Yalu102: iPhone 5S & iPad Air 2 fail !!!

[EGYbkgo9449]

Hey,
It fails on the 5S & Air 2 and reboots automatically !!!
Here is the Xcode log:

sysname: Darwin nodename: Omars-iPad release: 16.3.0 version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7001 machine: iPad5,3 2017-01-29 07:27:50.528777 yalu102[236:4395] found corruption 38903 2017-01-29 07:27:52.679048 yalu102[236:4395] found kernel text at fffffff010604000 2017-01-29 07:27:52.681139 yalu102[236:4395] got tfp0 -> 38a03 2017-01-29 07:27:52.681993 yalu102[236:4395] found procs at fffffff1152b0000 2017-01-29 07:27:52.685751 yalu102[236:4395] seg: __TEXT 2017-01-29 07:27:52.685821 yalu102[236:4395] seg: __DATA_CONST 2017-01-29 07:27:52.685859 yalu102[236:4395] seg: __TEXT_EXEC 2017-01-29 07:27:52.685890 yalu102[236:4395] seg: __KLD 2017-01-29 07:27:52.685920 yalu102[236:4395] seg: __LAST 2017-01-29 07:27:52.685950 yalu102[236:4395] seg: __DATA 2017-01-29 07:27:52.685981 yalu102[236:4395] seg: __PRELINK_TEXT 2017-01-29 07:27:52.686012 yalu102[236:4395] seg: __PLK_TEXT_EXEC 2017-01-29 07:27:52.686041 yalu102[236:4395] seg: __PRELINK_DATA 2017-01-29 07:27:52.686071 yalu102[236:4395] seg: __PLK_DATA_CONST 2017-01-29 07:27:52.686101 yalu102[236:4395] seg: __PLK_LINKEDIT 2017-01-29 07:27:52.686131 yalu102[236:4395] seg: __PRELINK_INFO 2017-01-29 07:27:52.686161 yalu102[236:4395] seg: __LINKEDIT 2017-01-29 07:27:52.686195 yalu102[236:4395] fffffff00f670000 - fffffff010ea0000 2017-01-29 07:27:52.721414 yalu102[236:4395] ffffffff0498c000 2017-01-29 07:27:52.757520 yalu102[236:4395] fffffff0106715a0 2017-01-29 07:27:52.794098 yalu102[236:4395] pmap: fffffff010b20850 2017-01-29 07:27:52.794325 yalu102[236:4395] got phys at 0 for virt fffffff1b7610000 2017-01-29 07:27:52.794388 yalu102[236:4395] found cpu 0 2017-01-29 07:27:52.794423 yalu102[236:4395] found physz: fffffff010693000 2017-01-29 07:27:52.794455 yalu102[236:4395] found cpu 1 2017-01-29 07:27:52.794481 yalu102[236:4395] found physz: fffffff010693000 2017-01-29 07:27:52.794574 yalu102[236:4395] found cpu 2 2017-01-29 07:27:52.794642 yalu102[236:4395] found physz: fffffff010693000 2017-01-29 07:27:52.794710 yalu102[236:4395] fffffff010793714 - fffffff010793548 2017-01-29 07:27:52.795928 yalu102[236:4395] ttbr0: 802ac5000 fffffff010671590 2017-01-29 07:27:52.796043 yalu102[236:4395] 0 - fffffff1b7800000

[ghost]

We know child.

[ghost]

Hush.

[ghost]

@nicogibbons stfu xd

[ghost]

We know this happens. Please close.

[itsCozmikk]

@nicogibbons Maybe wait for @kpwn to weigh in on this?

[EGYbkgo9449]

@nicogibbons
WE KNOW IT HAPPENS BUT I OPENED IT FOR @kpwn TO FIX IT

[creddy45]

Unable to Jailbreak Ipad Air 2 IOKitLib.h error

[justinoboyle]

@creddy45 Make a new issue.

...fyi, you need to add the IOKit headers.

[tangalbert919]

You'll have to find those headers yourself because of copyright. We respect Apple's ability to use DMCA takedowns when needed, just like Nintendo when they took down GBA4iOS and NDS4iOS for copyright.
A developer already made pull requests for this. Please close this issue.

[aididhaiqal]

162

[kpwn]

should be fixed in last commit

[kpwn]

(i need feedback on this, I am doing it blindly since I do not have a 5s)

[meyer9]

@kpwn, is this supposed to fix bugs in iP6 as well?

[kpwn]

yes

[chashmeetsingh]

@kpwn thanks, works after the latest commit. Thanks a tonne!

[kpwn]

Would like another few confirmations before closing this issue.

[meyer9]

@kpwn, I know you don't have a ton of time, but I was wondering if the best way I should learn about kernel level exploits? Books, conferences, or disassembling the kernel and looking at it myself?

[kpwn]

162

[Mila432]

@kpwn ipar air 2 still hanging on got a cpacr

[kpwn]

iPad Air 2 has a weird CPU. Until I get my hands on one, I will not be able to support it.

[ghost]

Can confirm iPad Air 2 ips 10.2 does indeed fail if you need the logs let me know

[chashmeetsingh]

@cawk always paste logs so that they can be investigated 😄

[timonline]

@kpwn trying now on iPhone5S, crossing fingers

[timonline]

@kpwn, you're the MAN. Works perfectly now. Installing tweaks

[ghost]

sysname: Darwin
nodename: iPad
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_T7001
machine: iPad5,3
2017-01-29 16:06:59.802635 yalu102[213:3876] found corruption 38903
2017-01-29 16:07:05.291269 yalu102[213:3876] found kernel text at fffffff020a04000
2017-01-29 16:07:05.293210 yalu102[213:3876] got tfp0 -> 1207
2017-01-29 16:07:05.293524 yalu102[213:3876] found procs at fffffff005a15cb8
2017-01-29 16:07:05.296801 yalu102[213:3876] seg: __TEXT
2017-01-29 16:07:05.296850 yalu102[213:3876] seg: __DATA_CONST
2017-01-29 16:07:05.296886 yalu102[213:3876] seg: __TEXT_EXEC
2017-01-29 16:07:05.296920 yalu102[213:3876] seg: __KLD
2017-01-29 16:07:05.296954 yalu102[213:3876] seg: __LAST
2017-01-29 16:07:05.296986 yalu102[213:3876] seg: __DATA
2017-01-29 16:07:05.297023 yalu102[213:3876] seg: __PRELINK_TEXT
2017-01-29 16:07:05.297069 yalu102[213:3876] seg: __PLK_TEXT_EXEC
2017-01-29 16:07:05.297100 yalu102[213:3876] seg: __PRELINK_DATA
2017-01-29 16:07:05.297130 yalu102[213:3876] seg: __PLK_DATA_CONST
2017-01-29 16:07:05.297161 yalu102[213:3876] seg: __PLK_LINKEDIT
2017-01-29 16:07:05.297206 yalu102[213:3876] seg: __PRELINK_INFO
2017-01-29 16:07:05.297236 yalu102[213:3876] seg: __LINKEDIT
2017-01-29 16:07:05.297262 yalu102[213:3876] fffffff01fa70000 - fffffff0212a0000
2017-01-29 16:07:05.331275 yalu102[213:3876] ffffffff04994000
2017-01-29 16:07:05.368318 yalu102[213:3876] fffffff020a715a0
2017-01-29 16:07:05.404401 yalu102[213:3876] pmap: fffffff020f20850
2017-01-29 16:07:05.404651 yalu102[213:3876] got phys at 0 for virt fffffff1b7720000
2017-01-29 16:07:05.404721 yalu102[213:3876] found cpu 0
2017-01-29 16:07:05.404748 yalu102[213:3876] found physz: fffffff020a93000
2017-01-29 16:07:05.404781 yalu102[213:3876] found cpu 1
2017-01-29 16:07:05.404807 yalu102[213:3876] found physz: fffffff020a93000
2017-01-29 16:07:05.404839 yalu102[213:3876] found cpu 2
2017-01-29 16:07:05.404864 yalu102[213:3876] found physz: fffffff020a93000
2017-01-29 16:07:05.404911 yalu102[213:3876] fffffff020b93714 - fffffff020b93548
2017-01-29 16:07:05.406105 yalu102[213:3876] ttbr0: 802ac5000 fffffff020a71590
2017-01-29 16:07:05.406529 yalu102[213:3876] got a cpacr

this is my log if it helps at all

[kpwn]

I have seen this log a million times. The issue is that 3 CPUs are present on the iPad Air, and I only tested this on 2. I don't need more logs.

[timonline]

@kpwn, i have an iPad Air. Want logs?

[meyer9]

I don't need more logs.

[nullpixel]

@kpwn I didn't think there was any CPU dependant code, is it due to different mem sizes? I haven't checked if the air 2 is 4K, is it different?

[chashmeetsingh]

I see that ota update is still available, I guess that service needs to be disabled ?

[kpwn]

service is disabled, but i don't remove what is already there

[meyer9]

The pmap(s?) are stored in CPU caches. It has everything to do with the CPU @nullpixel1

[kpwn]

The pmaps are stored in CPU caches. It has everything to do with the CPU @nullpixel1

.. what

[nullpixel]

@meyer9 lolwat

[meyer9]

I'm sorry. Aren't the page maps stored in CPU cache so they can map addresses quickly?

[genrichh93]

@kpwn, you're the MAN. Works perfectly now. Installing tweaks.

Can you run any stock apps like appstore, safari, whatsapp?
I was running a unstable version and cydia and other jailbroken apps were running fine but I couldnt open stock apps, they instantly crashed.

[genrichh93]

I'm on iP5s 10.1.1

[oliverkulpakko]

Not working on 5s. Newest commit.

sysname: Darwin
nodename: iPhone-5s
release: 16.3.0
version: Darwin Kernel Version 16.3.0: Tue Nov 29 21:40:09 PST 2016; root:xnu-3789.32.1~4/RELEASE_ARM64_S5L8960X
machine: iPhone6,2
2017-01-29 18:13:48.454565 yalu102[221:4372] found corruption 37c03
2017-01-29 18:13:53.869781 yalu102[221:4372] found kernel text at fffffff019e04000
2017-01-29 18:13:53.872546 yalu102[221:4372] got tfp0 -> 1407
2017-01-29 18:13:53.873115 yalu102[221:4372] found procs at fffffff002cfac38
2017-01-29 18:13:53.878322 yalu102[221:4372] seg: __TEXT
2017-01-29 18:13:53.878405 yalu102[221:4372] seg: __DATA_CONST
2017-01-29 18:13:53.878516 yalu102[221:4372] seg: __TEXT_EXEC
2017-01-29 18:13:53.878730 yalu102[221:4372] seg: __KLD
2017-01-29 18:13:53.878887 yalu102[221:4372] seg: __LAST
2017-01-29 18:13:53.878989 yalu102[221:4372] seg: __DATA
2017-01-29 18:13:53.879165 yalu102[221:4372] seg: __PRELINK_TEXT
2017-01-29 18:13:53.879292 yalu102[221:4372] seg: __PLK_TEXT_EXEC
2017-01-29 18:13:53.879333 yalu102[221:4372] seg: __PRELINK_DATA
2017-01-29 18:13:53.879422 yalu102[221:4372] seg: __PLK_DATA_CONST
2017-01-29 18:13:53.879517 yalu102[221:4372] seg: __PLK_LINKEDIT
2017-01-29 18:13:53.879630 yalu102[221:4372] seg: __PRELINK_INFO
2017-01-29 18:13:53.879726 yalu102[221:4372] seg: __LINKEDIT
2017-01-29 18:13:53.879788 yalu102[221:4372] fffffff018fbc000 - fffffff01a698000
2017-01-29 18:13:53.946446 yalu102[221:4372] ffffffff03d88000
2017-01-29 18:13:53.996975 yalu102[221:4372] fffffff019e655a0
2017-01-29 18:13:54.036916 yalu102[221:4372] pmap: fffffff01a314850
2017-01-29 18:13:54.037229 yalu102[221:4372] got phys at 80bc25000 for virt fffffff000823000
2017-01-29 18:13:54.037383 yalu102[221:4372] found cpu 0
2017-01-29 18:13:54.037516 yalu102[221:4372] found physz: fffffff019e87000
2017-01-29 18:13:54.037576 yalu102[221:4372] found cpu 1
2017-01-29 18:13:54.037610 yalu102[221:4372] found physz: fffffff019e87000
2017-01-29 18:13:54.037667 yalu102[221:4372] fffffff019f8733c - fffffff019f8719c
2017-01-29 18:13:54.039630 yalu102[221:4372] ttbr0: 8024c5000 fffffff019e65590
2017-01-29 18:13:54.040252 yalu102[221:4372] got a cpacr
2017-01-29 18:13:54.040565 yalu102[221:4372] level fffffff03bca7000 - 82eead000
2017-01-29 18:13:54.040711 yalu102[221:4372] level fffffff0476ad678 - 82182e000
2017-01-29 18:13:54.041007 yalu102[221:4372] level fffffff03a02e420 - 830baf000
2017-01-29 18:13:54.041236 yalu102[221:4372] level fffffff03bca7000 - 837f8d000
2017-01-29 18:13:54.041411 yalu102[221:4372] level fffffff05078d678 - 82b4b0000
2017-01-29 18:13:54.041583 yalu102[221:4372] level fffffff043cb0020 - 8382b1000
2017-01-29 18:13:54.176808 yalu102[221:4372] level fffffff03bca7000 - 8149f7000
2017-01-29 18:13:54.176999 yalu102[221:4372] level fffffff02d1f7670 - 8132f9000
2017-01-29 18:13:54.177127 yalu102[221:4372] level fffffff02baf99c0 - 83d433000
2017-01-29 18:13:54.232554 yalu102[221:4372] level fffffff03bca7000 - 815325000
2017-01-29 18:13:54.232716 yalu102[221:4372] level fffffff02db25678 - 811126000
2017-01-29 18:13:54.232816 yalu102[221:4372] level fffffff0299260f8 - 8115a7000
2017-01-29 18:13:54.243211 yalu102[221:4372] level fffffff03bca7000 - 80d851000
2017-01-29 18:13:54.243389 yalu102[221:4372] level fffffff026051670 - 831ad2000
2017-01-29 18:13:54.243580 yalu102[221:4372] level fffffff04a2d2478 - 80b353000
2017-01-29 18:13:54.258534 yalu102[221:4372] fref at fffffff019f84fd0
2017-01-29 18:13:54.273742 yalu102[221:4372] amfistr at fffffff019c90510
2017-01-29 18:13:54.274024 yalu102[221:4372] level fffffff03bca7000 - 81f14f000
2017-01-29 18:13:54.274288 yalu102[221:4372] level fffffff03794f670 - 822054000
2017-01-29 18:13:54.274468 yalu102[221:4372] level fffffff03a854480 - 819750000
2017-01-29 18:13:54.295263 yalu102[221:4372] level fffffff03bca7000 - 8373d5000

[nullpixel]

@meyer9 I don't believe they are

[kpwn]

Any data recently accessed is in a CPU cache, irrespective of what it is.

[timonline]

@genrichh93 tried messenger, twitter, and Appstore. All working fine

[nullpixel]

Yeah, pmaps aren't permanent stored in cache

[meyer9]

Oh ok. I was just inferring from the code since you use level1_table and things - making me think of CPU caches. carry on

[genrichh93]

@timonline is there any chance you can share the ipa with me? Really would like to test it out

[nullpixel]

I mean I can try and look into why it's not working, but it works on a quad core 7, so there can't be much broken

[timonline]

@genrichh93, you should never ask for an ipa unless it's from someone official like @kpwn but i can consult you if you have xcode building problems

[meyer9]

working great on iP6. No crashes at all

[timonline]

@meyer9 sadly i don't have an IP6 and my friend who does doesn't want to risk on an alpha/beta

[LordYusei]

@kpwn I have a spare 5S I can use for testing if you want the help?

[Slonick]

Last commit to working 5S

[timonline]

@genrichh93, no one is truly trustworthy on the internet. However I will see what I can do

[KILLCAMPER]

Am not getting any where fast with iPad Air 2 cellular any one

[0x0luke]

@KILLCAMPER Q said he can't make it work on that device till he gets one (:

[KILLCAMPER]

@0x0luke I am asking in general my little pickle ;)