GitHub - 34306/usbliter8-fun · GitHub
/" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
34306
usbliter8-fun
Public
forked from wh1te4ever/usbliter8-fun
Notifications<br>You must be signed in to change notification settings
Fork
Star<br>33
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>4 Commits<br>4 Commits
images
images
patches
patches
tools
tools
work-27.0b2
work-27.0b2
work-27.0b3
work-27.0b3
.gitignore
.gitignore
README.md
README.md
View all files
Repository files navigation
iOS 27 jailbreak with usbliter8 exploit
CAUTION!
Running this (restoring a custom firmware) will delete your entire device and break everything: SEP, passcode, Wifi, Baseband, Bluetooth (partially work) and the entire Apple services, so please don't run it on your main device, ONLY do it on a spare iPhone 11 Pro only. This tutorial only targets developers that enjoy breaking their device!
Currently only iPhone 11 Pro is supported. Other devices require finding the correct offsets to make it work.
Hardware setup
There's a SecureROM bug (released by Paradigm Shift) that requires the RP2350 chip to exploit the device into PWN DFU mode. It only supports A12 and A13 (S4, S5 on Apple Watch series are also supported).
You need to drop the file from the original usbliter8 source onto the board to make it run the exploit.
I use a Raspberry Pi Pico 2 with RP2350 and a cut lightning cable:
red → VBUS
black → GND
white (D-) → G13
green (D+) → G12
Downloads
iOS 27.0 beta 2 for iPhone 11 Pro IPSW from Apple's website.
Install requirements:
pip3 install requests pyimg4 pymobiledevice3
We work inside the work-27.0b2 folder!
Patches added
The original source from wh1te4ever included a lot of patches, you can read it in the code.
I added a few fixes to it to make it works:
Component<br>Offset<br>Value<br>Notes
kernel isDeviceInRestoreMode<br>file 0x2894b68 (VA 0xFFFFFFF009898B68)<br>20 00 80 d2 c0 03 5f d6<br>USB Restricted Mode bypass
kernel sandbox file_check_mmap<br>0x2f774e0<br>00 00 80 d2 c0 03 5f d6<br>Allow /var/jb execution (+ mount_check_mount 0x2f75640, remount 0x2f75474, umount 0x2f75110, vnode_check_rename 0x2f7019c)
kernel AMFIIsCDHashInTrustCache<br>0x1f1ebe0<br>mov x0,#1;...<br>Trust everything
DeviceTree ephemeral-storage<br>u32=1<br>Pass the 99% progress bar
coreauthd<br>0x95c0<br>NOP<br>Anti SEP crash
ctkd<br>0x1b38/1b3c<br>mov x0,#0; ret<br>Anti SEP crash
mobileactivationd should_hactivate<br>0x2ebb14<br>20 00 80 52 (mov w0,#1)<br>Hacktivation
mobileactivationd getActivationState<br>0x327cb0/d10/d14/d18<br>NOP/ADRP/ADD/NOP → "Activated"<br>Belt-and-suspenders
Tutorial
Put the device in DFU mode, then plug it into the PWN DFU rig (the Raspberry Pi Pico 2 mentioned above).
On the Pico 2, the light blinks twice while exploiting and stays lit on success. If the light turns off, the exploit failed, re-enter DFU mode and try again.
You can verify PWN mode by opening System Configuration → USB tab → Apple Mobile Device (DFU Mode) ; if you see PWND:[usbliter8] then it worked.
1. Flash the Custom Firmware
After PWN DFU mode is done, plug the device back into the Mac, then:
cd work-27.0b2<br>./make_cfw.py # requires sudo, enter your password<br>python3 tss_proxy_server.py && ./restore_cfw.sh
You'll see the restore progress bar on screen. Wait until the script is done and the device returns to recovery mode.
2. SSHRD boot
Re-enter DFU mode and PWN mode, plug it back into the Mac, then:
./get_rd.py<br>./boot_rd.sh<br>iproxy 2222 22 && ../tools/sshpass -p alpine ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -p 2222 root@localhost
On the SSH'd device, run:
/sbin/mount_apfs -o rdonly /dev/disk1s6 /mnt6<br>find /mnt6 -name sep-firmware.img4
scp/cat the file back to the Mac and name it dev_sep.img4. Back on the Mac:
../tools/img4tool -e -m t8030_apticket.der dev_sep.img4
The SSHRD log will print on screen, that means SSHRD succeeded.
3. Normal boot
./get_boot.py<br>./boot.py
That's the boot up. You can use SSH over dropbear and iproxy (default password alpine) to install Sileo with the bootstrap. Or you can do it over SSHRD.
4. Internet +...