View source for Ios-kexec-utils

{{DISPLAYTITLE:ios-kexec-utils}}
'''ios-kexec-utils''' are a set of four iOS command line utilities written by winocm, originally designed to make booting another OS easier. Though described as “probably crap” by winocm herself, they have paved the way for a range of tools for 32-bit devices, including Odysseus (including derivative works such as OdysseusOTA and Beehind) and CoolBooter, as well as futurerestore’s ability to downgrade 32-bit devices. Use cases include dumping onboard SHSH blobs, downgrading to OTA signed firmware, downgrading to unsigned firmware with blobs and dual booting.

== Utilities ==
Of the four utilities, kloader and multi_kloader must be executed on-device to “perform the magic”, while img3maker and ibsspatch just produce files and can be compiled for and run on any platform.

=== img3maker ===
'''img3maker''' is a tool that, offering a variety of options, makes an [[Img3]] file container for a given file. This is needed for the decrypted boot chain.

=== ibsspatch ===
'''ibsspatch''' is a generic [[iBSS]] patcher for iOS 7.

=== kloader ===
'''kloader''' ('''''k'''ernel '''loader''''') is an image loader for the kernel, that loads a custom image into RAM and bootstraps it. It must be executed on the device and requires access to the kernel memory through <code>task_for_pid(0)</code> (tfp0), but can be adapted to use the equivalent <code>host_get_special_port(4)</code> instead. Needless to say, kloader is thus unable to run on unjailbroken firmware.

The three main use cases for kloader are:
# Downgrading: kloader is used to bootstrap a custom iBSS image that has been patched out of all integrity checks. This allows a custom ramdisk with a custom [[ASR]] to be used, which in turn allows a system restore to finish without ASR ruining the process when the signatures don’t match. The ability to use any ramdisk also makes it possible to use OTA blobs instead of regular ERASE/UPDATE blobs. It can also be abused to restore with invalid blobs and thus on purpose render the device unbootable.
# Dual booting: kloader is used to bootstrap custom iBSS and iBEC images that also have been patched to boot the system on partition <code>/dev/disk0s1s3</code> instead of the main system. Additional patches down the bootchain are required.
# Dumping onboard SHSH blobs: kloader is used to bootstrap custom iBSS and iBEC images that have been patched in the same way as when downgrading. [[iRecovery]] is then used to upload xerub’s ibex payload and dump the blobs.

On iOS 6 hosts, kloader will be paused when locking the screen if run directly from MTerminal. There are ways to get around this, for example by using the GUI utility Way Out, or by launching kloader over ssh (OpenSSH must be installed and enabled): <code>ssh root@localhost</code>, then e.g. <code>kloader /iBSS</code>.

=== multi_kloader ===
'''multi_kloader''' extends kloader’s functionality by loading two images into memory instead of one. It is especially useful for dual booting iPods and iPhones, as it can load both iBSS and iBEC directly, without having to use [[iRecovery]] on a computer to bootstrap iBEC after loading iBSS. multi_kloader is used by dual boot utilities CoolBooter and Way Out.

== Further development ==
The last commit was pushed by winocm on {{date|2014|03|31}}, ten days after she announced that she would be joining Apple later that year. The project was left compatible with iOS 6 and 7 (the most recent firmware at the time) and was 32-bit only.

axi0mX later updated kloader to support iOS 4 and 5, and also introduced experimental support for 64-bit devices running iOS 7 or 8.

== External links ==
* winocm's [https://github.com/ramytuki/ios-kexec-utils ios-kexec-utils] repository on GitHub
* axi0mX's [https://github.com/axi0mx/ios-kexec-utils ios-kexec-utils] fork on GitHub

[[Category:Software]]
[[Category:Jailbreaking]]