int tss_populate_basebandvals(plist_t tssreq, plist_t tssparameters, int64_t BbGoldCertId){
plist_t parameters = plist_new_dict();
char bbnonce[noncelen+1];
char bbsnum[5];
int64_t BbChipID = 0;
getRandNum(bbnonce, noncelen, 256);
getRandNum(bbsnum, 4, 256);
int n=0; for (int i=1; i<7; i++) BbChipID += (arc4random() % 10) * pow(10, ++n);
plist_dict_set_item(parameters, "BbNonce", plist_new_data(bbnonce, noncelen));
plist_dict_set_item(parameters, "BbChipID", plist_new_uint(BbChipID));
plist_dict_set_item(parameters, "BbGoldCertId", plist_new_uint(BbGoldCertId));
plist_dict_set_item(parameters, "BbSNUM", plist_new_data(bbsnum, 4));
/* BasebandFirmware */
plist_t BasebandFirmware = plist_access_path(tssparameters, 2, "Manifest", "BasebandFirmware");
if (!BasebandFirmware || plist_get_node_type(BasebandFirmware) != PLIST_DICT) {
error("ERROR: Unable to get BasebandFirmware node\n");
return -1;
}
plist_t bbfwdict = plist_copy(BasebandFirmware);
BasebandFirmware = NULL;
if (plist_dict_get_item(bbfwdict, "Info")) {
plist_dict_remove_item(bbfwdict, "Info");
}
plist_dict_set_item(tssreq, "BasebandFirmware", bbfwdict);
tss_request_add_baseband_tags(tssreq, parameters, NULL);
return 0;
}
static instproxy_error_t instproxy_client_get_object_by_key_from_info_directionary_for_bundle_identifier(instproxy_client_t client, const char* appid, const char* key, plist_t* node)
{
if (!client || !appid || !key)
return INSTPROXY_E_INVALID_ARG;
plist_t apps = NULL;
// create client options for any application types
plist_t client_opts = instproxy_client_options_new();
instproxy_client_options_add(client_opts, "ApplicationType", "Any", NULL);
// only return attributes we need
instproxy_client_options_set_return_attributes(client_opts, "CFBundleIdentifier", "CFBundleExecutable", key, NULL);
// only query for specific appid
const char* appids[] = {appid, NULL};
// query device for list of apps
instproxy_error_t ierr = instproxy_lookup(client, appids, client_opts, &apps);
instproxy_client_options_free(client_opts);
if (ierr != INSTPROXY_E_SUCCESS) {
return ierr;
}
plist_t app_found = plist_access_path(apps, 1, appid);
if (!app_found) {
if (apps)
plist_free(apps);
*node = NULL;
return INSTPROXY_E_OP_FAILED;
}
plist_t object = plist_dict_get_item(app_found, key);
if (object) {
*node = plist_copy(object);
} else {
debug_info("key %s not found", key);
return INSTPROXY_E_OP_FAILED;
}
plist_free(apps);
return INSTPROXY_E_SUCCESS;
}
int tss_request_add_baseband_tags(plist_t request, plist_t parameters, plist_t overrides) {
plist_t node = NULL;
/* BbChipID */
node = plist_dict_get_item(parameters, "BbChipID");
if (node) {
plist_dict_set_item(request, "BbChipID", plist_copy(node));
}
node = NULL;
/* BbProvisioningManifestKeyHash */
node = plist_dict_get_item(parameters, "BbProvisioningManifestKeyHash");
if (node) {
plist_dict_set_item(request, "BbProvisioningManifestKeyHash", plist_copy(node));
}
node = NULL;
/* BbActivationManifestKeyHash - Used by Qualcomm MDM6610 */
node = plist_dict_get_item(parameters, "BbActivationManifestKeyHash");
if (node) {
plist_dict_set_item(request, "BbActivationManifestKeyHash", plist_copy(node));
}
node = NULL;
node = plist_dict_get_item(parameters, "BbCalibrationManifestKeyHash");
if (node) {
plist_dict_set_item(request, "BbCalibrationManifestKeyHash", plist_copy(node));
}
node = NULL;
/* BbFactoryActivationManifestKeyHash */
node = plist_dict_get_item(parameters, "BbFactoryActivationManifestKeyHash");
if (node) {
plist_dict_set_item(request, "BbFactoryActivationManifestKeyHash", plist_copy(node));
}
node = NULL;
/* BbFDRSecurityKeyHash */
node = plist_dict_get_item(parameters, "BbFDRSecurityKeyHash");
if (node) {
plist_dict_set_item(request, "BbFDRSecurityKeyHash", plist_copy(node));
}
node = NULL;
/* BbSkeyId - Used by XMM 6180/GSM */
node = plist_dict_get_item(parameters, "BbSkeyId");
if (node) {
plist_dict_set_item(request, "BbSkeyId", plist_copy(node));
}
node = NULL;
/* BbNonce */
node = plist_dict_get_item(parameters, "BbNonce");
if (node) {
plist_dict_set_item(request, "BbNonce", plist_copy(node));
}
node = NULL;
/* @BBTicket */
plist_dict_set_item(request, "@BBTicket", plist_new_bool(1));
/* BbGoldCertId */
node = plist_dict_get_item(parameters, "BbGoldCertId");
if (!node || plist_get_node_type(node) != PLIST_UINT) {
error("ERROR: Unable to find required BbGoldCertId in parameters\n");
return -1;
}
node = plist_copy(node);
uint64_t val;
plist_get_uint_val(node, &val);
plist_set_uint_val(node, (int32_t)val);
plist_dict_set_item(request, "BbGoldCertId", node);
node = NULL;
/* BbSNUM */
node = plist_dict_get_item(parameters, "BbSNUM");
if (!node || plist_get_node_type(node) != PLIST_DATA) {
error("ERROR: Unable to find required BbSNUM in parameters\n");
return -1;
}
plist_dict_set_item(request, "BbSNUM", plist_copy(node));
node = NULL;
/* BasebandFirmware */
node = plist_access_path(parameters, 2, "Manifest", "BasebandFirmware");
if (!node || plist_get_node_type(node) != PLIST_DICT) {
error("ERROR: Unable to get BasebandFirmware node\n");
return -1;
}
plist_t bbfwdict = plist_copy(node);
node = NULL;
if (plist_dict_get_item(bbfwdict, "Info")) {
plist_dict_remove_item(bbfwdict, "Info");
}
plist_dict_set_item(request, "BasebandFirmware", bbfwdict);
/* apply overrides */
if (overrides) {
plist_dict_merge(&request, overrides);
}
return 0;
}
int tss_request_add_ap_tags(plist_t request, plist_t parameters, plist_t overrides) {
/* loop over components from build manifest */
plist_t manifest_node = plist_dict_get_item(parameters, "Manifest");
if (!manifest_node || plist_get_node_type(manifest_node) != PLIST_DICT) {
error("ERROR: Unable to find restore manifest\n");
return -1;
}
/* add components to request */
char* key = NULL;
plist_t manifest_entry = NULL;
plist_dict_iter iter = NULL;
plist_dict_new_iter(manifest_node, &iter);
while (1) {
plist_dict_next_item(manifest_node, iter, &key, &manifest_entry);
if (key == NULL)
break;
if (!manifest_entry || plist_get_node_type(manifest_entry) != PLIST_DICT) {
error("ERROR: Unable to fetch BuildManifest entry\n");
return -1;
}
/* do not populate BaseBandFirmware, only in basebaseband request */
if ((strcmp(key, "BasebandFirmware") == 0)) {
free(key);
continue;
}
/* FIXME: only used with diagnostics firmware */
if (strcmp(key, "Diags") == 0) {
free(key);
continue;
}
/* copy this entry */
plist_t tss_entry = plist_copy(manifest_entry);
/* remove obsolete Info node */
plist_dict_remove_item(tss_entry, "Info");
/* handle RestoreRequestRules */
plist_t rules = plist_access_path(manifest_entry, 2, "Info", "RestoreRequestRules");
if (rules) {
debug("DEBUG: Applying restore request rules for entry %s\n", key);
tss_entry_apply_restore_request_rules(tss_entry, parameters, rules);
}
/* Make sure we have a Digest key for Trusted items even if empty */
plist_t node = plist_dict_get_item(manifest_entry, "Trusted");
if (node && plist_get_node_type(node) == PLIST_BOOLEAN) {
uint8_t trusted;
plist_get_bool_val(node, &trusted);
if (trusted && !plist_access_path(manifest_entry, 1, "Digest")) {
debug("DEBUG: No Digest data, using empty value for entry %s\n", key);
plist_dict_set_item(tss_entry, "Digest", plist_new_data(NULL, 0));
}
}
/* finally add entry to request */
plist_dict_set_item(request, key, tss_entry);
free(key);
}
free(iter);
/* apply overrides */
if (overrides) {
plist_dict_merge(&request, overrides);
}
return 0;
}
int idevicerestore_start(struct idevicerestore_client_t* client)
{
int tss_enabled = 0;
int result = 0;
if (!client) {
return -1;
}
if ((client->flags & FLAG_LATEST) && (client->flags & FLAG_CUSTOM)) {
error("ERROR: FLAG_LATEST cannot be used with FLAG_CUSTOM.\n");
return -1;
}
if (!client->ipsw && !(client->flags & FLAG_PWN) && !(client->flags & FLAG_LATEST)) {
error("ERROR: no ipsw file given\n");
return -1;
}
if (client->flags & FLAG_DEBUG) {
idevice_set_debug_level(1);
irecv_set_debug_level(1);
idevicerestore_debug = 1;
}
idevicerestore_progress(client, RESTORE_STEP_DETECT, 0.0);
// update version data (from cache, or apple if too old)
load_version_data(client);
// check which mode the device is currently in so we know where to start
if (check_mode(client) < 0 || client->mode->index == MODE_UNKNOWN) {
error("ERROR: Unable to discover device mode. Please make sure a device is attached.\n");
return -1;
}
idevicerestore_progress(client, RESTORE_STEP_DETECT, 0.1);
info("Found device in %s mode\n", client->mode->string);
if (client->mode->index == MODE_WTF) {
unsigned int cpid = 0;
if (dfu_client_new(client) != 0) {
error("ERROR: Could not open device in WTF mode\n");
return -1;
}
if ((dfu_get_cpid(client, &cpid) < 0) || (cpid == 0)) {
error("ERROR: Could not get CPID for WTF mode device\n");
dfu_client_free(client);
return -1;
}
char wtfname[256];
sprintf(wtfname, "Firmware/dfu/WTF.s5l%04xxall.RELEASE.dfu", cpid);
unsigned char* wtftmp = NULL;
unsigned int wtfsize = 0;
// Prefer to get WTF file from the restore IPSW
ipsw_extract_to_memory(client->ipsw, wtfname, &wtftmp, &wtfsize);
if (!wtftmp) {
// Download WTF IPSW
char* s_wtfurl = NULL;
plist_t wtfurl = plist_access_path(client->version_data, 7, "MobileDeviceSoftwareVersionsByVersion", "5", "RecoverySoftwareVersions", "WTF", "304218112", "5", "FirmwareURL");
if (wtfurl && (plist_get_node_type(wtfurl) == PLIST_STRING)) {
plist_get_string_val(wtfurl, &s_wtfurl);
}
if (!s_wtfurl) {
info("Using hardcoded x12220000_5_Recovery.ipsw URL\n");
s_wtfurl = strdup("http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6618.20090617.Xse7Y/x12220000_5_Recovery.ipsw");
}
// make a local file name
char* fnpart = strrchr(s_wtfurl, '/');
if (!fnpart) {
fnpart = "x12220000_5_Recovery.ipsw";
} else {
fnpart++;
}
struct stat fst;
char wtfipsw[1024];
if (client->cache_dir) {
if (stat(client->cache_dir, &fst) < 0) {
mkdir_with_parents(client->cache_dir, 0755);
}
strcpy(wtfipsw, client->cache_dir);
strcat(wtfipsw, "/");
strcat(wtfipsw, fnpart);
} else {
strcpy(wtfipsw, fnpart);
}
if (stat(wtfipsw, &fst) != 0) {
download_to_file(s_wtfurl, wtfipsw, 0);
}
ipsw_extract_to_memory(wtfipsw, wtfname, &wtftmp, &wtfsize);
if (!wtftmp) {
error("ERROR: Could not extract WTF\n");
}
}
if (wtftmp) {
if (dfu_send_buffer(client, wtftmp, wtfsize) != 0) {
error("ERROR: Could not send WTF...\n");
}
}
dfu_client_free(client);
sleep(1);
free(wtftmp);
client->mode = &idevicerestore_modes[MODE_DFU];
}
// discover the device type
if (check_product_type(client) == NULL || client->device == NULL) {
error("ERROR: Unable to discover device type\n");
return -1;
}
idevicerestore_progress(client, RESTORE_STEP_DETECT, 0.2);
info("Identified device as %s\n", client->device->product_type);
if ((client->flags & FLAG_PWN) && (client->mode->index != MODE_DFU)) {
error("ERROR: you need to put your device into DFU mode to pwn it.\n");
return -1;
}
if (client->flags & FLAG_PWN) {
recovery_client_free(client);
info("connecting to DFU\n");
if (dfu_client_new(client) < 0) {
return -1;
}
info("exploiting with limera1n...\n");
// TODO: check for non-limera1n device and fail
if (limera1n_exploit(client->device, &client->dfu->client) != 0) {
error("ERROR: limera1n exploit failed\n");
dfu_client_free(client);
return -1;
}
dfu_client_free(client);
info("Device should be in pwned DFU state now.\n");
return 0;
}
if (client->flags & FLAG_LATEST) {
char* ipsw = NULL;
int res = ipsw_download_latest_fw(client->version_data, client->device->product_type, "cache", &ipsw);
if (res != 0) {
if (ipsw) {
free(ipsw);
}
return res;
} else {
client->ipsw = ipsw;
}
}
idevicerestore_progress(client, RESTORE_STEP_DETECT, 0.6);
if (client->flags & FLAG_NOACTION) {
return 0;
}
if (client->mode->index == MODE_RESTORE) {
if (restore_reboot(client) < 0) {
error("ERROR: Unable to exit restore mode\n");
return -2;
}
// we need to refresh the current mode again
check_mode(client);
info("Found device in %s mode\n", client->mode->string);
}
// verify if ipsw file exists
if (access(client->ipsw, F_OK) < 0) {
error("ERROR: Firmware file %s does not exist.\n", client->ipsw);
return -1;
}
// extract buildmanifest
plist_t buildmanifest = NULL;
if (client->flags & FLAG_CUSTOM) {
info("Extracting Restore.plist from IPSW\n");
if (ipsw_extract_restore_plist(client->ipsw, &buildmanifest) < 0) {
error("ERROR: Unable to extract Restore.plist from %s. Firmware file might be corrupt.\n", client->ipsw);
return -1;
}
} else {
info("Extracting BuildManifest from IPSW\n");
if (ipsw_extract_build_manifest(client->ipsw, &buildmanifest, &tss_enabled) < 0) {
error("ERROR: Unable to extract BuildManifest from %s. Firmware file might be corrupt.\n", client->ipsw);
return -1;
}
}
idevicerestore_progress(client, RESTORE_STEP_DETECT, 0.8);
/* check if device type is supported by the given build manifest */
if (build_manifest_check_compatibility(buildmanifest, client->device->product_type) < 0) {
error("ERROR: Could not make sure this firmware is suitable for the current device. Refusing to continue.\n");
return -1;
}
/* print iOS information from the manifest */
build_manifest_get_version_information(buildmanifest, client);
info("Product Version: %s\n", client->version);
info("Product Build: %s Major: %d\n", client->build, client->build_major);
if (client->flags & FLAG_CUSTOM) {
/* prevent signing custom firmware */
tss_enabled = 0;
info("Custom firmware requested. Disabled TSS request.\n");
}
// choose whether this is an upgrade or a restore (default to upgrade)
client->tss = NULL;
plist_t build_identity = NULL;
if (client->flags & FLAG_CUSTOM) {
build_identity = plist_new_dict();
{
plist_t node;
plist_t comp;
plist_t inf;
plist_t manifest;
char tmpstr[256];
char p_all_flash[128];
char lcmodel[8];
strcpy(lcmodel, client->device->hardware_model);
int x = 0;
while (lcmodel[x]) {
lcmodel[x] = tolower(lcmodel[x]);
x++;
}
sprintf(p_all_flash, "Firmware/all_flash/all_flash.%s.%s", lcmodel, "production");
strcpy(tmpstr, p_all_flash);
strcat(tmpstr, "/manifest");
// get all_flash file manifest
char *files[16];
char *fmanifest = NULL;
uint32_t msize = 0;
if (ipsw_extract_to_memory(client->ipsw, tmpstr, (unsigned char**)&fmanifest, &msize) < 0) {
error("ERROR: could not extract %s from IPSW\n", tmpstr);
return -1;
}
char *tok = strtok(fmanifest, "\r\n");
int fc = 0;
while (tok) {
files[fc++] = strdup(tok);
if (fc >= 16) {
break;
}
tok = strtok(NULL, "\r\n");
}
free(fmanifest);
manifest = plist_new_dict();
for (x = 0; x < fc; x++) {
inf = plist_new_dict();
strcpy(tmpstr, p_all_flash);
strcat(tmpstr, "/");
strcat(tmpstr, files[x]);
plist_dict_insert_item(inf, "Path", plist_new_string(tmpstr));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", inf);
const char* compname = get_component_name(files[x]);
if (compname) {
plist_dict_insert_item(manifest, compname, comp);
if (!strncmp(files[x], "DeviceTree", 10)) {
plist_dict_insert_item(manifest, "RestoreDeviceTree", plist_copy(comp));
}
} else {
error("WARNING: unhandled component %s\n", files[x]);
plist_free(comp);
}
free(files[x]);
files[x] = NULL;
}
// add iBSS
sprintf(tmpstr, "Firmware/dfu/iBSS.%s.%s.dfu", lcmodel, "RELEASE");
inf = plist_new_dict();
plist_dict_insert_item(inf, "Path", plist_new_string(tmpstr));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", inf);
plist_dict_insert_item(manifest, "iBSS", comp);
// add iBEC
sprintf(tmpstr, "Firmware/dfu/iBEC.%s.%s.dfu", lcmodel, "RELEASE");
inf = plist_new_dict();
plist_dict_insert_item(inf, "Path", plist_new_string(tmpstr));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", inf);
plist_dict_insert_item(manifest, "iBEC", comp);
// add kernel cache
plist_t kdict = NULL;
node = plist_dict_get_item(buildmanifest, "KernelCachesByTarget");
if (node && (plist_get_node_type(node) == PLIST_DICT)) {
char tt[4];
strncpy(tt, lcmodel, 3);
tt[3] = 0;
kdict = plist_dict_get_item(node, tt);
} else {
// Populated in older iOS IPSWs
kdict = plist_dict_get_item(buildmanifest, "RestoreKernelCaches");
}
if (kdict && (plist_get_node_type(kdict) == PLIST_DICT)) {
plist_t kc = plist_dict_get_item(kdict, "Release");
if (kc && (plist_get_node_type(kc) == PLIST_STRING)) {
inf = plist_new_dict();
plist_dict_insert_item(inf, "Path", plist_copy(kc));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", inf);
plist_dict_insert_item(manifest, "KernelCache", comp);
plist_dict_insert_item(manifest, "RestoreKernelCache", plist_copy(comp));
}
}
// add ramdisk
node = plist_dict_get_item(buildmanifest, "RestoreRamDisks");
if (node && (plist_get_node_type(node) == PLIST_DICT)) {
plist_t rd = plist_dict_get_item(node, (client->flags & FLAG_ERASE) ? "User" : "Update");
// if no "Update" ram disk entry is found try "User" ram disk instead
if (!rd && !(client->flags & FLAG_ERASE)) {
rd = plist_dict_get_item(node, "User");
// also, set the ERASE flag since we actually change the restore variant
client->flags |= FLAG_ERASE;
}
if (rd && (plist_get_node_type(rd) == PLIST_STRING)) {
inf = plist_new_dict();
plist_dict_insert_item(inf, "Path", plist_copy(rd));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", inf);
plist_dict_insert_item(manifest, "RestoreRamDisk", comp);
}
}
// add OS filesystem
node = plist_dict_get_item(buildmanifest, "SystemRestoreImages");
if (!node) {
error("ERROR: missing SystemRestoreImages in Restore.plist\n");
}
plist_t os = plist_dict_get_item(node, "User");
if (!os) {
error("ERROR: missing filesystem in Restore.plist\n");
} else {
inf = plist_new_dict();
plist_dict_insert_item(inf, "Path", plist_copy(os));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", inf);
plist_dict_insert_item(manifest, "OS", comp);
}
// add info
inf = plist_new_dict();
plist_dict_insert_item(inf, "RestoreBehavior", plist_new_string((client->flags & FLAG_ERASE) ? "Erase" : "Update"));
plist_dict_insert_item(inf, "Variant", plist_new_string((client->flags & FLAG_ERASE) ? "Customer Erase Install (IPSW)" : "Customer Upgrade Install (IPSW)"));
plist_dict_insert_item(build_identity, "Info", inf);
// finally add manifest
plist_dict_insert_item(build_identity, "Manifest", manifest);
}
} else if (client->flags & FLAG_ERASE) {
build_identity = build_manifest_get_build_identity(buildmanifest, 0);
if (build_identity == NULL) {
error("ERROR: Unable to find any build identities\n");
plist_free(buildmanifest);
return -1;
}
} else {
// loop through all build identities in the build manifest
// and list the valid ones
int i = 0;
int valid_builds = 0;
int build_count = build_manifest_get_identity_count(buildmanifest);
for (i = 0; i < build_count; i++) {
build_identity = build_manifest_get_build_identity(buildmanifest, i);
valid_builds++;
}
}
/* print information about current build identity */
build_identity_print_information(build_identity);
idevicerestore_progress(client, RESTORE_STEP_PREPARE, 0.0);
/* retrieve shsh blobs if required */
if (tss_enabled) {
debug("Getting device's ECID for TSS request\n");
/* fetch the device's ECID for the TSS request */
if (get_ecid(client, &client->ecid) < 0) {
error("ERROR: Unable to find device ECID\n");
return -1;
}
info("Found ECID " FMT_qu "\n", (long long unsigned int)client->ecid);
if (client->build_major > 8) {
unsigned char* nonce = NULL;
int nonce_size = 0;
int nonce_changed = 0;
if (get_nonce(client, &nonce, &nonce_size) < 0) {
/* the first nonce request with older firmware releases can fail and it's OK */
info("NOTE: Unable to get nonce from device\n");
}
if (!client->nonce || (nonce_size != client->nonce_size) || (memcmp(nonce, client->nonce, nonce_size) != 0)) {
nonce_changed = 1;
if (client->nonce) {
free(client->nonce);
}
client->nonce = nonce;
client->nonce_size = nonce_size;
} else {
free(nonce);
}
}
if (get_shsh_blobs(client, client->ecid, client->nonce, client->nonce_size, build_identity, &client->tss) < 0) {
error("ERROR: Unable to get SHSH blobs for this device\n");
return -1;
}
}
if (client->flags & FLAG_SHSHONLY) {
if (!tss_enabled) {
info("This device does not require a TSS record");
return 0;
}
if (!client->tss) {
error("ERROR: could not fetch TSS record");
plist_free(buildmanifest);
return -1;
} else {
char *bin = NULL;
uint32_t blen = 0;
plist_to_bin(client->tss, &bin, &blen);
if (bin) {
char zfn[1024];
if (client->cache_dir) {
strcpy(zfn, client->cache_dir);
strcat(zfn, "/shsh");
} else {
strcpy(zfn, "shsh");
}
mkdir_with_parents(zfn, 0755);
sprintf(zfn+strlen(zfn), "/" FMT_qu "-%s-%s.shsh", (long long int)client->ecid, client->device->product_type, client->version);
struct stat fst;
if (stat(zfn, &fst) != 0) {
gzFile zf = gzopen(zfn, "wb");
gzwrite(zf, bin, blen);
gzclose(zf);
info("SHSH saved to '%s'\n", zfn);
} else {
info("SHSH '%s' already present.\n", zfn);
}
free(bin);
} else {
error("ERROR: could not get TSS record data\n");
}
plist_free(client->tss);
plist_free(buildmanifest);
return 0;
}
}
/* verify if we have tss records if required */
if ((tss_enabled) && (client->tss == NULL)) {
error("ERROR: Unable to proceed without a TSS record.\n");
plist_free(buildmanifest);
return -1;
}
if ((tss_enabled) && client->tss) {
/* fix empty dicts */
fixup_tss(client->tss);
}
idevicerestore_progress(client, RESTORE_STEP_PREPARE, 0.1);
// if the device is in normal mode, place device into recovery mode
if (client->mode->index == MODE_NORMAL) {
info("Entering recovery mode...\n");
if (normal_enter_recovery(client) < 0) {
error("ERROR: Unable to place device into recovery mode from %s mode\n", client->mode->string);
if (client->tss)
plist_free(client->tss);
plist_free(buildmanifest);
return -5;
}
}
// Get filesystem name from build identity
char* fsname = NULL;
if (build_identity_get_component_path(build_identity, "OS", &fsname) < 0) {
error("ERROR: Unable get path for filesystem component\n");
return -1;
}
// check if we already have an extracted filesystem
int delete_fs = 0;
char* filesystem = NULL;
struct stat st;
memset(&st, '\0', sizeof(struct stat));
char tmpf[1024];
if (client->cache_dir) {
if (stat(client->cache_dir, &st) < 0) {
mkdir_with_parents(client->cache_dir, 0755);
}
strcpy(tmpf, client->cache_dir);
strcat(tmpf, "/");
char *ipswtmp = strdup(client->ipsw);
strcat(tmpf, basename(ipswtmp));
free(ipswtmp);
} else {
strcpy(tmpf, client->ipsw);
}
char* p = strrchr((const char*)tmpf, '.');
if (p) {
*p = '\0';
}
if (stat(tmpf, &st) < 0) {
__mkdir(tmpf, 0755);
}
strcat(tmpf, "/");
strcat(tmpf, fsname);
memset(&st, '\0', sizeof(struct stat));
if (stat(tmpf, &st) == 0) {
off_t fssize = 0;
ipsw_get_file_size(client->ipsw, fsname, &fssize);
if ((fssize > 0) && (st.st_size == fssize)) {
info("Using cached filesystem from '%s'\n", tmpf);
filesystem = strdup(tmpf);
}
}
if (!filesystem) {
char extfn[1024];
strcpy(extfn, tmpf);
strcat(extfn, ".extract");
char lockfn[1024];
strcpy(lockfn, tmpf);
strcat(lockfn, ".lock");
lock_info_t li;
lock_file(lockfn, &li);
FILE* extf = NULL;
if (access(extfn, F_OK) != 0) {
extf = fopen(extfn, "w");
}
unlock_file(&li);
if (!extf) {
// use temp filename
filesystem = tempnam(NULL, "ipsw_");
if (!filesystem) {
error("WARNING: Could not get temporary filename, using '%s' in current directory\n", fsname);
filesystem = strdup(fsname);
}
delete_fs = 1;
} else {
// use <fsname>.extract as filename
filesystem = strdup(extfn);
fclose(extf);
}
remove(lockfn);
// Extract filesystem from IPSW
info("Extracting filesystem from IPSW\n");
if (ipsw_extract_to_file(client->ipsw, fsname, filesystem) < 0) {
error("ERROR: Unable to extract filesystem from IPSW\n");
if (client->tss)
plist_free(client->tss);
plist_free(buildmanifest);
return -1;
}
if (strstr(filesystem, ".extract")) {
// rename <fsname>.extract to <fsname>
rename(filesystem, tmpf);
free(filesystem);
filesystem = strdup(tmpf);
}
}
idevicerestore_progress(client, RESTORE_STEP_PREPARE, 0.3);
// if the device is in DFU mode, place device into recovery mode
if (client->mode->index == MODE_DFU) {
recovery_client_free(client);
if ((client->flags & FLAG_CUSTOM) && limera1n_is_supported(client->device)) {
info("connecting to DFU\n");
if (dfu_client_new(client) < 0) {
if (delete_fs && filesystem)
unlink(filesystem);
return -1;
}
info("exploiting with limera1n\n");
// TODO: check for non-limera1n device and fail
if (limera1n_exploit(client->device, &client->dfu->client) != 0) {
error("ERROR: limera1n exploit failed\n");
dfu_client_free(client);
if (delete_fs && filesystem)
unlink(filesystem);
return -1;
}
dfu_client_free(client);
info("exploited\n");
}
if (dfu_enter_recovery(client, build_identity) < 0) {
error("ERROR: Unable to place device into recovery mode from %s mode\n", client->mode->string);
plist_free(buildmanifest);
if (client->tss)
plist_free(client->tss);
if (delete_fs && filesystem)
unlink(filesystem);
return -2;
}
}
if (client->mode->index == MODE_DFU) {
client->mode = &idevicerestore_modes[MODE_RECOVERY];
} else {
if ((client->build_major > 8) && !(client->flags & FLAG_CUSTOM)) {
/* send ApTicket */
if (recovery_send_ticket(client) < 0) {
error("WARNING: Unable to send APTicket\n");
}
}
/* now we load the iBEC */
if (recovery_send_ibec(client, build_identity) < 0) {
error("ERROR: Unable to send iBEC\n");
if (delete_fs && filesystem)
unlink(filesystem);
return -2;
}
recovery_client_free(client);
/* this must be long enough to allow the device to run the iBEC */
/* FIXME: Probably better to detect if the device is back then */
sleep(7);
}
idevicerestore_progress(client, RESTORE_STEP_PREPARE, 0.5);
if (client->build_major > 8) {
// we need another tss request with nonce.
unsigned char* nonce = NULL;
int nonce_size = 0;
int nonce_changed = 0;
if (get_nonce(client, &nonce, &nonce_size) < 0) {
error("ERROR: Unable to get nonce from device!\n");
recovery_send_reset(client);
if (delete_fs && filesystem)
unlink(filesystem);
return -2;
}
if (!client->nonce || (nonce_size != client->nonce_size) || (memcmp(nonce, client->nonce, nonce_size) != 0)) {
nonce_changed = 1;
if (client->nonce) {
free(client->nonce);
}
client->nonce = nonce;
client->nonce_size = nonce_size;
} else {
free(nonce);
}
if (nonce_changed && !(client->flags & FLAG_CUSTOM)) {
// Welcome iOS5. We have to re-request the TSS with our nonce.
plist_free(client->tss);
if (get_shsh_blobs(client, client->ecid, client->nonce, client->nonce_size, build_identity, &client->tss) < 0) {
error("ERROR: Unable to get SHSH blobs for this device\n");
if (delete_fs && filesystem)
unlink(filesystem);
return -1;
}
if (!client->tss) {
error("ERROR: can't continue without TSS\n");
if (delete_fs && filesystem)
unlink(filesystem);
return -1;
}
fixup_tss(client->tss);
}
}
idevicerestore_progress(client, RESTORE_STEP_PREPARE, 0.7);
// now finally do the magic to put the device into restore mode
if (client->mode->index == MODE_RECOVERY) {
if (client->srnm == NULL) {
error("ERROR: could not retrieve device serial number. Can't continue.\n");
if (delete_fs && filesystem)
unlink(filesystem);
return -1;
}
if (recovery_enter_restore(client, build_identity) < 0) {
error("ERROR: Unable to place device into restore mode\n");
plist_free(buildmanifest);
if (client->tss)
plist_free(client->tss);
if (delete_fs && filesystem)
unlink(filesystem);
return -2;
}
recovery_client_free(client);
}
idevicerestore_progress(client, RESTORE_STEP_PREPARE, 0.9);
// device is finally in restore mode, let's do this
if (client->mode->index == MODE_RESTORE) {
info("About to restore device... \n");
result = restore_device(client, build_identity, filesystem);
if (result < 0) {
error("ERROR: Unable to restore device\n");
if (delete_fs && filesystem)
unlink(filesystem);
return result;
}
}
info("Cleaning up...\n");
if (delete_fs && filesystem)
unlink(filesystem);
/* special handling of AppleTVs */
if (strncmp(client->device->product_type, "AppleTV", 7) == 0) {
if (recovery_client_new(client) == 0) {
if (recovery_set_autoboot(client, 1) == 0) {
recovery_send_reset(client);
} else {
error("Setting auto-boot failed?!\n");
}
} else {
error("Could not connect to device in recovery mode.\n");
}
}
info("DONE\n");
if (result == 0) {
idevicerestore_progress(client, RESTORE_NUM_STEPS-1, 1.0);
}
return result;
}
int tss_request_add_yonkers_tags(plist_t request, plist_t parameters, plist_t overrides, char **component_name)
{
plist_t node = NULL;
plist_t manifest_node = plist_dict_get_item(parameters, "Manifest");
if (!manifest_node || plist_get_node_type(manifest_node) != PLIST_DICT) {
error("ERROR: %s: Unable to get restore manifest from parameters\n", __func__);
return -1;
}
/* add tags indicating we want to get the Savage,Ticket */
plist_dict_set_item(request, "@BBTicket", plist_new_bool(1));
plist_dict_set_item(request, "@Yonkers,Ticket", plist_new_bool(1));
/* add SEP */
node = plist_access_path(manifest_node, 2, "SEP", "Digest");
if (!node) {
error("ERROR: Unable to get SEP digest from manifest\n");
return -1;
}
plist_t dict = plist_new_dict();
plist_dict_set_item(dict, "Digest", plist_copy(node));
plist_dict_set_item(request, "SEP", dict);
{
static const char *keys[] = {"Yonkers,AllowOfflineBoot", "Yonkers,BoardID", "Yonkers,ChipID", "Yonkers,ECID", "Yonkers,Nonce", "Yonkers,PatchEpoch", "Yonkers,ProductionMode", "Yonkers,ReadECKey", "Yonkers,ReadFWKey", };
int i;
for (i = 0; i < (int)(sizeof(keys) / sizeof(keys[0])); ++i) {
node = plist_dict_get_item(parameters, keys[i]);
if (!node) {
error("ERROR: %s: Unable to find required %s in parameters\n", __func__, keys[i]);
}
plist_dict_set_item(request, keys[i], plist_copy(node));
node = NULL;
}
}
char *comp_name = NULL;
plist_t comp_node = NULL;
uint8_t isprod = 1;
uint64_t fabrevision = (uint64_t)-1;
node = plist_dict_get_item(parameters, "Yonkers,ProductionMode");
if (node && (plist_get_node_type(node) == PLIST_BOOLEAN)) {
plist_get_bool_val(node, &isprod);
}
node = plist_dict_get_item(parameters, "Yonkers,FabRevision");
if (node && (plist_get_node_type(node) == PLIST_UINT)) {
plist_get_uint_val(node, &fabrevision);
}
plist_dict_iter iter = NULL;
plist_dict_new_iter(manifest_node, &iter);
while (iter) {
node = NULL;
comp_name = NULL;
plist_dict_next_item(manifest_node, iter, &comp_name, &node);
if (comp_name == NULL) {
node = NULL;
break;
}
if (strncmp(comp_name, "Yonkers,", 8) == 0) {
int target_node = 1;
plist_t sub_node;
if ((sub_node = plist_dict_get_item(node, "EPRO")) != NULL && plist_get_node_type(sub_node) == PLIST_BOOLEAN) {
uint8_t b = 0;
plist_get_bool_val(sub_node, &b);
target_node &= ((isprod) ? b : !b);
}
if ((sub_node = plist_dict_get_item(node, "FabRevision")) != NULL && plist_get_node_type(sub_node) == PLIST_UINT) {
uint64_t v = 0;
plist_get_uint_val(sub_node, &v);
target_node &= (v == fabrevision);
}
if (target_node) {
comp_node = node;
break;
}
}
free(comp_name);
}
free(iter);
if (comp_name == NULL) {
error("ERROR: No Yonkers node for %s/%lu\n", (isprod) ? "Production" : "Development", (unsigned long)fabrevision);
return -1;
}
/* add Yonkers,SysTopPatch* */
if (comp_node != NULL) {
plist_t comp_dict = plist_copy(comp_node);
plist_dict_remove_item(comp_dict, "Info");
plist_dict_set_item(request, comp_name, comp_dict);
}
if (component_name) {
*component_name = comp_name;
} else {
free(comp_name);
}
/* apply overrides */
if (overrides) {
plist_dict_merge(&request, overrides);
}
return 0;
}
int tss_request_add_savage_tags(plist_t request, plist_t parameters, plist_t overrides, char **component_name)
{
plist_t node = NULL;
plist_t manifest_node = plist_dict_get_item(parameters, "Manifest");
if (!manifest_node || plist_get_node_type(manifest_node) != PLIST_DICT) {
error("ERROR: %s: Unable to get restore manifest from parameters\n", __func__);
return -1;
}
/* add tags indicating we want to get the Savage,Ticket */
plist_dict_set_item(request, "@BBTicket", plist_new_bool(1));
plist_dict_set_item(request, "@Savage,Ticket", plist_new_bool(1));
/* add Savage,UID */
node = plist_dict_get_item(parameters, "Savage,UID");
if (!node) {
error("ERROR: %s: Unable to find required Savage,UID in parameters\n", __func__);
return -1;
}
plist_dict_set_item(request, "Savage,UID", plist_copy(node));
node = NULL;
/* add SEP */
node = plist_access_path(manifest_node, 2, "SEP", "Digest");
if (!node) {
error("ERROR: Unable to get SEP digest from manifest\n");
return -1;
}
plist_t dict = plist_new_dict();
plist_dict_set_item(dict, "Digest", plist_copy(node));
plist_dict_set_item(request, "SEP", dict);
/* add Savage,PatchEpoch */
node = plist_dict_get_item(parameters, "Savage,PatchEpoch");
if (!node) {
error("ERROR: %s: Unable to find required Savage,PatchEpoch in parameters\n", __func__);
return -1;
}
plist_dict_set_item(request, "Savage,PatchEpoch", plist_copy(node));
node = NULL;
/* add Savage,ChipID */
node = plist_dict_get_item(parameters, "Savage,ChipID");
if (!node) {
error("ERROR: %s: Unable to find required Savage,ChipID in parameters\n", __func__);
return -1;
}
plist_dict_set_item(request, "Savage,ChipID", plist_copy(node));
node = NULL;
/* add Savage,AllowOfflineBoot */
node = plist_dict_get_item(parameters, "Savage,AllowOfflineBoot");
if (!node) {
error("ERROR: %s: Unable to find required Savage,AllowOfflineBoot in parameters\n", __func__);
return -1;
}
plist_dict_set_item(request, "Savage,AllowOfflineBoot", plist_copy(node));
node = NULL;
/* add Savage,ReadFWKey */
node = plist_dict_get_item(parameters, "Savage,ReadFWKey");
if (!node) {
error("ERROR: %s: Unable to find required Savage,ReadFWKey in parameters\n", __func__);
return -1;
}
plist_dict_set_item(request, "Savage,ReadFWKey", plist_copy(node));
node = NULL;
/* add Savage,ProductionMode */
node = plist_dict_get_item(parameters, "Savage,ProductionMode");
if (!node) {
error("ERROR: %s: Unable to find required Savage,ProductionMode in parameters\n", __func__);
return -1;
}
plist_dict_set_item(request, "Savage,ProductionMode", plist_copy(node));
const char *comp_name = NULL;
uint8_t isprod = 0;
plist_get_bool_val(node, &isprod);
node = NULL;
/* get the right component name */
comp_name = (isprod) ? "Savage,B0-Prod-Patch" : "Savage,B0-Dev-Patch";
node = plist_dict_get_item(parameters, "Savage,Revision");
if (node && (plist_get_node_type(node) == PLIST_DATA)) {
unsigned char *savage_rev = NULL;
uint64_t savage_rev_len = 0;
plist_get_data_val(node, (char**)&savage_rev, &savage_rev_len);
if (savage_rev_len > 0) {
if (((savage_rev[0] | 0x10) & 0xF0) == 0x30) {
comp_name = (isprod) ? "Savage,B2-Prod-Patch" : "Savage,B2-Dev-Patch";
} else if ((savage_rev[0] & 0xF0) == 0xA0) {
comp_name = (isprod) ? "Savage,BA-Prod-Patch" : "Savage,BA-Dev-Patch";
}
}
free(savage_rev);
}
/* add Savage,B?-*-Patch */
node = plist_dict_get_item(manifest_node, comp_name);
if (!node) {
error("ERROR: Unable to get %s entry from manifest\n", comp_name);
return -1;
}
dict = plist_copy(node);
plist_dict_remove_item(dict, "Info");
plist_dict_set_item(request, comp_name, dict);
if (component_name) {
*component_name = strdup(comp_name);
}
/* add Savage,Nonce */
node = plist_dict_get_item(parameters, "Savage,Nonce");
if (!node) {
error("ERROR: %s: Unable to find required Savage,Nonce in parameters\n", __func__);
return -1;
}
plist_dict_set_item(request, "Savage,Nonce", plist_copy(node));
node = NULL;
/* add Savage,ReadECKey */
node = plist_dict_get_item(parameters, "Savage,ReadECKey");
if (!node) {
error("ERROR: %s: Unable to find required Savage,ReadECKey in parameters\n", __func__);
return -1;
}
plist_dict_set_item(request, "Savage,ReadECKey", plist_copy(node));
node = NULL;
/* apply overrides */
if (overrides) {
plist_dict_merge(&request, overrides);
}
return 0;
}
int ipsw_get_latest_fw(plist_t version_data, const char* product, char** fwurl, unsigned char* sha1buf)
{
*fwurl = NULL;
if (sha1buf != NULL) {
memset(sha1buf, '\0', 20);
}
plist_t n1 = plist_dict_get_item(version_data, "MobileDeviceSoftwareVersionsByVersion");
if (!n1) {
error("%s: ERROR: Can't find MobileDeviceSoftwareVersionsByVersion dict in version data\n", __func__);
return -1;
}
plist_dict_iter iter = NULL;
plist_dict_new_iter(n1, &iter);
if (!iter) {
error("%s: ERROR: Can't get dict iter\n", __func__);
return -1;
}
char* key = NULL;
long long unsigned int major = 0;
plist_t val = NULL;
do {
plist_dict_next_item(n1, iter, &key, &val);
if (key) {
plist_t pr = plist_access_path(n1, 3, key, "MobileDeviceSoftwareVersions", product);
if (pr) {
long long unsigned int v = strtoull(key, NULL, 10);
if (v > major)
major = v;
}
free(key);
}
} while (val);
free(iter);
if (major == 0) {
error("%s: ERROR: Can't find major version?!\n", __func__);
return -1;
}
char majstr[32]; // should be enough for a uint64_t value
sprintf(majstr, FMT_qu, (long long unsigned int)major);
n1 = plist_access_path(version_data, 7, "MobileDeviceSoftwareVersionsByVersion", majstr, "MobileDeviceSoftwareVersions", product, "Unknown", "Universal", "Restore");
if (!n1) {
error("%s: ERROR: Can't get Unknown/Universal/Restore node?!\n", __func__);
return -1;
}
plist_t n2 = plist_dict_get_item(n1, "BuildVersion");
if (!n2 || (plist_get_node_type(n2) != PLIST_STRING)) {
error("%s: ERROR: Can't get build version node?!\n", __func__);
return -1;
}
char* strval = NULL;
plist_get_string_val(n2, &strval);
n1 = plist_access_path(version_data, 5, "MobileDeviceSoftwareVersionsByVersion", majstr, "MobileDeviceSoftwareVersions", product, strval);
if (!n1) {
error("%s: ERROR: Can't get MobileDeviceSoftwareVersions/%s node?!\n", __func__, strval);
free(strval);
return -1;
}
free(strval);
strval = NULL;
n2 = plist_dict_get_item(n1, "SameAs");
if (n2) {
plist_get_string_val(n2, &strval);
}
if (strval) {
n1 = plist_access_path(version_data, 5, "MobileDeviceSoftwareVersionsByVersion", majstr, "MobileDeviceSoftwareVersions", product, strval);
free(strval);
strval = NULL;
if (!n1 || (plist_dict_get_size(n1) == 0)) {
error("%s: ERROR: Can't get MobileDeviceSoftwareVersions/%s dict\n", __func__, product);
return -1;
}
}
n2 = plist_access_path(n1, 2, "Update", "BuildVersion");
if (n2) {
strval = NULL;
plist_get_string_val(n2, &strval);
if (strval) {
n1 = plist_access_path(version_data, 5, "MobileDeviceSoftwareVersionsByVersion", majstr, "MobileDeviceSoftwareVersions", product, strval);
free(strval);
strval = NULL;
}
}
n2 = plist_access_path(n1, 2, "Restore", "FirmwareURL");
if (!n2 || (plist_get_node_type(n2) != PLIST_STRING)) {
error("%s: ERROR: Can't get FirmwareURL node\n", __func__);
return -1;
}
plist_get_string_val(n2, fwurl);
if (sha1buf != NULL) {
n2 = plist_access_path(n1, 2, "Restore", "FirmwareSHA1");
if (n2 && plist_get_node_type(n2) == PLIST_STRING) {
strval = NULL;
plist_get_string_val(n2, &strval);
if (strval) {
if (strlen(strval) == 40) {
int i;
int v;
for (i = 0; i < 40; i+=2) {
v = 0;
sscanf(strval+i, "%02x", &v);
sha1buf[i/2] = (unsigned char)v;
}
}
free(strval);
}
}
}
return 0;
}
int main(int argc, char* argv[]) {
int opt = 0;
int optindex = 0;
char* ipsw = NULL;
char* uuid = NULL;
int tss_enabled = 0;
int shsh_only = 0;
char* shsh_dir = NULL;
use_apple_server=1;
// create an instance of our context
struct idevicerestore_client_t* client = (struct idevicerestore_client_t*) malloc(sizeof(struct idevicerestore_client_t));
if (client == NULL) {
error("ERROR: Out of memory\n");
return -1;
}
memset(client, '\0', sizeof(struct idevicerestore_client_t));
while ((opt = getopt_long(argc, argv, "dhcesxtpi:u:", longopts, &optindex)) > 0) {
switch (opt) {
case 'h':
usage(argc, argv);
return 0;
case 'd':
client->flags |= FLAG_DEBUG;
idevicerestore_debug = 1;
break;
case 'e':
client->flags |= FLAG_ERASE;
break;
case 'c':
client->flags |= FLAG_CUSTOM;
break;
case 's':
use_apple_server=0;
break;
case 'x':
client->flags |= FLAG_EXCLUDE;
break;
case 'i':
if (optarg) {
char* tail = NULL;
client->ecid = strtoull(optarg, &tail, 16);
if (tail && (tail[0] != '\0')) {
client->ecid = 0;
}
if (client->ecid == 0) {
error("ERROR: Could not parse ECID from '%s'\n", optarg);
return -1;
}
}
break;
case 'u':
uuid = optarg;
break;
case 't':
shsh_only = 1;
break;
case 'p':
client->flags |= FLAG_PWN;
break;
default:
usage(argc, argv);
return -1;
}
}
if (((argc-optind) == 1) || (client->flags & FLAG_PWN)) {
argc -= optind;
argv += optind;
ipsw = argv[0];
} else {
usage(argc, argv);
return -1;
}
if (client->flags & FLAG_DEBUG) {
idevice_set_debug_level(1);
irecv_set_debug_level(1);
}
client->uuid = uuid;
client->ipsw = ipsw;
// update version data (from cache, or apple if too old)
load_version_data(client);
// check which mode the device is currently in so we know where to start
if (check_mode(client) < 0 || client->mode->index == MODE_UNKNOWN) {
error("ERROR: Unable to discover device mode. Please make sure a device is attached.\n");
return -1;
}
info("Found device in %s mode\n", client->mode->string);
if (client->mode->index == MODE_WTF) {
int cpid = 0;
if (dfu_client_new(client) != 0) {
error("ERROR: Could not open device in WTF mode\n");
return -1;
}
if ((dfu_get_cpid(client, &cpid) < 0) || (cpid == 0)) {
error("ERROR: Could not get CPID for WTF mode device\n");
dfu_client_free(client);
return -1;
}
char* s_wtfurl = NULL;
plist_t wtfurl = plist_access_path(client->version_data, 7, "MobileDeviceSoftwareVersionsByVersion", "5", "RecoverySoftwareVersions", "WTF", "304218112", "5", "FirmwareURL");
if (wtfurl && (plist_get_node_type(wtfurl) == PLIST_STRING)) {
plist_get_string_val(wtfurl, &s_wtfurl);
}
if (!s_wtfurl) {
info("Using hardcoded x12220000_5_Recovery.ipsw URL\n");
s_wtfurl = strdup("http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6618.20090617.Xse7Y/x12220000_5_Recovery.ipsw");
}
// make a local file name
char* fnpart = strrchr(s_wtfurl, '/');
if (!fnpart) {
fnpart = "x12220000_5_Recovery.ipsw";
} else {
fnpart++;
}
struct stat fst;
char wtfipsw[256];
sprintf(wtfipsw, "cache/%s", fnpart);
if (stat(wtfipsw, &fst) != 0) {
__mkdir("cache", 0755);
download_to_file(s_wtfurl, wtfipsw);
}
char wtfname[256];
sprintf(wtfname, "Firmware/dfu/WTF.s5l%04xxall.RELEASE.dfu", cpid);
char* wtftmp = NULL;
uint32_t wtfsize = 0;
ipsw_extract_to_memory(wtfipsw, wtfname, &wtftmp, &wtfsize);
if (!wtftmp) {
error("ERROR: Could not extract WTF\n");
} else {
if (dfu_send_buffer(client, wtftmp, wtfsize) != 0) {
error("ERROR: Could not send WTF...\n");
}
}
dfu_client_free(client);
sleep(1);
free(wtftmp);
client->mode = &idevicerestore_modes[MODE_DFU];
}
// discover the device type
if (check_device(client) < 0 || client->device->index == DEVICE_UNKNOWN) {
error("ERROR: Unable to discover device type\n");
return -1;
}
info("Identified device as %s\n", client->device->product);
if ((client->flags & FLAG_PWN) && (client->mode->index != MODE_DFU)) {
error("ERROR: you need to put your device into DFU mode to pwn it.\n");
return -1;
}
if (client->flags & FLAG_PWN) {
recovery_client_free(client);
info("connecting to DFU\n");
if (dfu_client_new(client) < 0) {
return -1;
}
info("exploiting with limera1n...\n");
// TODO: check for non-limera1n device and fail
if (limera1n_exploit(client->device, client->dfu->client) != 0) {
error("ERROR: limera1n exploit failed\n");
dfu_client_free(client);
return -1;
}
dfu_client_free(client);
info("Device should be in pwned DFU state now.\n");
return 0;
}
if (client->mode->index == MODE_RESTORE) {
if (restore_reboot(client) < 0) {
error("ERROR: Unable to exit restore mode\n");
return -1;
}
}
// extract buildmanifest
plist_t buildmanifest = NULL;
if (client->flags & FLAG_CUSTOM) {
info("Extracting Restore.plist from IPSW\n");
if (ipsw_extract_restore_plist(ipsw, &buildmanifest) < 0) {
error("ERROR: Unable to extract Restore.plist from %s\n", ipsw);
return -1;
}
} else {
info("Extracting BuildManifest from IPSW\n");
if (ipsw_extract_build_manifest(ipsw, &buildmanifest, &tss_enabled) < 0) {
error("ERROR: Unable to extract BuildManifest from %s\n", ipsw);
return -1;
}
}
/* check if device type is supported by the given build manifest */
if (build_manifest_check_compatibility(buildmanifest, client->device->product) < 0) {
error("ERROR: could not make sure this firmware is suitable for the current device. refusing to continue.\n");
return -1;
}
/* print iOS information from the manifest */
build_manifest_get_version_information(buildmanifest, &client->version, &client->build);
info("Product Version: %s\n", client->version);
info("Product Build: %s\n", client->build);
if (client->flags & FLAG_CUSTOM) {
/* prevent signing custom firmware */
tss_enabled = 0;
info("Custom firmware requested. Disabled TSS request.\n");
}
// choose whether this is an upgrade or a restore (default to upgrade)
client->tss = NULL;
plist_t build_identity = NULL;
if (client->flags & FLAG_CUSTOM) {
build_identity = plist_new_dict();
{
plist_t node;
plist_t comp;
plist_t info;
plist_t manifest;
info = plist_new_dict();
plist_dict_insert_item(info, "RestoreBehavior", plist_new_string((client->flags & FLAG_ERASE) ? "Erase" : "Update"));
plist_dict_insert_item(info, "Variant", plist_new_string((client->flags & FLAG_ERASE) ? "Customer Erase Install (IPSW)" : "Customer Upgrade Install (IPSW)"));
plist_dict_insert_item(build_identity, "Info", info);
manifest = plist_new_dict();
char tmpstr[256];
char p_all_flash[128];
char lcmodel[8];
strcpy(lcmodel, client->device->model);
int x = 0;
while (lcmodel[x]) {
lcmodel[x] = tolower(lcmodel[x]);
x++;
}
sprintf(p_all_flash, "Firmware/all_flash/all_flash.%s.%s", lcmodel, "production");
strcpy(tmpstr, p_all_flash);
strcat(tmpstr, "/manifest");
// get all_flash file manifest
char *files[16];
char *fmanifest = NULL;
uint32_t msize = 0;
if (ipsw_extract_to_memory(ipsw, tmpstr, &fmanifest, &msize) < 0) {
error("ERROR: could not extract %s from IPSW\n", tmpstr);
return -1;
}
char *tok = strtok(fmanifest, "\r\n");
int fc = 0;
while (tok) {
files[fc++] = strdup(tok);
if (fc >= 16) {
break;
}
tok = strtok(NULL, "\r\n");
}
free(fmanifest);
for (x = 0; x < fc; x++) {
info = plist_new_dict();
strcpy(tmpstr, p_all_flash);
strcat(tmpstr, "/");
strcat(tmpstr, files[x]);
plist_dict_insert_item(info, "Path", plist_new_string(tmpstr));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", info);
const char* compname = get_component_name(files[x]);
if (compname) {
plist_dict_insert_item(manifest, compname, comp);
if (!strncmp(files[x], "DeviceTree", 10)) {
plist_dict_insert_item(manifest, "RestoreDeviceTree", plist_copy(comp));
}
} else {
error("WARNING: unhandled component %s\n", files[x]);
plist_free(comp);
}
free(files[x]);
files[x] = NULL;
}
// add iBSS
sprintf(tmpstr, "Firmware/dfu/iBSS.%s.%s.dfu", lcmodel, "RELEASE");
info = plist_new_dict();
plist_dict_insert_item(info, "Path", plist_new_string(tmpstr));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", info);
plist_dict_insert_item(manifest, "iBSS", comp);
// add iBEC
sprintf(tmpstr, "Firmware/dfu/iBEC.%s.%s.dfu", lcmodel, "RELEASE");
info = plist_new_dict();
plist_dict_insert_item(info, "Path", plist_new_string(tmpstr));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", info);
plist_dict_insert_item(manifest, "iBEC", comp);
// add kernel cache
node = plist_dict_get_item(buildmanifest, "KernelCachesByTarget");
if (node && (plist_get_node_type(node) == PLIST_DICT)) {
char tt[4];
strncpy(tt, lcmodel, 3);
tt[3] = 0;
plist_t kdict = plist_dict_get_item(node, tt);
if (kdict && (plist_get_node_type(kdict) == PLIST_DICT)) {
plist_t kc = plist_dict_get_item(kdict, "Release");
if (kc && (plist_get_node_type(kc) == PLIST_STRING)) {
info = plist_new_dict();
plist_dict_insert_item(info, "Path", plist_copy(kc));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", info);
plist_dict_insert_item(manifest, "KernelCache", comp);
plist_dict_insert_item(manifest, "RestoreKernelCache", plist_copy(comp));
}
}
}
// add ramdisk
node = plist_dict_get_item(buildmanifest, "RestoreRamDisks");
if (node && (plist_get_node_type(node) == PLIST_DICT)) {
plist_t rd = plist_dict_get_item(node, (client->flags & FLAG_ERASE) ? "User" : "Update");
if (rd && (plist_get_node_type(rd) == PLIST_STRING)) {
info = plist_new_dict();
plist_dict_insert_item(info, "Path", plist_copy(rd));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", info);
plist_dict_insert_item(manifest, "RestoreRamDisk", comp);
}
}
// add OS filesystem
node = plist_dict_get_item(buildmanifest, "SystemRestoreImages");
if (!node) {
error("ERROR: missing SystemRestoreImages in Restore.plist\n");
}
plist_t os = plist_dict_get_item(node, "User");
if (!os) {
error("ERROR: missing filesystem in Restore.plist\n");
} else {
info = plist_new_dict();
plist_dict_insert_item(info, "Path", plist_copy(os));
comp = plist_new_dict();
plist_dict_insert_item(comp, "Info", info);
plist_dict_insert_item(manifest, "OS", comp);
}
// finally add manifest
plist_dict_insert_item(build_identity, "Manifest", manifest);
}
} else if (client->flags & FLAG_ERASE) {
build_identity = build_manifest_get_build_identity(buildmanifest, 0);
if (build_identity == NULL) {
error("ERROR: Unable to find any build identities\n");
plist_free(buildmanifest);
return -1;
}
} else {
// loop through all build identities in the build manifest
// and list the valid ones
int i = 0;
int valid_builds = 0;
int build_count = build_manifest_get_identity_count(buildmanifest);
for (i = 0; i < build_count; i++) {
build_identity = build_manifest_get_build_identity(buildmanifest, i);
valid_builds++;
}
}
/* print information about current build identity */
build_identity_print_information(build_identity);
/* retrieve shsh blobs if required */
if (tss_enabled) {
debug("Getting device's ECID for TSS request\n");
/* fetch the device's ECID for the TSS request */
if (get_ecid(client, &client->ecid) < 0) {
error("ERROR: Unable to find device ECID\n");
return -1;
}
info("Found ECID " FMT_qu "\n", (long long unsigned int)client->ecid);
if (get_shsh_blobs(client, client->ecid, NULL, 0, build_identity, &client->tss) < 0) {
error("ERROR: Unable to get SHSH blobs for this device\n");
return -1;
}
}
if (shsh_only) {
if (!tss_enabled) {
info("This device does not require a TSS record");
return 0;
}
if (!client->tss) {
error("ERROR: could not fetch TSS record");
plist_free(buildmanifest);
return -1;
} else {
char *bin = NULL;
uint32_t blen = 0;
plist_to_bin(client->tss, &bin, &blen);
if (bin) {
char zfn[512];
sprintf(zfn, "shsh/" FMT_qu "-%s-%s.shsh", (long long int)client->ecid, client->device->product, client->version);
__mkdir("shsh", 0755);
struct stat fst;
if (stat(zfn, &fst) != 0) {
gzFile zf = gzopen(zfn, "wb");
gzwrite(zf, bin, blen);
gzclose(zf);
info("SHSH saved to '%s'\n", zfn);
} else {
info("SHSH '%s' already present.\n", zfn);
}
free(bin);
} else {
error("ERROR: could not get TSS record data\n");
}
plist_free(client->tss);
plist_free(buildmanifest);
return 0;
}
}
/* verify if we have tss records if required */
if ((tss_enabled) && (client->tss == NULL)) {
error("ERROR: Unable to proceed without a TSS record.\n");
plist_free(buildmanifest);
return -1;
}
if ((tss_enabled) && client->tss) {
/* fix empty dicts */
fixup_tss(client->tss);
}
// Extract filesystem from IPSW and return its name
char* filesystem = NULL;
if (ipsw_extract_filesystem(client->ipsw, build_identity, &filesystem) < 0) {
error("ERROR: Unable to extract filesystem from IPSW\n");
if (client->tss)
plist_free(client->tss);
plist_free(buildmanifest);
return -1;
}
// if the device is in normal mode, place device into recovery mode
if (client->mode->index == MODE_NORMAL) {
info("Entering recovery mode...\n");
if (normal_enter_recovery(client) < 0) {
error("ERROR: Unable to place device into recovery mode\n");
if (client->tss)
plist_free(client->tss);
plist_free(buildmanifest);
return -1;
}
}
// if the device is in DFU mode, place device into recovery mode
if (client->mode->index == MODE_DFU) {
recovery_client_free(client);
if (client->flags & FLAG_CUSTOM) {
info("connecting to DFU\n");
if (dfu_client_new(client) < 0) {
return -1;
}
info("exploiting with limera1n\n");
// TODO: check for non-limera1n device and fail
if (limera1n_exploit(client->device, client->dfu->client) != 0) {
error("ERROR: limera1n exploit failed\n");
dfu_client_free(client);
return -1;
}
dfu_client_free(client);
info("exploited\n");
}
if (dfu_enter_recovery(client, build_identity) < 0) {
error("ERROR: Unable to place device into recovery mode\n");
plist_free(buildmanifest);
if (client->tss)
plist_free(client->tss);
return -1;
}
}
if (client->mode->index == MODE_DFU) {
client->mode = &idevicerestore_modes[MODE_RECOVERY];
} else {
/* now we load the iBEC */
if (recovery_send_ibec(client, build_identity) < 0) {
error("ERROR: Unable to send iBEC\n");
return -1;
}
recovery_client_free(client);
/* this must be long enough to allow the device to run the iBEC */
/* FIXME: Probably better to detect if the device is back then */
sleep(7);
}
if (client->build[0] > '8') {
// we need another tss request with nonce.
unsigned char* nonce = NULL;
int nonce_size = 0;
int nonce_changed = 0;
if (get_nonce(client, &nonce, &nonce_size) < 0) {
error("ERROR: Unable to get nonce from device!\n");
recovery_send_reset(client);
return -1;
}
if (!client->nonce || (nonce_size != client->nonce_size) || (memcmp(nonce, client->nonce, nonce_size) != 0)) {
nonce_changed = 1;
if (client->nonce) {
free(client->nonce);
}
client->nonce = nonce;
client->nonce_size = nonce_size;
} else {
free(nonce);
}
info("Nonce: ");
int i;
for (i = 0; i < client->nonce_size; i++) {
info("%02x ", client->nonce[i]);
}
info("\n");
if (nonce_changed && !(client->flags & FLAG_CUSTOM)) {
// Welcome iOS5. We have to re-request the TSS with our nonce.
plist_free(client->tss);
if (get_shsh_blobs(client, client->ecid, client->nonce, client->nonce_size, build_identity, &client->tss) < 0) {
error("ERROR: Unable to get SHSH blobs for this device\n");
return -1;
}
if (!client->tss) {
error("ERROR: can't continue without TSS\n");
return -1;
}
fixup_tss(client->tss);
}
}
// now finally do the magic to put the device into restore mode
if (client->mode->index == MODE_RECOVERY) {
if (client->srnm == NULL) {
error("ERROR: could not retrieve device serial number. Can't continue.\n");
return -1;
}
if (recovery_enter_restore(client, build_identity) < 0) {
error("ERROR: Unable to place device into restore mode\n");
plist_free(buildmanifest);
if (client->tss)
plist_free(client->tss);
return -1;
}
}
// device is finally in restore mode, let's do this
if (client->mode->index == MODE_RESTORE) {
info("About to restore device... \n");
if (restore_device(client, build_identity, filesystem) < 0) {
error("ERROR: Unable to restore device\n");
return -1;
}
}
info("Cleaning up...\n");
if (filesystem)
unlink(filesystem);
info("DONE\n");
return 0;
}
