Talk:Pangu8 - Revision history

5urd at 20:48, 2 November 2014

2014-11-02T20:48:31Z

Haifisch at 08:00, 2 November 2014

2014-11-02T08:00:57Z

Haifisch: /* Research */ new section

2014-11-02T07:54:35Z

‎Research: new section

New page

== Research ==

Pangu8 uses the same method as evasi0n7 did to run the kernel exploit.
Here are some light details on the files in the untether package;
* libmis.dylib - Same as in evasi0n7, overrides symbols in amfid to make the signature check return 0, this is used in conjunction with the codesign hack.
* pangu_xpcd.dylib - handles codesigning hax???
* xpcd_cache.dylib - this dylib gets loaded by launchd on boot, this file is a new home for LaunchDaemons, Pangu8 replaces the old dylib with this patched version that includes an entry into the plist that gets returned that specifies xuanyuansword to be ran on boot (only once)
* xuanyuansword - this is the file that contains all the kernel exploit goodies that runs on every boot
* io.pangu.untether.plist - the launch daemon for the untether binary that gets used after the xpcd cache is rebuilt?
--[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 07:54, 2 November 2014 (UTC)

@@ Line 1: / Line 1: @@
 == Research ==
 Pangu8 uses the same method as evasi0n7 did to run the kernel exploit.
 Here are some light details on the files in the untether package;
 * libmis.dylib  - Same as in evasi0n7, overrides symbols in amfid to make the signature check return 0, this is used in conjunction with the codesign hack.
-* pangu_xpcd.dylib - handles codesigning hax???
+* pangu_xpcd.dylib - handles codesigning hacks(?)
 * xpcd_cache.dylib - this dylib gets loaded by launchd on boot, this file is a new home for LaunchDaemons, Pangu8 replaces the old dylib with this patched version that includes an entry into the plist that gets returned that specifies xuanyuansword to be ran on boot (only once)
 * xuanyuansword - this is the file that contains all the kernel exploit goodies that runs on every boot
 * io.pangu.untether.plist - the launch daemon for the untether binary that gets used after the xpcd cache is rebuilt?
-I went through and checked each dynamic library with IDA Pro for imports/exports and what functions each hack overrided, and grepped through launchd using strings command like so; 'strings launchd_binary | grep xpcd_cache.dylib' to see if the system path for xpcd_cache is defined in the iOS version of launchd like it is in the OSX [http://opensource.apple.com/source/launchd/launchd-842.92.1/support/launchctl.c launchctl source]
+I went through and checked each dynamic library with IDA Pro for imports/exports and what functions each hack overrided, and grepped through launchd using strings command like so; 'strings launchd_binary | grep xpcd_cache.dylib' to see if the system path for xpcd_cache is defined in the iOS version of launchd like it is in the OSX [http://opensource.apple.com/source/launchd/launchd-842.92.1/support/launchctl.c launchctl source] --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 07:54, 2 November 2014 (UTC)