Yalu102: Consistent Crashing on iPhone 6 (Does not produce logs)

[cjnott1999]

Upon jailbreak of 4k device (iPhone 7,2) consistent, and to my current knowledge, seemingly random crashing of what appears to be coreduetd along with several unknown crash logs. Attached is the crash log for coreduetd.

https://ghostbin.com/paste/g9uhx

[AppleBetas]

Do you happen to have an Apple Watch connected?

On Jan 29, 2017, at 9:47 AM, Cameron [e-mail] wrote:

Upon jailbreak of 4k device (iPhone 7,2) consistent, and to my current knowledge, seemingly random crashing of what appears to be coreduetd along with several unknown crash logs. Attached is the crash log for coreduetd.

https://ghostbin.com/paste/g9uhx
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub https://github.com/kpwn/yalu102/issues/206, or mute the thread https://github.com/notifications/unsubscribe-auth/ATUYz4h62Br7Oow2rUYA_SezVB8gRHJsks5rXKaIgaJpZM4Lwzu0.

[cjnott1999]

@AppleBetas Yes, yes I do. Are there known issues with apple watch compatibility? I saw something similar in another issue, but didn't seem to be exactly what I was experiencing.

[6e757275706f]

Yes there are many issues with the apple watch. Crashing apps. Blank icons, Delayed notifications, and now this

[AppleBetas]

There are a few known issues, but those don’t appear to be as severe as this one. I also have an Apple Watch and iPhone 6, with coreduetd crashing. Since coreduetd does do a few things regarding Apple Watch, it could be partly because of it.

On Jan 29, 2017, at 9:51 AM, Cameron [e-mail] wrote:

@AppleBetas https://github.com/AppleBetas Yes, yes I do. Are there known issues with apple watch compatibility? I saw something similar in another issue, but didn't seem to be exactly what I was experiencing.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub https://github.com/kpwn/yalu102/issues/206#issuecomment-275918482, or mute the thread https://github.com/notifications/unsubscribe-auth/ATUYz-_talRs7OE_KUQCIzRHTCI9nMiQks5rXKdUgaJpZM4Lwzu0.

[cjnott1999]

I am attempting to replicate the issue and collect more logs now

[karboN90]

Not just with Apple Watch.
I don't have a Apple Watch. And the problem still exists.
Everything works fine but there is sudden crash and reboot of the iPhone

[cjnott1999]

I appears the crashes i am experiencing don't produce logs at all. Unknown crashes. all around

[tamer3030]

same here Iphone 6+ random restarts specially when I connect my Bluetooth headset

[silerh7]

Yalu crashes when I open safari or messages for a little while, it's somewhat stable everywhere else

[msamuel002]

i wonder if he fixed any crashes on the iPhone 6 in the newest commit (10 minutes ago). He didnt say anything about it but

[tamer3030]

I will compile the current commit and check

[kpwn]

Please test last commit. Closing this for now, reopen if issue persists.

[liudayu]

Issue persists. After I press GO in the app, most of the time device produces a "coreduetd" log then reboots, few times it resprings and back in jailbroken mode.

[nullpixel]

@applebetas is also having it still happen

[kpwn]

oh i'm tripping. i thought this was my iPhone 6 is not stable issue. sorry, reopening. haven't looked into this

[nullpixel]

Also, it looks like a permission issue, and I think it's linked to the watch issuee

[liudayu]

This is the coreduetd log file.
Log.txt

[nullpixel]

Ooo that looks like a permission issue even more now

[nullpixel]

coreduetd handles stuff like watch connectivity and handoff for the record

[kpwn]

Is this only happening while in jailbroken mode?

[nullpixel]

Yep

[liudayu]

No, when you reactivating your jailbreak by pressing GO, sometimes it fails and then reboot, this is the only log it produces.

[nullpixel]

I tried to start it manually, and it crashes almost instantly

[cjnott1999]

It appears from timing that coreduetd actually crashes before the phone itself reboots. Then it produces an unknown log.

[AppleBetas]

I also was just able to trigger a crash by switching to Safari on my Mac (therefore activating Handoff).

[not99]

After the latest commit I have expierenced 0 crashes or bugs. I'll try and stress test it to see if it crashes.

[liudayu]

It still crashes for me, just got a panic log and reset counter log after the latest commit

panic-2017-01-30-024234.txt

[kpwn]

Ew, a SError with version set to MarijuanARM64. Are you sure you got the last commit?

[kpwn]

Anyway, that's a KPP failure. Had it happen due to inconsistent branch prediction. At least not a unknown memory access fault!

[liudayu]

Yes I did git-pull before I opened my Xcode. I will delete everything again and do a fresh clone, then see how it goes.

[karboN90]

@bobbysnow
You sure the latest commit experiences no crash at all ?

[cjnott1999]

Major kernel panic on clicking "go" with latest commit. In Xcode console the jailbreak doesn't reach completion. no logs generated.

[kpwn]

This is not 100% reliable, and expected. You should have a 50/50 chance of the exploit working.

[cjnott1999]

@kpwn Ah, still getting consistent crashing, again, no logs. Crashing happened quicker than last time upon reboot into a jailbroken state

[andrewwiik]

@kpwn rebooted, almost got to pressing the mail app before it crashed, iP6 10.2
Edit crashing is happening about 5 seconds after reboot into Jailbroken mode. I do not have a apple watch paired to the best of my knowledge.

[malhal]

After todays commits I successfully jailbroke my iPod Touch 6th Gen (log output), thanks can now get on with updating my tweaks. SSH working.

[callum-99]

Also getting a random panic with the same panic log as @liudayu (iPhone 7,2 10.2). But other than that its very stable

[justinoboyle]

Latest commit randomly panics as well (AFTER jailbreaking. Like, swiping pages on home screen, open an app and it will randomly go black and reboot). i6.

Also, Cydia just crashes, but SSH works.

[msamuel002]

Yea at least luca knows what the issue is. Hope its an easy fix

[chashmeetsingh]

works on iPhone 6

[msamuel002]

@chashmeetsingh no crashing at all? how lol

[chashmeetsingh]

did once -> rejailbreak -> works fine now

[msamuel002]

hmm, i havent tried it out since they said its still not fixed. let me try

[raj0x29]

rejailbreak won't work/// rebooted 4 times and try it still does not work

[justinoboyle]

@chashmeetsingh Try doing a few things on your device, it will probably crash in a few seconds.

[chashmeetsingh]

hmm right did

[msamuel002]

ohh

[andrewwiik]

I think it is important to reboot inbetween a failed patching that causes crashes, is this correct? @kpwn

[msamuel002]

lol so basically luca just fixed the 5S and accidentally left the 6 undone? (which is fine idc)

[kpwn]

I am unable to repro this over multiple rejailbreaks.

[msamuel002]

what does that mean lol @kpwn

[msamuel002]

ohhh lol reproduce

[kpwn]

that this is not happening on my 6.

[msamuel002]

oh so this means it wont be easy to fix since its not happening? that sucks

[msamuel002]

Kim Jong Un has given your iPhone blessings

[chashmeetsingh]

it jailbroke successfully but after using it for like 5-10 mins crashed automatically @kpwn

[andrewwiik]

@kpwn I believe it may be because of people not rebooting inbetween random crashes, which is making the crashes worse everytime, I could be wrong though

[justinoboyle]

@kpwn Interesting. Do you have an Apple Watch paired (I do and am experiencing this). Latest commit.

I can't seem to find any error logs for some strange reason, but in a few seconds the phone will sporadicly crash. I went a few hours strong a few minutes ago, but now it just crashes ~30sec after the jailbreak.

[liudayu]

Yes, on high CPU usage (eg open snapchat, then twitter, facebook etc) will result a reboot

[msamuel002]

i agree with @liudayu

[kpwn]

I have ran a benchmark for an hour now.

[msamuel002]

and then what happened?

[georgemcnish]

yeah, whenever I bring up multitasking it seems to crash or when I open an app it crashes, could it have something to do with corrupted memory?

[kpwn]

I wonder if I am by accident writing into KPP-checked memory.

[msamuel002]

@georgemcnish yea i think its memory overflow?

[andrewwiik]

@kpwn but don't you bypass KPP all together in the end?

[georgemcnish]

hmm

[liudayu]

Maybe try multiple apps, it will result either panic log or coreduetd & resetCounter logs

[msamuel002]

@liudayu would it come on the activate console on xcode?

[msamuel002]

or on diagnostics and usage? all i had to do to get it to crash is by opening cydia right after running the yalu102 app

[liudayu]

Those logs are in diagnostics and usage

[nullpixel]

coreduetd handles handoff

Do you have handoff on @kpwn

[cjnott1999]

@kpwn I may have a different method of reproducing issue and getting logs. I will try and get back. I feel it's a unique issue. Seemingly random.

[kpwn]

I do not, but I believe coreduetd issue is unrelated to KPP failures.

[kpwn]

For the record: I am running a forkbomb as well as several threads stuck in a tight syscall loop. This is the best benchmark for debugging KPP issues, and no crashes.

[andrewwiik]

I had it on, I just turned it off, I'll report back if it is more stable now with handoff disabled

[nullpixel]

Try reproing it with handoff

[msamuel002]

handoff as in the feature where you can type on one device then transfer it to another? lol im dumb

[kpwn]

This is all on 10.2, right?

[msamuel002]

yep

[nullpixel]

Indeed

[justinoboyle]

Yes.

[liudayu]

Yes, iOS 10.2

[andrewwiik]

Yep, Also a silent prayer goes out to your email, it probably got burned with all these issues, and comments like mine did because i chose to "watch" this repository lol

[tamer3030]

yes

[tomlube]

Yeah still crashing for me on iOS 10.2 iPhone 6. I do also have an Apple Watch as well...

[nullpixel]

@andrewwiik

yep rip me too

[msamuel002]

i got a log in diagnostics and usage called "com.apple.WebKit.WebContent.cpu_resource-2017-01-29-105305.ips"....does this have to do with the jb

[nullpixel]

Paste the whole thing to http://pastebin.com, looks like high cpu usage?

[kpwn]

    WriteAnywhere32(kppsh+n, 0x580001e1); n+=4; // ldr  x1, #60
    WriteAnywhere32(kppsh+n, 0x58000140); n+=4; // ldr  x0, #40
    WriteAnywhere32(kppsh+n, 0xd5182020); n+=4; // msr  TTBR1_EL1, x0
    WriteAnywhere32(kppsh+n, 0xd2a00600); n+=4; // movz x0, #0x30, lsl #16
    WriteAnywhere32(kppsh+n, 0xd5181040); n+=4; // msr  CPACR_EL1, x0
    WriteAnywhere32(kppsh+n, 0xd5182021); n+=4; // msr  TTBR1_EL1, x1
    WriteAnywhere32(kppsh+n, 0x10ffffe0); n+=4; // adr  x0, #-4
    WriteAnywhere32(kppsh+n, isvad ? 0xd5033b9f : 0xd503201f); n+=4; // nop
    WriteAnywhere32(kppsh+n, isvad ? 0xd508871f : 0xd508873e); n+=4; // tlbi vmalle1 (4k) / tlbi    vae1, x30 (16k)
    WriteAnywhere32(kppsh+n, 0xd5033fdf); n+=4; // isb
    WriteAnywhere32(kppsh+n, 0xd65f03c0); n+=4; // ret
    WriteAnywhere64(kppsh+n, ReadAnywhere64(ttbr0_real)); n+=8;
    WriteAnywhere64(kppsh+n, physp); n+=8;
    WriteAnywhere64(kppsh+n, physp); n+=8;

[kpwn]

Try using this as kpp shellcode.

[andrewwiik]

okay

[raj0x29]

@kpwn yes on 10.2

[cjnott1999]

ok. safari is a major issue i get consistent crashing with. finally got a log. @kpwn
log.txt

[andrewwiik]

is this for coreduet or the other crashes btw? @kpwn

[msamuel002]

http://pastebin.com/Es74WqRy i think its safari crashing due to high cpu usage

[kpwn]

I believe the reason behind these issues is related to cache management, and Safari may trigger that due to JIT and stuff. But I dunno. Need to test.

[msamuel002]

and i also got 8 "panic-2017-01-29-xxxxxx.ips" logs but they are like SOOOO LONG...also got quite a few "resetcounter-2017-01-29-xxxxxx.ips" logs

[nullpixel]

Holy fuck

[nullpixel]

That's some high cpu usage

[msamuel002]

ikr funny thing is that i havent even opened safari in like months @nullpixel1

[andrewwiik]

just ran, okay now what should I do? what should I open?

[nullpixel]

Did the shellcode work?

[justinoboyle]

@andrewwiik try safari and opening a bunch of apps to get high CPU usage

[nullpixel]

Try opening a page from handoff in safari on mac

[chashmeetsingh]

try updating cydia https://t.co/JhthOpc3dG

[georgemcnish]

Could it be WebKit treating the code as corrupted as safari could be running in the background? as stated in one of the bug reports

[andrewwiik]

@kpwn just opened a ton of shit, handoff pages in safari, a few social media apps, and everything seems to be good so far

[msamuel002]

yup @kpwn one of my panic logs says "SError". the pastebin for the shortest of those panic logs is here: http://pastebin.com/UMTjgd4k

[msamuel002]

dang that sounds good @andrewwiik

[nullpixel]

Okay, I just borrowed someones 6 again, and that works fine! It never worked before

[andrewwiik]

@kpwn youtube is a good one, phone is getting hot so I know the CPU is getting donald trumps small fist up it's ass.

[andrei085]

My 6 is also crashing for the same reason, especialy when opening fb or big safari pages with a lot of images.

[cjnott1999]

@kpwn new app shell code seems to work so far.... will continue to brute test in jailbroken state

[justinoboyle]

Experiencing similar results to @andrewwiik . Try Cydia? It just crashes for me, but SSH works fine

[Jailbreakers]

Last commit 11 minutes ago. Please someone compile it and test it

[kpwn]

Note that this fix is not 'proper': it will have a perf impact due to more cache flushing. It shouldn't be too bad as long as your code doesn't spin on a syscall.

[kpwn]

The issue here is that this is subtle behaviour inherent to the CPU design, that may vary across different cores, and is entirely undocumented.

[kpwn]

The proper 'documented' way is guaranteed to work: but it's also guaranteed to be slow.

[nullpixel]

Want me to PR? Or you got this?

Also, will it be helpful if I go through and review all the PRs? There's some good ones

[msamuel002]

what will happen if it spins on a syscall? boot loop?

[justinoboyle]

@Jailbreakers What do you think literally everyone here is doing?

@msamuel002 just crash
EDIT: I lied ;)

[kpwn]

No: it will continuously call into KPP and will flush caches + entirety of tlb every time. Which is a performance hit.

[cjnott1999]

@kpwn lol. I have not had a crash since re-implementing the kpp shell. so the improper fix works for now.

[kpwn]

Note that this is intrinsic to my KPP bypass: a small slowdown is to be expected (note that this is a fixed amount of slowdown for each syscall: raw performance is still identical as long as no user->kernel transitions happen. when they do happen, kernel performance is identical up to the point where it has to return back to userland (and kpp runs), which with this fix includes a full cache and tlb flush, which is something that takes a bit of time).

This is also true for 16K devices, however I am able to not flush anything but 1 TLB entry without making the device unstable, which is way faster (almost within margin of error).

[kpwn]

I believe that this sort of performance hit can only be felt with targeted microbenchmarks. I can't think of a reason for someone to tightly loop into a syscall.

[cjnott1999]

@kpwn see what you're saying. this was never guaranteed to be stable, its a tradeoff between performance (maybe?) over an occasional crash.

[kpwn]

Anyway, another few ACKs and I will commit the new shellcode and close this.

[nullpixel]

@kpwn Am I good to add the 6 to supported devices table in #141?

[Dason-g]

@kpwn I can not install the tweaks. help me please

[beanjo55]

@Dason-g #64

[cjnott1999]

Issue to be fixed.

[kpwn]

Even if this is closed, I'd still like some more ACKs that it is indeed fixed, given this is subtle behaviour.

[nullpixel]

Yeah. Can anyone confirm it works on the rest of the 4K devices? I'm about to update #141's table.

Or @kpwn, because #141 is so huge, should I make a new PR for readmes?

[andrewwiik]

No crash after running a shitty VR App I made, which leaves the CPU at 100%, consider it fixed for me

[KILLCAMPER]

Any iPad Air 2 cellular reports as I am getting no where fast

[kpwn]

iPad Air 2 is not supported yet.

[andrewwiik]

@kpwn is the iPad Air 2 the only device with 3 cores? I would of thought the iPad Pro would have a higher core count

[nullpixel]

son:tm:

[liudayu]

@andrewwiik with handoff on or off?

[georgemcnish]

Running well for me, no crashes in where it used to crash

[nullpixel]

on my gf's 6, I couldn't repro with handoff on or off with the new shellcode

[andrewwiik]

@liudayu hand off is on, I opened a few web pages with handoff as suggested too

[liudayu]

@andrewwiik Do you still experience sometimes you need to click on icon twice to open an app?

[msamuel002]

@kpwn have you fixed this in the latest commit yet? please let me know when you have :)

[msamuel002]

is it the "cacheshit"??? lmao

[andrewwiik]

@liudayu nope, first click it works

[andrewwiik]

nope, icons are fine

[karboN90]

Since the lastest commit seem to solve the crash problem in i6 partly,
Can someone compile the IPA and give us a download link to it ?
Please
Thank you

[nullpixel]

It's now on Yalus beta site

[andrewwiik]

@kpwn still no crashes, started using FLEXLoader which enumerates through the entire heap's of apps for live debugging so I think it is safe to say we are good

[karboN90]

No it's not ?

[karboN90]

There is no official IPA on the Yalu webpage 🤗
Can someone share the link of their own compiled IPA ?
@andrewwiik ?

[Mila432]

@karboN90 delete your internet mate

[georgemcnish]

https://yalu.qwertyoruiop.com/yalu102_beta.ipa

[karboN90]

Just refreshed
Got it
Thank you
@mila432 suck a dick

[msamuel002]

chill @karboN90 lmao

[msamuel002]

btw qwerty, when you said "a small slowdown is to be expected", does this mean battery life is gonna be worse. obviously with a jb it has to be worse, but would it be worse right now then a more stable jb version in the future?

[msamuel002]

nevermind i see exactly what you mean. it is alot slower for now but its fine, as long as we have a jailbreak :) thanks!

[andrewwiik]

@kpwn still no crashes :)