Code Monkey home page Code Monkey logo

ra1npoc's Introduction

ra1npoc

checkra1n dump and poc for iOS
A tool for re-jailbreak devices jailbroken by checkra1n/odysseyra1n on iOS/iPadOS/macOS platforms.

Notes

This is the demonstration code for running checkra1n on iOS, based on the Payload dumped from checkra1n 0.1337.x.
Please do not run on normal devices.

Support

iOS device you want to Jailbreak

chip name
S5L8960 Apple A7
T7000 Apple A8
T7001 Apple A8X
S8000 Apple A9
S8003 Apple A9
S8001 Apple A9X
T8010 Apple A10
T8011 Apple A10X
T8012 Apple T2
T8015 Apple A11

Host-side device (device to run this software)

  • iOS 12 - 17

    • via lightning to USB camera adapter
  • iOS 9 - 17

    • via lightning to USB camera adapter + power supply

Build

git submodule update --init --recursive
make

Run

Usage: ./ra1npoc15 [-r] [-hcyEsv] [-e <boot-args>] [-k <override_pongo>]
  mode:
	-r, --ra1npoc			    : start with legacy ra1npoc mode

  options:
	-c, --cleandfu			    : use clean dfu
	-y, --yolodfu			    : use download mode (yoloDFU)
	-E, --early-exit		    : exit after uploading Pongo
	-k, --override-pongo <path>	: override Pongo image
	-e, --extra-bootargs <args>	: replace bootargs
	-s, --safemode			    : enable safe mode
	-v, --verbose-boot		    : enable verbose boot

  help:
	-h, --help			: show usage
  • --ra1npoc mode is compatible with the old build.
  • iOS 15+ only support boot pongoOS. Plase be sure to add the -E flag.

Example

  • Boot pongoOS from DFU mode
./ra1npoc15 -rE
  • Boot any pongoOS.bin from DFU mode
./ra1npoc15 -rEk <Pongo.bin>
  • Jailbreak iOS 12 - 14 devices already jailbroken with checkra1n from Recovery mode
./ra1npoc15 -rc

How to use

ra1npoc - How to use

Credit

checkra1n team: checkra1n
axi0mX: checkm8 exploit

license: MIT

ra1npoc's People

Contributors

dora2-ios avatar kok3shidoll avatar m1zole avatar p5-2005 avatar verygenericname avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

ra1npoc's Issues

checkra1n.dmg ?

I run ra1npoc with Pongo.bin (from pongoOS) and request a pongo shell. Then, I use the following cmds with pongoterm:

sep auto
/send ../../PongoOS/build/checkra1n-kpf-pongo
modload
/send ../rdsk/rdsk.dmg // extracted from the checkra1n binary
ramdisk
xargs rootdev=md0
bootx

It works but how the checkra1n jailbreak load the checkra1n.dmg (with loader.dmg) ? at which stage ?

[BUG] A12X host to A8 guest fails via Apple USB-C to Lightning cable

I'm using an Apple USB-C to Lightning cable. irecovery and libimobiledevice can successfully read device info etc.

iPad Pro 11" A12X iOS 14.4 unc0ver 8.0.2
trying to checkra1n:
iPhone 6 A8 iOS 12.4. (I also have iPhone 6S A9 iOS 13.3 I can try?)


./ra1npoc_iphoneos  -vd
* checkRAIN clone v2.1.4 for iOS by interception
[BUILTIN] v0.12.4
[main] enabled: debug log
[main] Waiting for device in DFU mode...
[io_get_serial] Found serial number!
[main] CONNECTED
[main] CPID: 0x7000, STRG: [iBoot-1992.0.0.1.19]
[main] kpf_flags: 2
[main] enable: verbose boot
[main] bootArgs: rootdev=md0 -v
** exploiting with checkm8
[checkm8_t7000_s8000] reconnecting
[io_reset] ResetDevice: 0
[io_reset] USBDeviceReEnumerate: 0
[checkm8_t7000_s8000] running set_global_state()
[set_global_state] (*) retry: 1
[set_global_state] (*) 0
[set_global_state] (*) retry: 2
[set_global_state] (*) 0
[set_global_state] (*) retry: 3
[set_global_state] (*) 0

The last lines repeat a hundred times but nothing ever happens. Device remains at DFU.

Failed to connect at stage2

[checkm8_arm64] reconnecting
[io_reset] USBDeviceReEnumerate: 0
[checkm8_arm64] checkmate!
[checkm8_arm64] sending stage2 payload
[payload_stage2] (1/2) 0
[payload_stage2] (2/2) 0
[checkm8_arm64] connecting to stage2
[connect_to_stage2] reconnecting
[io_reset] ResetDevice: 0
[io_reset] USBDeviceReEnumerate: 0
[connect_to_stage2] ERROR:Failed to connect to checkra1n DFU

[BUG] Duplicate symbol debug_enabled

When I build this on iOS I always fail with:


duplicate symbol '_debug_enabled' in:
    /var/tmp/main-d46c05.o
    /var/tmp/payload-89202a.o
duplicate symbol '_debug_enabled' in:
    /var/tmp/main-d46c05.o
    /var/tmp/limera1n-4db8c7.o
duplicate symbol '_debug_enabled' in:
    /var/tmp/main-d46c05.o
    /var/tmp/s5l8950x-56592b.o
duplicate symbol '_debug_enabled' in:
    /var/tmp/main-d46c05.o
    /var/tmp/iousb-d1a8f6.o
duplicate symbol '_debug_enabled' in:
    /var/tmp/main-d46c05.o
    /var/tmp/common-c42f5d.o
duplicate symbol '_debug_enabled' in:
    /var/tmp/main-d46c05.o
    /var/tmp/checkm8_arm64-058c5f.o
ld: 6 duplicate symbols for architecture arm64

u0 doesn't see device

u0 jailbreak doesnt see other device, thats why its not working with the usb 3 cables i think

I can't install it.

this is the log. Dear what the problem?

`./builtin.sh
xcrun -sdk macosx gcc -I./include -Wall -Os -DBUILTIN_PAYLOAD -framework IOKit -framework CoreFoundation main.c io/iousb.c common/common.c soc/t8010_t8015.c soc/t7000_s8000.c soc/s5l8960x.c -o ra1npoc_macosx
xcrun -sdk iphoneos gcc -I./include -Wall -Os -DIPHONEOS_ARM -DBUILTIN_PAYLOAD -framework IOKit -framework CoreFoundation main.c io/iousb.c common/common.c soc/t8010_t8015.c soc/t7000_s8000.c soc/s5l8960x.c -arch armv7 -arch arm64 -o ra1npoc_iphoneos
xcrun: error: SDK "iphoneos" cannot be located
xcrun: error: SDK "iphoneos" cannot be located
In file included from main.c:26:
./include/io/iousb.h:4:10: fatal error: 'CoreFoundation/CoreFoundation.h' file not found
#include <CoreFoundation/CoreFoundation.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/io/iousb.h:4:10: note: did not find header 'CoreFoundation.h' in framework 'CoreFoundation' (loaded from '/System/Library/Frameworks')
1 error generated.
io/iousb.c:1:10: fatal error: 'CoreFoundation/CoreFoundation.h' file not found
#include <CoreFoundation/CoreFoundation.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
io/iousb.c:1:10: note: did not find header 'CoreFoundation.h' in framework 'CoreFoundation' (loaded from '/System/Library/Frameworks')
1 error generated.
In file included from common/common.c:26:
./include/io/iousb.h:4:10: fatal error: 'CoreFoundation/CoreFoundation.h' file not found
#include <CoreFoundation/CoreFoundation.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/io/iousb.h:4:10: note: did not find header 'CoreFoundation.h' in framework 'CoreFoundation' (loaded from '/System/Library/Frameworks')
1 error generated.
In file included from soc/t8010_t8015.c:26:
./include/io/iousb.h:4:10: fatal error: 'CoreFoundation/CoreFoundation.h' file not found
#include <CoreFoundation/CoreFoundation.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/io/iousb.h:4:10: note: did not find header 'CoreFoundation.h' in framework 'CoreFoundation' (loaded from '/System/Library/Frameworks')
1 error generated.
In file included from soc/t7000_s8000.c:26:
./include/io/iousb.h:4:10: fatal error: 'CoreFoundation/CoreFoundation.h' file not found
#include <CoreFoundation/CoreFoundation.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/io/iousb.h:4:10: note: did not find header 'CoreFoundation.h' in framework 'CoreFoundation' (loaded from '/System/Library/Frameworks')
1 error generated.
In file included from soc/s5l8960x.c:26:
./include/io/iousb.h:4:10: fatal error: 'CoreFoundation/CoreFoundation.h' file not found
#include <CoreFoundation/CoreFoundation.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/io/iousb.h:4:10: note: did not find header 'CoreFoundation.h' in framework 'CoreFoundation' (loaded from '/System/Library/Frameworks')
1 error generated.
make: *** [builtin] Error 1

[BUG] iPhone 6S fails using Mac Mini

iOS 13.3, OS X 10.9, Apple lightning cable

It just got stuck forever at the last step waiting for reconnect:


07:55:26 Mac-Mini.local:/src/ra1npoc/src power$ ./ra1npoc_macosx -v -d -c
* checkRAIN clone v2.1.4 for iOS by interception
[BUILTIN] v0.12.4
[main] enabled: debug log
[enter_dfu_via_recovery] Waiting for device in Recovery mode...
[io_get_serial] Found serial number!
[enter_dfu_via_recovery] CONNECTED: Recovery mode
[enter_dfu_via_recovery] CPID: 0x8000, BDID: 0x4
[enter_dfu_via_recovery] enterdfuType: 2

================
::
:: enter_dfu_via_recovery
:: CPID: 0x8000 BDID: 0x04 TYPE: 0x02
::
:: Time to put the device into DFU mode
:: Please follow the instructions below to operate the device.
::
:: STEP1 Press <enter> key.
:: STEP2 Press and hold Side(or Top) and Home buttons together (4sec)
:: STEP3 Release Side(or Top) button But keep holding Home button (10sec)
================

ready? it starts 3 seconds after press <enter> key.
[STEP1] Press <enter> key >> 

[STEP2] Press and hold Side(or Top) and Home buttons together (4sec)
[====] (4/4 sec)
[STEP3] Release Side(or Top) button But keep holding Home button (10sec)
[==========] (10/10 sec)
[enter_dfu_via_recovery] reconnecting
[enter_dfu_via_recovery] DONE!
[main] Waiting for device in DFU mode...
[io_get_serial] Found serial number!
[main] CONNECTED: DFU mode
[main] CPID: 0x8000, STRG: [iBoot-2234.0.0.3.3]
[main] kpf_flags: 2
[main] enable: verbose boot
[main] bootArgs: rootdev=md0 -v
** exploiting with checkm8
[checkm8_arm64] reconnecting
[io_reset] ResetDevice: 0
[io_reset] USBDeviceReEnumerate: 0
[checkm8_arm64] running set_global_state()
[set_global_state] (1/3) sent: 0, val: 300
[set_global_state] (2/3) e000404f
[set_global_state] (3/3) 0
[checkm8_arm64] reconnecting
[checkm8_arm64] running heap_occupation()
[heap_occupation] (1/1) e0004051
load: 2.07  cmd: ra1npoc_macosx 80892 waiting 4.10u 12.95s
[heap_occupation] send_abort: e00002eb
[checkm8_arm64] reconnecting
[checkm8_arm64] ERROR:Failed to reconnect to device

Stuck at : [io_get_serial] Found serial number!

Host Device : iPhone X (iPhone10,3 iOS 14.4.2) Jailbroke with checkra1n and odysseyra1n

Taget Device : iPad 6th Wifi (iPad7,5 Wifi iOS 14.6)

the message [io_get_serial] Found serial number! keep repeating and not continuing the process.

README.mdの英語翻訳?

こんにちは!あたしはこのプロジェクトのREADMEを英語に翻訳したいです。
まだ初心者ですが、してみたいっと思います。
興味がありますか?

ありがとうございます!
ータコヤキ

Builtin macOS

having this error on make all

strip ra1npoc_ios
strip: stY3BSlH: invalid operation

Update1. Ok, did a no strip Makefile change and it went well.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.