Yalu102: iPad air2 page size

[NewDwarf]

@kpwn
I've debugged the function
void checkvad() {
if (!sz) {
host_page_size(mach_host_self(), &sz);
assert(sz);
if (sz == 4096) {
isvad = 1;
}
}
}

host_page_size(mach_host_self(), &sz) returns page size 16384.
Thus, iPad air2 is 16K rather than 4K in context of JB execution.

[german8835]

I thought about that 30 mins ago, and wrote that he has 2gb of ram. :) It has something to do with ram right?

[hduarte]

About the A8X I don't know but may it have to do with this:

"In OS X and in earlier versions of iOS, the size of a page is 4 kilobytes. In later versions of iOS, A7- and A8-based systems expose 16-kilobyte pages to the 64-bit userspace backed by 4-kilobyte physical pages, while A9 systems expose 16-kilobyte pages backed by 16-kilobyte physical pages."

(https://developer.apple.com/library/content/documentation/Performance/Conceptual/ManagingMemory/Articles/AboutMemory.html)

The iPad Air 2 is the only device with an A8X SoC with 2GB LPDDR3.
The iPad mini 4 is the only device with an A8 SoC with 2GB LPDDR3.

Does it have to do with the fact that they are 4K devices but expose 16K page table size to the 64bit iOS ?

[NewDwarf]

If the function is changed to
void checkvad() {
if (!sz) {
// host_page_size(mach_host_self(), &sz);
sz = 4096;
assert(sz);
if (sz == 4096) {
isvad = 1;
}
}
}
to present iPad air2 as 4K device, the kernel crash on the
jailbreak.m:804

for (int i = 0; i < z; i++) {
    WriteAnywhere64(plist[i], physcode + 0x100);   // it is crashed here
}

2017-01-30 15:24:46.466680 yalu102[224:4722] pmap: fffffff021320850
2017-01-30 15:24:46.466957 yalu102[224:4722] got phys at 8216fc000 for virt fffffff01df7c000
2017-01-30 15:24:46.467027 yalu102[224:4722] found cpu 0
2017-01-30 15:24:46.467055 yalu102[224:4722] found physz: fffffff020e93000
2017-01-30 15:24:46.467087 yalu102[224:4722] found cpu 1
2017-01-30 15:24:46.467113 yalu102[224:4722] found physz: fffffff020e93000
2017-01-30 15:24:46.467163 yalu102[224:4722] found cpu 2
2017-01-30 15:24:46.467189 yalu102[224:4722] found physz: fffffff020e93000
2017-01-30 15:24:46.467249 yalu102[224:4722] fffffff020f93714 - fffffff020f93548
2017-01-30 15:24:46.468515 yalu102[224:4722] ttbr0: 802ac5000 fffffff020e71590
2017-01-30 15:24:46.468878 yalu102[224:4722] got a cpacr
2017-01-30 15:24:46.636905 yalu102[224:4722] 3
2017-01-30 15:24:46.661894 yalu102[224:4722] fref at fffffff020f91340
2017-01-30 15:24:46.676289 yalu102[224:4722] amfistr at fffffff020c68510

(lldb) p/x plist
(uint64_t [12]) $0 = ([0] = 0xfffffff02131c130, [1] = 0xfffffff021644130, [2] = 0xfffffff021658130
...)

Update: on attempt to run the tool again, the app displays "already jailbroken". But it is actually not full jailbreak. This message will be displayed if debug session is interrupted before running WriteAnywhere64(plist[i], physcode + 0x100);

[NewDwarf]

Decoded output on findphys_real(plist[1])
2017-01-30 16:24:48.134286 yalu102[221:4091] TTE physaddr: 000000081b848000
2017-01-30 16:24:48.134442 yalu102[221:4091] TTE table: 1
2017-01-30 16:24:48.134665 yalu102[221:4091] TTE valid: 1
2017-01-30 16:24:48.134749 yalu102[221:4091] TTE userland eXecute Never: 0
2017-01-30 16:24:48.134952 yalu102[221:4091] TTE privileged eXecute Never: 0
2017-01-30 16:24:48.135147 yalu102[221:4091] TTE contiguous: 0
2017-01-30 16:24:48.135335 yalu102[221:4091] TTE not global: 0
2017-01-30 16:24:48.135412 yalu102[221:4091] TTE access flag: 0
2017-01-30 16:24:48.135601 yalu102[221:4091] TTE shareable: 0
2017-01-30 16:24:48.136354 yalu102[221:4091] TTE access permissions: Read/Write
2017-01-30 16:24:48.136476 yalu102[221:4091] TTE access permissions: EL0 (Userland) cannot access this page

2017-01-30 16:24:48.136609 yalu102[221:4091] TTE physaddr: 0000000802acf000
2017-01-30 16:24:48.136685 yalu102[221:4091] TTE table: 1
2017-01-30 16:24:48.136758 yalu102[221:4091] TTE valid: 1
2017-01-30 16:24:48.136830 yalu102[221:4091] TTE userland eXecute Never: 0
2017-01-30 16:24:48.138293 yalu102[221:4091] TTE privileged eXecute Never: 0
2017-01-30 16:24:48.138370 yalu102[221:4091] TTE contiguous: 0
2017-01-30 16:24:48.138441 yalu102[221:4091] TTE not global: 0
2017-01-30 16:24:48.138512 yalu102[221:4091] TTE access flag: 0
2017-01-30 16:24:48.138585 yalu102[221:4091] TTE shareable: 0
2017-01-30 16:24:48.138675 yalu102[221:4091] TTE access permissions: Read/Write
2017-01-30 16:24:48.138782 yalu102[221:4091] TTE access permissions: EL0 (Userland) cannot access this page

2017-01-30 16:24:48.138909 yalu102[221:4091] TTE physaddr: 0000000802440000
2017-01-30 16:24:48.138985 yalu102[221:4091] TTE table: 1
2017-01-30 16:24:48.139057 yalu102[221:4091] TTE valid: 1
2017-01-30 16:24:48.139130 yalu102[221:4091] TTE userland eXecute Never: 1
2017-01-30 16:24:48.139202 yalu102[221:4091] TTE privileged eXecute Never: 1
2017-01-30 16:24:48.139273 yalu102[221:4091] TTE contiguous: 0
2017-01-30 16:24:48.139343 yalu102[221:4091] TTE not global: 0
2017-01-30 16:24:48.142455 yalu102[221:4091] TTE access flag: 1
2017-01-30 16:24:48.142533 yalu102[221:4091] TTE shareable: 2
2017-01-30 16:24:48.142628 yalu102[221:4091] TTE access permissions: Read/Write
2017-01-30 16:24:48.142736 yalu102[221:4091] TTE access permissions: EL0 (Userland) cannot access this page

[NewDwarf]

Installed Cydia on iPad air2

017-01-30 17:26:15.412174 yalu102[229:5625] enabled patches
2017-01-30 17:27:09.953425 yalu102[229:5625] remounting: 0
./
./Applications/
./bin/
./boot/
...
2017-01-30 17:28:31.439343 yalu102[229:5625] pid = ea
really jailbroken

[hduarte]

@NewDwarf What did you change ?

[german8835]

@NewDwarf Is it stable? Hopefully your patch will be implemented in the next beta, can't wait for Air 2 JB :)

[KILLCAMPER]

Oooohh yes hope fully in next update thank you

Sent from my iPad

On 30 Jan 2017, at 14:43, german8835 [e-mail] wrote:

@NewDwarf Is it stable? Hopefully your patch will be implemented in the next beta, can't wait for Air 2 JB :)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[NewDwarf]

No. It is not stable. I tried several time to run and once I pass the point where the JB is crashed.
But it was only one time.
Only one change
void checkvad() {
if (!sz) {
// host_page_size(mach_host_self(), &sz);
sz = 4096;
assert(sz);
if (sz == 4096) {
isvad = 1;
}
}
}

You can try if you have luck you will get Cydia to be installed.

Anyway we need kpwn's help.

[KILLCAMPER]

@NewDwarf still progressing thank you

[hduarte]

@NewDwarf Thks for sharing.

[NewDwarf]

Any time the device will be rebooted (on crash), check whether Cydia was installed.

[german8835]

The same thing happened yesterday with 5s, someone managed to get it running, but it was unusable. Then couple of hours later official patch and then beta was released :)

[hduarte]

Done it, iPad mini 4.

[NewDwarf]

How many times did you try?

[hduarte]

First run @NewDwarf I'll reset and run again.

[german8835]

@hduarte and is it as unstable as iPad Air 2 he was talking about?

[hduarte]

Just installed OpenSSH

[hduarte]

@german8835 unstable how ?

[german8835]

He wrote that it won't show up sometimes and that you need to try it out more than once

[hduarte]

@german8835 I just run it once and it it work. I'll try and run it multiple time to see. I'll give feedback later.

[NewDwarf]

Did anybody successfully run JB on iPad air2?

[Mila432]

@NewDwarf yes

[NewDwarf]

Are you able to run Cydia to install OpenSSH?

[NewDwarf]

Cydia is crashed on my device.

[Mila432]

@NewDwarf why would you do this ?
use dropbear

[NewDwarf]

@Mila432 Are you able to run Cydia?

[Mila432]

@NewDwarf yes

[KILLCAMPER]

@Mila432 is it stable or any boot loops

Sent from my iPad

On 30 Jan 2017, at 16:15, NewDwarf [e-mail] wrote:

@Mila432 Are you able to run Cydia?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[Mila432]

pretty stable the only down side is the jailbreak chance , its like 25% only

[xplodeteam]

Works here as well on iPad5,4 worked from the second try.

[KILLCAMPER]

I can test as int got my mac to run Xcode that's see what happens in next beta 7 if expected

Sent from my iPad

On 30 Jan 2017, at 16:24, Mila432 [e-mail] wrote:

pretty stable the only down side is the jailbreak chance , its like 25% only

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[KILLCAMPER]

@mila432 25% that's low man

Sent from my iPad

On 30 Jan 2017, at 16:24, Mila432 [e-mail] wrote:

pretty stable the only down side is the jailbreak chance , its like 25% only

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[kpwn]

hah interesting, my code handles the 3 cpus successfully!

anyway, so page size detection is broken for those devices. shall we hardcode the model ID?

[nullpixel]

I thought of doing this, but there might be a better way

[KILLCAMPER]

@kpwn do you sleep lol and we are getting closer

Sent from my iPad

On 30 Jan 2017, at 16:55, kpwn [e-mail] wrote:

hah interesting, my code handles the 3 cpus successfully!

anyway, so page size detection is broken for those devices. shall we hardcode the model ID?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[kpwn]

i literally woke up 5 mins ago

[KILLCAMPER]

@kpwn you run out of club mate;) you think hardcore will do it

Sent from my iPad

On 30 Jan 2017, at 16:57, kpwn [e-mail] wrote:

i literally woke up 5 mins ago

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[nullpixel]

lol time to get an Italian breakfast

[Mila432]

@kpwn after first reboot after jb , iPad will end with breakup and panic all the time

[NewDwarf]

@kpwn Do you have idea about likelihood of successful JB execution?

[xplodeteam]

Success rate is really low, after restart it took me 8 times in order to get in jailbroken state

[KILLCAMPER]

@xplodeteam what device Air 2 or mini 4 ?

[xplodeteam]

iPad Air 2 LTE (iPad8,4)

[nullpixel]

void checkvad() {
    if (!sz) {
        // host_page_size(mach_host_self(), &sz);
        sz = 4096;
        assert(sz);
        if (sz == 4096) {
            isvad = 1;
        }
    }
}

Formatted the code for ease of use

[KILLCAMPER]

That the iPad Air cellular ?

Sent from my iPad

On 30 Jan 2017, at 17:27, xplodeteam [e-mail] wrote:

iPad Air 2 LTE (iPad8,4)

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[ghost]

I am testing this out on an iPad Air 2 iOS 10.2 forced it to 4K tried 10 times so far and nothing no Cydia is there anything else you did

[nullpixel]

Worked first time here

[ghost]

Also be careful on these devices if it fails it can make some noise that'll scare the shit out of you
From experience

[jackb992]

Works on iPad Mini 4

[bronch]

Worked flawlessly on iPad5,3 (iPad Air Wi-Fi)

[masbog]

Worked on iPad Air 2, iPad5,3... cydia was installed on first run yalu102 project... thanks a lot...

[SniperGER]

Not working for me on iPad5,3. After pressing 'Go', it either says 'Failed', or simply reboots. Afterwards, Cydia is (of course) not installed.

Tried with the original and modified codes.

Edit: It only says 'Failed' if I wait some time after rebooting.

[Airbrando]

Jackbb992 what have you changed ?

[jackb992]

@Vitauser

void checkvad() {
if (!sz) {
// host_page_size(mach_host_self(), &sz);
sz = 4096;
assert(sz);
if (sz == 4096) {
isvad = 1;
}
}
}

this in pte_stuff.h, ill send over an .ipa if easier

[KILLCAMPER]

What's your % of jb after code

Sent from my iPad

On 30 Jan 2017, at 19:06, jackb992 [e-mail] wrote:

@Vitauser
void checkvad() {
if (!sz) {
// host_page_size(mach_host_self(), &sz);
sz = 4096;
assert(sz);
if (sz == 4096) {
isvad = 1;
}
}
}

this in pte_stuff.h, ill send over an .ipa if easier

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[nullpixel]

Can you guys test out #298 for me?

[jackb992]

@Vitauser sent

[KILLCAMPER]

Would you like me to test on iPad Air 2 cellular ? If so [email protected]
That's if need me to try thanks

Sent from my iPad

On 30 Jan 2017, at 19:19, jackb992 [e-mail] wrote:

@Vitauser sent

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[sirnoah]

Same here, would like to see if I can get it to work, won't have access to my mac until tomorrow so I can't try and compile it myself. Would be much appreciated ^^ Andres.ramirez.[email protected]

[jackb992]

@Vitauser it says it was attatched?

[nullpixel]

Can we not turn this into a ipa begging these. Thanks.

[Airbrando]

@jackb992 got it. Wait a minute the i can tell you if that works

[sirnoah]

Yea sorry about that. Don't gotta send me anything. I can compile it later, just wanted to test earlier for convenience.

[jackb992]

I'm gonna shove the ipa over at /r/ipahub to try and stop flooding the thread

edit: Put it on /r/ipahub
edit 2: because i didn't put a tag it won't let me put it on there for another 8 min, will put it up again when able

[Airbrando]

Not working for me ipad mini 4. tried it 5 times but no cydia icon here.

[jackb992]

@Vitauser Tell me about it, it took about 15-20 times to do it

[KILLCAMPER]

@jackb992 thank you if up load to /r/ipahub will do my best to report bugs and % of jb success

Sent from my iPad

On 30 Jan 2017, at 19:34, jackb992 [e-mail] wrote:

/r/ipahub

[german8835]

Can kpwn fix that issue?

[masbog]

just waiting the repo owner fix this issue and build a new officially ipa 🤗

[jackb992]

over at /r/ipahub now

[KILLCAMPER]

Thank you will side load it now see if get jb or how many attempts to get it in to jb state thanks just got it see if will as I have a iPad Air 2 cellular on 10.2

Sent from my iPad

On 30 Jan 2017, at 19:34, jackb992 [e-mail] wrote:

I'm gonna shove the ipa over at /r/ipahub to try and stop flooding the thread

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[nullpixel]

LUL I'm a sideloaded / IPAHub mod, leaving a sticky comment on that thread warning people

[jackb992]

@nullpixel1 Best to do that (I put in the title, VERY UNSTABLE)

[nullpixel]

Please link me, can't find it on frontpage

[jackb992]

@nullpixel1 https://www.reddit.com/r/iPAHub/comments/5r31nc/release_yalu_102_for_ipad_mini_4_and_ipad_air_2/

[german8835]

I got storage almost full message, ipad rebooted and I have cydia, worked with 1st try.

[KILLCAMPER]

I am going to cydia impact it have I said sum thing wrong ?

[german8835]

That was fast, cydia didnt even install or downloaded any startup-packages, went straight ahead.

[SniperGER]

IPA worked instantly. I guess it has something to do with how Yalu gets loaded onto the device. I've always compiled from source and ran directly on the device.

[Airbrando]

@jackb992 works now on ipad mini 4. but needed about 15 times of trying

[jackb992]

After you've used it once it takes forever to load after reboot. I would avoid rebooting.

[german8835]

I installed one simple tweak without any errors, nice

Edit: Once a stable ipa comes out, I should just reboot, uninstall old ipa and Cydia impact new one right?

[KILLCAMPER]

@jackb992 worked 1st time no drama on iPad Air 2 cellular

[jackb992]

@german8835 uninstall old ipa and reinstall

[Airbrando]

@KILLCAMPER ipad air 2 oder mini 4 ?

[jackb992]

@Vitauser iPad5,4 is iPad Air 2

[KILLCAMPER]

@Vitauser iPad Air 2 cellular if that's any dif to wifi haven't rebooted or added any tweaks

@jackb992 was this compiled from beta 6 thanks again.

[Airbrando]

it seems that ipad air 2 it does work always the first time but with ipad mini 4 it needs several tries. right or ?

[KILLCAMPER]

@Vitauser sorry don't have a iPad mini 4 to test

[Airbrando]

anyone here with a ipad mini 4 ?

[KILLCAMPER]

@kpwn any help for beta 7 for the iPad Air 2 this ipa works don't no if you can make more stable or helps with b7

[nullpixel]

I literally made a PR to fix this, but it's not too stable

[KILLCAMPER]

@Vitauser Sorry Not till tomorrow as my mate got one he is giving me as he bust a bit of digitiser but usable for this and is on 10.2

Sent from my iPad

On 30 Jan 2017, at 20:25, Vitauser [e-mail] wrote:

anyone here with a ipad mini 4 ?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

[jackb992]

@Vitauser I'm using iPad Mini 4

[Airbrando]

and you have also to do it 15-20 times or ?

[SteBowker10]

Can confirm it does indeed work for iPad A2, Exploit isn't very reliable though, taken me 9 tries before it was successfully jailbroken. Come from a freshly restored iOS 10.2 through iTunes. Once jailbroken it seemed okay.

[KILLCAMPER]

@SteBowker10 1st time for me but am looking at do and don't as don't want boot loop r/jailbrake will have a look 👀 what's working

[KILLCAMPER]

@nullpixel1 is this your IPA ? I.e. Your work around for support ?
If not will test your as well

[ladyeklipse]

Downloaded the IPA, installed on iPad Air 2 WiFi. Got Cydia on the first try, works fine!
Thank you for fixing this bug!

[SteBowker10]

Heres a working log from my iPad Air 2 using Apple Configurator 2. The log provided is one that worked and put my iDevice back into a jailbroken state.
Steven’s iPad.txt

[kpwn]

void checkvad() {
    if (!sz) {
        struct utsname u = { 0 };
        uname(&u);
        host_page_size(mach_host_self(), &sz);
        NSLog(@"checkvad: %x %x", sz, getpagesize());
        if (strstr(u.machine, "iPad5,") == u.machine) {
           sz = 4096*4; // this is 4k but host_page_size lies to us
        }
        assert(sz);
        if (sz == 4096) {
            isvad = 1;
        }
    }
}

does this code look good? (i.e. does it represent the fix correctly?) this issue got too many comments, hard to keep track.

[Mila432]

@kpwn please give it some more love , the chances to rejail are 1/60

[kpwn]

i can try to improve it but i don't have said devices.

[ghost]

this is similar to what i did and my device is absolutely fine sometimes takes 2 tries and my device after jailbroken has rebooted once seems okay

[Mila432]

@kpwn I will offer you remote access to Mac + iPad Air 2 again :)

[kpwn]

remote access is unfortunately hard to use. can you test my patch please? replace the checkvad function in pte_stuff.h

[ghost]

give me a minute i can test on my device just booting up my vm

[hduarte]

@kpwn earlier I had tested the getpagesize() and it returns the same size as host_page_size for my ipad mini 4.

[Mila432]

@kpwn

http://pastebin.com/raw/adNbydMZ

http://pastebin.com/raw/6Je6Dnwe

http://pastebin.com/raw/ermvGKzu

http://pastebin.com/raw/Ht2amb4r

[ccsasuke]

Might be a stupid question..
sz = 4096*4; // this is 4k but host_page_size lies to us
Why that wasn't sz = 4096; ?

I thought host_page_size() originally gave 4096*4.

[kpwn]

did it? i am honestly not sure, i didn't read the 100+ comments

[ghost]

yes your patch doesn't work it returns the sz variable as 16k where as for the iPad air 2 it needs to be 4k

[kpwn]

ok, thanks. so setting sz = 4096 works? (can you test this on a device?)

[hduarte]

Yes @kpwn host_page_size() returns 16k instead of 4k, for ipad mini 4 and ipad air 2.

[ghost]

yes this is what i did earlier to fix my iPad air 2 wifi iOS 10.2 and it works fine sometimes takes 1-3 tries but it works

[hduarte]

Setting sz = 4096 works, but is so unreliable

[ccsasuke]

By unreliable, do you mean i) low success rate, or ii) crashes after successful jailbreak?

[ghost]

for me both have happened takes a few tries and has crashed a couple of times

[Mila432]

@kpwn with

if (strstr(u.machine, "iPad5,") == u.machine) {
sz = 4096; // this is 4k but host_page_size lies to us
}

http://pastebin.com/raw/V1wMVxk3

[SteBowker10]

correct 'cawk' I 2nd that. i have set that value sz = 4096 but success rate is poor. At least for me its like 1/10

[hduarte]

low success rate @ccsasuke

[SteBowker10]

I don't know why and this might sound laughable but I seem to have a better success rate loading the yulu.ipa on it own with no other applications running and holding the go link in the app for about 10 seconds.

[va2ron1]

Maybe this will clear something
http://stackoverflow.com/a/33574804

[danielkoller]

Nullpixels Fix worked perfectly fine for me. Jailbreak happened at first try and so far no crashes. I've got an iPad Air 2 WIFI-Edition, btw.

[kpwn]

It works but breaks 4k devices.

[ghost]

its completely random fyi i went back to my original patch that worked fine before and now on my 7th try still nothing its just hit or miss for now I'm sure luca will make some sort of reliable fix soon when he can get his hands on a device

[kpwn]

committed