LukeZGD

#define _GNU_SOURCE

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>

// the following few functions are from patchfinder64
#define GET_OFFSET(len, x) (x - (uintptr_t) restored_external)

LukeZGD

// clang -isysroot iPhoneOS5.1.sdk -arch armv7 reboot4.c -o reboot4

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#include <spawn.h>

extern char **environ;

LukeZGD

Creating a Linux Live USB with Persistent Storage (Linux/macOS)

Creating a Linux live USB with persistent storage is very easy on Windows using tools like Rufus. But what about Linux or macOS?

This guide walks you through multiple methods to achieve the same result using Ventoy.

Overview

You have two main approaches:

LukeZGD

Installing TrollStore (TrollRestore Python Method, Windows)

1. Download and install Python (3.13 and newer, this tutorial is tested on 3.14.3): https://python.org
2. Download and install iTunes: https://www.apple.com/itunes/download/win64
3. Download and install Visual Studio Build Tools: https://visualstudio.microsoft.com/visual-cpp-build-tools/
   • In the installer, make sure to check "Desktop Development with C++" before clicking Install.
4. Download TrollRestore_Linux.zip: https://github.com/JJTech0130/TrollRestore/releases/latest
5. Extract TrollRestore_Linux.zip
6. In the TrollRestore_Linux folder, open requirements.txt and change the first line (don't forget to save it): pymobiledevice3<=6.2.0
7. While holding the Shift button, right-click the TrollRestore_Linux folder, and select "Open PowerShell window here"

LukeZGD

// from https://github.com/verygenericname/SSHRD_Script/commit/708ce254fea08e442ecb4cd20c3fdbfe6ce9ab66

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define MAX_DIFFS 16384

void print_usage(const char *prog_name) {
    printf("Usage: %s kernelcache_original kernelcache_patched output.bpatch\n", prog_name);

LukeZGD

#!/usr/bin/env bash
# diff between theapplewiki and fwkeydb ivkeys
#set -x
types=(iPhone1,1 iPhone1,2 iPhone2,1 iPhone3,1 iPhone3,2 iPhone3,3 iPhone4,1 iPhone5,1 iPhone5,2 iPhone5,3 iPhone5,4
       iPad1,1 iPad2,1 iPad2,2 iPad2,3 iPad2,4 iPad2,5 iPad2,6 iPad2,7 iPad3,1 iPad3,2 iPad3,3 iPad3,4 iPad3,5 iPad3,6
       iPod1,1 iPod2,1 iPod3,1 iPod4,1 iPod5,1

       iPhone6,1 iPhone6,2 iPhone7,1 iPhone7,2 iPhone9,1 iPhone9,2 iPhone9,3 iPhone9,4
       iPad4,1 iPad4,2 iPad4,3 iPad4,4 iPad4,5 iPad4,6 iPad4,7 iPad4,8 iPad4,9 iPad5,1 iPad5,2 iPad5,3 iPad5,4
       iPod7,1 iPod9,1)

LukeZGD

#include <stdlib.h>

int main() {
system("nvram -c");
system("nvram boot-partition=2");
system("nvram auto-boot=1");
//system("nvram auto-boot=0"); // for 4.2.x and lower, to send device to recovery after restore
system("umount /mnt1");
system("mount_hfs /dev/disk0s1 /mnt1");
system("dd if=/iBoot of=/mnt1/iBEC bs=512k");

LukeZGD

#!/bin/bash

# If you like this script and my work on libimobiledevice, please
# consider becoming a patron at https://patreon.com/nikias - Thanks <3

REV=1.0.22
export MACOSX_DEPLOYMENT_TARGET=10.11

if test "`echo -e Test`" != "Test" 2>&1; then
  echo Please run this with zsh or bash.

LukeZGD

Home Depot Offsets iOS 9.x.
Found with the help of https://github.com/stek29/awful-offset-finder
offset finder gives wrong clock_ops offsets for 9.0-9.1, so those are found manually.
allproc offsets are likely wrong for 9.0-9.0.2.
I can't get the 9.0-9.0.2 offsets to work anyway when I tried testing on my iPhone 5.

A5 9.0-9.0.2
0x317de4
0x31a5d0
0x1daec

LukeZGD

Home Depot Offsets iOS 8.x.
Found with the help of https://github.com/Merculous/OF32
bufattr_cpx and bx_lr offsets: first result of searching hex 00687047
A5 offsets should work. tested working: 8.0, 8.3, 8.4.1
A6 does not seem to work at all on Home Depot, possibly because of something to do with the Trident exploit.

A5 8.0-8.0.2
0x2c5308
0x2c73e8
0x1ba80