Skip to content
This repository


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

star and saffron

branch: master


latest commit 3243b19d79
comex authored
Octocat-spinner-32 catalog -3 July 12, 2011
Octocat-spinner-32 chain more chain stuff December 30, 2010
Octocat-spinner-32 common -3 July 12, 2011
Octocat-spinner-32 config RELEASE July 06, 2011
Octocat-spinner-32 data @ 9731118 fix tars July 15, 2011
Octocat-spinner-32 datautils add README July 18, 2011
Octocat-spinner-32 datautils0 @ e6d05a9 submodules I guess July 18, 2011
Octocat-spinner-32 dejavu RELEASE July 06, 2011
Octocat-spinner-32 dsc ipv6 June 08, 2011
Octocat-spinner-32 fs -3 July 12, 2011
Octocat-spinner-32 goo RELEASE July 06, 2011
Octocat-spinner-32 headers pivot AGAIN April 06, 2011
Octocat-spinner-32 install -3 July 12, 2011
Octocat-spinner-32 locutus fix tars July 15, 2011
Octocat-spinner-32 mroib upgrade data December 15, 2010
Octocat-spinner-32 otool otool update/fix April 06, 2011
Octocat-spinner-32 pdf I forgot to add this directory to git July 20, 2011
Octocat-spinner-32 starstuff oops July 18, 2011
Octocat-spinner-32 upgrade-data awful October 28, 2010
Octocat-spinner-32 white @ 97270ec submodules I guess July 18, 2011
Octocat-spinner-32 .gitignore head September 16, 2010
Octocat-spinner-32 .gitmodules starstuff May 02, 2011
Octocat-spinner-32 README README August 08, 2011
Octocat-spinner-32 go all the way June 22, 2011
Octocat-spinner-32 -3 July 12, 2011
Octocat-spinner-32 okay March 17, 2011
How to use:
- git submodule init -u
- ln -s /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS4.3.sdk /var/sdk
- add binaries to bs, e.g.
    mkdir iPhone2,1_4.3.3_8J2
    cp decrypted_kernel iPhone2,1_4.3.3_8J2/kern
    cp dyld_shared_cache_armv7 iPhone2,1_4.3.3_8J2/cache
    OR import an ipsw:
    install "xpwntool", "hfsplus", and "dmg" to ~/xpwnbin/
    in here: cd config; python whatever.ipsw

- get t1utils and apply this patch:
- get and point fs/xnu to it
- ./ pdf

external repositories:
data:       mach-o handling
white:      load dylibs into the kernel
datautils0: make kernel patches, port over symbols

in here:
catalog: ROP code and kernel exploit
    kcode.S:    kernel payload
chain: unused
    common.h:   _log, _assert, etc
datautils:   python interface to data
dejavu: FreeType exploit
    dsc.c:      mount dyld shared cache via fuse
goo:    the "string with pointers, relocations, etc." abstraction     doing ROP with the abstraction  specific gadgets     creating mach-o files with the abstraction
headers: external headers
    install.m:  install the jailbreak
    locutus.c:  download files / communicate with locutus_server / run install
    inject.c:   inject a dylib into a process
    locutus_server.m: injected into SpringBoard
mroib: unused
otool: patch to otool that supports "force ARM" mode
starstuff: build the saffron-jailbreak-xxx debian package
    mount_nulls.c:    do so
upgrade-data: unused

Something went wrong with that request. Please try again.