v0rtex-S icon indicating copy to clipboard operation
v0rtex-S copied to clipboard

nvram boot-nonce patch, more elegant offset loading

Open arx8x opened this issue 7 years ago • 4 comments

pls read, senpai

  • changes the button to say 'go', since we're not just running the sploit anymore
  • use sysctl calls to get hw identifier and current build id
  • organized device, build id blocks to add offset for every possible device that has 10.3 - 10.3.3(more will be added in the next commit)
  • log test offset, device identifier, build id, kern version to console so that you can actually check if it loads the offset
  • fixed a condition check in offset loading
  • changed some return values and comparisons to match C standards
  • removed comparisons using Foundation objects for identifying device + buildid combinations (replaced with C string for consistency. We're now using NSObjects only in viewController stuff)

Patches the nvram variable 'com.apple.System.boot-nonce' to enable users to set generator. note : this has to be done as part of the exploit as we have both kernel task and kernel base address. Getting these in a different tool is not that easy. Requires getting tfp0 and kernel base address. We will be compelled to do this in future.

Accept this one after you accept #10

arx8x avatar Dec 21 '17 12:12 arx8x

I assume you have verified everything to work correctly, without any issues? :)

PsychoTea avatar Dec 21 '17 18:12 PsychoTea

On an iPhone 6s 10.3.2, yes. Remounting / failed because it lacked the offset. iPhone 7 should succeed if it did before. Try though

arx8x avatar Dec 21 '17 18:12 arx8x

@PsychoTea don't forget to merge #10 first 👍 Here everything works OK.

talanov avatar Dec 21 '17 20:12 talanov

@PsychoTea There's not much tbd to remove conflicts. I guess, only conflicts to dismiss for you are in storyboard.

talanov avatar Dec 22 '17 18:12 talanov