• Breaking News

    Saturday, October 5, 2019

    Home Unlabelled iOS Jailbreak [News] iOS 12.4.1 is no longer signed:(

    iOS Jailbreak [News] iOS 12.4.1 is no longer signed:(

    October 05, 2019

    iOS Jailbreak [News] iOS 12.4.1 is no longer signed:(

    [News] iOS 12.4.1 is no longer signed:(

    Posted: 04 Oct 2019 12:46 PM PDT

    [Tutorial] Untethered downgrade (compatible) A7 devices to 10.3.3 using checkm8 and currently signed OTA blobs

    Posted: 04 Oct 2019 02:18 PM PDT

    This guide assumes you have the latest liboffsetfinder64, iBoot64patcher, img4tool, img4lib, irecovery, tsschecker, bspatch, python and all the dependencies installed and updated to the latest version. I'm not going to help you install/compile these programs because I don't have time to help everyone sadly. It should be straight forward to compile and install everything, just google things and read errors if you get them.

    If this is shit or doesn't make sense I'm sorry, I wrote this at 3am and on 3 hours of sleep :)

    Note: If you don't want to patch iBSS/iBEC yourself or can't compile any of the programs then I have provided .patch files below. Please read the whole post though, so you don't miss anything.

    COMPATIBILITY: At the moment only the iPhone 5s (s5l8960x) is supported. I will create more patch files when Linus updates his rmsigchks.py for more A7 devices.

    Note that this IS an untethered downgrade as we are using OTA blobs meaning that the install of iOS is signed and won't need to be booted from pwndfu mode everytime unless you are booting in verbose mode.

    Currently only the iPhone6,2 has patch files as this is the 5s that I have. If requested I can create patch files for the iPhone6,1 but you can do those yourself if you want to. Turns out I'm stupid and 6,1 shares iBSS/iBEC with 6,2. Have uploaded new patches to fix another issue but if someone with a 6,1 can test that'd be great.

    I am planning on updating this guide soon to show how to boot in verbose mode. The way I use currently isn't amazing so I want to figure that out before I post how to.

    First download the 10.3.3 ipsw from here. Extract the contents of said ipsw and traverse from the root directory to /Firmware/dfu/ and grab iBSS.iphone6.RELEASE.im4p and iBEC.iphone6.RELEASE.im4p

    Move the two files into a folder with iBoot64patcher, img4tool and img4lib (img4 is name of binary for img4lib, and yes img4tool and img4 are very different you need both).

    Go to https://www.theiphonewiki.com/wiki/Firmware_Keys/10.x and click the link for the keys for 10.3.3 for your device

    Find the IV and Key for iBSS and iBEC.

    Put the two numbers together as one with the IV before the Key so for iphone6,2 iBSS the IV is 

    f2aa35f6e27c409fd57e9b711f416cfe

    and the Key is 

    599d9b18bc51d93f2385fa4e83539a2eec955fce5f4ae960b252583fcbebfe75

    so the final number is 

    f2aa35f6e27c409fd57e9b711f416cfe599d9b18bc51d93f2385fa4e83539a2eec955fce5f4ae960b252583fcbebfe75

    Now you need to decrypt iBSS and iBEC 

    ./img4 -i iBSS.iphone6.RELEASE.im4p -o ibss.decrypt -k "ivkey" -D"

    same command for iBEC just with file names and different ivkey.

    MAKE SURE TO INCLUDE "-D" OTHERWISE IT WON'T DECRYPT THE IMAGE

    Next run img4tool to extract the raw binary from the decrypted images as iboot64patcher does not support im4p and img4 files at the moment.

    Run 

    ./img4tool -e -o ibss.raw ibss.decrypt

    Same for iBEC, just change file names.

    Now you need to run iBoot64patcher. Here you can choose the boot-args you want to use, e.g here is where you enable verbose boot.

     ./iBoot64patcher ibss.raw ibss.pwn ./iBoot64patcher ibec.raw ibec.pwn -b "add-your-boot-args-here"

    As far as I know, you don't pass boot args to iBSS but I might be wrong. If you aren't sure then just use my verbose patch files to get verbose boot to work as I know they work.

    Next, use img4tool to do some cool shit.

     ./img4tool -p ibss.im4p --tag ibss --info iBoot-hax ibss.pwn ./img4tool -p ibec.im4p --tag ibec --info iBoot-hax ibec.pwn

    Now you need to use img4tool again but with some shsh. Lets get the shsh for 10.3.3 ota first.

    Download and install the latest tsschecker if you don't have it already. Then run 

    ./tsschecker -e "your-ecid" -s -o -i 9.9.10.3.3 --buildid 14G60 -d iPhone6,2(or whatever your device is) --save-path "/where/futurerestore/is"

    This will save shsh for your device for 10.3.3 to where you specified .

    Now use img4tool as follows 

    ./img4tool -p ibss.im4p -c ibss.img4 -s "/path/to/shsh/you/saved/" ./img4tool -p ibec.im4p -c ibec.img4 -s "/path/to/shsh/you/saved/"

    Now you have patched iBSS and iBEC that you can use to downgrade!

    Now, for those who don't want to mess around with that, I'll be providing patch files for iBSS/iBEC that you can use. You can download all the .patch files from my github repo

    First make sure you have "bspatch" installed then get the stock iBSS and iBEC from the 10.3.3 ipsw and place them in a folder with the .patch files.

    Now if you want verbose then run 

    bspatch iBSS.iphone6.RELEASE.im4p ibss.patched ibss.verbose.patch

    If you don't then run 

    bspatch iBSS.iphone6.RELEASE.im4p ibss.patched ibss.normal.patch

    Now do the same for iBEC.

    Note: I found that for switching from pwndfu to pwnrecovery later on only the verbose iBSS and iBEC worked so if irecovery fails or stops when sending iBEC then trying using the verbose files instead.

    Now you need a modified version of futurerestore (currently, tihmstar is updating the official version but for now we have to make do).

    I used s0uthwest's fork at latest version, 246, and modified it. You will need to download the latest release (245) and apply this patch to the futurerestore binary. You can also git clone the latest version, 246, and build from source then patch but either works I have tested both.

    bspatch futurerestore futurerestore_patched futurerestore.patch

    Now delete the old fututrerestore binary file and rename the new patched one to "futurerestore"

    Now download/clone Linus's fork of ipwndfu from here. cd into the ipwndfu_public folder and put your device into dfu mode then connect it to your macos device (hackintosh or legit mac, either is fine).

    Run 

    ./ipwndfu -p

    to get into pwndfu mode. Now this will fail a lot of times as that is just the nature of this exploit on the A7. That's expected just keep trying. I found closing itunes and iTunesHelper to help a bit but results may vary.

    Once in pwndfu mode, run 

    python rmsigchks.py

    and if all goes well it should return with 

    "Device is now ready to accept unsigned images"

    Now download the latest irecovery. Once done, you need to send a random dummy file to the device. This can be anything but I use a small .txt file. Run 

    ./irecovery -f random.txt

    After that runs and the device reconnects, you can send your pwned ibss and ibec =).

    ./irecovery -f ibss.img4

    Then once that sends and device reconnects run 

    ./irecovery -f ibec.img4

    and you will be able to futurerestore to 10.3.3 as you are now in pwnrecovery!

    Also download the 10.3.3 OTA build manifest from Alitek. Linked here

    Now we need to edit the stock 10.3.3 ipsw that we downloaded at the start. For this you will need a program that can edit the contents of a zip without breaking it. On windows I used 7Zip to do this, not sure what you can use for macOS but I know that there is programs that can do this. Easiest way to do use 7Zip on windows however.

    You need to grab the pwned iBSS and iBEC that you created before and rename them to match the original names that they had inside the ipsw. iBSS needs to be named iBSS.iphone6.RELEASE.im4p and iBEC needs to be named iBEC.iphone6.RELEASE.im4p. Now overwrite the current iBSS and iBEC inside the ipsw and once it repacks and is complete you have a custom ipsw to dowgrade with!

    Now the shsh you downloaded will not match the current apnonce of the device. My way of getting around this is attempting a restore with the mismatched shsh, finding the current apnonce of the device, Use igetnonce to get the apnonce of the device and grab shsh with the current apnonce of the device (Credit to rA9 for reminidng me that igetnonce is a thing). Run 

    ./igetnonce

    It will print out the apnonce for the device.

    Now use this apnonce and request a new ticket.

    Run 

    ./tsschecker -e "your-ecid" -s -o -i 9.9.10.3.3 --buildid 14G60 -d iPhone6,2(or whatever your device is) --save-path "/where/futurerestore/is" --apnonce "the number we just grabbed"

    This will grab shsh with the correct apnonce that your device currently has!

    Now run futurerestore again but with the new shsh 

    ./futurerestore -t "new-shsh-file" -b baseband from 10.3.3 ipsw -p Alitek's_OTA_buildmanifest.plist -s sep from 10.3.3 ipsw -m Alitek's_OTA_buildmanifest.plist 10.3.3.ipsw

    Phone should now restore to 10.3.3 with no issues! Make sure you have a good amount of storage availible when futurerestoreing, I ran into an issue where the restore failed because I ran out of SSD space.

    If you run into any issues, which I expect as this guide/tutorial probably contains some errors, just feel free to either comment here or dm me on twitter. Though i'm more likely to reply here because twitter sucks.

    Credits go to: axi0mx (checkm8), Tihmstar (img4tool, futurerestore, iBoot64patcher, liboffsetfinder64 and probably more), Linus (ipwndfu fork with removedsigpatches), alitek12 (OTA Buildmanifest for A7 devices), xerub (img4lib) and S0uthwes(futurerestore fork).

    submitted by /u/_Matty
    [link] [comments]

    [Release] CallSlicer - Your Apple Watch shows a third-party incoming call.

    Posted: 04 Oct 2019 11:39 AM PDT

    [Release] CCModules Pro - Increase the usability of your control center

    Posted: 04 Oct 2019 02:24 PM PDT

    Grab it from the Packix repo: https://repo.packix.com/package/com.jailbreak365.ccmodulespro

    CCModules Pro is a tweak that adds a number of useful features to the control center, with more on the way soon.

    Currently included with v1.0.0:

    • Cellular Data expandable view | What Apple should have done

    • WiFi expandable view | iOS 13 design

    • Bluetooth expandable view | iOS 13 design

    • Power Actions module | Native design

    • Contact modules | Four contact modules are included

    Power Actions Settings

    Contact Settings

    Upcoming features:

    • Volume and brightness with steps

    • Website links module

    • ??? Leave comments for more suggestions!

    Price: $2.50

    Also a massive thanks to u/opa334 for all his help on this tweak, I could not have made it without him!

    Edit: CCModules Pro and CCModules go together, CCModules Pro does not replace the original CCModules.

    submitted by /u/jailbreak365
    [link] [comments]

    [News] iPhone 6s/+ can be restored to 12.4.2 forever via iTunes.

    Posted: 04 Oct 2019 04:23 PM PDT

    [Request] Show 5 more songs in the popular section of an artist on spotify

    Posted: 04 Oct 2019 07:44 PM PDT

    [UPDATE] Noctis12 - 1.8 - New Adaptive Modes and Animations

    Posted: 04 Oct 2019 09:58 PM PDT

    [UPCOMING] Originals - Translate your messages quickly

    Posted: 04 Oct 2019 10:26 AM PDT

    [Discussion] Creation of a Raspberry Pi Zero based checkm8 exploit device

    Posted: 04 Oct 2019 03:04 PM PDT

    Attention: Long post!

    As far as I know, checkm8 is a nonpersisting (tethered) exploit. Therefore every time we e.g. want to jailbreak a device with checkm8, we would need a computer or a dongle to execute it. Because of the fact that carrying a computer all the time is not convenient (for me, and I assume for many others of this sub too), and the creation of a dongle would be quite challenging, I want to discuss the hardware setup by using a Raspberry Pi to facilitate the exploitation.

    My solution in short: A Raspberry Pi Zero exploits an iDevice via checkm8 after pressing a button on the RasPi.

    Problem 1: Powering the Raspberry Pi Zero:

    • The iPhone doesn't give enough power through the lightning port to run a Raspberry Pi 0. It boots, but crashed as I wanted to log in (tested via Lightning to USB Camera Adapter)
    • As far as I know, the Phone doesn't even give out power in DFU mode —> The exploiting device must have an external power source
    • Because the device has to be portable, we need (recharge) batteries. For my solution I would use a Pi Juice Zero with a battery.

    Problem 2: If we have a iDevice with two/three OSes or want to jailbreak/verbose Boot how to select what to do? * Probably the device would either need a screen or buttons connected to the GPIOs * maybe somehow we could use the iDevices' screen. It would probably require a lot of programming work, but would be the most user friendly solution.

    Problem 3: How to connect the iDevice to the Pi?

    • Not really a problem: OTG Adapter + Lightning cable would solve it...

    All in all (Tl;Dr)

    My „solution":

    Raspberry Pi Zero with a Pi Juice Zero and a battery, a USB OTG Adapter (found this small one: RPIZ-USB OTG Adapter (German site)) and a Lightning cable.

    This „solution" is quite bulky, but easy to setup (we still need to do some basic programming to get possible buttons to work, but that's minor work).

    What do you think about this idea? How would you do it? Maybe using an other board? And how hard will it be to create a real „dongle"?

    submitted by /u/Nonoone
    [link] [comments]

    [Request] Top charts in Zebra

    Posted: 04 Oct 2019 11:09 AM PDT

    Many new jailbreakers have no idea where to start with which tweaks to install. A top charts page, similar to the one in the App Store, would be really helpful for those users, as well as experienced ones. It would also give another benefit of Zebra over other package managers.

    The top charts could show each tweak and their respective repo (excluding pirate repos). It would also be a great way to discover new repos as well. If the user doesn't have the repo for a tweak on the top charts installed, it would ask them if they want to add it.

    submitted by /u/ctalbot4
    [link] [comments]

    [News] iOS 13.0 and 13.1.1 unsigned

    Posted: 04 Oct 2019 12:49 PM PDT

    [Request] A tweak to show usage time since last charge instead of 24 hours.

    Posted: 04 Oct 2019 08:55 AM PDT

    [Discussion] iOS 12.4.2 will be forever signed for iPhone 6

    Posted: 04 Oct 2019 03:34 PM PDT

    So we can use the SEP from it to downgrade the iPhone 6s/+ to 12.x with blobs when a tool will be released because there are identical firmwares and I think you can also restore the 6s to 12.4.2 without any problems. Correct me if I am wrong.

    submitted by /u/vince085
    [link] [comments]

    [Update] TweakReviewsDB v0.4.2 - Added basic dark mode support in Zebra

    Posted: 04 Oct 2019 10:11 AM PDT

    [Question] iPhone wont enter DFU or Recovery mode!

    Posted: 04 Oct 2019 06:28 PM PDT

    Long story short, I tried to reset all content and settings, and the reset bar was stuck approximately at 3/4. Wouldn't go any further. Waited hours! Tried to put it into Recovery and the DFU mode, and it just doesn't work; keeps on restarting back to the progress bar.

    Cannot even run any third party programs on my PC as they don't detect my iPhone even though it is connected.

    Please help me out with this matter!

    submitted by /u/boyarinn
    [link] [comments]

    [Request] full calendar similar to CCCalc

    Posted: 04 Oct 2019 12:35 PM PDT

    [Request] A tweak that would replace ONLY the non-X Status Bar battery to iPhone X styled battery (for use with BatteryPercent12 and similar tweaks, do NOT suggest me the one that changes the status bar complete replacement to iPad or iPhone or such)

    Posted: 04 Oct 2019 08:45 PM PDT

    [Upcoming] futurerestore update which will make checkm8 downgrading easier.

    Posted: 04 Oct 2019 02:24 AM PDT

    [Question] Set CS_Debugged in unc0ver does this allow me to do more things in terminal, and does this change any security vulnerabilities, is it safe to turn on ?

    Posted: 04 Oct 2019 05:24 PM PDT

    Title explains my question. Also same question for Export TFP0 in unc0ver thanks

    submitted by /u/MidnightTweaks
    [link] [comments]

    [Question] Does the tweak TSS Saver save valid blobs? I’m on 12.4 a12 and I’m not sure if it’s worked or not because it seemed too easy to have worked.

    Posted: 04 Oct 2019 04:05 PM PDT

    [Request] Tweak that brings iOS 13 CarPlay to A12 12.2?

    Posted: 04 Oct 2019 07:03 AM PDT

    [Help] No incoming audio in calls

    Posted: 04 Oct 2019 06:38 PM PDT

    Sometimes when I answer a call I don't get any incoming audio, even when connected to Bluetooth devices. It persists until I reboot and rejailbreak my device.

    Am I wrong to think it's some tweak I have?

    Tweak List: https://pastebin.com/aSLBq2Aw (Seems too long to include in the post)

    submitted by /u/CthuluOurSavior
    [link] [comments]

    [Question] Is the iPhone 6 (not S) officially discontinued? I cannot update to iOS 13.

    Posted: 04 Oct 2019 07:36 PM PDT
    Read more
    at

    No comments:

    Post a Comment

    Fashion

    Beauty

    Travel