102[220:3927] seg: __DATA
2017-01-29 13:43:25.781637 yalu102[220:3927] seg: __PRELINK_TEXT
2017-01-29 13:43:25.781683 yalu102[220:3927] seg: __PLK_TEXT_EXEC
2017-01-29 13:43:25.781713 yalu102[220:3927] seg: __PRELINK_DATA
2017-01-29 13:43:25.781742 yalu102[220:3927] seg: __PLK_DATA_CONST
2017-01-29 13:43:25.781773 yalu102[220:3927] seg: __PLK_LINKEDIT
2017-01-29 13:43:25.781805 yalu102[220:3927] seg: __PRELINK_INFO
2017-01-29 13:43:25.781852 yalu102[220:3927] seg: __LINKEDIT
2017-01-29 13:43:25.781879 yalu102[220:3927] fffffff020a70000 - fffffff0222a0000
2017-01-29 13:43:25.815749 yalu102[220:3927] ffffffff046a0000
2017-01-29 13:43:25.852261 yalu102[220:3927] fffffff021a715a0
2017-01-29 13:43:25.888519 yalu102[220:3927] pmap: fffffff021f20850
2017-01-29 13:43:25.888753 yalu102[220:3927] got phys at 0 for virt fffffff1b74fc000
2017-01-29 13:43:25.888821 yalu102[220:3927] found cpu 0
2017-01-29 13:43:25.888854 yalu102[220:3927] found physz: fffffff021a93000
2017-01-29 13:43:25.888886 yalu102[220:3927] found cpu 1
2017-01-29 13:43:25.888912 yalu102[220:3927] found physz: fffffff021a93000
2017-01-29 13:43:25.888943 yalu102[220:3927] found cpu 2
2017-01-29 13:43:25.888969 yalu102[220:3927] found physz: fffffff021a93000
2017-01-29 13:43:25.889066 yalu102[220:3927] fffffff021b93714 - fffffff021b93548
2017-01-29 13:43:25.890269 yalu102[220:3927] ttbr0: 802ac5000 fffffff021a71590
2017-01-29 13:43:25.890370 yalu102[220:3927] 0 - fffffff1b7528000

[ghost]

Always fails at same spot.

[kpwn]

interesting, 3 cpus. was not aware of that, and it likely causes issues.

[NewDwarf]

findphys_real(level0_pte) from jailbreak.m:377 return 0

(lldb) p/x physp
(uint64_t) $0 = 0x0000000000000000

[kpwn]

yes, it's because it has different pagetables than 6.

this was much easier in iOS 9! will be fixed

[ghost]

Thanks :)

[GodzExploit]

Now that you add 4k support does it support 5s?

[NewDwarf]

@kpwn Do you mean the order of entries of the table 0 ?

[ghost]

literally fuck off @adi2k17

[NewDwarf]

@kpwn Maybe it has sense to dump out the content of table 0 and compare with dump from iPhone6 to find out what is wrong?

[kpwn]

yeah, that's how i debugged it for the 6: looking at a table dump

[NewDwarf]

@kpwn Could you hint what base address and size of the dump would be interesting for us, please?

[kpwn]

level1_table, 0x1000/8 elements, parse_block_tte each non0 element

[NewDwarf]

@kpwn Thanks. Give me few time to append dump out procedure.

[ghost]

If you need me to run more logs or change anything just ask.

[akelly5]

is there gonna be an ipa for this jb?

[ghost]

Already is one. 4K IPA will probably be released when it is deemed safe enough for the average user. Please don't post unrelated questions here.

[hcl2k]

your community work gives me the urge to interest me in code, I hesitate to mount a virtual machine to compile your code because if I am not so silly it is the only way to test your support for the 4K right?

[hcl2k]

or maybe there are a xcode version for windows :D jokee

[NewDwarf]

@all Are there any way to attach the dump here? The dump is long and I cannot put more than 65536 characters in the write console

[NewDwarf]

@nicogibbons
You can put the code after the jailbreak.m:264 and run it as well
uint64_t vLevel1_table = 0;
NSLog(@"Start of Level1_table:");
for(unsigned int i = 0; i < 0x1000; i++)
{
vLevel1_table = ReadAnywhere64(level1_table + i * sizeof(uint64_t));
NSLog(@"Address %llx: %llx", level1_table + i * sizeof(uint64_t), vLevel1_table);
}

NSLog(@"End of Level1_table:");

[1337jay]

@NewDwarf paste it on http://pastebin.com and then post the link here.

[kpwn]

Don't NSLog. call parse_block_tte with vLevel1_table as argument, but only if it's != 0

[ghost]

So what exactly do I put? @kpwn

[NewDwarf]

uint64_t vLevel1_table = 0;
NSLog(@"Start of Level1_table");
for(unsigned int i = 0; i < 0x1000; i++)
{
    vLevel1_table = ReadAnywhere64(level1_table + i * sizeof(uint64_t));
    if(vLevel1_table)
    {
        parse_block_tte(vLevel1_table);
    }
}

NSLog(@"End of Level1_table");

[ghost]

Cheers, what line?

[NewDwarf]

@nicogibbons put it after jailbreak.m:264

[ghost]

I'm sorry how do I get there x.x

[NewDwarf]

I afraid I am not clear with your question. Put it in the jailbreak.m after the line number 264

[ghost]

Never mind found it

[chaustark]

@NewDwarf what is the purpose of those code

[NewDwarf]

To dump out the content of the level 1 table and compare it with same content of the iphone 6

[chaustark]

@NewDwarf hmm , after put that code my device restart immidately and no out put in console

[NewDwarf]

The expected output is

2017-01-29 06:47:46.492496 yalu102[232:5887] Start of Level1_table
2017-01-29 06:47:51.052379 yalu102[232:5887] TTE physaddr: 0000000802ac6000
2017-01-29 06:47:51.052528 yalu102[232:5887] TTE table: 1
2017-01-29 06:47:51.052609 yalu102[232:5887] TTE valid: 1
2017-01-29 06:47:51.052686 yalu102[232:5887] TTE userland eXecute Never: 0
2017-01-29 06:47:51.052761 yalu102[232:5887] TTE privileged eXecute Never: 0
2017-01-29 06:47:51.052836 yalu102[232:5887] TTE contiguous: 0
2017-01-29 06:47:51.052910 yalu102[232:5887] TTE not global: 0
2017-01-29 06:47:51.052983 yalu102[232:5887] TTE access flag: 0
2017-01-29 06:47:51.053057 yalu102[232:5887] TTE shareable: 0
2017-01-29 06:47:51.053171 yalu102[232:5887] TTE access permissions: Read/Write
2017-01-29 06:47:51.053312 yalu102[232:5887] TTE access permissions: EL0 (Userland) cannot access this page

[NewDwarf]

for single iteration when vLevel1_table is not zero

[kpwn]

that really looks like level1_table is wrong

[NewDwarf]

@kpwn that output was only for the first iteration. I didn't put another output.

[ghost]

do I need to run code anymore? @NewDwarf

[NewDwarf]

@nicogibbons Yes you can run it and attach the full log to somewhere.

[kpwn]

i am closing this to avoid spam, you should be able to continue commenting without issues

[ghost]

LOGS.txt
@kpwn @NewDwarf iPad Air 2 WiFi (iPad5,3)

[NewDwarf]

Thanks. Here is my output for comparing.
table1_iPadAir2WiFi_Cellular.txt

[ghost]

Hopefully they can help :) @kpwn