Skip to content

Commit

Permalink
Switch exploit ramdisk 5/5C
Browse files Browse the repository at this point in the history
  • Loading branch information
LukeZGD committed Nov 10, 2023
1 parent 064b2c5 commit 5a5d7ca
Show file tree
Hide file tree
Showing 8 changed files with 39 additions and 27 deletions.
Binary file modified resources/firmware/src/target/iphone5/11B554a/exploit
Binary file not shown.
21 changes: 13 additions & 8 deletions resources/firmware/src/target/iphone5/11B554a/partition
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ if [ -e "/ios9" ]; then
mv -v /mnt1/Library/LaunchDaemons/com.apple.jetsamproperties.*.plist /mnt1/System/Library/LaunchDaemons/
sleep 3s

# step3
# step3
mv -v /mnt1/usr/libexec/CrashHousekeeping /mnt1/usr/libexec/CrashHousekeeping_
mv -v /mnt1/reloader /mnt1/usr/libexec/CrashHousekeeping
sleep 1s
Expand All @@ -53,33 +53,38 @@ System_LastSector="$((echo -e "i\n1\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null |
Data_LastSector="$((echo -e "i\n2\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null | sed -n -e 's/^.*Last sector: //p' | sed 's/ .*//')"
Data_Attributeflags="$((echo -e "i\n2\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null | sed -n -e 's/^.*flags: //p')"
Exploit_LastSector="$((524288/$LogicalSector))"
New_Data_LastSector="$(($Data_LastSector-$Exploit_LastSector))"
BOOTLOADER="$((8388608/$LogicalSector))"
NOTSD="$(($Exploit_LastSector+$BOOTLOADER))"
Data_LastSectorSD="$(($Data_LastSector-$BOOTLOADER))"
New_Data_LastSector="$(($Data_LastSector-$NOTSD))"
New_Data_SectorSize="$(($New_Data_LastSector-$System_LastSector))"
New_Data_Size="$(($New_Data_SectorSize*$LogicalSector))"

hfs_resize /mnt1/private/var $New_Data_Size
sleep 1s

if [ "$Data_Attributeflags" = "0001000000000000" ]; then
echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
else
echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n49\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
fi

echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n49\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSectorSD\n\nn\n4\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
sleep 1s

sleep 1s
newfs_hfs -s -v exploit /dev/rdisk0s1s3
newfs_hfs -s -v bootloader /dev/rdisk0s1s4
sleep 1s
fsck_hfs -f /dev/rdisk0s1s3
fsck_hfs -f /dev/rdisk0s1s4
sleep 2s

dd of=/dev/rdisk0s1s3 if=/exploit bs=512k count=1
sleep 1s
mount_hfs /dev/disk0s1s4 /mnt2

nvram -c
nvram boot-partition=2
nvram boot-ramdisk="/a/b/c/d/e/f/g/h/i/j/k/l/m/disk.dmg"
sleep 1s

dd of=/mnt2/iBEC if=/mnt1/iBoot bs=512k
rm /mnt1/iBoot
sleep 1s

reboot_
Binary file modified resources/firmware/src/target/iphone5/11D257/exploit
Binary file not shown.
20 changes: 12 additions & 8 deletions resources/firmware/src/target/iphone5/11D257/partition
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ if [ -e "/ios8" ]; then
sleep 1s
fi


if [ -e "/ios9" ]; then
# step1
mv -v /mnt1/System/Library/LaunchDaemons/* /mnt1/Library/LaunchDaemons/
Expand All @@ -54,33 +53,38 @@ System_LastSector="$((echo -e "i\n1\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null |
Data_LastSector="$((echo -e "i\n2\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null | sed -n -e 's/^.*Last sector: //p' | sed 's/ .*//')"
Data_Attributeflags="$((echo -e "i\n2\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null | sed -n -e 's/^.*flags: //p')"
Exploit_LastSector="$((524288/$LogicalSector))"
New_Data_LastSector="$(($Data_LastSector-$Exploit_LastSector))"
BOOTLOADER="$((8388608/$LogicalSector))"
NOTSD="$(($Exploit_LastSector+$BOOTLOADER))"
Data_LastSectorSD="$(($Data_LastSector-$BOOTLOADER))"
New_Data_LastSector="$(($Data_LastSector-$NOTSD))"
New_Data_SectorSize="$(($New_Data_LastSector-$System_LastSector))"
New_Data_Size="$(($New_Data_SectorSize*$LogicalSector))"

hfs_resize /mnt1/private/var $New_Data_Size
sleep 1s

if [ "$Data_Attributeflags" = "0001000000000000" ]; then
echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
else
echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n49\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
fi

echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n49\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSectorSD\n\nn\n4\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
sleep 1s

sleep 1s
newfs_hfs -s -v exploit /dev/rdisk0s1s3
newfs_hfs -s -v bootloader /dev/rdisk0s1s4
sleep 1s
fsck_hfs -f /dev/rdisk0s1s3
fsck_hfs -f /dev/rdisk0s1s4
sleep 2s

dd of=/dev/rdisk0s1s3 if=/exploit bs=512k count=1
sleep 1s
mount_hfs /dev/disk0s1s4 /mnt2

nvram -c
nvram boot-partition=2
nvram boot-ramdisk="/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/disk.dmg"
sleep 1s

dd of=/mnt2/iBEC if=/mnt1/iBoot bs=512k
rm /mnt1/iBoot
sleep 1s

reboot_
1 change: 0 additions & 1 deletion resources/firmware/src/target/iphone5b/11B554a/partition
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ if [ -e "/ios8" ]; then
sleep 1s
fi


if [ -e "/ios9" ]; then
# step1
mv -v /mnt1/System/Library/LaunchDaemons/* /mnt1/Library/LaunchDaemons/
Expand Down
Binary file modified resources/firmware/src/target/iphone5b/11D257/exploit
Binary file not shown.
20 changes: 12 additions & 8 deletions resources/firmware/src/target/iphone5b/11D257/partition
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ if [ -e "/ios8" ]; then
sleep 1s
fi


if [ -e "/ios9" ]; then
# step1
mv -v /mnt1/System/Library/LaunchDaemons/* /mnt1/Library/LaunchDaemons/
Expand All @@ -54,33 +53,38 @@ System_LastSector="$((echo -e "i\n1\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null |
Data_LastSector="$((echo -e "i\n2\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null | sed -n -e 's/^.*Last sector: //p' | sed 's/ .*//')"
Data_Attributeflags="$((echo -e "i\n2\nq") | gptfdisk /dev/rdisk0s1 2>/dev/null | sed -n -e 's/^.*flags: //p')"
Exploit_LastSector="$((524288/$LogicalSector))"
New_Data_LastSector="$(($Data_LastSector-$Exploit_LastSector))"
BOOTLOADER="$((8388608/$LogicalSector))"
NOTSD="$(($Exploit_LastSector+$BOOTLOADER))"
Data_LastSectorSD="$(($Data_LastSector-$BOOTLOADER))"
New_Data_LastSector="$(($Data_LastSector-$NOTSD))"
New_Data_SectorSize="$(($New_Data_LastSector-$System_LastSector))"
New_Data_Size="$(($New_Data_SectorSize*$LogicalSector))"

hfs_resize /mnt1/private/var $New_Data_Size
sleep 1s

if [ "$Data_Attributeflags" = "0001000000000000" ]; then
echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
else
echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n49\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
fi

echo -e "d\n2\nn\n\n$New_Data_LastSector\n\nc\n2\nData\nx\na\n2\n48\n49\n\nc\n2\n$Data_GUID\ns\n4\nm\nn\n3\n\n$Data_LastSectorSD\n\nn\n4\n\n$Data_LastSector\n\nw\nY\n" | gptfdisk /dev/rdisk0s1
sleep 1s

sleep 1s
newfs_hfs -s -v exploit /dev/rdisk0s1s3
newfs_hfs -s -v bootloader /dev/rdisk0s1s4
sleep 1s
fsck_hfs -f /dev/rdisk0s1s3
fsck_hfs -f /dev/rdisk0s1s4
sleep 2s

dd of=/dev/rdisk0s1s3 if=/exploit bs=512k count=1
sleep 1s
mount_hfs /dev/disk0s1s4 /mnt2

nvram -c
nvram boot-partition=2
nvram boot-ramdisk="/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/disk.dmg"
sleep 1s

dd of=/mnt2/iBEC if=/mnt1/iBoot bs=512k
rm /mnt1/iBoot
sleep 1s

reboot_
4 changes: 2 additions & 2 deletions restore.sh
Original file line number Diff line number Diff line change
Expand Up @@ -2449,7 +2449,7 @@ ipsw_prepare_powder() {
fi
fi
local ExtraArgs2="--boot-partition"
if [[ $device_type == "iPhone5,3" || $device_type == "iPhone5,4" ]] && [[ $device_base_vers == "7.0"* ]]; then
if [[ $device_type == "iPhone5"* ]]; then
# do this stuff because these use ramdiskH (jump to /boot/iBEC) instead of jump ibot to ibob
if [[ $device_target_vers == "9"* ]]; then
ExtraArgs2+="9"
Expand Down Expand Up @@ -3735,7 +3735,7 @@ menu_print_info() {
warn "Activation records flag detected. Proceed with caution"
fi
if [[ -n $device_disable_bbupdate || $device_actrec == 1 ]]; then
print "* Stitching is supported in these restores/downgrades: 8.4.1/6.1.3, Other with SHSH (iOS 5+), powdersn0w"
print "* Stitching is supported in these restores/downgrades: 8.4.1/6.1.3, Other with SHSH, powdersn0w"
fi
if [[ -n $device_build ]]; then
print "* iOS Version: $device_vers ($device_build)"
Expand Down

0 comments on commit 5a5d7ca

Please sign in to comment.