Tutorial:Odysseus Bundles - Revision history

Kiddepants: fix typo's

2018-12-21T11:37:39Z

fix typo's

Benfxmth: Correction: it is actually option+G

2018-12-14T07:55:22Z

Correction: it is actually option+G

OothecaPickle: option not command

2018-03-14T03:11:13Z

option not command

Gjest: /* iBEC Patch */ 0xBFF01199 is the memory address of the go command handler subroutine

2017-05-26T08:21:06Z

‎iBEC Patch: 0xBFF01199 is the memory address of the go command handler subroutine

Gjest: /* iBSS Patch */ patch explanation, format

2017-05-26T06:05:04Z

‎iBSS Patch: patch explanation, format

Gjest: /* Getting Decrypted Files */ link to partial-zip source

2017-05-26T05:33:02Z

‎Getting Decrypted Files: link to partial-zip source

Gjest: /* Kernel Disassembly */ format

2017-05-26T05:27:56Z

‎Kernel Disassembly: format

Gjest: /* Getting Decrypted Files */ format, a couple of details, notes, links to mentioned tools

2017-05-26T05:09:26Z

‎Getting Decrypted Files: format, a couple of details, notes, links to mentioned tools

Gjest: /* iBEC Patch */ Possible explanation for one patch, some information about another

2017-05-26T04:40:28Z

‎iBEC Patch: Possible explanation for one patch, some information about another

Spydar007: Spydar007 moved page Tutorial: Odysseus Bundles to Tutorial:Odysseus Bundles

2017-04-24T08:34:41Z

Spydar007 moved page Tutorial: Odysseus Bundles to Tutorial:Odysseus Bundles

@@ Line 102: / Line 102: @@
 *In IDA's right panel, search for "failed signature"
 *Calculate the value needed to do a branch from failed instruction to passed instruction (which should be before or after it). In this case, it will be from "176E4" to "1768C", which will be <code>D2 E7</code>
-*Apply patch by clicking in signtuare failed line, then by going in IDA to Edit->Patch Program->Change Byte, and replace the first bytes with <code>D2 E7</code>. Then Edit->Patch Program->Apply patches to input file, and check box for create a backup. You will notice the branch visually pointing from signtaure failed (text no longer visible) to signature passed
+*Apply patch by clicking in signature failed line, then by going in IDA to Edit->Patch Program->Change Byte, and replace the first bytes with <code>D2 E7</code>. Then Edit->Patch Program->Apply patches to input file, and check box for create a backup. You will notice the branch visually pointing from signature failed (text no longer visible) to signature passed
 *Run "ldid -s" on patched file
 *Create a .patch file by diffing both files: bsdiff [original] [patched] asr.patch

@@ Line 7: / Line 7: @@
 After running this tutorial and creating the iPhone5,1 9.3.3 bundle, you can use the same logic to create other bundles as code will be similar.
-WARNING: This tutorial is for advanced users. You are proceeding on your own risk, as patching something incorrectly will result in unintended consequences in addition to restoring to currently singed un-jailbroken firmware.
+WARNING: This tutorial is for advanced users. You are proceeding on your own risk, as patching something incorrectly will result in unintended consequences in addition to restoring to currently signed un-jailbroken firmware.
 ==Getting Decrypted Files==
@@ Line 125: / Line 125: @@
  Line 001C0: 0020 0020 7ACC E400 0000 0000 0000 0000
-*Open edited file in IDA. Select line at 1A8, and press "cmd+G" to enter thumb mode and enter "0x1" for Value. Afterwards, press "C" to convert code and lastly, press "P" to create new subroutine on line 1A8. It will look like this, where you can see the offsets that we found and there corresponding patches:
+*Open edited file in IDA. Select line at 1A8, and press "option+G" to enter thumb mode and enter "0x1" for Value. Afterwards, press "C" to convert code and lastly, press "P" to create new subroutine on line 1A8. It will look like this, where you can see the offsets that we found and there corresponding patches:
  ROM:000001A8 sub_1A8                                 ; CODE XREF: sub_1A048+154p

@@ Line 67: / Line 67: @@
 # In IDA's right panel, search for "com.apple.security.sandbox:__text"
-# If you don't see disassembled code (like above), then you need to convert to arm thumb mode. Press "cmd+G" when using mac, enter for "Value" "0x1" and press "Ok". You will then see disassembled code
+# If you don't see disassembled code (like above), then you need to convert to arm thumb mode. Press "option+G" when using mac, enter for "Value" "0x1" and press "Ok". You will then see disassembled code
 # Continue search for "mac_label_get"
 # Double click "sub_80EA3F70" for "mac_label_get" (the sub is found to the right of it)

← Older revision		Revision as of 08:21, 26 May 2017
Line 166:		Line 166:
	5) In IDA's right panel, search for "0xBFF01199", and change to "0x80000000". This will be <code>00 00 00 80</code> in bytes.		5) In IDA's right panel, search for "0xBFF01199", and change to "0x80000000". This will be <code>00 00 00 80</code> in bytes.

		+	0xBFF01199 is the memory address of the [[Go (iBoot command)\|''go'' command]] handler (at byte offset 0x44 there is a reference to 0xBFF00000, which is the base address. Rebase to this and jump to 0xBFF01199 to get to the subroutine). This patch is needed for TBD
−	This patch is needed for TBD
−
−	(At offset 0x44 there is a reference to an address 0xBFF00000. After rebasing to this address, jumping to 0xBFF01199 leads to a subroutine referencing strings such as “Memory image not valid” and “Permission Denied”.)

	6) In IDA's right panel, search for "0x496D6733", and delete the sub after it, "sub_17F54":		6) In IDA's right panel, search for "0x496D6733", and delete the sub after it, "sub_17F54":

@@ Line 293: / Line 293: @@
 ==iBSS Patch==
-) Load the decrypted iBSS file. In IDA's right panel, search for "0x496D6733", and delete the sub after it "sub_6228"
+# Load the decrypted iBSS file. In IDA's right panel, search for "0x496D6733", and delete the sub after it "sub_6228". This procedure references the same IMG3 tag magic numbers as the iBEC procedure deleted above, meaning that this patch is likely there to disable the evaluation of SHSH blobs.
  ROM:0000621C ; ---------------------------------------------------------------------------
@@ Line 329: / Line 329: @@
  ROM:0000623E                 LDR             R6, [R6]
  ROM:0000665A loc_665A                                ; CODE XREF: sub_655C+298j
@@ Line 353: / Line 353: @@
  ROM:0000668A                 B               loc_66B6
  ROM:0000665A loc_665A                                ; CODE XREF: sub_655C+298j
@@ Line 376: / Line 378: @@
  ROM:0000668A                 B               loc_66B6
  ROM:0000F004 loc_F004                                ; CODE XREF: sub_EED4+11Ej
@@ Line 392: / Line 394: @@
  ROM:0000F016                 BEQ             loc_F05E
  ROM:0000F004 loc_F004                                ; CODE XREF: sub_EED4+11Ej
@@ Line 406: / Line 410: @@
  ROM:0000F016                 BEQ             loc_F05E
 ==Create Plist File==

@@ Line 11: / Line 11: @@
 ==Getting Decrypted Files==
-# Download the [http://appldnld.apple.com/iOS9.3.3/031-59985-20160718-06E852CA-4378-11E6-80FA-E0EC7FED88F1/iPhone5,1_9.3.3_13G34_Restore.ipsw iPhone5,1 9.3.3 IPSW]. Alternatively, you can use partial zip to grab the files below
+# Download the [http://appldnld.apple.com/iOS9.3.3/031-59985-20160718-06E852CA-4378-11E6-80FA-E0EC7FED88F1/iPhone5,1_9.3.3_13G34_Restore.ipsw iPhone5,1 9.3.3 IPSW]. Alternatively, you can use [https://github.com/planetbeing/partial-zip partial-zip] to grab the files below
 # Change the extension from IPSW to ZIP, and grab the following files:
 #* 058-49199-034.dmg (Restore Ramdisk)

@@ Line 32: / Line 32: @@
 We need to disassemble kernel in order to retreive offsets that we will use when patching iBEC. Load the final decrypted kernel file (kernelcache.decrypted.arm) using IDA, select "ARM Little Endian" under "Processor Type" and let it do its thing. When done, we will be looking for 2 offsets:
-*First Offset
+=== First Offset ===
-) In IDA's right panel, search for "entitlements are not a dictionary". This will be in the "com.apple.driver.AppleMobileFileIntegrity" section<br>
+# In IDA's right panel, search for "entitlements are not a dictionary". This will be in the "com.apple.driver.AppleMobileFileIntegrity" section
-) Double click "loc_80775D12" right before the text we searched for<br>
+# Double click "loc_80775D12" right before the text we searched for
-) Double click "sub_80776B2C", which is the 2nd BL in the instruction<br>
+# Double click "sub_80776B2C", which is the 2nd BL in the instruction
-) This will take you to an instruction similar to this:<br>
+# This will take you to an instruction similar to this:
  com.apple.driver.AppleMobileFileIntegrity:__text:80776B2C sub_80776B2C                    ; CODE XREF: sub_80775C88+9Ap
@@ Line 60: / Line 60: @@
  com.apple.driver.AppleMobileFileIntegrity:__text:80776B50               MLA.W           R5, R3, R0, R2
-) Record the offset for this sub, where in IDA it will show in bottom left of the right panel. Here, it will be "0x72CB2C".
+Record the offset for this sub, where in IDA it will show in bottom left of the right panel. Here, it will be "0x72CB2C".
 This offset is needed to patch [[AppleMobileFileIntegrity]].
-*Second Offset
+=== Second Offset ===
-) In IDA's right panel, search for "com.apple.security.sandbox:__text"<br>
+# In IDA's right panel, search for "com.apple.security.sandbox:__text"
-) If you don't see disassembled code (like above), then you need to convert to arm thumb mode. Press "cmd+G" when using mac, enter for "Value" "0x1" and press "Ok". You will then see disassembled code<br>
+# If you don't see disassembled code (like above), then you need to convert to arm thumb mode. Press "cmd+G" when using mac, enter for "Value" "0x1" and press "Ok". You will then see disassembled code
-) Continue search for "mac_label_get"<br>
+# Continue search for "mac_label_get"
-) Double click "sub_80EA3F70" for "mac_label_get" (the sub is found to the right of it)<br>
+# Double click "sub_80EA3F70" for "mac_label_get" (the sub is found to the right of it)
-) Double click "sub_80E96C58", which is a reference for that previous "sub_80EA3F70" (to the top after CODE XREF)<br>
+# Double click "sub_80E96C58", which is a reference for that previous "sub_80EA3F70" (to the top after CODE XREF)
-) This will take you to an instruction similar to this:<br>
+# This will take you to an instruction similar to this:
  com.apple.security.sandbox:__text:80E4B270 loc_80E96C60     		; CODE XREF: sub_80E96C58+2j
@@ Line 93: / Line 93: @@
  com.apple.security.sandbox:__text:80E96C86                 DMB.W           ISHST
-) Look for offset in IDA at "BL sub_80EA3F70". Here, it will be "0xE4CC7A".
+Look for offset in IDA at "BL sub_80EA3F70". Here, it will be "0xE4CC7A".
 This offset is needed to patch [[Sandbox]], which goes together with first offset.

@@ Line 169: / Line 169: @@
 This patch is needed for TBD
  ROM:00017F48 ; ---------------------------------------------------------------------------
@@ Line 206: / Line 208: @@
 This patch is needed for TBD
 ) In IDA's right panel, search for <code>BL    loc_17F54</code> found in this instruction:

← Older revision	Revision as of 08:34, 24 April 2017
(No difference)