Tfp0 patch - Revision history

JonathanSeals: Yalu enables tfp0 on A9 and earlier devices, not sure if extra_recipe enables it there for those devices.

2017-12-29T16:02:12Z

Yalu enables tfp0 on A9 and earlier devices, not sure if extra_recipe enables it there for those devices.

Gjest: /* Jailbreaks lacking tfp0 */ link fix

2017-12-26T21:36:54Z

‎Jailbreaks lacking tfp0: link fix

Gjest: /* tfp0 enabled jailbreaks */

2017-12-26T21:35:19Z

‎tfp0 enabled jailbreaks

Gjest at 21:33, 26 December 2017

2017-12-26T21:33:19Z

Spydar007 at 07:39, 26 December 2017

2017-12-26T07:39:45Z

Gjest: tfp0 enabled jailbreaks

2017-12-26T00:07:54Z

tfp0 enabled jailbreaks

Gjest: Gjest moved page Task for pid0 patch to Tfp0 patch: More common name, easier to find article

2017-12-25T23:15:45Z

Gjest moved page Task for pid0 patch to Tfp0 patch: More common name, easier to find article

Gjest: +lede, +example code, “task_for_pid-allow” is needed on iOS 6 (but not “get-task-allow”, will test on higher versions later)

2017-12-25T23:14:59Z

+lede, +example code, “task_for_pid-allow” is needed on iOS 6 (but not “get-task-allow”, will test on higher versions later)

Winocm: Created page with "{{DISPLAYTITLE:task-for-pid0 Patch}} * task_for_pid requires entitlements 'get-task-allow' to make AMFI happy. * task_for_pid cannot get kernel_task without a patch. * Thi..."

2014-01-12T23:44:20Z

Created page with "{{DISPLAYTITLE:task-for-pid0 Patch}} * task_for_pid requires entitlements 'get-task-allow' to make AMFI happy. * task_for_pid cannot get kernel_task without a patch. * Thi..."

New page

{{DISPLAYTITLE:task-for-pid0 Patch}}
* task_for_pid requires entitlements 'get-task-allow' to make [[AMFI]] happy.
* task_for_pid cannot get kernel_task without a patch.
* This patch allows you to get the kernel Mach task, you can then use vm_read and vm_write to modify the kernel VM region.
[[Category:Kernel Patches]]

@@ Line 55: / Line 55: @@
 * [[Pangu9]] (9.0–9.3.3) on 64-bit
 :* Solution: use cl0ver by Siguza, or re-jailbreak using jbme (uses the trident exploit chain instead)
-* [[yalu + mach_portal]] (10.0–10.1.1) on 64-bit
+* [[yalu + mach_portal]] (10.0–10.1.1) on iPhone 7/iPhone 7 Plus
 :* Solution: use extra_recipe+yaluX instead
 * [[h3lix]] (10.0–10.3.3) on 32-bit

@@ Line 55: / Line 55: @@
 * [[Pangu9]] (9.0–9.3.3) on 64-bit
 :* Solution: use cl0ver by Siguza, or re-jailbreak using jbme (uses the trident exploit chain instead)
-* [[mach_portal+yalu]] (10.0–10.1.1) on 64-bit
+* [[yalu + mach_portal]] (10.0–10.1.1) on 64-bit
 :* Solution: use extra_recipe+yaluX instead
 * [[h3lix]] (10.0–10.3.3) on 32-bit

@@ Line 45: / Line 45: @@
 * [[yalu102]] (10.2) on 64-bit (excluding iPhone 7)
 The following jailbreaks do ''not'' have tfp0 enabled:
 * [[Pangu]] v0.1–0.2 (7.1–7.1.2)
@@ Line 53: / Line 54: @@
 :* Solution: replace PPJailbreak with TaiG
 * [[Pangu9]] (9.0–9.3.3) on 64-bit
-:* Solution: use cl0ver by Siguza
+:* Solution: use cl0ver by Siguza, or re-jailbreak using jbme (uses the trident exploit chain instead)
 * [[h3lix]] (10.0–10.3.3) on 32-bit
 :* No solution for compiled code, replace <code>task_for_pid(mach_task_self(), 0, &ktask)</code> calls with <code>host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &ktask)</code> if source is available

@@ Line 42: / Line 42: @@
 * [[Home Depot]] (9.1–9.3.4) on 32-bit
 * [[jbme]] (9.2–9.3.3) on 64-bit
-* [[yalu]] (10.x) on 64-bit
+* [[extra_recipe+yaluX]] (10.0–10.1.1) on 64-bit
 The following jailbreaks do ''not'' have tfp0 enabled:
@@ Line 55: / Line 56: @@
 * [[h3lix]] (10.0–10.3.3) on 32-bit
 :* No solution for compiled code, replace <code>task_for_pid(mach_task_self(), 0, &ktask)</code> calls with <code>host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &ktask)</code> if source is available
 [[Category:Kernel Patches]]

@@ Line 32: / Line 32: @@
 == tfp0 enabled jailbreaks ==
 Jailbreaks known to enable tfp0 include:
-* Absinthe (5.1.1)
+* [[Absinthe]] (5.1.1)
-* evasi0n (6.0–6.1.2)
+* [[evasi0n]] (6.0–6.1.2)
-* p0sixspwn (6.1.3–6.1.6)
+* [[p0sixspwn]] (6.1.3–6.1.6)
-* evasi0n7 (7.0–7.0.6)
+* [[evasi0n7]] (7.0–7.0.6)
-* Pangu v 0.3 (7.1–7.1.2)
+* [[Pangu]] v0.3 (7.1–7.1.2)
-* Pangu8 v 0.5 (8.0–8.1)
+* [[Pangu8]] v0.5 (8.0–8.1)
-* TaiG (8.0–8.4)
+* [[TaiG]] (8.0–8.4)
-* Pangu9 (9.0–9.0.2) on 32-bit
+* [[Pangu9]] (9.0–9.0.2) on 32-bit
-* Home Depot (9.1–9.3.4) on 32-bit
+* [[Home Depot]] (9.1–9.3.4) on 32-bit
-* JailbreakMe (9.2–9.3.3) on 64-bit
+* [[jbme]] (9.2–9.3.3) on 64-bit
-* Yalu (10.x) on 64-bit
+* [[yalu]] (10.x) on 64-bit
 The following jailbreaks do ''not'' have tfp0 enabled:
-* Pangu7 v 0.1–0.2 (7.1–7.1.2)
+* [[Pangu]] v0.1–0.2 (7.1–7.1.2)
 :* Solution: Update to version 0.3 (filename: <code>io.pangu.axe7_0.3_iphoneos-arm.deb</code>)
-* Pangu8 v 0.1–0.4 (8.0–8.1)
+* [[Pangu8]] v0.1–0.4 (8.0–8.1)
 :* Solution: Update to version 0.5 (filename: <code>io.pangu.xuanyuansword8_0.5_iphoneos-arm.deb</code>)
-* PPJailbreak (8.0–8.4)
+* [[PPJailbreak]] (8.0–8.4)
 :* Solution: replace PPJailbreak with TaiG
-* Pangu9 (9.0–9.3.3) on 64-bit
+* [[Pangu9]] (9.0–9.3.3) on 64-bit
 :* Solution: use cl0ver by Siguza
-* h3lix (10.0–10.3.3) on 32-bit
+* [[h3lix]] (10.0–10.3.3) on 32-bit
 :* No solution for compiled code, replace <code>task_for_pid(mach_task_self(), 0, &ktask)</code> calls with <code>host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &ktask)</code> if source is available

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:tfp0 patch}}
-In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.
+In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable running as root to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.
 == Example code ==
@@ Line 29: / Line 29: @@
  </dict>
  </plist>
 [[Category:Kernel Patches]]

← Older revision	Revision as of 23:15, 25 December 2017
(No difference)

← Older revision		Revision as of 23:14, 25 December 2017
Line 1:		Line 1:
−	{{DISPLAYTITLE:~~task-for-pid0~~ ~~Patch~~}}	+	{{DISPLAYTITLE:tfp0 patch}}
		+	In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.
−	* task_for_pid requires entitlements 'get-task-allow' to make [[AMFI]] happy.
		+
−	* task_for_pid cannot get kernel_task without a patch.
		+	== Example code ==
−	* This patch allows you to get the kernel Mach task, you can then use vm_read and vm_write to modify the kernel VM region.
		+	The following C program calls <code>task_for_pid</code> and returns the error code:
		+
		+	#include <mach/mach.h>
		+
		+	// Compile and fakesign with entitlements (on-device; LLVM+Clang and ldid must be installed):
		+	// cc -o tfp0 tfp0.c && ldid -Stfp0.plist tfp0
		+
		+	int main(void) {
		+	mach_port_t kernel_task = 0;
		+	return task_for_pid(mach_task_self(), 0, &kernel_task);
		+	}
		+
		+	The returned error code, which can be checked using <code>echo $?</code> in bash after running the test program, will be 0 if the call succeeded. If it did not, a positive number, e.g. 5 (KERN_FAILURE), is returned instead (see <code>kern_return.h</code> for possible values). The entitlements plist (named <code>tfp0.plist</code> in this example) for [[ldid]] can look like this:
		+
		+	<?xml version="1.0" encoding="UTF-8"?>
		+	<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">
		+	<plist version="1.0">
		+	<dict>
		+	<key>get-task-allow</key>
		+	<true/>
		+	<key>run-unsigned-code</key>
		+	<true/>
		+	<key>task_for_pid-allow</key>
		+	<true/>
		+	</dict>
		+	</plist>
		+
	[[Category:Kernel Patches]]		[[Category:Kernel Patches]]