Compare commits

...

10 Commits

Author SHA1 Message Date
Sam Bingner 987c9f9759 Use the right path for injectme.plist (resolves #300) 2019-02-05 21:13:59 -10:00
Sam Bingner 218a474452 Update apt7 transitional package 2019-02-05 09:05:30 -10:00
Sam Bingner d750769e57 Handle all the old apt7 packages better 2019-02-05 09:05:30 -10:00
Sam Bingner f96a600945 Make diagnostics include the logfile again 2019-02-03 22:36:19 -10:00
Pwn20wnd 9c0d73ccaf Update README 2019-02-02 13:19:11 +03:00
Sam Bingner ce3e5035a7 Fix a possible bootstrap extraction error 2019-01-31 22:43:26 -10:00
Sam Bingner ccfdf1294f Fix possible infinite loop 2019-01-31 22:43:21 -10:00
Sam Bingner 1e3a86e836 Fix resolveDeps for pkgs with no deps 2019-01-31 17:42:11 +03:00
Pwn20wnd 9583329c5c Actually fix this error... 2019-01-31 00:34:23 +03:00
Pwn20wnd 7cad24e8f4 Fix failed to extract bootstrap 2019-01-30 23:41:21 +03:00
9 changed files with 80 additions and 59 deletions
+2
View File
@@ -103,6 +103,8 @@ UI by [@DennisBednarz](https://twitter.com/DennisBednarz) & [Samg_is_a_Ninja](ht
* [@theninjaprawn](https://twitter.com/theninjaprawn) for the patchfinder64 additions
* [@saurik](https://twitter.com/saurik) for Cydia and Substrate
* [@FCE365](https://twitter.com/FCE365) for the empty_list reliability improvements
* Credits for [Undecimus-Resources](https://github.com/pwn20wndstuff/Undecimus-Resources)
* [@coolstarorg](https://twitter.com/coolstarorg) for the snapshot rename idea
* [@Cryptiiiic](https://twitter.com/Cryptiiiic) for testing
* [@xanDesign_](https://twitter.com/xanDesign_) for testing
* [@AppleDry05](https://twitter.com/AppleDry05) for testing
+10 -13
View File
@@ -237,6 +237,11 @@ NSArray *allDepsForPkg(NSString *pkg) {
}
NSArray *resolveDepsForPkgWithQueue(NSString *pkg, NSMutableArray *queue, BOOL preDeps) {
if (pkg == nil) {
LOG("I can't resolve deps for no pkg. WTF.");
return nil;
}
NSArray *deps = preDeps?allDepsForPkg(pkg):getDepsForPkg(pkg);
NSDictionary *pkgs = getPkgs();
@@ -244,14 +249,6 @@ NSArray *resolveDepsForPkgWithQueue(NSString *pkg, NSMutableArray *queue, BOOL p
queue = [NSMutableArray new];
}
if (deps == nil) {
return queue;
}
if (deps.count < 1) {
return queue;
}
NSRegularExpression *or = [NSRegularExpression regularExpressionWithPattern:@"\\s*([^\\|]+)\\s*\\|?" options:0 error:nil];
for (NSString *dep in deps) {
BOOL __block resolved = NO;
@@ -318,25 +315,24 @@ NSArray *resolveDepsForPkgWithQueue(NSString *pkg, NSMutableArray *queue, BOOL p
return nil;
}
}
[queue removeObject:pkg];
[queue addObject:pkg];
if (![queue containsObject:pkg])
[queue addObject:pkg];
return queue;
}
NSArray *resolveDepsForPkg(NSString *pkg, BOOL preDeps) {
if (pkg == nil) {
return nil;
}
return resolveDepsForPkgWithQueue(pkg, nil, preDeps);
}
BOOL extractDebsForPkg(NSString *pkg, NSMutableArray *installed, BOOL preDeps) {
NSArray *pkgsForPkg = resolveDepsForPkg(pkg, preDeps);
if (pkgsForPkg == nil || pkgsForPkg.count < 1) {
LOG("Found no pkgs to install for \"%@\"", pkg);
return NO;
}
NSMutableArray *debsForPkg = [debsForPkgs(pkgsForPkg) mutableCopy];
if (debsForPkg == nil) {
LOG("Found no debs to install for \"%@\"", pkg);
return NO;
}
if (installed != nil) {
@@ -347,6 +343,7 @@ BOOL extractDebsForPkg(NSString *pkg, NSMutableArray *installed, BOOL preDeps) {
return YES;
}
if (!extractDebs(debsForPkg)) {
LOG("Failed to extract debs for \"%@\"", pkg);
return NO;
}
[installed addObjectsFromArray:debsForPkg];
+21 -1
View File
@@ -1217,7 +1217,7 @@ void exploit()
LOG("Injecting trust cache...");
SETMESSAGE(NSLocalizedString(@"Failed to inject trust cache.", nil));
NSArray *resources = [NSArray arrayWithContentsOfFile:@"/usr/share/undecimus/injectme.plist"];
NSArray *resources = [NSArray arrayWithContentsOfFile:@"/usr/share/jailbreak/injectme.plist"];
resources = [@[@"/usr/libexec/substrate"] arrayByAddingObjectsFromArray:resources];
_assert(injectTrustCache(resources, GETOFFSET(trustcache)) == ERR_SUCCESS, message, true);
LOG("Successfully injected trust cache.");
@@ -1405,6 +1405,26 @@ void exploit()
}
// Dpkg better work now
if (pkgIsInstalled("science.xnu.undecimus.resources")) {
LOG("Removing old resources...");
_assert(removePkg("science.xnu.undecimus.resources", true), message, true);
}
if ((pkgIsInstalled("apt7") && compareInstalledVersion("apt7", "lt", "1:0")) ||
(pkgIsInstalled("apt7-lib") && compareInstalledVersion("apt7-lib", "lt", "1:0")) ||
(pkgIsInstalled("apt7-key") && compareInstalledVersion("apt7-key", "lt", "1:0"))
) {
LOG("Installing newer version of apt7");
NSArray *apt7debs = debsForPkgs(@[@"apt7", @"apt7-key", @"apt7-lib"]);
_assert(apt7debs != nil && apt7debs.count == 3, message, true);
for (NSString *deb in apt7debs) {
if (![debsToInstall containsObject:deb]) {
[debsToInstall addObject:deb];
}
}
}
if (debsToInstall.count > 0) {
LOG("Installing manually exctracted debs...");
_assert(installDebs(debsToInstall, true), message, true);
+5 -5
View File
@@ -23,7 +23,7 @@ uint64_t cached_task_self_addr = 0;
uint64_t task_self_addr()
{
if (cached_task_self_addr == 0) {
cached_task_self_addr = (kCFCoreFoundationVersionNumber >= 1450.14) ? get_address_of_port(getpid(), mach_task_self()) : find_port_address(mach_task_self(), MACH_MSG_TYPE_COPY_SEND);
cached_task_self_addr = have_kmem_read() ? get_address_of_port(getpid(), mach_task_self()) : find_port_address(mach_task_self(), MACH_MSG_TYPE_COPY_SEND);
LOG("task self: 0x%llx", cached_task_self_addr);
}
return cached_task_self_addr;
@@ -36,13 +36,13 @@ uint64_t ipc_space_kernel()
uint64_t current_thread()
{
uint64_t thread_port = (kCFCoreFoundationVersionNumber >= 1450.14) ? get_address_of_port(getpid(), mach_thread_self()) : find_port_address(mach_thread_self(), MACH_MSG_TYPE_COPY_SEND);
uint64_t thread_port = have_kmem_read() ? get_address_of_port(getpid(), mach_thread_self()) : find_port_address(mach_thread_self(), MACH_MSG_TYPE_COPY_SEND);
return ReadKernel64(thread_port + koffset(KSTRUCT_OFFSET_IPC_PORT_IP_KOBJECT));
}
uint64_t find_kernel_base()
{
uint64_t hostport_addr = (kCFCoreFoundationVersionNumber >= 1450.14) ? get_address_of_port(getpid(), mach_host_self()) : find_port_address(mach_host_self(), MACH_MSG_TYPE_COPY_SEND);
uint64_t hostport_addr = have_kmem_read() ? get_address_of_port(getpid(), mach_host_self()) : find_port_address(mach_host_self(), MACH_MSG_TYPE_COPY_SEND);
uint64_t realhost = ReadKernel64(hostport_addr + koffset(KSTRUCT_OFFSET_IPC_PORT_IP_KOBJECT));
the_realhost = realhost;
@@ -65,7 +65,7 @@ mach_port_t fake_host_priv()
return fake_host_priv_port;
}
// get the address of realhost:
uint64_t hostport_addr = (kCFCoreFoundationVersionNumber >= 1450.14) ? get_address_of_port(getpid(), mach_host_self()) : find_port_address(mach_host_self(), MACH_MSG_TYPE_COPY_SEND);
uint64_t hostport_addr = have_kmem_read() ? get_address_of_port(getpid(), mach_host_self()) : find_port_address(mach_host_self(), MACH_MSG_TYPE_COPY_SEND);
uint64_t realhost = ReadKernel64(hostport_addr + koffset(KSTRUCT_OFFSET_IPC_PORT_IP_KOBJECT));
// allocate a port
@@ -81,7 +81,7 @@ mach_port_t fake_host_priv()
mach_port_insert_right(mach_task_self(), port, port, MACH_MSG_TYPE_MAKE_SEND);
// locate the port
uint64_t port_addr = (kCFCoreFoundationVersionNumber >= 1450.14) ? get_address_of_port(getpid(), port) : find_port_address(port, MACH_MSG_TYPE_COPY_SEND);
uint64_t port_addr = have_kmem_read() ? get_address_of_port(getpid(), port) : find_port_address(port, MACH_MSG_TYPE_COPY_SEND);
// change the type of the port
#define IKOT_HOST_PRIV 4
+31 -29
View File
@@ -164,36 +164,38 @@
+ (NSDictionary *)getDiagnostics {
struct utsname u = { 0 };
NSMutableDictionary *md = nil;
uname(&u);
md = [NSMutableDictionary new];
md[@"Sysname"] = [NSString stringWithUTF8String:u.sysname];
md[@"Nodename"] = [NSString stringWithUTF8String:u.nodename];
md[@"Release"] = [NSString stringWithUTF8String:u.release];
md[@"Version"] = [NSString stringWithUTF8String:u.version];
md[@"Machine"] = [NSString stringWithUTF8String:u.machine];
md[@"ProductVersion"] = [NSMutableDictionary dictionaryWithContentsOfFile:@"/System/Library/CoreServices/SystemVersion.plist"][@"ProductVersion"];
md[@"ProductBuildVersion"] = [NSMutableDictionary dictionaryWithContentsOfFile:@"/System/Library/CoreServices/SystemVersion.plist"][@"ProductBuildVersion"];
md[@"Sources"] = [SettingsTableViewController sourcesFromFile:CYDIA_LIST];
md[@"Packages"] = [SettingsTableViewController parsedPackageArray];
md[@"Preferences"] = [NSMutableDictionary new];
md[@"Preferences"][@"TweakInjection"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_TWEAK_INJECTION];
md[@"Preferences"][@"LoadDaemons"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_LOAD_DAEMONS];
md[@"Preferences"][@"DumpAPTicket"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_DUMP_APTICKET];
md[@"Preferences"][@"RefreshIconCache"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_REFRESH_ICON_CACHE];
md[@"Preferences"][@"BootNonce"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_BOOT_NONCE];
md[@"Preferences"][@"Exploit"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_EXPLOIT];
md[@"Preferences"][@"DisableAutoUpdates"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_DISABLE_AUTO_UPDATES];
md[@"Preferences"][@"DisableAppRevokes"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_DISABLE_APP_REVOKES];
md[@"Preferences"][@"OverwriteBootNonce"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_OVERWRITE_BOOT_NONCE];
md[@"Preferences"][@"ExportKernelTaskPort"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_EXPORT_KERNEL_TASK_PORT];
md[@"Preferences"][@"RestoreRootFS"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_RESTORE_ROOTFS];
md[@"Preferences"][@"IncreaseMemoryLimit"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_INCREASE_MEMORY_LIMIT];
md[@"Preferences"][@"InstallCydia"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_INSTALL_CYDIA];
md[@"Preferences"][@"InstallOpenSSH"] = [[NSUserDefaults standardUserDefaults] objectForKey:K_INSTALL_OPENSSH];
md[@"AppVersion"] = appVersion();
md[@"LogFile"] = [NSString stringWithContentsOfFile:[NSString stringWithUTF8String:getLogFile()] encoding:NSUTF8StringEncoding error:nil];
return md;
NSDictionary *systemVersion = [NSDictionary dictionaryWithContentsOfFile:@"/System/Library/CoreServices/SystemVersion.plist"];
NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
return @{
@"Sysname": @(u.sysname),
@"Nodename": @(u.nodename),
@"Release": @(u.release),
@"Version": @(u.version),
@"Machine": @(u.machine),
@"ProductVersion": systemVersion[@"ProductVersion"],
@"ProductBuildVersion": systemVersion[@"ProductBuildVersion"],
@"Sources": [SettingsTableViewController sourcesFromFile:CYDIA_LIST],
@"Packages": [SettingsTableViewController parsedPackageArray],
@"Preferences": @{
@"TweakInjection": [defaults objectForKey:K_TWEAK_INJECTION],
@"LoadDaemons": [defaults objectForKey:K_LOAD_DAEMONS],
@"DumpAPTicket": [defaults objectForKey:K_DUMP_APTICKET],
@"RefreshIconCache": [defaults objectForKey:K_REFRESH_ICON_CACHE],
@"BootNonce": [defaults objectForKey:K_BOOT_NONCE],
@"Exploit": [defaults objectForKey:K_EXPLOIT],
@"DisableAutoUpdates": [defaults objectForKey:K_DISABLE_AUTO_UPDATES],
@"DisableAppRevokes": [defaults objectForKey:K_DISABLE_APP_REVOKES],
@"OverwriteBootNonce": [defaults objectForKey:K_OVERWRITE_BOOT_NONCE],
@"ExportKernelTaskPort": [defaults objectForKey:K_EXPORT_KERNEL_TASK_PORT],
@"RestoreRootFS": [defaults objectForKey:K_RESTORE_ROOTFS],
@"IncreaseMemoryLimit": [defaults objectForKey:K_INCREASE_MEMORY_LIMIT],
@"InstallCydia": [defaults objectForKey:K_INSTALL_CYDIA],
@"InstallOpenSSH": [defaults objectForKey:K_INSTALL_OPENSSH]
},
@"AppVersion": appVersion(),
@"LogFile": [NSString stringWithContentsOfFile:getLogFile() encoding:NSUTF8StringEncoding error:nil]
};
}
- (void)viewDidLoad {
+1 -1
View File
@@ -106,7 +106,7 @@ bool daemonIsLoaded(char *daemonID);
NSString *bundledResourcesVersion(void);
NSString *appVersion(void);
bool debuggerEnabled(void);
const char *getLogFile(void);
NSString *getLogFile(void);
void enableLogging(void);
void disableLogging(void);
void cleanLogs(void);
+10 -10
View File
@@ -853,21 +853,21 @@ bool debuggerEnabled() {
return (getppid() != 1);
}
const char *getLogFile() {
static const char *logfile = NULL;
if (logfile == NULL) {
NSString *homeDirectory = NSHomeDirectory();
logfile = [NSString stringWithFormat:@"%@/Documents/log_file.txt", homeDirectory].UTF8String;
}
NSString *getLogFile() {
static NSString *logfile;
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
logfile = [NSHomeDirectory() stringByAppendingPathComponent:@"Documents/log_file.txt"];
});
return logfile;
}
void enableLogging() {
if (!debuggerEnabled()) {
int old_logfd = logfd;
int newfd = open(getLogFile(), O_WRONLY|O_CREAT, 0);
if (newfd > 0) {
init_file(getLogFile(), 501, 0644);
int newfd = open(getLogFile().UTF8String, O_WRONLY|O_CREAT|O_APPEND, 0644);
if (newfd < 0) {
LOG("Error opening logfile: %s", strerror(errno));
}
logfd = newfd;
if (old_logfd > 0)
@@ -885,7 +885,7 @@ void disableLogging() {
}
void cleanLogs() {
const char *logFile = getLogFile();
const char *logFile = getLogFile().UTF8String;
clean_file(logFile);
enableLogging();
}
Binary file not shown.
Binary file not shown.