Kód: Vybrat vše
*** Legacy iOS Kit ***
- Script by LukeZGD -
* Version: v25.11.09 (677319e)
* Platform: linux (Debian GNU/Linux 12 (bookworm) - x86_64)
* Device: iPhone 4S (iPhone4,1 - n94ap) in DFU mode
* iOS Version: Unknown
* To get iOS version, go to: Misc Utilities -> Get iOS Version
* ECID: xxxxxxxxxxxxx
* Pwned: checkm8
> Main Menu > Useful Utilities
[Input] Select an option:
Send Pwned iBSS
Clear NVRAM
Disable/Enable Exploit
-> SSH Ramdisk
Update DateTime
Console
DFU Mode Helper
Go Back
* To mount /var (/mnt2) for iOS 9-10, I recommend using version 9.0.2 (13A452).
* Do not use iOS 9+ ramdisks if your device is on iOS 8 or lower, and vice versa.
* If not sure, just leave it blank and press Enter/Return. This will select the default version.
[Input] Enter build version (eg. 10B329): 13A452
[Log] Checking firmware keys in ../saved/firmware/iPhone4,1/13A452
[Log] Checking URL in ../saved/firmware/iPhone4,1/13A452/url
[Log] iBSS
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 604ca9a4aca0dc1fb90b851a72b1724318b71387353ee95594858693eaa1cc8578f8b1e2ef631fd6699bf904d9e7c14e
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 604ca9a4aca0dc1fb90b851a72b1724318b71387353ee95594858693eaa1cc8578f8b1e2ef631fd6699bf904d9e7c14e
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 604ca9a4aca0dc1fb90b851a72b1724318b71387353ee95594858693eaa1cc8578f8b1e2ef631fd6699bf904d9e7c14e
[Log] iBEC
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 48d818c42d6af34f6df17b632be74731847aaf45a4f8ca24168a52f2fc4273884e3e486101703ae742d6d6f0559eaef9
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 48d818c42d6af34f6df17b632be74731847aaf45a4f8ca24168a52f2fc4273884e3e486101703ae742d6d6f0559eaef9
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 48d818c42d6af34f6df17b632be74731847aaf45a4f8ca24168a52f2fc4273884e3e486101703ae742d6d6f0559eaef9
[Log] DeviceTree
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 8396a6238977905748e9954b46c89583d80884cf88055e36010aab932d07f858f1504dd789eefa3d1c87bf1dd0443e6c
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 8396a6238977905748e9954b46c89583d80884cf88055e36010aab932d07f858f1504dd789eefa3d1c87bf1dd0443e6c
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 8396a6238977905748e9954b46c89583d80884cf88055e36010aab932d07f858f1504dd789eefa3d1c87bf1dd0443e6c
[Log] Kernelcache
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 2c0e2bbeb2bec3bcdde1ecfb7012a81342d41d2412acbea5b5881e9ee718bbdaca40d265412230652b58b513085f8b2a
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 2c0e2bbeb2bec3bcdde1ecfb7012a81342d41d2412acbea5b5881e9ee718bbdaca40d265412230652b58b513085f8b2a
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 2c0e2bbeb2bec3bcdde1ecfb7012a81342d41d2412acbea5b5881e9ee718bbdaca40d265412230652b58b513085f8b2a
[Log] RestoreRamdisk
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: d5346d366f6c80d8b1b8fc452074b81b03df1cc3a7c149544eb663d9cb043544bdab91275f98e908bbf0eb52dbb15885
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: d5346d366f6c80d8b1b8fc452074b81b03df1cc3a7c149544eb663d9cb043544bdab91275f98e908bbf0eb52dbb15885
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: d5346d366f6c80d8b1b8fc452074b81b03df1cc3a7c149544eb663d9cb043544bdab91275f98e908bbf0eb52dbb15885
[Log] Patch RestoreRamdisk
grew volume: 30000000
file: com.apple.springboard.plist (0644), size = 333
ignoring usr, type = 5
ignoring usr/bin, type = 5
file: usr/bin/gptfdisk (0755), size = 164368
file: usr/bin/du (0755), size = 178736
file: usr/bin/df (0755), size = 143296
file: usr/bin/nano (0755), size = 209008
file: usr/bin/date (0755), size = 140704
file: usr/bin/device_infos (0755), size = 75936
file: usr/bin/ibsspatch (0755), size = 51840
file: usr/bin/scp (0755), size = 49008
file: usr/bin/hfs_resize (0755), size = 12960
symlink: usr/bin/rnano (0777) -> nano
ignoring usr/libexec, type = 5
file: usr/libexec/sftp-server (0755), size = 44240
ignoring usr/lib, type = 5
symlink: usr/lib/libncursesw.dylib (0755) -> libncursesw.5.dylib
symlink: usr/lib/libncurses.5.dylib (0755) -> libncurses.5.4.dylib
file: usr/lib/libiconv.2.dylib (0755), size = 1022528
file: usr/lib/libncurses.5.4.dylib (0755), size = 335968
file: usr/lib/libhistory.6.0.dylib (0755), size = 54752
file: usr/lib/libreadline.6.0.dylib (0755), size = 198112
file: usr/lib/libcrypto.0.9.8.dylib (0755), size = 1604336
file: usr/lib/libncursesw.5.dylib (0755), size = 390032
ignoring bin, type = 5
file: bin/mount.sh (0755), size = 1366
file: bin/bash (0755), size = 546768
symlink: bin/sh (0777) -> bash
file: bin/dd (0755), size = 124896
file: bin/ls (0755), size = 152096
file: bin/cp (0755), size = 162560
file: bin/chown (0755), size = 125616
file: bin/chmod (0755), size = 125168
file: bin/tar (0755), size = 430304
ignoring sbin, type = 5
file: sbin/sshd (0755), size = 722848
file: sbin/umount (4755), size = 22784
ignoring private, type = 5
ignoring private/etc, type = 5
file: private/etc/rc.boot (0755), size = 369
directory: private/etc/ssh (0700)
file: private/etc/ssh/ssh_host_rsa_key (0600), size = 1675
file: private/etc/ssh/ssh_host_dsa_key.pub (0644), size = 590
file: private/etc/ssh/sshd_config (0644), size = 3227
file: private/etc/ssh/ssh_host_key.pub (0644), size = 627
file: private/etc/ssh/ssh_config (0644), size = 1526
file: private/etc/ssh/ssh_host_dsa_key (0600), size = 668
file: private/etc/ssh/ssh_host_rsa_key.pub (0644), size = 382
file: private/etc/ssh/moduli (0644), size = 125811
file: private/etc/ssh/ssh_host_key (0600), size = 963
ignoring private/var, type = 5
directory: private/var/root (0700)
file: private/var/root/.profile (0644), size = 391
[Log] Patch iBSS
main: Starting...
main: iBoot-2817 inputted.
patch_rsa_check: Entering...
find_bl_verify_shsh_generic: Entering...
find_bl_verify_shsh_generic: Found LDR instruction at 0x6066
find_bl_verify_shsh_generic: Found BL verify_shsh at 0x6392
find_bl_verify_shsh_generic: Leaving...
patch_rsa_check: Patching BL verify_shsh at 0x6392...
patch_rsa_check: Leaving...
main: Writing out patched file to iBSS.patched...
main: Quitting...
[Log] Patch iBEC
main: Starting...
main: iBoot-2817 inputted.
patch_boot_args: Entering...
patch_boot_args: Default boot-args string is at 0x3cf48
patch_boot_args: boot-args xref is at 0x1990c
patch_boot_args: Relocating boot-args string...
patch_boot_args: "Reliance on this certificate" string found at 0x41a04
patch_boot_args: Pointing default boot-args xref to 0x9ff41a04...
patch_boot_args: Applying custom boot-args "rd=md0 -v amfi=0xff amfi_get_out_of_my_way=1 cs_enforcement_disable=1 pio-error=0"
patch_boot_args: Found LDR R1, =boot_args at 0x1969a
patch_boot_args: Found IT instruction at 0x196ba
patch_boot_args: Found CMP Rx, #0 at 0x196b8
patch_boot_args: Found MOV R6, R1 at 0x196bc
patch_boot_args: Found LDR R6, =null_str at 0x196b6
patch_boot_args: Pointing LDR R6, =null_str to boot-args xref...
patch_boot_args: Leaving...
patch_debug_enabled: Entering...
find_dtre_get_value_bl_insn: Entering...
find_dtre_get_value_bl_insn: debug-enabled string is at 0x3c955
find_dtre_get_value_bl_insn: "debug-enabled" xref is at 0x1871c
find_dtre_get_value_bl_insn: Found LDR R0, ="debug-enabled" at 0x18700
find_dtre_get_value_bl_insn: Found BL instruction at 0x18722
find_dtre_get_value_bl_insn: Leaving...
patch_debug_enabled: Patching BL insn at 0x18722...
patch_debug_enabled: Leaving...
patch_rsa_check: Entering...
find_bl_verify_shsh_generic: Entering...
find_bl_verify_shsh_generic: Found LDR instruction at 0x17492
find_bl_verify_shsh_generic: Found BL verify_shsh at 0x17bc4
find_bl_verify_shsh_generic: Leaving...
patch_rsa_check: Patching BL verify_shsh at 0x17bc4...
patch_rsa_check: Leaving...
main: Writing out patched file to iBEC.patched...
main: Quitting...
[Log] Device seems to be already in pwned DFU mode
* Pwned: checkm8
[Log] Checking URL in ../saved/firmware/iPhone4,1/12H321/url
[Log] Checking firmware keys in ../saved/firmware/iPhone4,1/12H321
[Log] Decrypting iBSS...
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f
[Log] Patching iBSS...
main: Starting...
main: iBoot-2261 inputted.
patch_rsa_check: Entering...
find_bl_verify_shsh_generic: Entering...
find_bl_verify_shsh_generic: Found LDR instruction at 0x60ac
find_bl_verify_shsh_generic: Found BL verify_shsh at 0x6452
find_bl_verify_shsh_generic: Leaving...
patch_rsa_check: Patching BL verify_shsh at 0x6452...
patch_rsa_check: Leaving...
main: Writing out patched file to pwnediBSS...
main: Quitting...
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f
[Log] Pwned iBSS saved at: saved/iPhone4,1/pwnediBSS
[Log] Pwned iBSS img3 saved at: saved/iPhone4,1/pwnediBSS.dfu
[Log] Sending unpacked iBSS...
Acquiring device handle.
iBSS file found: pwnediBSS
Sending 0x10 bytes of data to device.
Sending 0x13000 bytes of data to device.
Releasing device handle.
[Log] Checking for device
[Log] Device should now be in pwned iBSS mode.
[Log] Sending iBEC...
[==================================================] 100.0%
[Log] Finding device in Recovery mode...
[Log] Found device in Recovery mode.
[Log] Sending ramdisk...
[==================================================] 100.0%
[Log] Running ramdisk
[Log] Sending DeviceTree...
[==================================================] 100.0%
[Log] Running devicetree
[Log] Sending KernelCache...
[==================================================] 100.0%
[Log] Booting, please wait...
[Log] Running iproxy for SSH...
[Log] iproxy PID: 7857
[Log] Waiting for device...
* You may need to unplug and replug your device.
kex_exchange_identification: read: Connection reset by peer
Connection reset by 127.0.0.1 port 6414
Connection closed by 127.0.0.1 port 6414
Warning: Permanently added '[127.0.0.1]:6414' (RSA) to the list of known hosts.
[Log] Device should now boot to SSH ramdisk mode.
* Mount filesystems with this command:
mount.sh
* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/SSH-Ramdisk
* For accessing data, note the following:
* Host: sftp://127.0.0.1 | User: root | Password: alpine | Port: 6414
* Other Useful SSH Ramdisk commands:
* Clear NVRAM with this command:
nvram -c
* Erase All Content and Settings with this command (iOS 9+ only):
nvram oblit-inprogress=5
* To reboot, use this command:
reboot_bak
* SSH Ramdisk Menu
[Input] Select an option:
-> Connect to SSH
Dump Blobs
Dump Baseband/Activation
Erase All (iOS 7 and 8)
Erase All (iOS 9+)
Disable/Enable Exploit
Clear NVRAM
Get iOS Version
Update DateTime
Reboot Device
Exit
[Log] Use the "exit" command to go back to SSH Ramdisk Menu
Warning: Permanently added '[127.0.0.1]:6414' (RSA) to the list of known hosts.
Use mount.sh script to mount the partitions
Use reboot_bak to reboot
Use 'device_infos' to dump EMF keys (when imaging user volume)
-sh-4.0# mount.sh
/bin/mount.sh: line 26: cannot create temp file for here-document: Read-only file system
Waiting for disks...
Mounting /dev/disk0s1s1 on /mnt1
mount_hfs: Could not create property for re-key environment check: No such file or directory
Mounting /dev/disk0s1s2 on /mnt2
mount_hfs: Could not create property for re-key environment check: No such file or directory
-sh-4.0# ls -la /mnt2/tmp
total 100
drwxrwxrwt 4 root wheel 374 Apr 1 09:10 .
drwxr-xr-x 25 root wheel 986 Mar 25 18:36 ..
drwx------ 2 mobile wheel 102 Dec 2 2025 MediaCache
-rw-r--r-- 1 _wireless wheel 0 Dec 2 2025 abm.shutdown
-rw-r--r-- 1 root wheel 93200 Apr 1 09:10 bruteforce
-rw-rw-rw- 1 mobile wheel 181 Apr 1 09:01 com.apple.audio.hogmode.plist
drwx------ 2 mobile wheel 68 Apr 1 09:01 com.apple.tccd
-rw-r--r-- 1 mobile wheel 51 Dec 2 2025 com.apple.timed.plist
-rw------- 1 _wireless wheel 0 Apr 1 09:01 csilock
-rw-r--r-- 1 _wireless wheel 0 Dec 2 2025 ct.shutdown
-rw-r--r-- 1 _wireless wheel 0 Apr 1 09:01 libETL.log
-sh-4.0# chmod +x /mnt2/tmp/bruteforce
-sh-4.0# time /mnt2/tmp/bruteforce -u
Writing results to (null).plist
keyboardType=0
0000
0001
...
1006
1007
Found passcode : 1007
Keybag version : 4
Keybag keys : 11
Class Wrap Key
12 0 189d822afd022a8bf63c094a0963744f7464a0ff8b7c003c0fa84dabb9d3e0cb
11 0 59fc7da999bcfe5b2d38ad48f3e57c814786380e91305bd02052b0be8a6950a0
10 0 b4039d0d208ff90d829b814f3b6e9fc958407e83f5b24f447fc8af2782ca579d
9 0 e5978ddadc6a263cef37b2bded8d0eb1c677f929c02665afef9b2a43f17fec9d
8 0 dd6cb07d58d6e493f086c1ecfd7006b82b86daf60f57ce18f6d4201bfd90a6ef
7 0 de58400e3447621685d1468661d8adf01fc3b518569ecf9d50732412a3cec22f
6 0 d6714e6373f44a7e96aafb5df7542adf4521fa23432c06c336e363f68863347c
5 0 a28e0ec0f2ff6718060f6e9a8d01aa19fa75468ab6af8b3c065c63abe1b26d7b
3 0 04cffa61f99fc1ea3a094c961151a3fa13a864c7f38f59c7e0b57be32b59eb2d
2 0 89ca0f676be097de9dd17f40af966a0795ffdbfa0ab5093eb40fa61d5d8542ab
1 0 e0d59e87918fdd47f0c9d755f2e28f0e4c08dc5238c599b9c884728ce1e053e3
Passcode key : 336bf6a86d689049cd91fab56943a47388837c2913291e52898fff879f89d23d
Key 0x835 : f2459f57f7e29198f0b2b33991dd81c7
Writing results to (null).plist
real 2m29.241s
user 1m38.008s
sys 0m0.000s
