dfu-util/CMakeLists.txt dfu-util/COPYING dfu-util/README dfu-util/dfu.c dfu-util/dfu.h dfu-util/main.c dfu-util/sam7dfu.c dfu-util/sam7dfu.h dfu-util/usb_dfu.h ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/018-3786-2-nowipe.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/018-3786-2.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/DeviceTree.m68ap.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/Info.plist ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/LLB.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/WTF.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/WTF.s5l8900xall.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/bbupdater.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/iBEC.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/iBSS.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/iBoot.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/kernelcache.release.patch.bak.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A347.bundle/lockdownd.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/.Info.plist.swp ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/018-3783-2-nowipe.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/018-3783-2.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/DeviceTree.n82ap.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/Info.plist ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/LLB.n82ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/WTF.n82ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/WTF.s5l8900xall.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/iBEC.n82ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/iBSS.n82ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/iBoot.n82ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPhone1,2_2.0_5A347.bundle/lockdownd.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/018-3783-2-nowipe.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/018-3783-2.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/DeviceTree.n45ap.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/Info.plist ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/LLB.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/WTF.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/WTF.s5l8900xall.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/iBEC.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/iBSS.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/iBoot.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A347.bundle/kernelcache.release.patch ipsw-patch/bundles/BootNeuter.tar ipsw-patch/bundles/Cydia.tar ipsw-patch/bundles/YoutubeActivation.tar ipsw-patch/bundles/logo.png ipsw-patch/bundles/recovery.png @@ -37,6 +37,17 @@ Credits This utility is merely an implementation of Pwnage, which is the work of roxfan, Turbo, wizdaz, bgm, and pumpkin. Those guys are the real heroes. +Also, the new super-awesome bootrom exploit is courtesy of wizdaz. + +MuscleNerd has put a lot of work into the 3G effort. The BootNeuter unlock +for first-generation iPhones packaged within is primarily his effort. + +Thanks also go to gray and c1de0x for their RCE efforts. saurik is the author +of Cydia, included within. bugout was the lucky guy who did our first 3G tests. + +Thanks to chris for his hardware wisdom, Zf for his French humor, and pytey +for the support on the serial stuff. + XPwn attempts to use all the same data files and patches as PwnageTool to avoid duplication of present and future labor. I believe that wizdaz probably put the most sweat into PwnageTool, and the pwnage ramdisk is the work of @@ -52,10 +63,104 @@ the initial exploratory work with the undocumented DMG format. Usage ----- -There are two utilities in this package, as well as the InternalPackages and +There are two utilities in this package, as well as the bundles and FirmwareBundles folders from PwnageTool, and Turbo's autopwn ramdisk. -## xpwn +## ipsw + +*NOTE: Important change for 2.0: (uncompressed) tarballs rather than paths are +now used for bundles* + +ipsw is a more complex tool to generate custom IPSWs that you can restore +after using xpwn (or any other pwnage-based utility). This is important, since +that's how the jailbreak actually occurs. + + ./ipsw <input.ipsw> <output.ipsw> [-b <bootimage.png>] [-nowipe] \ + [-r <recoveryimage.png>] [-e "<action to exclude>"] \ + [[-unlock] [-use39] [-use46] [-cleanup] \ + -3 <bootloader 3.9 file> -4 <bootloader 4.6 file>] \ + <package1.tar> <package2.tar>... + + +Yes, I know, confusing syntax. The first two options are the IPSW you want to +modify, and where you want to save the modified IPSW respectively. -b and -r +have the same semantics and requirements as for xpwn. You can also specify +actions to exclude from the "FilesystemPatches" section of the Info.plist +for your particular IPSW (in FirmwareBundles/). + +The most common use of the '-e' flag is to disable automatic activation, i.e. +'-e "Phone Activation"'. Note that the double-quotes are necessary. + +-nowipe disables Apple's wiping of the NAND (user data), before proceeding +with the restore. This allows the restore to happen much, much more quickly. + +-unlock, -use39, -use46, -cleanup, -3, and -4 are valid only if you merge the +BootNeuter package. These provide instructions to BootNeuter (which provides +unlocking for iPhones). If you choose to use BootNeuter, you must specify the +location where the 3.9 and 4.9 bootloader can be found with the -3 and -4 +options. These cannot be included with xpwn due to copyright restrictions. + +-unlock specifies that you wish BootNeuter to unlock the phone (if it is not +already unlocked). -use39 and -use46 instructs BootNeuter to either upgrade +or downgrade your bootloader (if it is not already on the version you choose). +-cleanup instructs BootNeuter to delete itself off of the iPhone after it is +complete. If you do not specify -cleanup, BootNeuter will be accessible via +SpringBoard. + +The last options are for tar-files to merge. All permissions and ownership +will be preserved except for already directories that already exist. This is +to prevent accidental clobbering (we're guessing you don't really want to +alter permissions on existing directories). This behavior may change in the +future. + +Told you it was a mess. + +## dfu-util + +dfu-util is an utility adapted from OpenMoko that satisfies the "pwning" stage +of the process, that is, allowing the execution of our unsigned code. It +relies upon an exploit in the DFU mode of the iPhone/iPod touch bootrom. This +cannot be fixed by Apple on the current hardware revisions. If we can mess +with the device before iTunes sees it, we can have it load a WTF with +signature checking disabled with the exploit, and load an iBSS with signature +checking disabled over that WTF. iTunes will see the device as a regular +iPhone/iPod in recovery mode, and will happily send our custom firmware to it, +which will now be accepted. + +YOU MUST COMPLETELY DISABLE iTUNES WITH TASK MANAGER OR EQUIVALENT BEFORE +PROCEEDING. + +Only AFTERWARDS do you put your device into DFU mode. If you switch the order +of these steps, iTunes will be able to load software onto your device without +this vulnerability, rendering dfu-util useless. + +AFTER you have disabled iTunes, iTunesHelper, etc., plug your device into the +computer. Shut down the device in the normal way if necessary (Slide to +shutdown). Hold down the Power and Home buttons simultaneously and count +slowly to ten. (You may need to push down on power an instant before you +push down on home). The iPhone will start. At around the time you count to 6, +the iPhone will shut down again. KEEP HOLDING BOTH BUTTONS. Hold down both +buttons until you reach 10. At this point, release the power button ONLY. +Keep holding the stand-by button forever (this may take up to two minutes). +You will know when you can stop holding the button when Windows notifies you +via an audible cue that a USB device has connected. This is your device in +DFU mode. The screen of the device will remain completely powered off. + +THEN, run dfu-util with the following syntax: + + sudo ./dfu-util <custom.ipsw> <n82ap|m68ap|n45ap> + +Where n82ap = 3G iPhone, m68ap = First-generation iPhone, n45ap = iPod touch. +Note that you're using your CUSTOM IPSW for this stage, since we will need the +patched firmware, not the stock firmware. dfu-util will pick out the right +files from the ipsw and send them in the right order. If your screen powers on +and then turns white, then you know it worked. You can now restore with iTunes. + +## xpwn *(DEPRECATED)* + +If DFU mode is too complicated for you, and you have a first-generation phone, +you can still use the legacy xpwn ramdisk method on 1.1.4 to pwn your phone. +Then you can restore the custom IPSW without messing with DFU mode. xpwn will use libibooter to bootstrap the autopwn ramdisk. This will patch NOR so that unsigned IPSWs can subsequently be used. The vulnerability used @@ -93,78 +198,26 @@ used to swap boot logos without restoring. A restore with a non-customized IPSW will undo what xpwn did (the NOR will be reflashed with Apple's image that does have signature checking) -## ipsw - -ipsw is a more complex tool to generate custom IPSWs that you can restore -after using xpwn (or any other pwnage-based utility). This is important, since -that's how the jailbreak actually occurs. - - ./ipsw <input.ipsw> <output.ipsw> [-b <bootimage.png>] [-nobbupdate] \ - [-r <recoveryimage.png>] [-e "<action to exclude>"] \ - [[-unlock] [-use39] [-use46] [-cleanup] \ - -3 <bootloader 3.9 file> -4 <bootloader 4.6 file>] \ - <path/to/merge1> <path/to/merge2>... - -Yes, I know, confusing syntax. The first two options are the IPSW you want to -modify, and where you want to save the modified IPSW respectively. -b and -r -have the same semantics and requirements as for xpwn. You can also specify -actions to exclude from the "FilesystemPatches" section of the Info.plist -for your particular IPSW (in FirmwareBundles/). - -The most common use of the '-e' flag is to disable automatic activation, i.e. -'-e "Phone Activation"'. Note that the double-quotes are necessary. - --nobbupdate disables Apple's baseband upgrade program from running during -the restore. However, bbupdate must be enabled for unlocking with BootNeuter. - --unlock, -use39, -use46, -cleanup, -3, and -4 are valid only if you merge the -BootNeuter package. These provide instructions to BootNeuter (which provides -unlocking for iPhones). If you choose to use BootNeuter, you must specify the -location where the 3.9 and 4.9 bootloader can be found with the -3 and -4 -options. These cannot be included with xpwn due to copyright restrictions. - --unlock specifies that you wish BootNeuter to unlock the phone (if it is not -already unlocked). -use39 and -use46 instructs BootNeuter to either upgrade -or downgrade your bootloader (if it is not already on the version you choose). --cleanup instructs BootNeuter to delete itself off of the iPhone after it is -complete. If you do not specify -cleanup, BootNeuter will be accessible via -SpringBoard. - -The last options are for directories to merge into the root filesystem of your -device. The included bundles can be merged by specifying something like -"bundles/Installer.bundle/files". Notice the "files" part must be specified. -It is also perfectly possible to set up your own files to merge. - -/Applications/Installer.app/Installer will be given special setuid -permissions. All files that have the format /Applications/XXX.app/XXX will be -given execute permissions. All files in /sbin, /bin, /usr/bin, /usr/sbin, -/usr/libexec, /usr/local/bin, /usr/local/sbin, /usr/local/libexec will also be -given execute permissions. Special permissions are also given to BootNeuter. -Everything else will be non-executable, so a special LaunchDaemon task may need -to be constructed to properly set up your custom apps. Generally, however, -those permissions are already sufficient. - -Told you it was a mess. ### Examples -Jailbreaking iPod 1.1.4: +Jailbreaking iPod 2.0: - ./ipsw iPod1,1_1.1.4_4A102_Restore.ipsw custom.ipsw \ - bundles/Installer.bundle/files + ./ipsw iPod1,1_2.0_5A347.bundle custom.ipsw \ + bundles/Cydia.tar -Jailbreaking iPhone 1.1.4: +Jailbreaking iPhone 3G: - ./ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw custom.ipsw \ - -e "Phone Activation" bundles/Installer.bundle/files + ./ipsw iPhone1,2_2.0_5A347.bundle custom.ipsw \ + -e "Phone Activation" bundles/Cydia.tar -Jailbreaking, activating, and unlocking iPhone 1.1.4: +Jailbreaking, activating, and unlocking iPhone 2.0: - ./ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw custom.ipsw \ + ./ipsw iPhone1,1_2.0_5A347.bundle custom.ipsw \ -unlock -cleanup -3 bl39.bin -4 bl46.bin \ - bundles/Installer.bundle/files \ - bundles/BootNeuter.bundle/files \ - bundles/YoutubeActivation.bundle/files + bundles/Cydia.tar \ + bundles/BootNeuter.tar \ + bundles/YoutubeActivation.tar Technical notes --------------- README.markdown @@ -99,6 +99,9 @@ AbstractFile* createAbstractFileFromDummy() { size_t memRead(AbstractFile* file, void* data, size_t len) { MemWrapperInfo* info = (MemWrapperInfo*) (file->data); + if(info->bufferSize < (info->offset + len)) { + len = info->bufferSize - info->offset; + } memcpy(data, (void*)((uint8_t*)(*(info->buffer)) + (uint32_t)info->offset), len); info->offset += (size_t)len; return len; common/abstractfile.c @@ -4,6 +4,7 @@ #include <dmg/dmg.h> #include <dmg/filevault.h> +#include <inttypes.h> #ifdef HAVE_CRYPT @@ -207,7 +208,7 @@ AbstractFile* createAbstractFileFromFileVault(AbstractFile* file, const char* ke file->read(file, &signature, sizeof(uint64_t)); FLIPENDIAN(signature); if(signature != FILEVAULT_V2_SIGNATURE) { - printf("Unknown signature: %x\n", signature); + printf("Unknown signature: %" PRId64 "\n", signature); /* no FileVault v1 handling yet */ return NULL; } @@ -222,7 +223,9 @@ AbstractFile* createAbstractFileFromFileVault(AbstractFile* file, const char* ke flipFileVaultV2Header(&(info->header.v2)); for(i = 0; i < 16; i++) { - sscanf(&(key[i * 2]), "%02hhx", &(aesKey[i])); + unsigned int curByte; + sscanf(&(key[i * 2]), "%02x", &curByte); + aesKey[i] = curByte; } for(i = 0; i < 20; i++) { dmg/filevault.c @@ -4,6 +4,7 @@ #include <zlib.h> #include <dmg/dmg.h> +#include <inttypes.h> #define SECTORS_AT_A_TIME 0x200 @@ -71,7 +72,7 @@ BLKXTable* insertBLKX(AbstractFile* out, AbstractFile* in, uint32_t firstSectorN strm.zfree = Z_NULL; strm.opaque = Z_NULL; - printf("run %d: sectors=%lld, left=%d\n", curRun, blkx->runs[curRun].sectorCount, numSectors); + printf("run %d: sectors=%" PRId64 ", left=%d\n", curRun, blkx->runs[curRun].sectorCount, numSectors); ASSERT(deflateInit(&strm, Z_DEFAULT_COMPRESSION) == Z_OK, "deflateInit"); @@ -176,7 +177,7 @@ void extractBLKX(AbstractFile* in, AbstractFile* out, BLKXTable* blkx) { continue; } - printf("run %d: sectors=%lld, length=%lld, fileOffset=0x%llx\n", i, blkx->runs[i].sectorCount, blkx->runs[i].compLength, blkx->runs[i].compOffset); + printf("run %d: sectors=%" PRId64 ", length=%" PRId64 ", fileOffset=0x%" PRIx64 "\n", i, blkx->runs[i].sectorCount, blkx->runs[i].compLength, blkx->runs[i].compOffset); switch(blkx->runs[i].type) { case BLOCK_ZLIB: dmg/io.c @@ -1,27 +1,29 @@ -#include <stdlib.h> -#include <stdio.h> -#include <stdint.h> -#include <time.h> -#include <string.h> -#include <unistd.h> -#include <hfs/hfsplus.h> -#include <dmg/dmgfile.h> -#include <dmg/filevault.h> -#include <sys/types.h> -#include <sys/stat.h> +#include <stdlib.h> +#include <stdio.h> +#include <stdint.h> +#include <time.h> +#include <string.h> +#include <unistd.h> +#include <hfs/hfsplus.h> +#include <dmg/dmgfile.h> +#include <dmg/filevault.h> +#include <sys/types.h> +#include <sys/stat.h> #include <dirent.h> -#include "hfs/hfslib.h" - -char endianness; - -void cmd_ls(Volume* volume, int argc, const char *argv[]) { - if(argc > 1) - hfs_ls(volume, argv[1]); - else - hfs_ls(volume, "/"); } - -void cmd_cat(Volume* volume, int argc, const char *argv[]) { - HFSPlusCatalogRecord* record; +#include "hfs/hfslib.h" +#include <inttypes.h> + +char endianness; + +void cmd_ls(Volume* volume, int argc, const char *argv[]) { + if(argc > 1) + hfs_ls(volume, argv[1]); + else + hfs_ls(volume, "/"); +} + +void cmd_cat(Volume* volume, int argc, const char *argv[]) { + HFSPlusCatalogRecord* record; AbstractFile* stdoutFile; record = getRecordFromPath(argv[1], volume, NULL, NULL); @@ -215,11 +217,28 @@ void cmd_grow(Volume* volume, int argc, const char *argv[]) { } newSize = 0; - sscanf(argv[1], "%lld", &newSize); + sscanf(argv[1], "%" PRId64, &newSize); grow_hfs(volume, newSize); - printf("grew volume: %lld\n", newSize); + printf("grew volume: %" PRId64 "\n", newSize); +} + +void cmd_untar(Volume* volume, int argc, const char *argv[]) { + AbstractFile *inFile; + + if(argc < 2) { + printf("Not enough arguments"); + return; + } + + inFile = createAbstractFileFromFile(fopen(argv[1], "rb")); + + if(inFile == NULL) { + printf("file to untar not found"); + } + + hfs_untar(volume, inFile); } void TestByteOrder() @@ -238,7 +257,7 @@ int main(int argc, const char *argv[]) { TestByteOrder(); if(argc < 3) { - printf("usage: %s <image-file> (-k <key>) <ls|cat|mv|mkdir|add|rm|chmod|extract|extractall|rmall|addall> <arguments>\n", argv[0]); + printf("usage: %s <image-file> (-k <key>) <ls|cat|mv|mkdir|add|rm|chmod|extract|extractall|rmall|addall|grow|untar> <arguments>\n", argv[0]); return 0; } @@ -296,6 +315,8 @@ int main(int argc, const char *argv[]) { cmd_addall(volume, argc - argOff, argv + argOff); } else if(strcmp(argv[argOff], "grow") == 0) { cmd_grow(volume, argc - argOff, argv + argOff); + } else if(strcmp(argv[argOff], "untar") == 0) { + cmd_untar(volume, argc - argOff, argv + argOff); } } hdutil/hdutil.c @@ -462,7 +462,7 @@ HFSPlusCatalogRecord* getRecordFromPath3(const char* path, Volume* volume, char char* pathLimit; uint32_t realParent; - char* lastWordDetectSlash; + int exact; if(path[0] == '\0' || (path[0] == '/' && path[1] == '\0')) { @@ -522,8 +522,7 @@ HFSPlusCatalogRecord* getRecordFromPath3(const char* path, Volume* volume, char } if(traverse) { - lastWordDetectSlash = strchr(word, '/'); - if((lastWordDetectSlash && *(lastWordDetectSlash + 1) != '\0') || returnLink) { + if(((word + strlen(word) + 1) < pathLimit) || returnLink) { record = getLinkTarget(record, key.parentID, &key, volume); if(record == NULL || exact == FALSE) { free(origPath); @@ -533,13 +532,18 @@ HFSPlusCatalogRecord* getRecordFromPath3(const char* path, Volume* volume, char } if(record->recordType == kHFSPlusFileRecord) { - free(origPath); + if((word + strlen(word) + 1) >= pathLimit) { + free(origPath); - if(retKey != NULL) { - memcpy(retKey, &key, sizeof(HFSPlusCatalogKey)); - } + if(retKey != NULL) { + memcpy(retKey, &key, sizeof(HFSPlusCatalogKey)); + } - return record; + return record; + } else { + free(origPath); + return NULL; + } } if(record->recordType != kHFSPlusFolderRecord) @@ -860,13 +864,13 @@ HFSCatalogNodeID newFolder(const char* pathName, Volume* volume) { } else { name = lastSeparator + 1; *lastSeparator = '\0'; - parentFolder = (HFSPlusCatalogFolder*) getRecordFromPath(path, volume, NULL, NULL); - - if(parentFolder == NULL || parentFolder->recordType != kHFSPlusFolderRecord) { - free(path); - free(parentFolder); - return FALSE; - } + parentFolder = (HFSPlusCatalogFolder*) getRecordFromPath(path, volume, NULL, NULL); + } + + if(parentFolder == NULL || parentFolder->recordType != kHFSPlusFolderRecord) { + free(path); + free(parentFolder); + return FALSE; } newFolderID = volume->volumeHeader->nextCatalogID++; @@ -955,12 +959,12 @@ HFSCatalogNodeID newFile(const char* pathName, Volume* volume) { name = lastSeparator + 1; *lastSeparator = '\0'; parentFolder = (HFSPlusCatalogFolder*) getRecordFromPath(path, volume, NULL, NULL); - - if(parentFolder == NULL || parentFolder->recordType != kHFSPlusFolderRecord) { - free(path); - free(parentFolder); - return FALSE; - } + } + + if(parentFolder == NULL || parentFolder->recordType != kHFSPlusFolderRecord) { + free(path); + free(parentFolder); + return FALSE; } newFileID = volume->volumeHeader->nextCatalogID++; hfs/catalog.c @@ -8,6 +8,7 @@ #include <hfs/hfslib.h> #include "abstractfile.h" +#include <inttypes.h> char endianness; @@ -16,7 +17,8 @@ void cmd_ls(Volume* volume, int argc, const char *argv[]) { if(argc > 1) hfs_ls(volume, argv[1]); else - hfs_ls(volume, "/"); } + hfs_ls(volume, "/"); +} void cmd_cat(Volume* volume, int argc, const char *argv[]) { HFSPlusCatalogRecord* record; @@ -213,11 +215,11 @@ void cmd_grow(Volume* volume, int argc, const char *argv[]) { } newSize = 0; - sscanf(argv[1], "%lld", &newSize); + sscanf(argv[1], "%" PRId64, &newSize); grow_hfs(volume, newSize); - printf("grew volume: %lld\n", newSize); + printf("grew volume: %" PRId64 "\n", newSize); } void TestByteOrder() hfs/hfs.c @@ -7,6 +7,7 @@ #include <hfs/hfsplus.h> #include "abstractfile.h" #include <sys/stat.h> +#include <inttypes.h> #define BUFSIZE 1024*1024 @@ -132,7 +133,6 @@ int add_hfs(Volume* volume, AbstractFile* inFile, const char* outFileName) { writeToHFSFile((HFSPlusCatalogFile*)record, inFile, volume); ret = TRUE; } else { - inFile->close(inFile); ret = FALSE; } } @@ -453,7 +453,8 @@ void addall_hfs(Volume* volume, const char* dirToMerge, const char* dest) { ASSERT(chdir(cwd) == 0, "chdir"); free(record); -} +} + int copyAcrossVolumes(Volume* volume1, Volume* volume2, char* path1, char* path2) { void* buffer; size_t bufferSize; @@ -467,7 +468,7 @@ int copyAcrossVolumes(Volume* volume1, Volume* volume2, char* path1, char* path2 printf("retrieving... "); fflush(stdout); get_hfs(volume1, path1, tmpFile); tmpFile->seek(tmpFile, 0); - printf("writing (%ld)... ", tmpFile->getLength(tmpFile)); fflush(stdout); + printf("writing (%ld)... ", (long) tmpFile->getLength(tmpFile)); fflush(stdout); ret = add_hfs(volume2, tmpFile, path2); printf("done\n"); @@ -499,7 +500,7 @@ void displayFolder(HFSCatalogNodeID folderID, Volume* volume) { printf("%06o ", file->permissions.fileMode); printf("%3d ", file->permissions.ownerID); printf("%3d ", file->permissions.groupID); - printf("%12lld ", file->dataFork.logicalSize); + printf("%12" PRId64 " ", file->dataFork.logicalSize); fileTime = APPLE_TO_UNIX_TIME(file->contentModDate); } @@ -526,7 +527,7 @@ void displayFileLSLine(HFSPlusCatalogFile* file, const char* name) { printf("%06o ", file->permissions.fileMode); printf("%3d ", file->permissions.ownerID); printf("%3d ", file->permissions.groupID); - printf("%12lld ", file->dataFork.logicalSize); + printf("%12" PRId64 " ", file->dataFork.logicalSize); fileTime = APPLE_TO_UNIX_TIME(file->contentModDate); date = localtime(&fileTime); if(date != NULL) { @@ -543,6 +544,7 @@ void hfs_ls(Volume* volume, const char* path) { record = getRecordFromPath(path, volume, &name, NULL); + printf("%s: \n", name); if(record != NULL) { if(record->recordType == kHFSPlusFolderRecord) displayFolder(((HFSPlusCatalogFolder*)record)->folderID, volume); @@ -556,3 +558,78 @@ void hfs_ls(Volume* volume, const char* path) { free(record); } + +void hfs_untar(Volume* volume, AbstractFile* tarFile) { + size_t tarSize = tarFile->getLength(tarFile); + size_t curRecord = 0; + char block[512]; + + while(curRecord < tarSize) { + tarFile->seek(tarFile, curRecord); + tarFile->read(tarFile, block, 512); + + uint32_t mode = 0; + char* fileName = NULL; + const char* target = NULL; + uint32_t type = 0; + uint32_t size; + uint32_t uid; + uint32_t gid; + + sscanf(&block[100], "%o", &mode); + fileName = &block[0]; + sscanf(&block[156], "%o", &type); + target = &block[157]; + sscanf(&block[124], "%o", &size); + sscanf(&block[108], "%o", &uid); + sscanf(&block[116], "%o", &gid); + + if(fileName[0] == '\0') + break; + + if(fileName[0] == '.' && fileName[1] == '/') { + fileName += 2; + } + + if(fileName[0] == '\0') + goto loop; + + if(fileName[strlen(fileName) - 1] == '/') + fileName[strlen(fileName) - 1] = '\0'; + + HFSPlusCatalogRecord* record = getRecordFromPath3(fileName, volume, NULL, NULL, TRUE, FALSE, kHFSRootFolderID); + if(record) { + if(record->recordType == kHFSPlusFolderRecord || type == 5) { + printf("ignoring %s, type = %d\n", fileName, type); + goto loop; + } else { + printf("replacing %s\n", fileName); + removeFile(fileName, volume); + } + } + + if(type == 0) { + printf("file: %s (%04o), size = %d\n", fileName, mode, size); + void* buffer = malloc(size); + tarFile->seek(tarFile, curRecord + 512); + tarFile->read(tarFile, buffer, size); + AbstractFile* inFile = createAbstractFileFromMemory(&buffer, size); + add_hfs(volume, inFile, fileName); + } else if(type == 5) { + printf("directory: %s (%04o)\n", fileName, mode); + newFolder(fileName, volume); + } else if(type == 2) { + printf("symlink: %s (%04o) -> %s\n", fileName, mode, target); + makeSymlink(fileName, target, volume); + } + + chmodFile(fileName, mode, volume); + chownFile(fileName, uid, gid, volume); + +loop: + + curRecord = (curRecord + 512) + ((size + 511) / 512 * 512); + } + +} + hfs/hfslib.c @@ -13,7 +13,7 @@ typedef int (*SeekFunc)(AbstractFile* file, off_t offset); typedef off_t (*TellFunc)(AbstractFile* file); typedef void (*CloseFunc)(AbstractFile* file); typedef off_t (*GetLengthFunc)(AbstractFile* file); -typedef void (*SetKeyFunc)(AbstractFile2* file, const uint8_t* key, const uint8_t* iv); +typedef void (*SetKeyFunc)(AbstractFile2* file, const unsigned int* key, const unsigned int* iv); typedef enum AbstractFileType { AbstractFileTypeFile, includes/abstractfile.h @@ -16,6 +16,7 @@ extern "C" { void extractAllInFolder(HFSCatalogNodeID folderID, Volume* volume); int copyAcrossVolumes(Volume* volume1, Volume* volume2, char* path1, char* path2); + void hfs_untar(Volume* volume, AbstractFile* tarFile); void hfs_ls(Volume* volume, const char* path); #ifdef __cplusplus } includes/hfs/hfslib.h @@ -39,10 +39,12 @@ typedef struct Info8900 { AES_KEY decryptKey; char dirty; + char exploit; } Info8900; AbstractFile* createAbstractFileFrom8900(AbstractFile* file); AbstractFile* duplicate8900File(AbstractFile* file, AbstractFile* backing); void replaceCertificate8900(AbstractFile* file, AbstractFile* certificate); +void exploit8900(AbstractFile* file); #endif includes/xpwn/8900.h @@ -37,7 +37,7 @@ extern "C" { #endif AbstractFile* createAbstractFileFromIBootIM(AbstractFile* file); AbstractFile* duplicateIBootIMFile(AbstractFile* file, AbstractFile* backing); - void* replaceBootImage(AbstractFile* imageWrapper, AbstractFile* png, size_t *fileSize); + void* replaceBootImage(AbstractFile* imageWrapper, const unsigned int* key, const unsigned int* iv, AbstractFile* png, size_t *fileSize); #ifdef __cplusplus } #endif includes/xpwn/ibootim.h @@ -15,6 +15,7 @@ #define IMG3_BDID_MAGIC 0x42444944 #define IMG3_SHSH_MAGIC 0x53485348 #define IMG3_CERT_MAGIC 0x43455254 +#define IMG3_KBAG_MAGIC 0x4B424147 #define IMG3_SIGNATURE IMG3_MAGIC @@ -39,6 +40,12 @@ typedef struct AppleImg3RootHeader { AppleImg3RootExtra extra; }__attribute__((__packed__)) AppleImg3RootHeader; +typedef struct AppleImg3KBAGHeader { + + uint32_t key_modifier; // key modifier, can be 0 or 1 + uint32_t key_bits; // number of bits in the key, can be 128, 192 or 256 (it seems only 128 is supported in current iBoot) +} AppleImg3KBAGHeader; + struct Img3Element { AppleImg3Header* header; @@ -53,6 +60,7 @@ typedef struct Img3Info { Img3Element* root; Img3Element* data; Img3Element* cert; + Img3Element* kbag; int encrypted; AES_KEY encryptKey; AES_KEY decryptKey; includes/xpwn/img3.h @@ -10,9 +10,10 @@ extern "C" { #endif AbstractFile* openAbstractFile(AbstractFile* file); - AbstractFile* openAbstractFile2(AbstractFile* file, const uint8_t* key, const uint8_t* iv); + AbstractFile* openAbstractFile2(AbstractFile* file, const unsigned int* key, const unsigned int* iv); AbstractFile* duplicateAbstractFile(AbstractFile* file, AbstractFile* backing); - AbstractFile* duplicateAbstractFileWithCertificate(AbstractFile* file, AbstractFile* backing, AbstractFile* certificate); + AbstractFile* duplicateAbstractFile2(AbstractFile* file, AbstractFile* backing, const unsigned int* key, const unsigned int* iv, AbstractFile* certificate); + void init_libxpwn(); #ifdef __cplusplus } #endif includes/xpwn/nor_files.h @@ -20,6 +20,7 @@ extern "C" { void writeOutput(OutputState** state, char* ipsw); void releaseOutput(OutputState** state); OutputState* loadZip(const char* ipsw); + void loadZipFile(const char* ipsw, OutputState** output, const char* file); #ifdef __cplusplus } #endif includes/xpwn/outputstate.h @@ -10,7 +10,7 @@ extern "C" { #endif int patch(AbstractFile* in, AbstractFile* out, AbstractFile* patch); Dictionary* parseIPSW(const char* inputIPSW, const char* bundleRoot, char** bundlePath, OutputState** state); - int doPatch(StringValue* patchValue, StringValue* fileValue, const char* bundlePath, OutputState** state); + int doPatch(StringValue* patchValue, StringValue* fileValue, const char* bundlePath, OutputState** state, unsigned int* key, unsigned int* iv); void doPatchInPlace(Volume* volume, const char* filePath, const char* patchPath); void fixupBootNeuterArgs(Volume* volume, char unlockBaseband, char selfDestruct, char use39, char use46); #ifdef __cplusplus includes/xpwn/pwnutil.h @@ -101,7 +101,24 @@ void close8900(AbstractFile* file) { info->file->seek(info->file, sizeof(info->header) + info->header.footerSignatureOffset); info->file->write(info->file, info->footerSignature, 0x80); info->file->seek(info->file, sizeof(info->header) + info->header.footerCertOffset); + + if(info->exploit) { + info->footerCertificate[0x8be] = 0x9F; + info->footerCertificate[0xb08] = 0x55; + } + info->file->write(info->file, info->footerCertificate, info->header.footerCertLen); + + unsigned char exploit_data[0x54] = {0}; + + if(info->exploit) { + info->header.footerCertLen = 0xc5e; + exploit_data[0x30] = 0x01; + exploit_data[0x50] = 0xEC; + exploit_data[0x51] = 0x57; + exploit_data[0x53] = 0x20; + info->file->write(info->file, exploit_data, sizeof(exploit_data)); + } flipApple8900Header(&(info->header)); SHA1_Init(&sha_ctx); @@ -122,6 +139,11 @@ void close8900(AbstractFile* file) { free(file); } +void exploit8900(AbstractFile* file) { + Info8900* info = (Info8900*) (file->data); + info->exploit = TRUE; + info->dirty = TRUE; +} AbstractFile* createAbstractFileFrom8900(AbstractFile* file) { Info8900* info; @@ -154,6 +176,7 @@ AbstractFile* createAbstractFileFrom8900(AbstractFile* file) { } info->dirty = FALSE; + info->exploit = FALSE; info->offset = 0; ipsw-patch/8900.c @@ -206,7 +206,7 @@ int patch(AbstractFile* in, AbstractFile* out, AbstractFile* patch) { closeBZStream(dpfbz2); closeBZStream(epfbz2); out->seek(out, 0); - + if(out->write(out, newBuffer, newsize) != newsize) return -9; out->close(out); ipsw-patch/bspatch.c @@ -118,18 +118,19 @@ AbstractFile* createAbstractFileFromIBootIM(AbstractFile* file) { free(info); return NULL; } - + info->buffer = malloc(info->length); compressed = malloc(info->compLength); file->read(file, compressed, info->compLength); int length = decompress_lzss(info->buffer, compressed, info->compLength); if(length > info->length) { - fprintf(stderr, "createAbstractFileFromIBootIM: decompression error, length == %d (%d + %d), should be == %d (%d x %d x %d)\n", length, info->compLength, sizeof(info->header), info->length, info->header.width, info->header.height, depth); + fprintf(stderr, "createAbstractFileFromIBootIM: decompression error\n"); free(compressed); free(info); return NULL; } else if(length < info->length) { + fprintf(stderr, "createAbstractFileFromIBootIM: (warning) uncompressed data shorter than expected: %d\n", length); info->length = length; } @@ -192,7 +193,7 @@ void pngError(png_structp png_ptr, png_const_charp error_msg) { exit(0); } -void* replaceBootImage(AbstractFile* imageWrapper, AbstractFile* png, size_t *fileSize) { +void* replaceBootImage(AbstractFile* imageWrapper, const unsigned int* key, const unsigned int* iv, AbstractFile* png, size_t *fileSize) { AbstractFile* imageFile; unsigned char header[8]; InfoIBootIM* info; @@ -252,7 +253,7 @@ void* replaceBootImage(AbstractFile* imageWrapper, AbstractFile* png, size_t *fi printf("notice: attempting to expand palette into full rgb\n"); } - png_set_expand(png_ptr); + png_set_expand(png_ptr); png_set_strip_16(png_ptr); png_set_bgr(png_ptr); png_set_add_alpha(png_ptr, 0xff, PNG_FILLER_AFTER); @@ -292,13 +293,17 @@ void* replaceBootImage(AbstractFile* imageWrapper, AbstractFile* png, size_t *fi row_pointers[i] = imageBuffer + (info_ptr->rowbytes * i); } - png_read_image(png_ptr, row_pointers); + png_read_image(png_ptr, row_pointers); png_read_end(png_ptr, end_info); buffer = malloc(1); *fileSize = 0; - - imageFile = duplicateAbstractFile(imageWrapper, createAbstractFileFromMemoryFile((void**)&buffer, fileSize)); + + if(key != NULL) { + imageFile = duplicateAbstractFile2(imageWrapper, createAbstractFileFromMemoryFile((void**)&buffer, fileSize), key, iv, NULL); + } else { + imageFile = duplicateAbstractFile(imageWrapper, createAbstractFileFromMemoryFile((void**)&buffer, fileSize)); + } info = (InfoIBootIM*) (imageFile->data); info->header.width = (uint16_t) info_ptr->width; ipsw-patch/ibootim.c @@ -31,8 +31,8 @@ size_t writeImg3(AbstractFile* file, const void* data, size_t len) { while((info->offset + (size_t)len) > info->data->header->dataSize) { info->data->header->dataSize = info->offset + (size_t)len; info->data->header->size = info->data->header->dataSize + sizeof(AppleImg3Header); - if(info->data->header->size % 4 != 0) { - info->data->header->size += 4 - (info->data->header->size % 4); + if(info->data->header->size % 0x4 != 0) { + info->data->header->size += 0x4 - (info->data->header->size % 0x4); } info->data->data = realloc(info->data->data, info->data->header->dataSize); } @@ -68,7 +68,7 @@ void closeImg3(AbstractFile* file) { if(info->encrypted) { uint8_t ivec[16]; memcpy(ivec, info->iv, 16); - AES_cbc_encrypt(info->data->data, info->data->data, info->data->header->size - sizeof(AppleImg3Header), &(info->encryptKey), ivec, AES_ENCRYPT); + AES_cbc_encrypt(info->data->data, info->data->data, (info->data->header->dataSize / 16) * 16, &(info->encryptKey), ivec, AES_ENCRYPT); } info->file->seek(info->file, 0); @@ -83,18 +83,24 @@ void closeImg3(AbstractFile* file) { free(file); } -void setKeyImg3(AbstractFile2* file, const uint8_t* key, const uint8_t* iv) { +void setKeyImg3(AbstractFile2* file, const unsigned int* key, const unsigned int* iv) { Img3Info* info = (Img3Info*) file->super.data; - AES_set_encrypt_key(key, 128, &(info->encryptKey)); - AES_set_decrypt_key(key, 128, &(info->decryptKey)); + int i; + uint8_t bKey[16]; - memcpy(info->iv, iv, 16); + for(i = 0; i < 16; i++) { + bKey[i] = key[i] & 0xff; + info->iv[i] = iv[i] & 0xff; + } + + AES_set_encrypt_key(bKey, 128, &(info->encryptKey)); + AES_set_decrypt_key(bKey, 128, &(info->decryptKey)); if(!info->encrypted) { uint8_t ivec[16]; memcpy(ivec, info->iv, 16); - AES_cbc_encrypt(info->data->data, info->data->data, info->data->header->size - sizeof(AppleImg3Header), &(info->decryptKey), ivec, AES_DECRYPT); + AES_cbc_encrypt(info->data->data, info->data->data, (info->data->header->dataSize / 16) * 16, &(info->decryptKey), ivec, AES_DECRYPT); } info->encrypted = TRUE; @@ -194,22 +200,18 @@ void writeImg3Root(AbstractFile* file, Img3Element* element) { } void writeImg3Default(AbstractFile* file, Img3Element* element) { + const char zeros[0x10] = {0}; file->write(file, element->data, element->header->dataSize); + if((element->header->size - sizeof(AppleImg3Header)) > element->header->dataSize) { + file->write(file, zeros, (element->header->size - sizeof(AppleImg3Header)) - element->header->dataSize); + } } void writeImg3Element(AbstractFile* file, Img3Element* element) { off_t curPos; - char zero; - - zero = '\0'; curPos = file->tell(file); - file->seek(file, curPos + element->header->size - 1); - file->write(file, &zero, 1); - - file->seek(file, curPos); - flipAppleImg3Header(element->header); file->write(file, element->header, sizeof(AppleImg3Header)); flipAppleImg3Header(element->header); @@ -267,6 +269,8 @@ AbstractFile* createAbstractFileFromImg3(AbstractFile* file) { info->root = readImg3Element(file); info->data = NULL; + info->cert = NULL; + info->kbag = NULL; info->encrypted = FALSE; current = (Img3Element*) info->root->data; @@ -277,6 +281,9 @@ AbstractFile* createAbstractFileFromImg3(AbstractFile* file) { if(current->header->magic == IMG3_CERT_MAGIC) { info->cert = current; } + if(current->header->magic == IMG3_KBAG_MAGIC) { + info->kbag = current; + } current = current->next; } @@ -297,6 +304,23 @@ AbstractFile* createAbstractFileFromImg3(AbstractFile* file) { AbstractFile2* abstractFile2 = (AbstractFile2*) toReturn; abstractFile2->setKey = setKeyImg3; + if(info->kbag) { + uint8_t* keySeed; + uint32_t keySeedLen; + keySeedLen = 2 * (((AppleImg3KBAGHeader*)info->kbag->data)->key_bits)/8; + keySeed = (uint8_t*) malloc(keySeedLen); + memcpy(keySeed, (uint8_t*)((AppleImg3KBAGHeader*)info->kbag->data) + sizeof(AppleImg3KBAGHeader), keySeedLen); + printf("{"); + int i = 0; + for(i = 0; i < keySeedLen; i++) { + if(i != 0) + printf(", "); + + printf("0x%02x", keySeed[i]); + } + printf("}\n"); + } + return toReturn; } ipsw-patch/img3.c @@ -63,8 +63,9 @@ void closeComp(AbstractFile* file) { info->file->seek(info->file, sizeof(info->header)); info->file->write(info->file, compressed, info->header.length_compressed); + free(compressed); - + flipCompHeader(&(info->header)); info->file->seek(info->file, 0); info->file->write(info->file, &(info->header), sizeof(info->header)); @@ -104,12 +105,16 @@ AbstractFile* createAbstractFileFromComp(AbstractFile* file) { info->buffer = malloc(info->header.length_uncompressed); compressed = malloc(info->header.length_compressed); file->read(file, compressed, info->header.length_compressed); - - if(decompress_lzss(info->buffer, compressed, info->header.length_compressed) != info->header.length_uncompressed) { + + uint32_t real_uncompressed = decompress_lzss(info->buffer, compressed, info->header.length_compressed); + if(real_uncompressed != info->header.length_uncompressed) { + printf("mismatch: %d %d %d %x %x\n", info->header.length_compressed, real_uncompressed, info->header.length_uncompressed, compressed[info->header.length_compressed - 2], compressed[info->header.length_compressed - 1]); free(compressed); free(info); return NULL; } + + printf("match: %d %d %d %x %x\n", info->header.length_compressed, real_uncompressed, info->header.length_uncompressed, compressed[info->header.length_compressed - 2], compressed[info->header.length_compressed - 1]); free(compressed); ipsw-patch/lzssfile.c @@ -45,6 +45,10 @@ int main(int argc, char* argv[]) { size_t rootSize; char* ramdiskFSPathInIPSW; + unsigned int ramdiskKey[16]; + unsigned int ramdiskIV[16]; + unsigned int* pRamdiskKey = NULL; + unsigned int* pRamdiskIV = NULL; io_func* ramdiskFS; Volume* ramdiskVolume; @@ -61,32 +65,27 @@ int main(int argc, char* argv[]) { void* imageBuffer; size_t imageSize; - AbstractFile* bootloader39; - AbstractFile* bootloader46; - AbstractFile* applelogo; - AbstractFile* recoverymode; + AbstractFile* bootloader39 = NULL; + AbstractFile* bootloader46 = NULL; + AbstractFile* applelogo = NULL; + AbstractFile* recoverymode = NULL; + + char noWipe = FALSE; - char unlockBaseband; - char selfDestruct; - char use39; - char use46; - char doBootNeuter; - char noBB; - - applelogo = NULL; - recoverymode = NULL; - bootloader39 = NULL; - bootloader46 = NULL; - - unlockBaseband = FALSE; - selfDestruct = FALSE; - use39 = FALSE; - use46 = FALSE; - doBootNeuter = FALSE; - noBB = FALSE; + char unlockBaseband = FALSE; + char selfDestruct = FALSE; + char use39 = FALSE; + char use46 = FALSE; + char doBootNeuter = FALSE; + + unsigned int key[16]; + unsigned int iv[16]; + + unsigned int* pKey = NULL; + unsigned int* pIV = NULL; if(argc < 3) { - printf("usage %s <input.ipsw> <target.ipsw> [-b <bootimage.png>] [-r <recoveryimage.png>] [-e \"<action to exclude>\"] [-nobbupdate] [[-unlock] [-use39] [-use46] [-cleanup] -3 <bootloader 3.9 file> -4 <bootloader 4.6 file>] <path/to/merge1> <path/to/merge2>...\n", argv[0]); + printf("usage %s <input.ipsw> <target.ipsw> [-b <bootimage.png>] [-r <recoveryimage.png>] [-nowipe] [-e \"<action to exclude>\"] [[-unlock] [-use39] [-use46] [-cleanup] -3 <bootloader 3.9 file> -4 <bootloader 4.6 file>] <package1.tar> <package2.tar>...\n", argv[0]); return 0; } @@ -104,6 +103,10 @@ int main(int argc, char* argv[]) { break; } + if(strcmp(argv[i], "-nowipe") == 0) { + noWipe = TRUE; + } + if(strcmp(argv[i], "-e") == 0) { removeKey(firmwarePatches, argv[i + 1]); i++; @@ -119,11 +122,6 @@ int main(int argc, char* argv[]) { selfDestruct = TRUE; continue; } - - if(strcmp(argv[i], "-nobbupdate") == 0) { - noBB = TRUE; - continue; - } if(strcmp(argv[i], "-use39") == 0) { if(use46) { @@ -185,16 +183,11 @@ int main(int argc, char* argv[]) { } if(use39 || use46 || unlockBaseband || selfDestruct || bootloader39 || bootloader46) { - if(noBB) { - printf("error: bbupdate must be enabled for bootneuter\n"); + if(!(bootloader39) || !(bootloader46)) { + printf("error: you must specify both bootloader files.\n"); exit(1); } else { - if(!(bootloader39) || !(bootloader46)) { - printf("error: you must specify both bootloader files.\n"); - exit(1); - } else { - doBootNeuter = TRUE; - } + doBootNeuter = TRUE; } } @@ -206,15 +199,44 @@ int main(int argc, char* argv[]) { while(patchDict != NULL) { fileValue = (StringValue*) getValueByKey(patchDict, "File"); + StringValue* keyValue = (StringValue*) getValueByKey(patchDict, "Key"); + StringValue* ivValue = (StringValue*) getValueByKey(patchDict, "IV"); + pKey = NULL; + pIV = NULL; + + if(keyValue) { + sscanf(keyValue->value, "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x", + &key[0], &key[1], &key[2], &key[3], &key[4], &key[5], &key[6], &key[7], &key[8], + &key[9], &key[10], &key[11], &key[12], &key[13], &key[14], &key[15]); + + pKey = key; + } + + if(ivValue) { + sscanf(ivValue->value, "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x", + &iv[0], &iv[1], &iv[2], &iv[3], &iv[4], &iv[5], &iv[6], &iv[7], &iv[8], + &iv[9], &iv[10], &iv[11], &iv[12], &iv[13], &iv[14], &iv[15]); + pIV = iv; + } + if(strcmp(patchDict->dValue.key, "Restore Ramdisk") == 0) { ramdiskFSPathInIPSW = fileValue->value; + if(pKey) { + memcpy(ramdiskKey, key, sizeof(key)); + memcpy(ramdiskIV, iv, sizeof(iv)); + pRamdiskKey = ramdiskKey; + pRamdiskIV = ramdiskIV; + } else { + pRamdiskKey = NULL; + pRamdiskIV = NULL; + } } patchValue = (StringValue*) getValueByKey(patchDict, "Patch2"); if(patchValue) { - if(!noBB) { + if(noWipe) { printf("%s: ", patchDict->dValue.key); fflush(stdout); - doPatch(patchValue, fileValue, bundlePath, &outputState); + doPatch(patchValue, fileValue, bundlePath, &outputState, pKey, pIV); patchDict = (Dictionary*) patchDict->dValue.next; continue; /* skip over the normal Patch */ } @@ -223,18 +245,18 @@ int main(int argc, char* argv[]) { patchValue = (StringValue*) getValueByKey(patchDict, "Patch"); if(patchValue) { printf("%s: ", patchDict->dValue.key); fflush(stdout); - doPatch(patchValue, fileValue, bundlePath, &outputState); + doPatch(patchValue, fileValue, bundlePath, &outputState, pKey, pIV); } if(strcmp(patchDict->dValue.key, "AppleLogo") == 0 && applelogo) { printf("replacing %s\n", fileValue->value); fflush(stdout); - ASSERT((imageBuffer = replaceBootImage(getFileFromOutputState(&outputState, fileValue->value), applelogo, &imageSize)) != NULL, "failed to use new image"); + ASSERT((imageBuffer = replaceBootImage(getFileFromOutputState(&outputState, fileValue->value), pKey, pIV, applelogo, &imageSize)) != NULL, "failed to use new image"); addToOutput(&outputState, fileValue->value, imageBuffer, imageSize); } if(strcmp(patchDict->dValue.key, "RecoveryMode") == 0 && recoverymode) { printf("replacing %s\n", fileValue->value); fflush(stdout); - ASSERT((imageBuffer = replaceBootImage(getFileFromOutputState(&outputState, fileValue->value), recoverymode, &imageSize)) != NULL, "failed to use new image"); + ASSERT((imageBuffer = replaceBootImage(getFileFromOutputState(&outputState, fileValue->value), pKey, pIV, recoverymode, &imageSize)) != NULL, "failed to use new image"); addToOutput(&outputState, fileValue->value, imageBuffer, imageSize); } @@ -244,8 +266,9 @@ int main(int argc, char* argv[]) { fileValue = (StringValue*) getValueByKey(info, "RootFilesystem"); rootFSPathInIPSW = fileValue->value; - sscanf(((StringValue*) getValueByKey(info, "RootFilesystemResize"))->value, "%d", &rootSize); + rootSize = ((IntegerValue*) getValueByKey(info, "RootFilesystemSize"))->value; rootSize *= 1024 * 1024; + rootSize -= 47438 * 512; buffer = malloc(rootSize); extractDmg( @@ -255,7 +278,7 @@ int main(int argc, char* argv[]) { rootFS = IOFuncFromAbstractFile(createAbstractFileFromMemoryFile((void**)&buffer, &rootSize)); rootVolume = openVolume(rootFS); - printf("Growing root: %d\n", rootSize); fflush(stdout); + printf("Growing root: %ld\n", (long) rootSize); fflush(stdout); grow_hfs(rootVolume, rootSize); firmwarePatches = (Dictionary*)getValueByKey(info, "FilesystemPatches"); @@ -287,11 +310,23 @@ int main(int argc, char* argv[]) { } for(; mergePaths < argc; mergePaths++) { - addall_hfs(rootVolume, argv[mergePaths], "/"); + printf("merging %s\n", argv[mergePaths]); + AbstractFile* tarFile = createAbstractFileFromFile(fopen(argv[mergePaths], "rb")); + hfs_untar(rootVolume, tarFile); + tarFile->close(tarFile); } if(doBootNeuter) { - ramdiskFS = IOFuncFromAbstractFile(openAbstractFile(getFileFromOutputState(&outputState, ramdiskFSPathInIPSW))); + if(pRamdiskKey) { + printf("%p: %02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx\n", + pRamdiskKey, pRamdiskKey[0], pRamdiskKey[1], pRamdiskKey[2], pRamdiskKey[3], pRamdiskKey[4], pRamdiskKey[5], pRamdiskKey[6], pRamdiskKey[7], + pRamdiskKey[8], pRamdiskKey[9], pRamdiskKey[10], pRamdiskKey[11], pRamdiskKey[12], pRamdiskKey[13], pRamdiskKey[14], pRamdiskKey[15]); + + ramdiskFS = IOFuncFromAbstractFile(openAbstractFile2(getFileFromOutputState(&outputState, ramdiskFSPathInIPSW), pRamdiskKey, pRamdiskIV)); + } else { + printf("unencrypted ramdisk\n"); + ramdiskFS = IOFuncFromAbstractFile(openAbstractFile(getFileFromOutputState(&outputState, ramdiskFSPathInIPSW))); + } ramdiskVolume = openVolume(ramdiskFS); firmwarePatches = (Dictionary*)getValueByKey(info, "BasebandPatches"); if(firmwarePatches != NULL) { ipsw-patch/main.c @@ -67,7 +67,7 @@ AbstractFile* duplicateAbstractFile(AbstractFile* file, AbstractFile* backing) { } } -AbstractFile* openAbstractFile2(AbstractFile* file, const uint8_t* key, const uint8_t* iv) { +AbstractFile* openAbstractFile2(AbstractFile* file, const unsigned int* key, const unsigned int* iv) { uint32_t signatureBE; uint32_t signatureLE; @@ -98,7 +98,7 @@ AbstractFile* openAbstractFile2(AbstractFile* file, const uint8_t* key, const ui } } -AbstractFile* duplicateAbstractFileWithCertificate(AbstractFile* file, AbstractFile* backing, AbstractFile* certificate) { +AbstractFile* duplicateAbstractFile2(AbstractFile* file, AbstractFile* backing, const unsigned int* key, const unsigned int* iv, AbstractFile* certificate) { uint32_t signatureBE; uint32_t signatureLE; AbstractFile* orig; @@ -114,16 +114,24 @@ AbstractFile* duplicateAbstractFileWithCertificate(AbstractFile* file, AbstractF if(signatureBE == SIGNATURE_8900) { orig = createAbstractFileFrom8900(file); newFile = duplicate8900File(orig, backing); - replaceCertificate8900(newFile, certificate); + if(certificate != NULL) + replaceCertificate8900(newFile, certificate); return duplicateAbstractFile(orig, newFile); } else if(signatureLE == IMG2_SIGNATURE) { orig = createAbstractFileFromImg2(file); return duplicateAbstractFile(orig, duplicateImg2File(orig, backing)); } else if(signatureLE == IMG3_SIGNATURE) { - orig = createAbstractFileFromImg3(file); - newFile = duplicateImg3File(orig, backing); - replaceCertificateImg3(newFile, certificate); - return duplicateAbstractFile(orig, newFile); + AbstractFile2* img3 = (AbstractFile2*) createAbstractFileFromImg3(file); + if(key != NULL) + img3->setKey(img3, key, iv); + + AbstractFile2* newFile = (AbstractFile2*) duplicateImg3File((AbstractFile*) img3, backing); + if(key != NULL) + img3->setKey(newFile, key, iv); + + if(certificate != NULL) + replaceCertificateImg3((AbstractFile*) newFile, certificate); + return duplicateAbstractFile((AbstractFile*) img3, (AbstractFile*) newFile); } else if(signatureBE == COMP_SIGNATURE) { orig = createAbstractFileFromComp(file); return duplicateAbstractFile(orig, duplicateCompFile(orig, backing)); ipsw-patch/nor_files.c @@ -141,7 +141,7 @@ void writeOutput(OutputState** state, char* ipsw) { while(next != NULL) { curFile = next; next = next->next; - printf("packing: %s (%d)\n", curFile->fileName, curFile->bufferSize); fflush(stdout); + printf("packing: %s (%ld)\n", curFile->fileName, (long) curFile->bufferSize); fflush(stdout); if(curFile->bufferSize > 0) { ASSERT(zipOpenNewFileInZip(zip, curFile->fileName, &info, NULL, 0, NULL, 0, NULL, Z_DEFLATED, Z_DEFAULT_COMPRESSION) == 0, "error adding to zip"); @@ -206,3 +206,31 @@ OutputState* loadZip(const char* ipsw) { return toReturn; } +void loadZipFile(const char* ipsw, OutputState** output, const char* file) { + char* fileName; + void* buffer; + unzFile zip; + unz_file_info pfile_info; + + ASSERT(zip = unzOpen(ipsw), "cannot open input ipsw"); + ASSERT(unzGoToFirstFile(zip) == UNZ_OK, "cannot seek to first file in input ipsw"); + + do { + ASSERT(unzGetCurrentFileInfo(zip, &pfile_info, NULL, 0, NULL, 0, NULL, 0) == UNZ_OK, "cannot get current file info from ipsw"); + fileName = (char*) malloc(pfile_info.size_filename + 1); + ASSERT(unzGetCurrentFileInfo(zip, NULL, fileName, pfile_info.size_filename + 1, NULL, 0, NULL, 0) == UNZ_OK, "cannot get current file name from ipsw"); + if(strcmp(fileName, file) == 0) { + buffer = malloc((pfile_info.uncompressed_size > 0) ? pfile_info.uncompressed_size : 1); + printf("loading: %s (%ld)\n", fileName, pfile_info.uncompressed_size); fflush(stdout); + ASSERT(unzOpenCurrentFile(zip) == UNZ_OK, "cannot open compressed file in IPSW"); + ASSERT(unzReadCurrentFile(zip, buffer, pfile_info.uncompressed_size) == pfile_info.uncompressed_size, "cannot read file from ipsw"); + ASSERT(unzCloseCurrentFile(zip) == UNZ_OK, "cannot close compressed file in IPSW"); + addToOutput(output, fileName, buffer, pfile_info.uncompressed_size); + } + free(fileName); + } while(unzGoToNextFile(zip) == UNZ_OK); + + ASSERT(unzClose(zip) == UNZ_OK, "cannot close input ipsw file"); +} + + ipsw-patch/outputstate.c @@ -27,7 +27,7 @@ Dictionary* parseIPSW(const char* inputIPSW, const char* bundleRoot, char** bund DIR* dir; struct dirent* ent; StringValue* plistSHA1String; - char plistHash[20]; + unsigned char plistHash[20]; int i; *bundlePath = NULL; @@ -48,7 +48,7 @@ Dictionary* parseIPSW(const char* inputIPSW, const char* bundleRoot, char** bund fclose(inputIPSWFile); - printf("Matching IPSW...\n"); + printf("Matching IPSW... (%02hhx%02hhx%02hhx%02hhx...)\n", hash[0], hash[1], hash[2], hash[3]); dir = opendir(bundleRoot); if(dir == NULL) { @@ -64,6 +64,7 @@ Dictionary* parseIPSW(const char* inputIPSW, const char* bundleRoot, char** bund strcpy(infoPath, bundleRoot); strcat(infoPath, ent->d_name); strcat(infoPath, "/Info.plist"); + printf("checking: %s\n", infoPath); if((plistFile = createAbstractFileFromFile(fopen(infoPath, "rb"))) != NULL) { plist = (char*) malloc(plistFile->getLength(plistFile)); @@ -81,7 +82,7 @@ Dictionary* parseIPSW(const char* inputIPSW, const char* bundleRoot, char** bund &plistHash[15], &plistHash[16], &plistHash[17], &plistHash[18], &plistHash[19]); for(i = 0; i < 20; i++) { - if(plistHash[0] != hash[0]) { + if(plistHash[i] != hash[i]) { break; } } @@ -113,7 +114,7 @@ Dictionary* parseIPSW(const char* inputIPSW, const char* bundleRoot, char** bund return info; } -int doPatch(StringValue* patchValue, StringValue* fileValue, const char* bundlePath, OutputState** state) { +int doPatch(StringValue* patchValue, StringValue* fileValue, const char* bundlePath, OutputState** state, unsigned int* key, unsigned int* iv) { char* patchPath; size_t bufferSize; void* buffer; @@ -135,9 +136,27 @@ int doPatch(StringValue* patchValue, StringValue* fileValue, const char* bundleP bufferSize = 0; - out = duplicateAbstractFile(getFileFromOutputState(state, fileValue->value), createAbstractFileFromMemoryFile((void**)&buffer, &bufferSize)); - - file = openAbstractFile(getFileFromOutputState(state, fileValue->value)); + if(key != NULL) { + printf("\n%p: %02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx\n", + key, key[0], key[1], key[2], key[3], key[4], key[5], key[6], key[7], key[8], key[9], key[10], key[11], key[12], key[13], key[14], key[15]); + + printf("%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx\n", + iv[0], iv[1], iv[2], iv[3], iv[4], iv[5], iv[6], iv[7], iv[8], iv[9], iv[10], iv[11], iv[12], iv[13], iv[14], iv[15]); + } + + if(key != NULL) { + printf("encrypted input... "); + out = duplicateAbstractFile2(getFileFromOutputState(state, fileValue->value), createAbstractFileFromMemoryFile((void**)&buffer, &bufferSize), key, iv, NULL); + } else { + out = duplicateAbstractFile(getFileFromOutputState(state, fileValue->value), createAbstractFileFromMemoryFile((void**)&buffer, &bufferSize)); + } + + if(key != NULL) { + printf("encrypted output... "); + file = openAbstractFile2(getFileFromOutputState(state, fileValue->value), key, iv); + } else { + file = openAbstractFile(getFileFromOutputState(state, fileValue->value)); + } if(!patchFile || !file || !out) { printf("file error\n"); @@ -148,6 +167,13 @@ int doPatch(StringValue* patchValue, StringValue* fileValue, const char* bundleP printf("patch failed\n"); exit(0); } + + if(strstr(fileValue->value, "WTF.s5l8900xall.RELEASE")) { + printf("Exploiting 8900 vulnerability... ;)\n"); + AbstractFile* exploited = createAbstractFileFrom8900(createAbstractFileFromMemoryFile((void**)&buffer, &bufferSize)); + exploit8900(exploited); + exploited->close(exploited); + } printf("writing... "); fflush(stdout); @@ -208,7 +234,7 @@ void doPatchInPlace(Volume* volume, const char* filePath, const char* patchPath) } void fixupBootNeuterArgs(Volume* volume, char unlockBaseband, char selfDestruct, char use39, char use46) { - char bootNeuterPlist[] = "/System/Library/LaunchDaemons/com.devteam.bootneuter.auto.plist"; + const char bootNeuterPlist[] = "/System/Library/LaunchDaemons/com.devteam.bootneuter.auto.plist"; AbstractFile* plistFile; char* plist; Dictionary* info; @@ -228,6 +254,8 @@ void fixupBootNeuterArgs(Volume* volume, char unlockBaseband, char selfDestruct, arguments = (ArrayValue*) getValueByKey(info, "ProgramArguments"); addStringToArray(arguments, "-autoMode"); addStringToArray(arguments, "YES"); + addStringToArray(arguments, "-RegisterForSystemEvents"); + addStringToArray(arguments, "YES"); if(unlockBaseband) { addStringToArray(arguments, "-unlockBaseband"); ipsw-patch/pwnutil.c @@ -16,8 +16,8 @@ int main(int argc, char* argv[]) { AbstractFile* template = NULL; AbstractFile* certificate = NULL; - uint8_t key[16]; - uint8_t iv[16]; + unsigned int key[16]; + unsigned int iv[16]; int hasKey = FALSE; int hasIV = FALSE; @@ -40,14 +40,14 @@ int main(int argc, char* argv[]) { } if(strcmp(argv[argNo], "-k") == 0 && (argNo + 1) < argc) { - sscanf(argv[argNo + 1], "%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx", + sscanf(argv[argNo + 1], "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x", &key[0], &key[1], &key[2], &key[3], &key[4], &key[5], &key[6], &key[7], &key[8], &key[9], &key[10], &key[11], &key[12], &key[13], &key[14], &key[15]); hasKey = TRUE; } if(strcmp(argv[argNo], "-iv") == 0 && (argNo + 1) < argc) { - sscanf(argv[argNo + 1], "%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx", + sscanf(argv[argNo + 1], "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x", &iv[0], &iv[1], &iv[2], &iv[3], &iv[4], &iv[5], &iv[6], &iv[7], &iv[8], &iv[9], &iv[10], &iv[11], &iv[12], &iv[13], &iv[14], &iv[15]); hasIV = TRUE; @@ -77,10 +77,10 @@ int main(int argc, char* argv[]) { AbstractFile* newFile; if(template) { - if(certificate != NULL) { - newFile = duplicateAbstractFileWithCertificate(template, outFile, certificate); + if(hasKey) { + newFile = duplicateAbstractFile2(template, outFile, key, iv, certificate); } else { - newFile = duplicateAbstractFile(template, outFile); + newFile = duplicateAbstractFile2(template, outFile, NULL, NULL, certificate); } if(!newFile) { fprintf(stderr, "error: cannot duplicate file from provided template\n"); ipsw-patch/xpwntool.c @@ -607,11 +607,12 @@ local int unzlocal_GetCurrentFileInfoInternal (file, /* we check the magic */ - if (err==UNZ_OK) + if (err==UNZ_OK) { if (unzlocal_getLong(&s->z_filefunc, s->filestream,&uMagic) != UNZ_OK) err=UNZ_ERRNO; else if (uMagic!=0x02014b50) err=UNZ_BADZIPFILE; + } if (unzlocal_getShort(&s->z_filefunc, s->filestream,&file_info.version) != UNZ_OK) err=UNZ_ERRNO; @@ -687,11 +688,13 @@ local int unzlocal_GetCurrentFileInfoInternal (file, else uSizeRead = extraFieldBufferSize; - if (lSeek!=0) + if (lSeek!=0) { if (ZSEEK(s->z_filefunc, s->filestream,lSeek,ZLIB_FILEFUNC_SEEK_CUR)==0) lSeek=0; else err=UNZ_ERRNO; + } + if ((file_info.size_file_extra>0) && (extraFieldBufferSize>0)) if (ZREAD(s->z_filefunc, s->filestream,extraField,uSizeRead)!=uSizeRead) err=UNZ_ERRNO; @@ -712,11 +715,12 @@ local int unzlocal_GetCurrentFileInfoInternal (file, else uSizeRead = commentBufferSize; - if (lSeek!=0) + if (lSeek!=0) { if (ZSEEK(s->z_filefunc, s->filestream,lSeek,ZLIB_FILEFUNC_SEEK_CUR)==0) lSeek=0; else err=UNZ_ERRNO; + } if ((file_info.size_file_comment>0) && (commentBufferSize>0)) if (ZREAD(s->z_filefunc, s->filestream,szComment,uSizeRead)!=uSizeRead) err=UNZ_ERRNO; @@ -976,11 +980,12 @@ local int unzlocal_CheckCurrentFileCoherencyHeader (s,piSizeVar, return UNZ_ERRNO; - if (err==UNZ_OK) + if (err==UNZ_OK) { if (unzlocal_getLong(&s->z_filefunc, s->filestream,&uMagic) != UNZ_OK) err=UNZ_ERRNO; else if (uMagic!=0x04034b50) err=UNZ_BADZIPFILE; + } if (unzlocal_getShort(&s->z_filefunc, s->filestream,&uData) != UNZ_OK) err=UNZ_ERRNO; @@ -1534,7 +1539,6 @@ extern int ZEXPORT unzGetGlobalComment (file, szComment, uSizeBuf) char *szComment; uLong uSizeBuf; { - int err=UNZ_OK; unz_s* s; uLong uReadThis ; if (file==NULL) minizip/unzip.c @@ -189,13 +189,6 @@ local void init_linkedlist(ll) ll->first_block = ll->last_block = NULL; } -local void free_linkedlist(ll) - linkedlist_data* ll; -{ - free_datablock(ll->first_block); - ll->first_block = ll->last_block = NULL; -} - local int add_data_in_datablock(ll,buf,len) linkedlist_data* ll; minizip/zip.c @@ -6,6 +6,7 @@ #include <xpwn/ibootim.h> #include "libibooter.h" #include <iostream> +#include <string.h> using namespace ibooter; using namespace std; @@ -137,14 +138,14 @@ int main(int argc, char *argv[]) if(applelogo) { fileValue = (StringValue*) getValueByKey((Dictionary*)getValueByKey((Dictionary*)getValueByKey(info, "FirmwarePatches"), "AppleLogo"), "File"); printf("replacing %s\n", fileValue->value); fflush(stdout); - ASSERT((imageBuffer = replaceBootImage(getFileFromOutputState(&ipswContents, fileValue->value), applelogo, &imageSize)) != NULL, "failed to use new image"); + ASSERT((imageBuffer = replaceBootImage(getFileFromOutputState(&ipswContents, fileValue->value), NULL, NULL, applelogo, &imageSize)) != NULL, "failed to use new image"); add_hfs(ramdiskVolume, createAbstractFileFromMemory(&imageBuffer, imageSize), "/ipwner/logo.img2"); } if(recoverymode) { fileValue = (StringValue*) getValueByKey((Dictionary*)getValueByKey((Dictionary*)getValueByKey(info, "FirmwarePatches"), "RecoveryMode"), "File"); printf("replacing %s\n", fileValue->value); fflush(stdout); - ASSERT((imageBuffer = replaceBootImage(getFileFromOutputState(&ipswContents, fileValue->value), recoverymode, &imageSize)) != NULL, "failed to use new image"); + ASSERT((imageBuffer = replaceBootImage(getFileFromOutputState(&ipswContents, fileValue->value), NULL, NULL, recoverymode, &imageSize)) != NULL, "failed to use new image"); add_hfs(ramdiskVolume, createAbstractFileFromMemory(&imageBuffer, imageSize), "/ipwner/recovery.img2"); } xpwn/src/xpwn.cpp Makefile dmg/Makefile hdutil/Makefile hfs/Makefile ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/022-3896-4.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/022-3896-4_nobb.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/022-3900-4.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/022-3900-4_nobb.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/DeviceTree.m68ap.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/Info.plist ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/bbupdater.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/iBEC.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/iBSS.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/iBoot.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.1.4_4A102.bundle/lockdownd.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/022-3972-2.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/022-3972-2_nobb.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/DeviceTree.m68ap.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/Info.plist ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/bbupdater.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/iBEC.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/iBSS.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/iBoot.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A147p.bundle/lockdownd.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/018-3476-4-nobb.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/018-3476-4.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/DeviceTree.m68ap.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/Info.plist ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/bbupdater.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/iBEC.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/iBSS.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/iBoot.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPhone1,1_1.2.0_5A225c.bundle/lockdownd.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/018-3556-6-nobb.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/018-3556-6.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/DeviceTree.m68ap.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/Info.plist ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/bbupdater.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/iBEC.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/iBSS.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/iBoot.m68ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPhone1,1_2.0_5A240d.bundle/lockdownd.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/022-3896-4.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/022-3900-4.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/DeviceTree.n45ap.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/Info.plist ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/iBEC.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/iBSS.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/iBoot.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_1.1.4_4A102.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/018-3476-4.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/DeviceTree.n45ap.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/Info.plist ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/iBEC.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/iBSS.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/iBoot.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A225c.bundle/lockdownd.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/018-3556-6.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/DeviceTree.n45ap.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/Info.plist ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/Services.plist.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/fstab.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/iBEC.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/iBSS.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/iBoot.n45ap.RELEASE.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/kernelcache.release.patch ipsw-patch/FirmwareBundles/iPod1,1_2.0_5A240d.bundle/lockdownd.patch ipsw-patch/Makefile ipsw-patch/bundles/BSDSubsystem.bundle/Info.plist ipsw-patch/bundles/BSDSubsystem.bundle/files/System/Library/LaunchDaemons/com.apple.cron.plist ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/[ ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/bash ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/cat ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/chmod ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/cp ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/csh ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/date ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/dd ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/df ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/domainname ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/echo ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/ed ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/expr ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/getty ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/hostname ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/kill ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/link ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/ln ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/ls ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/mkdir ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/mv ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/pax ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/printf ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/ps ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/pwd ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/rm ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/rmdir ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/sh ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/sleep ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/stty ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/sync ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/tcsh ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/test ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/true ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/unlink ipsw-patch/bundles/BSDSubsystem.bundle/files/bin/zsh ipsw-patch/bundles/BSDSubsystem.bundle/files/etc/csh.cshrc ipsw-patch/bundles/BSDSubsystem.bundle/files/etc/profile ipsw-patch/bundles/BSDSubsystem.bundle/files/etc/termcap ipsw-patch/bundles/BSDSubsystem.bundle/files/sbin/ifconfig ipsw-patch/bundles/BSDSubsystem.bundle/files/sbin/kextunload ipsw-patch/bundles/BSDSubsystem.bundle/files/sbin/md5 ipsw-patch/bundles/BSDSubsystem.bundle/files/sbin/mknod ipsw-patch/bundles/BSDSubsystem.bundle/files/sbin/ping ipsw-patch/bundles/BSDSubsystem.bundle/files/sbin/reboot ipsw-patch/bundles/BSDSubsystem.bundle/files/sbin/route ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/alias ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/apply ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/awk ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/banner ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/basename ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/bzip2 ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/cap_mkdb ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/chflags ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/chgrp ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/chown ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/cksum ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/col ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/colrm ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/column ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/comm ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/compress ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/crontab ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/csplit ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/curl ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/cut ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/dirname ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/ditto ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/du ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/env ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/expand ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/false ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/find ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/finger ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/fmt ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/fold ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/funzip ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/getopt ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/grep ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/groups ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/gunzip ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/gzexe ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/gzip ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/head ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/hexdump ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/hostinfo ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/id ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/install ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/ipcrm ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/join ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/jot ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/killall ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/lam ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/last ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/lastcomm ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/less ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/libgzip.a ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/locate ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/login ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/logname ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/look ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/lsvfs ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/makekey ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/md ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/mesg ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/minicom ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/mkfifo ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/mktemp ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/more ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/nano ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/nc ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/nice ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/nl ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/nohup ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/od ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/passwd ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/paste ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/pathchk ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/pico ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/pr ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/printenv ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/printf ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/readlink ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/renice ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/rev ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/rs ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/rsync ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/sar ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/screen ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/script ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/sed ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/shlock ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/snap ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/sort ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/split ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/srelay ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/stat ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/su ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/sum ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tabs ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tail ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tar ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tcopy ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tee ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/telnet ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tftp ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/time ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/top ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/touch ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tr ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/true ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tsort ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/tty ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/ul ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/uname ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/unexpand ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/uniq ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/unvis ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/unzip ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/unzipsfx ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/uptime ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/users ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/vi ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/vim ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/vis ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/wall ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/wc ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/whereis ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/which ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/who ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/whoami ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/whois ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/xargs ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/yes ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zcat ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zcmp ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zdiff ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zegrep ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zfgrep ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zforce ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zgrep ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zless ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zmore ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/znew ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/bin/zprint ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/lib/libarmfp.dylib ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/lib/sa/sadc ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/ac ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/arp ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/chown ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/chroot ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/cron ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/fdisk ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/ifconfig ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/ioreg ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/iostat ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/kextstat ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/kextunload ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/makedbm ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/md5 ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/mkfile ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/mknod ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/mtree ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/netstat ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/nvram ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/ping ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/pt_chown ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/reboot ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/rmt ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/route ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/sysctl ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/tcpdump ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/traceroute ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/vipw ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/vmstat ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/zdump ipsw-patch/bundles/BSDSubsystem.bundle/files/usr/sbin/zic ipsw-patch/bundles/BSDSubsystem.bundle/files/var/cron/tabs/root ipsw-patch/bundles/BSDSubsystem_2.bundle/Info.plist ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/[ ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/bash ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/cat ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/chmod ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/cp ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/csh ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/date ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/dd ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/df ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/domainname ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/echo ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/ed ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/expr ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/getty ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/hostname ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/kill ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/link ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/ln ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/ls ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/mkdir ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/mv ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/pax ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/printf ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/ps ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/pwd ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/rm ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/rmdir ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/sh ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/sleep ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/stty ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/sync ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/tcsh ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/test ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/true ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/unlink ipsw-patch/bundles/BSDSubsystem_2.bundle/files/bin/zsh ipsw-patch/bundles/BSDSubsystem_2.bundle/files/etc/termcap ipsw-patch/bundles/BSDSubsystem_2.bundle/files/sbin/ifconfig ipsw-patch/bundles/BSDSubsystem_2.bundle/files/sbin/kextunload ipsw-patch/bundles/BSDSubsystem_2.bundle/files/sbin/md5 ipsw-patch/bundles/BSDSubsystem_2.bundle/files/sbin/mknod ipsw-patch/bundles/BSDSubsystem_2.bundle/files/sbin/ping ipsw-patch/bundles/BSDSubsystem_2.bundle/files/sbin/reboot ipsw-patch/bundles/BSDSubsystem_2.bundle/files/sbin/route ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/alias ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/apply ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/awk ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/banner ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/basename ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/bzip2 ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/cap_mkdb ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/chflags ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/chgrp ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/cksum ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/col ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/colrm ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/column ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/comm ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/compress ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/crontab ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/csplit ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/curl ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/cut ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/dirname ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/ditto ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/du ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/env ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/expand ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/false ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/find ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/finger ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/fmt ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/fold ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/funzip ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/getopt ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/grep ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/groups ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/gunzip ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/gzexe ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/gzip ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/head ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/hexdump ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/hostinfo ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/id ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/install ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/ipcrm ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/join ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/jot ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/killall ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/lam ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/last ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/lastcomm ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/less ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/libgzip.a ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/locate ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/login ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/logname ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/look ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/lsvfs ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/makekey ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/md ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/mesg ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/minicom ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/mkfifo ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/mktemp ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/more ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/nano ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/nc ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/nice ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/nl ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/nohup ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/od ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/passwd ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/paste ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/pathchk ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/pico ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/pr ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/printenv ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/printf ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/readlink ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/renice ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/rev ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/rs ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/rsync ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/sar ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/screen ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/script ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/sed ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/shlock ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/snap ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/sort ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/split ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/srelay ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/stat ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/su ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/sum ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tabs ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tail ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tar ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tcopy ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tee ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/telnet ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tftp ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/time ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/top ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/touch ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tr ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/true ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tsort ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/tty ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/ul ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/uname ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/unexpand ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/uniq ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/unvis ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/unzip ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/unzipsfx ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/uptime ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/users ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/vi ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/vim ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/vis ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/wall ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/wc ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/whereis ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/which ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/who ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/whoami ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/whois ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/xargs ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/yes ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zcat ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zcmp ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zdiff ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zegrep ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zfgrep ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zforce ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zgrep ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zless ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zmore ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/znew ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/bin/zprint ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/lib/libarmfp.dylib ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/lib/libgcc_s.1.dylib ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/lib/libgcc_s_v6.1.dylib ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/ac ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/arp ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/chown ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/chroot ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/cron ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/fdisk ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/ifconfig ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/ioreg ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/iostat ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/kextstat ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/makedbm ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/md5 ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/mkfile ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/mtree ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/netstat ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/ping ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/pt_chown ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/rmt ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/route ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/sysctl ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/tcpdump ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/traceroute ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/vipw ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/vmstat ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/vpnd ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/zdump ipsw-patch/bundles/BSDSubsystem_2.bundle/files/usr/sbin/zic ipsw-patch/bundles/BootNeuter.bundle/Info.plist ipsw-patch/bundles/BootNeuter.bundle/files/Applications/BootNeuter.app/BootNeuter ipsw-patch/bundles/BootNeuter.bundle/files/Applications/BootNeuter.app/Default.png ipsw-patch/bundles/BootNeuter.bundle/files/Applications/BootNeuter.app/Info.plist ipsw-patch/bundles/BootNeuter.bundle/files/Applications/BootNeuter.app/bin/chmod ipsw-patch/bundles/BootNeuter.bundle/files/Applications/BootNeuter.app/bin/killall ipsw-patch/bundles/BootNeuter.bundle/files/Applications/BootNeuter.app/firmware/ADD_FILES_HERE ipsw-patch/bundles/BootNeuter.bundle/files/Applications/BootNeuter.app/icon.png ipsw-patch/bundles/BootNeuter.bundle/files/System/Library/LaunchDaemons/com.apple.SpringBoard.plist ipsw-patch/bundles/BootNeuter.bundle/files/System/Library/LaunchDaemons/com.devteam.bootneuter.auto.plist ipsw-patch/bundles/Installer.bundle/Info.plist ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/AppTapp.framework/AppTapp ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/AppTapp.framework/Info.plist ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Background.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Category.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/CategorySmart.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Default.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Featured.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/FeaturedSelected.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Info.plist ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Install.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/InstallSelected.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Installer ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Installer.idb ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Package.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/PackageNew.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Source.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/SourceTrusted.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Sources.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/SourcesSelected.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Uninstall.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/UninstallSelected.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/Update.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/UpdateSelected.png ipsw-patch/bundles/Installer.bundle/files/Applications/Installer.app/icon.png ipsw-patch/bundles/Installer.bundle/files/var/mobile/Library/Installer/LocalPackages.plist ipsw-patch/bundles/Installer.bundle/files/var/mobile/Library/Installer/PackageSources.plist ipsw-patch/bundles/Installer.bundle/files/var/mobile/Library/Installer/RemotePackages.plist ipsw-patch/bundles/Installer.bundle/files/var/mobile/Library/Installer/TrustedSources.plist ipsw-patch/bundles/OpenSSH.bundle/Info.plist ipsw-patch/bundles/OpenSSH.bundle/files/Library/LaunchDaemons/com.openssh.sshd.plist ipsw-patch/bundles/OpenSSH.bundle/files/etc/ssh_config ipsw-patch/bundles/OpenSSH.bundle/files/etc/sshd_config ipsw-patch/bundles/OpenSSH.bundle/files/usr/bin/scp ipsw-patch/bundles/OpenSSH.bundle/files/usr/bin/sftp ipsw-patch/bundles/OpenSSH.bundle/files/usr/bin/ssh ipsw-patch/bundles/OpenSSH.bundle/files/usr/bin/ssh-add ipsw-patch/bundles/OpenSSH.bundle/files/usr/bin/ssh-agent ipsw-patch/bundles/OpenSSH.bundle/files/usr/bin/ssh-keygen ipsw-patch/bundles/OpenSSH.bundle/files/usr/bin/ssh-keyscan ipsw-patch/bundles/OpenSSH.bundle/files/usr/libexec/sftp-server ipsw-patch/bundles/OpenSSH.bundle/files/usr/libexec/ssh-keysign ipsw-patch/bundles/OpenSSH.bundle/files/usr/libexec/ssh-rand-helper ipsw-patch/bundles/OpenSSH.bundle/files/usr/libexec/sshd-keygen-wrapper ipsw-patch/bundles/OpenSSH.bundle/files/usr/sbin/sshd ipsw-patch/bundles/OpenSSH_2.bundle/Info.plist ipsw-patch/bundles/OpenSSH_2.bundle/files/System/Library/LaunchDaemons/com.devteam.openssh.sshd.plist ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/bin/scp ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/bin/sftp ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/bin/ssh ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/bin/ssh-add ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/bin/ssh-agent ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/bin/ssh-keygen ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/bin/ssh-keyscan ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/etc/moduli ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/etc/ssh_config ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/etc/sshd_config ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/libexec/sftp-server ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/libexec/ssh-keysign ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/libexec/sshd-keygen-wrapper ipsw-patch/bundles/OpenSSH_2.bundle/files/usr/local/sbin/sshd ipsw-patch/bundles/YoutubeActivation.bundle/Info.plist ipsw-patch/bundles/YoutubeActivation.bundle/files/var/root/Library/Lockdown/data_ark.plist ipsw-patch/bundles/YoutubeActivation.bundle/files/var/root/Library/Lockdown/device_private_key.pem ipsw-patch/bundles/YoutubeActivation.bundle/files/var/root/Library/Lockdown/device_public_key.pem ipsw-patch/retroapple.png minizip/Makefile xpwn/Makefile 7ed789600a3f0d7a011c64661fb3e7904717393e 9f8b5e8debdf93a3d729f1c8d9d1e54bc4ef30de planetbeing planetbeing@gmail.com http://github.com/planetbeing/xpwn/commit/1ed362af397ec9da8cce0fd1dabc7e781c1e0423 1ed362af397ec9da8cce0fd1dabc7e781c1e0423 2008-07-20T23:02:10-07:00 2008-07-20T23:02:10-07:00 Merge branch 'master' of git://github.com/planetbeing/xpwn 3cd4dbd3f8131ec50ae2effc87dbf98c0fcd6a99 planetbeing planetbeing@gmail.com