Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

README Enhancements: Markdown list and added dependency #105

Open
wants to merge 14 commits into
base: master
Choose a base branch
from
Open

README Enhancements: Markdown list and added dependency #105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
ee7850c
rectified a grammatic error
EricBrianAnil Oct 1, 2019
471d350
Added Dependency for Python 2.7
DaJakerBoss Oct 1, 2019
2ff24c5
Fancied README for SoC support
DaJakerBoss Oct 1, 2019
f6f420e
Merge pull request #1 from EricBrianAnil/patch-1
DaJakerBoss Oct 1, 2019
94c60f3
fixed grammar again
DaJakerBoss Oct 1, 2019
02907f2
Some housekeeping, restructuringm aesthetic things
DaJakerBoss Oct 2, 2019
1c6f1bd
Condensing and indention
DaJakerBoss Oct 2, 2019
c2746db
Gave dependencies more priority and bolded a message
DaJakerBoss Oct 2, 2019
4907059
Added new table of detailed support
DaJakerBoss Oct 2, 2019
71a181d
Added table line breaks
DaJakerBoss Oct 2, 2019
2d1446f
hotfix for broken link
DaJakerBoss Oct 2, 2019
aa6a840
again, tried fixing link
DaJakerBoss Oct 2, 2019
d8468bd
Added a message
DaJakerBoss Oct 2, 2019
4b0da5d
unfuck the table
DaJakerBoss Oct 2, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions JAILBREAK-GUIDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ You must answer No to create a 24Kpwn IPSW using redsn0w. If you did this correc

### Compatibility with older iOS versions

Newer phones might not support some older versions of iOS. You cannot brick your phone by attempting to restore an older version of iOS, so it might be worth it to try anyway. If iTunes restore fails with Error 28, the hardware of your phone is not compatible with that version of iOS.
Newer iPhones might not support some older versions of iOS. You cannot brick your phone by attempting to restore an older version of iOS, so it might be worth it to try anyway. If iTunes restore fails with Error 28, the hardware of your phone is not compatible with that version of iOS.

| Manufactured | Error 28 | Success |
|--------------|------------|------------|
Expand All @@ -110,7 +110,7 @@ Newer phones might not support some older versions of iOS. You cannot brick your
| Week 36 2011 | 3.x | 4.0+ |
| Week 26 2012 | 3.x, 4.x | 5.0+ |

You can find the week and year of manufacture by looking at the serial number of your phone. If your phone is from 2011 or 2012, help me expand this list and let me what versions worked or didn't work.
You can find the week and year of manufacture by looking at the serial number of your phone. If your phone is from 2011 or 2012, help me expand this list and let me know what versions worked or didn't work.


### Decoding iPhone 3GS serial number
Expand Down
105 changes: 62 additions & 43 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,94 +7,113 @@

## checkm8

* permanent unpatchable bootrom exploit for hundreds of millions of iOS devices
* Permanent, unpatchable bootrom exploit for hundreds of millions of iOS devices
* Meant for researchers, **this is not a jailbreak with Cydia yet** (see below)
* Allows dumping SecureROM, decrypting keybags for iOS firmware, and demoting device for JTAG
* current SoC support:
- s5l8947x
- s5l8950x
- s5l8955x
- s5l8960x
- t8002
- t8004
- t8010
- t8011
- t8015
* future SoC support:
- s5l8940x
- s5l8942x
- s5l8945x
- s5l8747x
- t7000
- t7001
- s7002
- s8000
- s8001
- s8003
- t8012

*(more support information in [Detailed Support](#Detailed-Support))*

*Full (Cydia-inclusive) jailbreak on any iOS version is possible, but requires additional work*

* meant for researchers, this is not a jailbreak with Cydia yet

* allows dumping SecureROM, decrypting keybags for iOS firmware, and demoting device for JTAG

* current SoC support: s5l8947x, s5l8950x, s5l8955x, s5l8960x, t8002, t8004, t8010, t8011, t8015
## Dependencies

* future SoC support: s5l8940x, s5l8942x, s5l8945x, s5l8747x, t7000, t7001, s7002, s8000, s8001, s8003, t8012
This tool is compatible with macOS and Linux **[NO WINDOWS SUPPORT FOR NOW]**. It won't work in a virtual machine.

* full jailbreak with Cydia on latest iOS version is possible, but requires additional work
* libusb `If you are using Linux: install libusb using your package manager.`
* Python 2.7 `Python 3 is NOT backwards compatible`
* [iPhone 3GS iOS 4.3.5 iBSS](#ibss)


## Quick start guide for checkm8

1. Use a cable to connect device to your Mac. Hold buttons as needed to enter DFU Mode.
1. Use a cable to connect device to your Mac or Linux machine. Hold buttons as needed to enter DFU Mode.
2. First run ```./ipwndfu -p``` to exploit the device. Repeat the process if it fails, **it is not reliable**.
3. Run ```./ipwndfu --dump-rom``` to get a dump of SecureROM.
4. Run ```./ipwndfu --decrypt-gid KEYBAG``` to decrypt a keybag.
5. Run ```./ipwndfu --demote``` to demote device and enable JTAG.

2. First run ```./ipwndfu -p``` to exploit the device. Repeat the process if it fails, it is not reliable.

3. Run ```./ipwndfu --dump-rom``` to get a dump of SecureROM.
## Detailed-Support

4. Run ```./ipwndfu --decrypt-gid KEYBAG``` to decrypt a keybag.
This table lists all currently supported devices for the checkm8 exploit:

5. Run ```./ipwndfu --demote``` to demote device and enable JTAG.
| SoC | CPUID | Name | Supported Devices |
|--------------------|--------|-------------|------------------------------------------------------------------------------------|
| S5L8930 | 0x8930 | A4 | * iPad <br>* iPhone 4 <br>* iPod Touch (4th Gen) <br>* Apple TV (2nd Gen) |
| S5L8947 | 0x8947 | A5 (rev. B) | * Apple TV (3rd Gen) |
| S5L8950 | 0x8950 | A6 | * iPhone 5 <br>* iPhone 5c |
| S5L8955 | 0x8955 | A6X | * iPad (4th Gen) |
| S5L8950<br>S5L8965 | 0x8960 | A7 | * iPhone 5S <br>* iPad mini 2 <br>* iPad mini 3 <br>* iPad Air |
| T8002 | 0x8002 | S1P S2 T1 | * Apple Watch S1 <br>* Apple Watch S2 <br>* T1 iBridge |
| T8004 | 0x8004 | S3 | * Apple Watch S3 |
| T8010 | 0x8010 | A10 Fusion | * iPad (6th Gen) <br>* iPad (7th Gen) <br>* iPhone 7/7+ <br>* iPod Touch (7th Gen) |
| T8011 | 0x8011 | A10X Fusion | * iPad Pro (2nd Gen) <br>* Apple TV 4K |
| T8015 | 0x8015 | A11 Bionic | * iPhone 8/8+ <br>* iPhone X |

**If your device is not on this list, it is _NOT SUPPORTED_**
Future device support is being worked on, please be patient.
If you have a device older than the iPhone 3GS (the iPhone 3G or original) or newer than the iPhone X (all A12 and A13 devices), this tool will *not* support your device. Not now, most likely not ever.

## Features

* Jailbreak and downgrade iPhone 3GS (new bootrom) with alloc8 untethered bootrom exploit. :-)

* Pwned DFU Mode with steaks4uce exploit for S5L8720 devices.

* Pwned DFU Mode with limera1n exploit for S5L8920/S5L8922 devices.

* Pwned DFU Mode with SHAtter exploit for S5L8930 devices.

* Dump SecureROM on S5L8920/S5L8922/S5L8930 devices.

* Dump NOR on S5L8920 devices.

* Flash NOR on S5L8920 devices.

* Encrypt or decrypt hex data on a connected device in pwned DFU Mode using its GID or UID key.


## Dependencies

This tool should be compatible with Mac and Linux. It won't work in a virtual machine.

* libusb, `If you are using Linux: install libusb using your package manager.`
* [iPhone 3GS iOS 4.3.5 iBSS](#ibss)


## Tutorial

This tool can be used to downgrade or jailbreak iPhone 3GS (new bootrom) without SHSH blobs, as documented in [JAILBREAK-GUIDE](https://github.com/axi0mX/ipwndfu/blob/master/JAILBREAK-GUIDE.md).


## Exploit write-up

Write-up for alloc8 exploit can be found here:

https://github.com/axi0mX/alloc8
Write-up for alloc8 exploit can be found [here](https://github.com/axi0mX/alloc8)


## iBSS

Download iPhone 3GS iOS 4.3.5 IPSW from Apple:

http://appldnld.apple.com/iPhone4/041-1965.20110721.gxUB5/iPhone2,1_4.3.5_8L1_Restore.ipsw

In Terminal, extract iBSS using the following command, then move the file to ipwndfu folder:

```
unzip -p iPhone2,1_4.3.5_8L1_Restore.ipsw Firmware/dfu/iBSS.n88ap.RELEASE.dfu > n88ap-iBSS-4.3.5.img3
```
* Download [iPhone 3GS iOS 4.3.5 IPSW](http://appldnld.apple.com/iPhone4/041-1965.20110721.gxUB5/iPhone2,1_4.3.5_8L1_Restore.ipsw) from Apple
* In Terminal, extract iBSS using the following command, then move the file to ipwndfu folder:
```
unzip -p iPhone2,1_4.3.5_8L1_Restore.ipsw Firmware/dfu/iBSS.n88ap.RELEASE.dfu > n88ap-iBSS-4.3.5.img3
```


## Coming soon!

* Reorganize and refactor code.

* Easier setup: download iBSS automatically using partial zip.

* Dump SecureROM on S5L8720 devices.

* Install custom boot logos on devices jailbroken with 24Kpwn and alloc8.

* Enable verbose boot on devices jailbroken with 24Kpwn and alloc8.

## Disclaimer
Expand Down