How to finish patching USB restriction?

[FdezRomero]

Hi @nick-botticelli!

Thank you so much for sharing this tool. I have an iPhone X running iOS 16.4 with a broken screen that I'd like to backup, and I hope to be able to connect a USB keyboard to enter the passcode.

After successfully creating and uploading meowcat454's ramdisk and getting SSH access, I ran install-usbpatchd.sh but the snappy binary was always exiting with Killed: 9. I commented the lines about the system snapshot and I was able to install the necessary files in the filesystem.

However, the instructions at the end of the process were not very clear on how to finish patching the USB restriction:

Finished installing usbpatchd.
Now you can reboot and run checkra1n (either from CLI or from Recovery mode)
to finish patching USB restriction. After that, SSH should now be accessible
from the lock screen when using iproxy or tcprelay (`iproxy 2222 44`)!

When I rebooted the iPhone the USB restriction was still applied and the Mac didn't recognize it. I also tried putting it directly into DFU mode, right after running usbpatchd, and installing the latest checkra1n from the CLI but it complains that something isn't right (not sure what).

I have also noticed that when I run mount from the ramdisk the system partition has a different name, it's /dev/disk1s1 instead of /dev/disk0s1s1. I've also tried changing it in usbpatchd.sh but the USB restriction is still being applied.

Do you have any pointers about what may be failing? I'd be happy to contribute with a PR if I get it working, thanks!

[nick-botticelli]

Beyond iOS 14 isn't supported currently. I might be able to test iOS 15 solution based on palera1n (which may translate into iOS 16 functionality), but currently I haven't found the time to come back to this project—it mostly remains a proof-of-concept in its current form and the scripts aren't perfectly functional, sorry.