DownRa1n/downr1n.sh
2023-09-01 19:43:07 +09:00

1046 lines
40 KiB
Bash
Executable file

#!/usr/bin/env bash
mkdir -p logs
mkdir -p boot
set -e
log="last".log
cd logs
touch "$log"
cd ..
{
echo "[*] Command ran:`if [ $EUID = 0 ]; then echo " sudo"; fi` ./downr1n.sh $@"
# =========
# Variables
# =========
version="2.0"
os=$(uname)
dir="$(pwd)/binaries/$os"
max_args=2
arg_count=0
extractedIpsw="ipsw/extracted/"
deviceid=$("$dir"/irecovery -q | grep PRODUCT | sed 's/PRODUCT: //')
chmod +x "$dir"/*
if [ ! -d "ramdisk/" ]; then
git clone https://github.com/dualra1n/ramdisk.git --depth=1
fi
if [ ! -e ipsw/*.ipsw ]; then
echo "[*] Downloading ipsw"
"$dir"/aria2c -x16 -s16 -j16 "$(curl -sL "https://api.ipsw.me/v4/device/$deviceid?type=ipsw" | "$dir"/jq '.firmwares | .[] | select(.version=="'$1'")' | "$dir"/jq -s '.[0] | .url' --raw-output)"
mv *.ipsw ipsw
fi
ipsw=$(ls ipsw/*.ipsw) # put your ipsw
if [ -e .downgraded ]; then
downgrade=1
fi
# =========
# Functions
# =========
remote_cmd() {
sleep 1
"$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "$@"
sleep 1
}
remote_cp() {
sleep 1
if [ "$downgrade" ]; then
"$dir"/sshpass -p 'alpine' rsync -rvz -e 'ssh -p 2222' "$@"
else
"$dir"/sshpass -p 'alpine' scp -r -o StrictHostKeyChecking=no -P2222 $@
fi
sleep 1
}
step() {
rm -f .entered_dfu
for i in $(seq "$1" -1 0); do
if [[ -e .entered_dfu ]]; then
rm -f .entered_dfu
break
fi
if [[ $(get_device_mode) == "dfu" || ($1 == "10" && $(get_device_mode) != "none") ]]; then
touch .entered_dfu
fi &
printf '\r\e[K\e[1;36m%s (%d)' "$2" "$i"
sleep 1
done
printf '\e[0m\n'
}
print_help() {
cat << EOF
Usage: $0 [Options] [ subcommand | iOS version which are you]. put your ipsw in the directory ipsw/
iOS 15 - 14.0 downgrade tool ./downr1n --downgrade 15.7 (the ios of your device) ipsw
Options:
--downgrade downgrade tethered your device to ios 14. you can use --localboot or --fsboot in order to fix some problems if you had them
--dfuhelper A helper to help get A11 devices into DFU mode from recovery mode
--jailbreak jailbreak with pogo. usage ./downr1n --jailbreak 14.8
--taurine jailbreak with taurine. usage ./downr1n --jailbreak 14.3 --taurine
--boot this boot the device.
--dont-restore this will avoid the restore using futurerestore, this can be used if you wanted only create the boot files
--fixBoot that will boot the device using fsboot
--debug Debug the script
Subcommands:
clean clean the downgrade tool in order to downgrade again.
EOF
}
parse_opt() {
case "$1" in
--)
no_more_opts=1
;;
--downgrade)
downgrade=1
;;
--boot)
boot=1
;;
--jailbreak)
jailbreak=1
;;
--taurine)
taurine=1
;;
--fixBoot)
fixBoot=1
;;
--dont-restore)
dontRestore=1
;;
--localboot)
local=1
;;
--fsboot)
fsboot=1
;;
--dfuhelper)
dfuhelper=1
;;
--debug)
debug=1
;;
--help)
print_help
exit 0
;;
*)
echo "[-] Unknown option $1. Use $0 --help for help."
exit 1;
esac
}
parse_arg() {
arg_count=$((arg_count + 1))
case "$1" in
dfuhelper)
dfuhelper=1
;;
*)
version="$1"
;;
esac
}
parse_cmdline() {
for arg in $@; do
if [[ "$arg" == --* ]] && [ -z "$no_more_opts" ]; then
parse_opt "$arg";
elif [ "$arg_count" -lt "$max_args" ]; then
parse_arg "$arg";
else
echo "[-] Too many arguments. Use $0 --help for help.";
exit 1;
fi
done
}
recovery_fix_auto_boot() {
"$dir"/irecovery -c "setenv auto-boot true"
"$dir"/irecovery -c "saveenv"
}
_info() {
if [ "$1" = 'recovery' ]; then
echo $("$dir"/irecovery -q | grep "$2" | sed "s/$2: //")
elif [ "$1" = 'normal' ]; then
echo $("$dir"/ideviceinfo | grep "$2: " | sed "s/$2: //")
fi
}
_pwn() {
pwnd=$(_info recovery PWND)
if [ "$pwnd" = "" ]; then
echo "[*] Pwning device"
"$dir"/gaster pwn
sleep 2
#"$dir"/gaster reset
#sleep 1
fi
}
_reset() {
echo "[*] Resetting DFU state"
"$dir"/gaster reset
}
get_device_mode() {
if [ "$os" = "Darwin" ]; then
sp="$(system_profiler SPUSBDataType 2> /dev/null)"
apples="$(printf '%s' "$sp" | grep -B1 'Vendor ID: 0x05ac' | grep 'Product ID:' | cut -dx -f2 | cut -d' ' -f1 | tail -r)"
elif [ "$os" = "Linux" ]; then
apples="$(lsusb | cut -d' ' -f6 | grep '05ac:' | cut -d: -f2)"
fi
local device_count=0
local usbserials=""
for apple in $apples; do
case "$apple" in
12a8|12aa|12ab)
device_mode=normal
device_count=$((device_count+1))
;;
1281)
device_mode=recovery
device_count=$((device_count+1))
;;
1227)
device_mode=dfu
device_count=$((device_count+1))
;;
1222)
device_mode=diag
device_count=$((device_count+1))
;;
1338)
device_mode=checkra1n_stage2
device_count=$((device_count+1))
;;
4141)
device_mode=pongo
device_count=$((device_count+1))
;;
esac
done
if [ "$device_count" = "0" ]; then
device_mode=none
elif [ "$device_count" -ge "2" ]; then
echo "[-] Please attach only one device" > /dev/tty
kill -30 0
exit 1;
fi
if [ "$os" = "Linux" ]; then
usbserials=$(cat /sys/bus/usb/devices/*/serial)
elif [ "$os" = "Darwin" ]; then
usbserials=$(printf '%s' "$sp" | grep 'Serial Number' | cut -d: -f2- | sed 's/ //')
fi
if grep -qE '(ramdisk tool|SSHRD_Script) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{1,2} [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2}' <<< "$usbserials"; then
device_mode=ramdisk
fi
echo "$device_mode"
}
_wait() {
if [ "$(get_device_mode)" != "$1" ]; then
echo "[*] Waiting for device in $1 mode"
fi
while [ "$(get_device_mode)" != "$1" ]; do
sleep 1
done
if [ "$1" = 'recovery' ]; then
recovery_fix_auto_boot;
fi
}
_dfuhelper() {
local step_one;
deviceid=$( [ -z "$deviceid" ] && _info normal ProductType || echo $deviceid )
if [[ "$1" = 0x801* && "$deviceid" != *"iPad"* ]]; then
step_one="Hold volume down + side button"
else
step_one="Hold home + power button"
fi
echo "[*] To get into DFU mode, you will be guided through 2 steps:"
echo "[*] Press any key when ready for DFU mode"
read -n 1 -s
step 3 "Get ready"
step 4 "$step_one" &
sleep 3
"$dir"/irecovery -c "reset" &
sleep 1
if [[ "$1" = 0x801* && "$deviceid" != *"iPad"* ]]; then
step 10 'Release side button, but keep holding volume down'
else
step 10 'Release power button, but keep holding home button'
fi
sleep 1
if [ "$(get_device_mode)" = "recovery" ]; then
_dfuhelper
fi
if [ "$(get_device_mode)" = "dfu" ]; then
echo "[*] Device entered DFU!"
else
echo "[-] Device did not enter DFU mode, rerun the script and try again"
exit;
fi
}
usage() {
echo "Please answer with YES or NO (case-insensitive)."
}
ask() {
echo "Do you want to activate the iBoot localboot path? YES or NO."
echo "Activating this path can help avoid a lot of problems and is generally more stable."
echo "If you activate it, you will need to use --boot again after it finishes to boot with localboot."
echo "If localboot breaks your boot process (like you can't boot), please execute ./downr1n.sh --downgrade (version) --dont-restore to fix the boot files."
}
_kill_if_running() {
if (pgrep -u root -x "$1" &> /dev/null > /dev/null); then
# yes, it's running as root. kill it
sudo killall $1 &> /dev/null
else
if (pgrep -x "$1" &> /dev/null > /dev/null); then
killall $1 &> /dev/null
fi
fi
}
_runFuturerestore() {
cat <<EOF
===================================================================================================
# WARNING: Starting 'futurerestore' command !
---------------------------------------------------------------------------------------------------
If futurerestore FAILS, Run '$0 --downgrade' to try again.
---------------------------------------------------------------------------------------------------
If futurerestore SUCCEEDS, Run '$0 --boot' to boot device.
---------------------------------------------------------------------------------------------------
===================================================================================================
EOF
read -p "Press ENTER to continue <-"
rm -rf /tmp/futurerestore/
"$dir"/futurerestore -t blobs/"$deviceid"-"$version".shsh2 --use-pwndfu --skip-blob \
--rdsk work/rdsk.im4p --rkrn work/krnl.im4p \
--latest-sep "$HasBaseband" "$ipsw"
}
_boot() {
_pwn
sleep 1
_reset
sleep 1
echo "[*] Booting device"
"$dir"/irecovery -f "blobs/"$deviceid"-"$version".shsh2"
sleep 1
if [[ ! "$cpid" == *"0x801"* ]]; then
"$dir"/irecovery -f "boot/${deviceid}/iBSS.img4"
sleep 1
fi
"$dir"/irecovery -f "boot/${deviceid}/iBEC.img4"
sleep 3
if [ "$local" = "1" ]; then
echo "booting ..."
echo "your devicd should be booting into the ios using localboot:)"
exit;
fi
if [[ "$cpid" == *"0x801"* ]]; then
"$dir"/irecovery -c "go"
sleep 2
else
"$dir"/irecovery -c "bootx"
sleep 2
fi
"$dir"/irecovery -f "boot/${deviceid}/devicetree.img4"
sleep 1
"$dir"/irecovery -c "devicetree"
sleep 1
"$dir"/irecovery -v -f "boot/${deviceid}/trustcache.img4"
"$dir"/irecovery -c "firmware"
sleep 1
"$dir"/irecovery -f "boot/${deviceid}/kernelcache.img4"
sleep 1
"$dir"/irecovery -c "$(if [ ! "$fsboot" = "1" ]; then echo "bootx"; else echo "fsboot"; fi)"
exit;
}
_exit_handler() {
if [ "$os" = "Darwin" ]; then
killall -CONT AMPDevicesAgent AMPDeviceDiscoveryAgent MobileDeviceUpdater || true
fi
[ $? -eq 0 ] && exit
echo "[-] An error occurred"
if [ -d "logs" ]; then
cd logs
mv "$log" FAIL_${log}
cd ..
fi
echo "[*] A failure log has been made. If you're going ask for help, please attach the latest log."
}
trap _exit_handler EXIT
# ============
# Dependencies
# ============
if [ "$os" = "Linux" ]; then
chmod +x getSSHOnLinux.sh
./getSSHOnLinux.sh &
fi
if [ "$os" = 'Linux' ]; then
linux_cmds='lsusb'
fi
for cmd in unzip python3 rsync git ssh scp killall sudo grep pgrep xz ${linux_cmds}; do
if ! command -v "${cmd}" > /dev/null; then
echo "[-] Command '${cmd}' not installed, please install it!";
cmd_not_found=1
fi
done
if [ "$cmd_not_found" = "1" ]; then
exit 1
fi
# Check for pyimg4
if ! python3 -c 'import pkgutil; exit(not pkgutil.find_loader("fastapi") and not pkgutil.find_loader("aiohttp") and not pkgutil.find_loader("ujson") and not pkgutil.find_loader("wikitextparser") and not pkgutil.find_loader("uvicorn") and not pkgutil.find_loader("pyimg4"))'; then
echo '[-] One or more required modules are not installed. Press any key to install them, or press ctrl + c to cancel'
read -n 1 -s
python3 -m pip install fastapi aiohttp ujson wikitextparser uvicorn pyimg4
fi
# Check if futurerestore exists
if [ ! -e "$dir"/futurerestore ]; then
echo "[*] Downloading futurerestore please wait..." # futurerestore downloader by sasa :)
if [ "$os" = "Darwin" ]; then
curl -sLo futurerestore-macOS-RELEASE.zip https://nightly.link/futurerestore/futurerestore/workflows/ci/main/futurerestore-macOS-RELEASE.zip
unzip futurerestore-macOS-RELEASE.zip
xz -dc futurerestore-*.xz | tar xfv -
else
curl -sLo futurerestore-Linux-x86_64-RELEASE.zip https://nightly.link/futurerestore/futurerestore/workflows/ci/main/futurerestore-Linux-x86_64-RELEASE.zip
unzip futurerestore-Linux-x86_64-RELEASE.zip
xz -dc futurerestore-*.xz | tar xfv -
fi
mv futurerestore "$dir"/
rm -rf futurerestore-*
fi
# Update submodules
git submodule update --init --recursive
git submodule foreach git pull origin main
# Re-create work dir if it exists, else, make it
if [ -e work ]; then
rm -rf work
mkdir work
else
mkdir work
fi
chmod +x "$dir"/*
# ============
# Start
# ============
echo "downr1n | Version 1.0"
echo "Created by edwin, thanks sunst0rm, and all people creator of path file boot"
echo ""
parse_cmdline "$@"
if [ "$debug" = "1" ]; then
set -o xtrace
fi
if [ "$clean" = "1" ]; then
rm -rf work blobs/ boot/"$deviceid"/ ipsw/extracted .downgraded
echo "[*] Removed the created boot files"
exit
fi
# Get device's iOS version from ideviceinfo if in normal mode
echo "[*] Waiting for devices"
while [ "$(get_device_mode)" = "none" ]; do
sleep 1;
done
echo $(echo "[*] Detected $(get_device_mode) mode device" | sed 's/dfu/DFU/')
if grep -E 'pongo|checkra1n_stage2|diag' <<< "$(get_device_mode)"; then
echo "[-] Detected device in unsupported mode '$(get_device_mode)'"
exit 1;
fi
if [ "$(get_device_mode)" != "normal" ] && [ -z "$version" ] && [ "$dfuhelper" != "1" ]; then
echo "[-] You must pass the version your device is on when not starting from normal mode"
exit
fi
if [ "$(get_device_mode)" = "ramdisk" ]; then
# If a device is in ramdisk mode, perhaps iproxy is still running?
_kill_if_running iproxy
echo "[*] Rebooting device in SSH Ramdisk"
if [ "$os" = 'Linux' ]; then
sudo "$dir"/iproxy 2222 22 >/dev/null &
else
"$dir"/iproxy 2222 22 >/dev/null &
fi
sleep 2
remote_cmd "/usr/sbin/nvram auto-boot=false"
remote_cmd "/sbin/reboot"
_kill_if_running iproxy
_wait recovery
fi
if [ "$(get_device_mode)" = "normal" ]; then
version=${version:-$(_info normal ProductVersion)}
arch=$(_info normal CPUArchitecture)
if [ "$arch" = "arm64e" ]; then
echo "[-] downgrade doesn't, and never will, work on non-checkm8 devices"
exit
fi
echo "Hello, $(_info normal ProductType) on $version!"
echo "[*] Switching device into recovery mode..."
"$dir"/ideviceenterrecovery $(_info normal UniqueDeviceID)
_wait recovery
fi
# Grab more info
echo "[*] Getting device info..."
cpid=$(_info recovery CPID)
model=$(_info recovery MODEL)
deviceid=$(_info recovery PRODUCT)
echo "$cpid"
echo "$model"
echo "$deviceid"
if [ "$dfuhelper" = "1" ]; then
echo "[*] Running DFU helper"
_dfuhelper "$cpid"
exit
fi
ipswurl=$(curl -sL "https://api.ipsw.me/v4/device/$deviceid?type=ipsw" | "$dir"/jq '.firmwares | .[] | select(.version=="'$version'")' | "$dir"/jq -s '.[0] | .url' --raw-output)
# Have the user put the device into DFU
if [ "$(get_device_mode)" != "dfu" ]; then
recovery_fix_auto_boot;
_dfuhelper "$cpid" || {
echo "[-] failed to enter DFU mode, run downr1n.sh again"
exit -1
}
fi
sleep 2
if [ "$boot" = "1" ]; then # call boot in order to boot it
_boot
fi
# =========
# extract ipsw
# =========
cd ipsw/
ipsw_files=(*.ipsw)
if [[ ${#ipsw_files[@]} -gt 1 ]]; then
echo "in ipsw/ directory there is more than one ipsw so delete one and try again please"
cd ..
exit;
fi
cd ..
if [ -a $ipsw ] || [ "${ipsw: -5}" == ".ipsw" ]; then
echo "[*] Continuing..."
else
_eexit $ipsw "[-] is not a valid ipsw file."
fi
if [ "$downgrade" = "1" ] || [ "$jailbreak" = "1" ]; then
# extracting ipsw
echo "extracting ipsw, hang on please ..." # this will extract the ipsw into ipsw/extracted
unzip -n $ipsw -d "ipsw/extracted"
cp -v "$extractedIpsw/BuildManifest.plist" work/
echo "now the IPSW is extracted"
fi
if [ "$jailbreak" = "1" ]; then
cp "$extractedIpsw$(awk "/""${model}""/{x=1}x&&/iBoot[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "work/"
"$dir"/gaster decrypt work/"$(awk "/""${model}""/{x=1}x&&/iBoot[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | sed 's/Firmware[/]all_flash[/]//')" work/iBEC.dec
fi
# ============
# Ramdisk
# ============
# Dump blobs, and install pogo if needed
if [ true ]; then
mkdir -p blobs
cd ramdisk
chmod +x sshrd.sh
echo "[*] Creating ramdisk"
./sshrd.sh 15.6
echo "[*] Booting ramdisk"
./sshrd.sh boot
cd ..
# remove special lines from known_hosts
if [ -f ~/.ssh/known_hosts ]; then
if [ "$os" = "Darwin" ]; then
sed -i.bak '/localhost/d' ~/.ssh/known_hosts
sed -i.bak '/127\.0\.0\.1/d' ~/.ssh/known_hosts
elif [ "$os" = "Linux" ]; then
sed -i '/localhost/d' ~/.ssh/known_hosts
sed -i '/127\.0\.0\.1/d' ~/.ssh/known_hosts
fi
fi
# Execute the commands once the rd is booted
if [ "$os" = 'Linux' ]; then
sudo "$dir"/iproxy 2222 22 >/dev/null &
else
"$dir"/iproxy 2222 22 >/dev/null &
fi
if ! ("$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "echo connected" &> /dev/null); then
echo "[*] Waiting for the ramdisk to finish booting"
fi
while ! ("$dir"/sshpass -p 'alpine' ssh -o StrictHostKeyChecking=no -p2222 root@localhost "echo connected" &> /dev/null); do
sleep 1
done
if [ "$(remote_cmd "/usr/bin/mgask HasBaseband | grep -E 'true|false'")" = "true" ]; then
HasBaseband='--latest-baseband'
else
HasBaseband='--no-baseband'
fi
remote_cmd "/usr/bin/mount_filesystems"
has_active=$(remote_cmd "ls /mnt6/active" 2> /dev/null)
if [ ! "$has_active" = "/mnt6/active" ]; then
echo "[!] Active file does not exist! Please use SSH to create it"
echo " /mnt6/active should contain the name of the UUID in /mnt6"
echo " When done, type reboot in the SSH session, then rerun the script"
echo " ssh root@localhost -p 2222"
exit
fi
active=$(remote_cmd "cat /mnt6/active" 2> /dev/null)
mkdir -p "boot/${deviceid}"
if [ ! -e blobs/"$deviceid"-"$version".shsh2 ]; then
remote_cmd "cat /dev/rdisk1" | dd of=dump.raw bs=256 count=$((0x4000))
"$dir"/img4tool --convert -s blobs/"$deviceid"-"$version".shsh2 dump.raw
echo "[*] Converting blob"
sleep 3
rm dump.raw
fi
"$dir"/img4tool -e -s blobs/"$deviceid"-"$version".shsh2 -m work/IM4M
echo "Dumpped SHSH"
if [ "$jailbreak" = "1" ]; then
echo "[*] Patching kernel" # this will send and patch the kernel
cp "$extractedIpsw$(awk "/""${model}""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "work/"
cp work/"$(awk "/""${model}""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" work/kernelcache
if [[ "$deviceid" == "iPhone8"* ]] || [[ "$deviceid" == "iPad6"* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
python3 -m pyimg4 im4p extract -i work/kernelcache -o work/kcache.raw --extra work/kpp.bin
else
python3 -m pyimg4 im4p extract -i work/kernelcache -o work/kcache.raw
fi
remote_cp work/kcache.raw root@localhost:/mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw
remote_cp boot/"${deviceid}"/kernelcache.img4 "root@localhost:/mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcache"
remote_cp binaries/Kernel15Patcher.ios root@localhost:/mnt1/private/var/root/Kernel15Patcher.ios
remote_cmd "/usr/sbin/chown 0 /mnt1/private/var/root/Kernel15Patcher.ios"
remote_cmd "/bin/chmod 755 /mnt1/private/var/root/Kernel15Patcher.ios"
sleep 1
if [ ! $(remote_cmd "/mnt1/private/var/root/Kernel15Patcher.ios /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched") ]; then
echo "you have the kernelpath already installed "
fi
sleep 2
remote_cp root@localhost:/mnt6/"$active"/System/Library/Caches/com.apple.kernelcaches/kcache.patched work/ # that will return the kernelpatcher in order to be patched again and boot with it
"$dir"/Kernel64Patcher work/kcache.patched work/kcache.patchedB -e $(if [[ ! "$version" = "15."* ]]; then echo "-b"; else echo "-f"; fi) $(if [ ! "$taurine" = "1" ]; then echo "-l"; fi)
if [[ "$deviceid" == *'iPhone8'* ]] || [[ "$deviceid" == *'iPad6'* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
python3 -m pyimg4 im4p create -i work/kcache.patchedB -o work/kcache.im4p -f rknl --extra work/kpp.bin --lzss
else
python3 -m pyimg4 im4p create -i work/kcache.patchedB -o work/kcache.im4p -f rknl --lzss
fi
remote_cmd "rm -f /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.patched /mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kcache.im4p"
python3 -m pyimg4 img4 create -p work/kcache.im4p -o work/kernelcache.img4 -m work/IM4M
#"$dir"/kerneldiff work/kcache.raw work/kcache.patchedB work/kc.bpatch
#"$dir"/img4 -i work/"$(awk "/""${model}""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" -o work/kernelcache.img4 -M work/IM4M -T rkrn -P work/kc.bpatch `if [ "$os" = 'Linux' ]; then echo "-J"; fi`
#remote_cp root@localhost:/mnt6/$active/System/Library/Caches/com.apple.kernelcaches/kernelcachd work/kernelcache.img4
cp -v "work/kernelcache.img4" "boot/${deviceid}"
echo "[*] Finished of patching the kernel"
echo "[*] installing dualra1n-loader"
unzip other/dualra1n-loader.ipa -d other/
mkdir -p other/Payload/Applications/
mv -nv other/Payload/dualra1n-loader.app other/Payload/Applications/
remote_cp other/Payload/Applications/ root@localhost:/mnt1/Applications
echo "[*] Saving snapshot"
if [ ! "$(remote_cmd "/usr/bin/snaputil -c orig-fs /mnt1")" ]; then
echo "the snapshot are already created, SKIPPING ..."
fi
if [ ! $(remote_cmd "trollstoreinstaller TV") ]; then
echo "[/] error installing trollstore on TV app"
fi
echo "[*] Fixing dualra1n-loader"
if [ ! $(remote_cmd "chmod +x /mnt1/Applications/dualra1n-loader.app/dualra1n* && /usr/sbin/chown 33 /mnt1/Applications/dualra1n-loader.app/dualra1n-loader && /bin/chmod 755 /mnt1/Applications/dualra1n-loader.app/dualra1n-helper && /usr/sbin/chown 0 /mnt1/Applications/dualra1n-loader.app/dualra1n-helper" ) ]; then
echo "install dualra1n-loader using trollstore or another methods"
fi
if [ "$taurine" = 1 ]; then
echo "installing taurine"
remote_cp other/taurine/* root@localhost:/mnt1/
echo "[*] Finished, now your downgrade is jailbroken, you can boot it"
remote_cmd "/sbin/reboot"
exit;
fi
echo "installing JBINIT jailbreak, thanks palera1n"
echo "[*] Copying files to rootfs"
remote_cmd "rm -rf /mnt1/jbin /mnt1/.installed_palera1n"
sleep 1
remote_cmd "mkdir -p /mnt1/jbin/binpack /mnt1/jbin/loader.app"
sleep 1
# this is the jailbreak of palera1n being installing
cp -v other/post.sh other/rootfs/jbin/
remote_cp -r other/rootfs/* root@localhost:/mnt1/
remote_cmd "ldid -s /mnt1/jbin/launchd /mnt1/jbin/jbloader /mnt1/jbin/jb.dylib"
remote_cmd "chmod +rwx /mnt1/jbin/launchd /mnt1/jbin/jbloader /mnt1/jbin/post.sh"
remote_cmd "tar -xvf /mnt1/jbin/binpack/binpack.tar -C /mnt1/jbin/binpack/"
sleep 1
remote_cmd "rm /mnt1/jbin/binpack/binpack.tar"
remote_cmd "/usr/sbin/nvram auto-boot=true"
echo "[*] Finished of jailbreaking"
ask
while true; do
read -r answer
case "$(echo "$answer" | tr '[:upper:]' '[:lower:]')" in
yes)
echo "[*] You answered YES. so Activating the iBoot localboot path..."
echo '[*] Patching the kernel to krnl'
if [[ "$deviceid" == *'iPhone8'* ]] || [[ "$deviceid" == *'iPad6'* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
python3 -m pyimg4 im4p create -i work/kcache.patchedB -o work/krnl.im4p -f krnl --extra work/kpp.bin --lzss
else
python3 -m pyimg4 im4p create -i work/kcache.patchedB -o work/krnl.im4p -f krnl --lzss
fi
python3 -m pyimg4 img4 create -p work/krnl.im4p -o work/kernelcachd -m work/IM4M
remote_cp work/kernelcachd root@localhost:/mnt6/"$active"/System/Library/Caches/com.apple.kernelcaches/
if [ "$os" = 'Linux' ]; then
sed -i 's/\/\kernelcache/\/\kernelcachd/g' work/iBEC.dec
else
LC_ALL=C sed -i.bak -e 's/s\/\kernelcache/s\/\kernelcachd/g' work/iBEC.dec
fi
"$dir"/iBoot64Patcher work/iBEC.dec work/iBEC.patched -b "-v wdt=-1 debug=0x2014e `if [ "$cpid" = '0x8960' ] || [ "$cpid" = '0x7000' ] || [ "$cpid" = '0x7001' ]; then echo "-restore"; fi`" -n -l
"$dir"/img4 -i work/iBEC.patched -o work/iBEC.img4 -M work/IM4M -A -T "$(if [[ "$cpid" == *"0x801"* ]]; then echo "ibss"; else echo "ibec"; fi)"
cp -v work/iBEC.img4 "boot/${deviceid}"
break
;;
no)
echo "You answered NO. so Not activating the iBoot localboot path."
break
;;
*)
echo "Invalid answer."
usage
;;
esac
done
echo "[*] DONE ... now reboot and boot again"
remote_cmd "/sbin/reboot"
exit;
fi
echo "[*] Patching kernel ..." # this will send and patch the kernel
cp "$extractedIpsw$(awk "/""${model}""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "work/kernelcache"
if [[ "$deviceid" == "iPhone8"* ]] || [[ "$deviceid" == "iPad6"* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
python3 -m pyimg4 im4p extract -i work/kernelcache -o work/kcache.raw --extra work/kpp.bin
else
python3 -m pyimg4 im4p extract -i work/kernelcache -o work/kcache.raw
fi
remote_cp work/kcache.raw root@localhost:/mnt1/System/Library/Caches/com.apple.kernelcaches/kcache.raw
remote_cp binaries/Kernel15Patcher.ios root@localhost:/mnt1/private/var/root/kpf15.ios
remote_cmd "/usr/sbin/chown 0 /mnt1/private/var/root/kpf15.ios"
remote_cmd "/bin/chmod 755 /mnt1/private/var/root/kpf15.ios"
sleep 1
if [ ! $(remote_cmd "/mnt1/private/var/root/kpf15.ios /mnt1/System/Library/Caches/com.apple.kernelcaches/kcache.raw /mnt1/System/Library/Caches/com.apple.kernelcaches/kcache.patched") ]; then
echo "you have the kernelpath already installed "
fi
remote_cp root@localhost:/mnt1/System/Library/Caches/com.apple.kernelcaches/kcache.patched work/
remote_cmd "/usr/sbin/nvram auto-boot=false"
remote_cmd "/sbin/reboot"
sleep 12
if [ "$(get_device_mode)" = "dfu" ]; then
echo "device in false dfu mode. please force reboot and try to put it on dfu mode by precing the button."
read -p "click enter if you got dfu mode on the iphone"
"$dir"/gaster pwn
else
_wait recovery
sleep 4
_dfuhelper "$cpid"
sleep 3
fi
echo "[* ]Patchimg some boot files..."
if [ "$downgrade" = "1" ]; then
sleep 1
if [ -e boot/"$deviceid" ]; then
rm -rf boot/"$deviceid"
mkdir boot/"$deviceid"
else
mkdir boot/"$deviceid"
fi
if [ "$fixBoot" = "1" ]; then # i put it because my friend tested on his ipad and that does not boot so when we download all file from the internet so not extracting ipsw that boot fine idk why
cd work
#that will download the files needed
sleep 1
"$dir"/pzb -g "$(awk "/""${model}""/{x=1}x&&/iBSS[.]/{print;exit}" BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "$ipswurl"
"$dir"/pzb -g "$(awk "/""${model}""/{x=1}x&&/iBoot[.]/{print;exit}" BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "$ipswurl"
"$dir"/pzb -g "$(awk "/""${model}""/{x=1}x&&/DeviceTree[.]/{print;exit}" BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "$ipswurl"
"$dir"/pzb -g "$(awk "/""${model}""/{x=1}x&&/kernelcache.release/{print;exit}" BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "$ipswurl"
if [ "$os" = 'Darwin' ]; then
"$dir"/pzb -g Firmware/"$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."RestoreRamDisk"."Info"."Path" xml1 -o - BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | head -1)".trustcache "$ipswurl"
else
"$dir"/pzb -g Firmware/"$(../Linux/PlistBuddy BuildManifest.plist -c "Print BuildIdentities:0:Manifest:RestoreRamDisk:Info:Path" | sed 's/"//g')".trustcache "$ipswurl"
fi
cd ..
else
#that will extract the files needed
cp "$extractedIpsw$(awk "/""${model}""/{x=1}x&&/iBSS[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "work/"
cp "$extractedIpsw$(awk "/""${model}""/{x=1}x&&/iBoot[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "work/"
cp "$extractedIpsw$(awk "/""${model}""/{x=1}x&&/DeviceTree[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "work/"
cp "$extractedIpsw$(awk "/""${model}""/{x=1}x&&/kernelcache.release/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1)" "work/"
if [ "$os" = "Darwin" ]; then
"$dir"/img4 -i "$extractedIpsw"/Firmware/"$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."OS"."Info"."Path" xml1 -o - work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | head -1)".trustcache -o work/trustcache.img4 -M work/IM4M
else
"$dir"/img4 -i "$extractedIpsw"/Firmware/"$(binaries/Linux/PlistBuddy work/BuildManifest.plist -c "Print BuildIdentities:0:Manifest:OS:Info:Path" | sed 's/"//g')".trustcache -o work/trustcache.img4 -M work/IM4M
fi
fi
echo "[*] Finished moving the boot files to work"
sleep 2
_pwn
sleep 2
_reset
sleep 3
"$dir"/gaster decrypt work/"$(awk "/""${model}""/{x=1}x&&/iBSS[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | sed 's/Firmware[/]dfu[/]//')" work/iBSS.dec
"$dir"/iBoot64Patcher work/iBSS.dec work/iBSS.patched
"$dir"/img4 -i work/iBSS.patched -o work/iBSS.img4 -M work/IM4M -A -T ibss
"$dir"/gaster decrypt work/"$(awk "/""${model}""/{x=1}x&&/iBoot[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | sed 's/Firmware[/]all_flash[/]//')" work/iBEC.dec
if [ "$os" = 'Linux' ]; then
sed -i 's/\/\kernelcache/\/\kernelcachd/g' work/iBEC.dec
else
LC_ALL=C sed -i.bak -e 's/s\/\kernelcache/s\/\kernelcachd/g' work/iBEC.dec
fi
"$dir"/iBoot64Patcher work/iBEC.dec work/iBEC.patched -b "-v wdt=-1 `if [ "$cpid" = '0x8960' ] || [ "$cpid" = '0x7000' ] || [ "$cpid" = '0x7001' ]; then echo "-restore"; fi`" -n "$(if [ "$local" = "1" ]; then echo "-l"; elif [ "$fsboot" = "1" ]; then echo "-f"; fi)"
"$dir"/img4 -i work/iBEC.patched -o work/iBEC.img4 -M work/IM4M -A -T "$(if [[ "$cpid" == *"0x801"* ]]; then echo "ibss"; else echo "ibec"; fi)"
"$dir"/Kernel64Patcher work/kcache.patched work/kcache.patchedB -a -e $(if [[ "$version" = "14."* ]]; then echo "-b"; else echo "-f"; fi) `if [ "$fixBoot" = "1" ]; then echo "-s"; fi`
if [[ "$deviceid" == *'iPhone8'* ]] || [[ "$deviceid" == *'iPad6'* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
python3 -m pyimg4 im4p create -i work/kcache.patchedB -o work/kcache.im4p -f rkrn --extra work/kpp.bin --lzss
else
python3 -m pyimg4 im4p create -i work/kcache.patchedB -o work/kcache.im4p -f rkrn --lzss
fi
python3 -m pyimg4 img4 create -p work/kcache.im4p -o work/kernelcache.img4 -m work/IM4M
if [[ "$deviceid" == "iPhone8"* ]] || [[ "$deviceid" == "iPad6"* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
if [ "$os" = "Darwin" ]; then
python3 -m pyimg4 im4p extract -i "$extractedIpsw$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."RestoreKernelCache"."Info"."Path" xml1 -o - work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | head -1)" -o work/kcache.dec --extra work/kpp.bin
else
python3 -m pyimg4 im4p extract -i "$extractedIpsw$(binaries/Linux/PlistBuddy work/BuildManifest.plist -c "Print BuildIdentities:0:Manifest:RestoreKernelCache:Info:Path" | sed 's/"//g')" -o work/kcache.dec --extra work/kpp.bin
fi
else
if [ "$os" = "Darwin" ]; then
python3 -m pyimg4 im4p extract -i "$extractedIpsw$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."RestoreKernelCache"."Info"."Path" xml1 -o - work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | head -1)" -o work/kcache.dec
else
python3 -m pyimg4 im4p extract -i "$extractedIpsw$(binaries/Linux/PlistBuddy work/BuildManifest.plist -c "Print BuildIdentities:0:Manifest:RestoreKernelCache:Info:Path" | sed 's/"//g')" -o work/kcache.dec
fi
fi
"$dir"/Kernel64Patcher work/kcache.dec work/krnl.patched -a -b
if [[ "$deviceid" == "iPhone8"* ]] || [[ "$deviceid" == "iPad6"* ]] || [[ "$deviceid" == *'iPad5'* ]]; then
python3 -m pyimg4 im4p create -i work/krnl.patched -o work/krnl.im4p --extra work/kpp.bin -f rkrn --lzss
else
python3 -m pyimg4 im4p create -i work/krnl.patched -o work/krnl.im4p -f rkrn --lzss
fi
"$dir"/img4 -i work/"$(awk "/""${model}""/{x=1}x&&/DeviceTree[.]/{print;exit}" work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | sed 's/Firmware[/]all_flash[/]//')" work/devicetree.img4 -M work/IM4M -T rdtr
if [ "$os" = "Darwin" ]; then
cp "$extractedIpsw$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."RestoreRamDisk"."Info"."Path" xml1 -o - work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | head -1)" "work/"
else
cp "$extractedIpsw$(binaries/Linux/PlistBuddy work/BuildManifest.plist -c "Print BuildIdentities:0:Manifest:RestoreRamDisk:Info:Path" | sed 's/"//g')" "work/"
fi
if [ "$os" = "Darwin" ]; then
"$dir"/img4 -i work/"$(/usr/bin/plutil -extract "BuildIdentities".0."Manifest"."RestoreRamDisk"."Info"."Path" xml1 -o - work/BuildManifest.plist | grep '<string>' |cut -d\> -f2 |cut -d\< -f1 | head -1)" -o work/ramdisk.dmg
else
"$dir"/img4 -i work/"$(binaries/Linux/PlistBuddy work/BuildManifest.plist -c "Print BuildIdentities:0:Manifest:RestoreRamDisk:Info:Path" | sed 's/"//g')" -o work/ramdisk.dmg
fi
echo "[*] Patching the restored_external and asr, and saving them into the ramdisk ..."
if [ "$os" = "Darwin" ]; then
hdiutil attach work/ramdisk.dmg -mountpoint /tmp/SSHRD
mounted="/tmp/SSHRD"
"$dir"/asr64_patcher $mounted/usr/sbin/asr work/patched_asr
"$dir"/ldid -e $mounted/usr/sbin/asr > work/asr.plist
"$dir"/ldid -Swork/asr.plist work/patched_asr
chmod -R 755 work/patched_asr
cp $mounted/usr/local/bin/restored_external work/restored_external
"$dir"/restored_external64_patcher work/restored_external work/patched_restored_external
"$dir"/ldid -e work/restored_external > work/restored_external.plist
"$dir"/ldid -Swork/restored_external.plist work/patched_restored_external
chmod -R 755 work/patched_restored_external
rm $mounted/usr/sbin/asr
rm $mounted/usr/local/bin/restored_external
mv work/patched_asr $mounted/usr/sbin/asr
mv work/patched_restored_external $mounted/usr/local/bin/restored_external
hdiutil detach -force /tmp/SSHRD
else
"$dir"/hfsplus work/ramdisk.dmg extract /usr/sbin/asr work/asr
"$dir"/asr64_patcher work/asr work/patched_asr
"$dir"/ldid -e work/asr > work/asr.plist
"$dir"/ldid -Swork/asr.plist work/patched_asr
chmod 755 work/patched_asr
"$dir"/hfsplus work/ramdisk.dmg extract /usr/local/bin/restored_external work/restored_external
"$dir"/restored_external64_patcher work/restored_external work/patched_restored_external
"$dir"/ldid -e work/restored_external > work/restored_external.plist
"$dir"/ldid -Swork/restored_external.plist work/patched_restored_external
chmod 755 work/patched_restored_external
"$dir"/hfsplus work/ramdisk.dmg rm /usr/sbin/asr
"$dir"/hfsplus work/ramdisk.dmg rm /usr/local/bin/restored_external
"$dir"/hfsplus work/ramdisk.dmg add work/patched_asr /usr/sbin/asr
"$dir"/hfsplus work/ramdisk.dmg add work/patched_restored_external /usr/local/bin/restored_external
"$dir"/hfsplus work/ramdisk.dmg chmod 100755 /usr/sbin/asr
"$dir"/hfsplus work/ramdisk.dmg chmod 100755 /usr/local/bin/restored_external
fi
python3 -m pyimg4 im4p create -i work/ramdisk.dmg -o work/rdsk.im4p -f rdsk
cp -v work/*.img4 "boot/${deviceid}" # copying all file img4 to boot
echo "[*] Sucess Patching the boot files"
sleep 1
echo "[*] please execute wikiproxy.py in order to fix key issue"
echo "Please open another terminal and execute: python3 wikiproxy.py, [CLICK ENTER WHEN YOU SUCCESS]"
read -n 1 -s
set +e
"$dir"/gaster reset
sleep 1
"$dir"/irecovery -f "blobs/"$deviceid"-"$version".shsh2"
if [ "$dontRestore" = "1" ]; then
echo "[*] Finished creating boot files now you can --boot in order to get boot to the system"
exit;
fi
echo "[*] Executing futurerestore ..."
_runFuturerestore
sleep 2
echo -e "\033[1;33mif nothing works just try to run (with sudo or without) this command:\033[0m \033[1m$dir/futurerestore -t blobs/$deviceid-$version.shsh2 --use-pwndfu --skip-blob --rdsk work/rdsk.im4p --rkrn work/krnl.im4p --latest-sep $HasBaseband $ipsw\033[0m"
touch .downgraded
echo "if futurerestore restore sucess, you can boot using --boot"
fi
fi
} 2>&1 | tee logs/${log}