iOS13.2_XSM_usbliter8.md

This is WIP, may contain incomplete info.

Dualboot 13.2 InternalUI

You need to find 13.2_17B45a_InternalUI_D331pAP_DVT, sha256sum ffdc84e560e14cad79916aaa9f143b225348ebca47e8fdd096a7cd47bdd0983d on the internet. I can't include the link here.

Copy all IMG4 files from the dump /usr/standalone/firmware/* (and inside FUD too) to your working dir.

Setup

Make 2 volumes from ramdisk, I have my System and Data as disk0s1s11 and disk0s1s12, mounted to /mnt1 and /mnt2 respectively.

Extract the archive to /mnt1, and mv /mnt1/var/* /mnt2/. Then you will need to manually fixup chmod and chown. You can partially do this by extracting var.tar.xz and cp -Rp extractedVar/* /mnt2/

Patch iBEC

Use spironolactone to create patched 13.2 iBEC. Modify the script to use the following boot-args: -v rd=disk0s1s11 wdt=-1 rdar102001044=yes amfi_allow_any_signature=1 cs_enforcement_disable=1 PE_i_can_has_debugger=1 amfi_unrestrict_task_for_pid=1 pmap_cs_allow_modified_code_pages=1 pmap_cs_unrestrict_pmap_cs_disable=1 -disable_aslr

Repack stuff

img4tool -e -p devicetree.im4p devicetree.img4
~/Developer/SSHRD_Script/Darwin/img4 -i devicetree.im4p -o devicetree.img4 -T rdtr -M ../apticket.der

img4tool -e -p kernelcache.im4p kernelcache
~/Developer/SSHRD_Script/Darwin/img4 -i kernelcache.im4p -o kernelcache -T rkrn -M ../apticket.der

Setup 2 (since I have jailbreak I just wrote this script to copy files)

cd /var/mnt
chown -R root:wheel AppleInternal Applications System
#chown -R mobile:mobile var/{buddy,mobile,empty,log,run}

# Avoid nuking main OS
mv usr/libexec/mobile_obliterator{,.bak}

# Avoid mounting other volumes
mv sbin/mount{,.bak}
cat << 'EOF' > sbin/mount
#!/bin/bash
set -e

if [[ "$1" == "-P" ]]; then
    echo "Skipping mount phase"
    if [[ "$2" == "1" ]]; then
        /sbin/mount_apfs /dev/disk0s1s12 /var
        /sbin/mount.bak -uw /
    fi
    exit 0
else
    /sbin/mount.bak $@
fi
EOF
chmod +x sbin/mount

# Fixup var and activation. Get your own activation file:
# On iOS versions where no sandbox escape is available, go to Settings type `file://a/path/to/folder` onto the search bar, then select all the text you just typed > Share. Hold another device running iOS 17.0+ upside down like NearDrop to share to it.

cp /var/keybags/* var/keybags/
cp -R $(realpath $(echo /var/containers/Data/System/*/Library/activation_records)/../..)/* private/var/containers/Data/System/EAAA23FE-EEF5-4579-A2A8-0FAF7E18AE07/
cp -R /var/wireless/* private/var/wireless/
cp -R /var/root/Library/Lockdown private/var/root/Library/
cp -R /var/root/Library/Catacomb private/var/root/Library/
cp -R /var/hardware private/var/

# make copy of FactoryData
rm -r System/Library/Caches/com.apple.factorydata
cp -R var/hardware/FactoryData/System/Library/Caches/com.apple.factorydata System/Library/Caches/com.apple.factorydata
#ln -s /System/Library/Caches/com.apple.factorydata var/hardware/FactoryData/System/Library/Caches/com.apple.factorydata

# SEP, FIXME?
#cp /usr/standalone/firmware/sep-firmware.img4 usr/standalone/firmware/sep-firmware.img4
mv usr/libexec/seputil{,.bak}

Patch kernelcache

Bypass USB Restricted Mode (legacy method, modify device tree instead)

BOOL isDeviceInRestoreMode() {
  char v1[32];
  if ( (PE_parse_boot_argn("rd", v1, 32) || PE_parse_boot_argn("rootdev", v1, 32))
    && v1[0] == 'm' && v1[1] == 'd' && !v1[3] ) {
    isDeviceInRestoreMode_inRestoreMode = 1;
  }
  return isDeviceInRestoreMode_inRestoreMode;
}

Patch (using img4 patch format)

# 20 00 80 d2 c0 03 5f d6
0x1599dd4 0x7f 0x20
0x1599dd5 0x23 0x0
0x1599dd6 0x3 0xffffff80
0x1599dd7 0xffffffd5 0xffffffd2
0x1599dd8 0xffffffff 0xffffffc0
0x1599dda 0x1 0x5f
0x1599ddb 0xffffffd1 0xffffffd6

Fix Multitouch not working

(using img4 patch format)

# image4_validation_callback: w1=-1 to w1=0
# 00 00 80 52
0x14ea117 0x12 0xffffffd2
# Image4: Effective production status did not match
# was changing -1 to 0 or something I don't remember
0x14e9db4 0x3f 0xffffffff

Patch launchd.development

required boot task executable not found

• Patch the first occurrence of RequireSuccess string to RequireSucces_

code signing identity mismatch for a boot-task (can also use cs_enforcement_disable=1 instead)

000000000002F83C  28 00 80 D2

Fix keybagd and containermanagerd crashing

To workaround this, fake the device to ephemeral storage state, aka os_variant_uses_ephemeral_storage. This makes keybagd skip init entirely and containermanagerd skip using keybag personas. Use my fork of devicetree-parse

devicetree-parse devicetree.bin > devicetree.json

Edit the following keys to match these values

• disable-transport-rm: disable USB Restricted Mode
• ephemeral-storage, protected-data-access, sepfw-load-at-boot: force iOS to work without SEP

{"name": "ephemeral-storage", "length": 4, "flags": 0, "disp": 1, "value": 1 },
{"name": "disable-transport-rm", "length": 4, "flags": 0, "disp": 1, "value": 1 },
{"name": "protected-data-access", "length": 4, "flags": 0, "disp": 1, "value": 0 },
{"name": "sepfw-load-at-boot", "length": 4, "flags": 0, "disp": 1, "value": 0 },

Add the following keys:

• boot-ios-diagnostics: fix bluetoothd crash

{"name": "boot-ios-diagnostics", "length": 4, "flags": 0, "disp": 1, "value": 1 },

repack

devicetree-repack devicetree.json devicetree.bin
img4tool -c devicetree.im4p -t rdtr devicetree.bin
img4 -i devicetree.im4p -o devicetree.img4 -T rdtr -M ../apticket.der

Fix bluetoothd crash (legacy method)

Fake diagnostics mode in bluetoothd: xref boot-ios-diagnostics, change MOV W21, #0 to 1

0000000000209C14  F5 03 00 32

Patch SpringBoard

ACMContextCreate at 0xb289850, 0x13f8a820, 0x1b67f234 in dyld_shared_cache_arm64e (might need to patch .development aswell, or just delete it)

0x13f8a820: 7f 23 03 d5 ff c3 01 d1 f6 57 04 a9 f4 4f 05 a9  .#.......W...O..
0x13f8a830: fd 7b 06 a9 fd 83 01 91 f4 03 00 aa a8 7f 1a d0  .{..............

patch it to return 0

0000000013f8a820  00 00 80 d2 c0 03 5f d6

boot.sh

pwn your device and run the following script

#!/bin/bash
set -e

load_component() {
    echo "Uploading $2"
    irecovery -f $2
    irecovery -c $1
}

../../usbliter8ctl boot iBEC.d331p.RELEASE.bin

# Wait for device to connect
irecovery -q > /dev/null
irecovery -q > /dev/null

#irecovery -c "setenvnp boot-args rd=disk1s11 usbserial=enabled debug=0x2014e -v wdt=-1 amfi=-1"
#irecovery -c "setenv auto-boot true"

load_component devicetree devicetree.img4
load_component firmware ANE.img4
load_component firmware AOP.img4
load_component firmware AVE.img4
load_component firmware GFX.img4
load_component firmware ISP.img4
load_component firmware SIO.img4
load_component firmware StaticTrustCache.img4
load_component bootx kernelcache

Post setup

After SpringBoard boot, run this as mobile

defaults write -g MCInternalOverrideDiagnosticEnforcement -bool true 

Then you can disable Share iPhone Analytics

Fix securityd (WIP, doesn't work for joining password wifi now)

Change KEYBAG_DEVICE to KEYBAG_NONE

securityd`SecDbItemCreate:
    0x1000ddc98 <+0>:   pacibsp 
    0x1000ddc9c <+4>:   sub    sp, sp, #0x60             ; =0x60 
    0x1000ddca0 <+8>:   stp    x22, x21, [sp, #0x30]
    0x1000ddca4 <+12>:  stp    x20, x19, [sp, #0x40]
    0x1000ddca8 <+16>:  stp    x29, x30, [sp, #0x50]
    0x1000ddcac <+20>:  add    x29, sp, #0x50            ; =0x50 
->  0x1000ddcb0 <+24>:  mov    x19, x2

# mov x19, #-1
mem w 0x1000ddcb0 13 00 80 92

ks_decrypt_data: invalid keyclass detected

securityd`ks_decrypt_data:
    0x1000e7188 <+1964>: bl     0x10001b528               ; SecError

# mov x0, #0
mem w 0x1000e7188 00 00 80 d2