Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Branch: master
Fetching contributors…

Cannot retrieve contributors at this time

57 lines (51 sloc) 1.839 kB
How to use:
- git submodule init -u
- ln -s /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS4.3.sdk /var/sdk
- add binaries to bs, e.g.
mkdir iPhone2,1_4.3.3_8J2
cp decrypted_kernel iPhone2,1_4.3.3_8J2/kern
cp dyld_shared_cache_armv7 iPhone2,1_4.3.3_8J2/cache
OR import an ipsw:
grab https://github.com/posixninja/xpwn.git
install "xpwntool", "hfsplus", and "dmg" to ~/xpwnbin/
in here: cd config; python ipsw.py whatever.ipsw
- get t1utils and apply this patch: http://pastie.org/2251647
- get http://github.com/comex/xnu-env and point fs/xnu to it
- ./make.py pdf
external repositories:
------------------------------------------------------
data: mach-o handling
white: load dylibs into the kernel
datautils0: make kernel patches, port over symbols
in here:
------------------------------------------------------
catalog:
catalog.py: ROP code and kernel exploit
kcode.S: kernel payload
chain: unused
common:
common.h: _log, _assert, etc
datautils:
dmini.py: python interface to data
dejavu:
gen_dejavu.raw.py: FreeType exploit
dsc:
dsc.c: mount dyld shared cache via fuse
goo:
goop.py: the "string with pointers, relocations, etc." abstraction
goo.py: doing ROP with the abstraction
world1.py: specific gadgets
two.py: creating mach-o files with the abstraction
headers: external headers
install:
install.m: install the jailbreak
locutus:
locutus.c: download files / communicate with locutus_server / run install
inject.c: inject a dylib into a process
locutus_server.m: injected into SpringBoard
mroib: unused
otool: patch to otool that supports "force ARM" mode
starstuff:
build-archive.sh: build the saffron-jailbreak-xxx debian package
mount_nulls.c: do so
upgrade-data: unused
Jump to Line
Something went wrong with that request. Please try again.