PongoOS icon indicating copy to clipboard operation
PongoOS copied to clipboard

Can't boot pongoOS

Open Clindbergh opened this issue 3 years ago • 5 comments

I have an iphone 6s (N71mAP) with iOS 13.X that only booted into recovery mode after low storage. I tried to update with iTunes to iOS 14, but the update failed after about 1/3 (of progressbar during the update). I didn't try to restore from iTunes since I wanted to save data.

With PyBoot/eclipsa (as part of @danieltroger nice telnet ramdisk, thx!) I wasn't able to get into pwndfu mode. With king I was more successful and irecovery -s confirmed the checkm8 pwned dfu mode.

I tried to boot pongo /Applications/checkra1n.app/Contents/MacOS/checkra1n -p, but the iPhone boots straight into recovery mode. I tried multiple times with two different Macs.

Clindbergh avatar Oct 18 '20 14:10 Clindbergh

try /Applications/checkra1n.app/Contents/MacOS/checkra1n -cp the c is force cli mode and the p boots to pongoOS (I don't know if this really helps or not)

cuj avatar Oct 25 '20 09:10 cuj

@IIWare Pongo only boots if iBoot exits though.

@Clindbergh I guess you could try uploading a signed iBEC to recovery...

Siguza avatar Oct 25 '20 10:10 Siguza

@Clindbergh I guess you could try uploading a signed iBEC to recovery...

@Siguza: Could you elaborate how that would work? I think I tried it as part of the telnet ramdisk.

How likely do you think is a Hardware (USB) defect? I am thinking about replacing the lightning board.

Clindbergh avatar Oct 28 '20 23:10 Clindbergh

I am in the same exact situation with my iPhone 6s (N71mAP) that failed to update because of error 14 (out of space). Running checkra1n -cp restarts the device from DFU into recovery.

See this thread on booting the images using irecovery by entering the commands manually. @ajpayne1 was able to create an SSH ramdisk. I'm still trying to figure that out...

iOS 13.5 / iPhone10,1 / Unable to load ramdisk #9: https://github.com/danieltroger/telnetd_ramdisk/issues/9

XP1 avatar Apr 13 '21 00:04 XP1

So, we patch iBoot in a way that when it hands off execution to the next stage (usually the kernel), it will jump to Pongo instead. The problem that you're running into is that your file system is broken and iBoot cannot load the kernel, and it will thus never jump to Pongo.

But once it drops to recovery, you should be able to take the iBEC from the latest IPSW, fetch a valid APTicket for it and upload it to recovery. This iBEC will never run, it's just needed to satisfy iBoot. You would then use the Pongo USB shell to replace the loaded iBEC with an extracted kernel, and attach a custom ramdisk.

Siguza avatar Apr 13 '21 03:04 Siguza

So, we patch iBoot in a way that when it hands off execution to the next stage (usually the kernel), it will jump to Pongo instead. The problem that you're running into is that your file system is broken and iBoot cannot load the kernel, and it will thus never jump to Pongo.

But once it drops to recovery, you should be able to take the iBEC from the latest IPSW, fetch a valid APTicket for it and upload it to recovery. This iBEC will never run, it's just needed to satisfy iBoot. You would then use the Pongo USB shell to replace the loaded iBEC with an extracted kernel, and attach a custom ramdisk.

Hi sir, sorry for bumping an old issue. But can you recommend a tutorial or write up on how to patch iBoot(ibss,ibec) maybe using IDA, to boot to the next stage? Thank you very much

amats211 avatar Mar 09 '23 01:03 amats211