0x7ff / gaster Goto Github PK
View Code? Open in Web Editor NEWCheckm8 experiment to understand AP/SEP internals.
License: Apache License 2.0
Checkm8 experiment to understand AP/SEP internals.
License: Apache License 2.0
hello,
thanks for this amazing project,
about 8012 issue, the patch still on bootlooping, even unplug/plug
C:\Users\BH11040\Desktop\pwn>gaster.exe pwn
usb_timeout: 5
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8012 CPRV:10 CPFM:03 SCEP:01 BDID:17 ECID:0016XXXXXXXXXXX IBFL:3C SRTG:[iBoot-3401.0.0.1.16]
Found the USB handle.
Stage: RESET
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8012 CPRV:10 CPFM:03 SCEP:01 BDID:17 ECID:0016XXXXXXXXXXX IBFL:3C SRTG:[iBoot-3401.0.0.1.16]
Found the USB handle.
Stage: SPRAY
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8012 CPRV:10 CPFM:03 SCEP:01 BDID:17 ECID:0016XXXXXXXXXXX IBFL:3C SRTG:[iBoot-3401.0.0.1.16]
Found the USB handle.
Stage: SETUP
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8012 CPRV:10 CPFM:03 SCEP:01 BDID:17 ECID:0016XXXXXXXXXXX IBFL:3C SRTG:[iBoot-3401.0.0.1.16]
Found the USB handle.
Stage: PATCH
ret: true
any idea why can't send iboot patched .... itry ipwndfu with rmsgcheck mbut on gaster didn't success ?
Boot Failure Count: 4 Panic Fail Count: 0
Delaying boot for 0 seconds. Hit enter to break into the command prompt...
boot-command 'fsboot' not supported
Entering recovery mode, starting command prompt
] USB command: "go"
Memory image not valid
same problem with this issue
#1
last commit, issue with 7000 on patch step, device panic and reboot to normal mode
The device does not accept ibss, ibec etc to enter purple mode when the device is patched with this pwnd. While using different pwnd all works fine.
Question: How to fix my files to let it works with this pwnd?
Many thanks
Hi sory to disturb ,How to fix this error during make?
xxd -iC payload_A9.bin payload_A9.h
process_begin: CreateProcess(NULL, xxd -iC payload_A9.bin payload_A9.h, ...) failed.
make (e=2): The system cannot find the file specified.
make: *** [macos] Error 2
thanks ,
Attempting to run './gaster pwn' hangs forever after reaching the PATCH stage on all my A9 devices, a 6s and two SEs. This occurs using both LibUSB and IOKit, along with raised USB_TIMEOUT values. Device does not reboot, just stays on a black screen with nothing being printed to the serial output. Only occurs on my A9 devices, works perfectly fine on my A7, A8, A10 and A11 devices (Side-note, great job on the support for those devices!).
I am doing this on an iPhone 5s on Manjaro and it always just hangs after the patch stage and no matter how long I leave it for it just doesn't do anything after it
Logs:
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8960
Found the USB handle.
Stage: RESET
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8960
Found the USB handle.
Stage: SETUP
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8960
Found the USB handle.
Stage: SPRAY
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8960
Found the USB handle.
Stage: PATCH
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Gaster built for Windows using libUsbK driver tries to patch an 8950 device (in my case, iPhone 5) and after that device reboots.
Under Linux (Ubuntu) patching can stop at some step and Gaster stops responding. If patching succeeds, the descriptor becomes unrecognizable and applying the patch becomes impossible until the next reboot to DFU. Gaster tries to patch all over again.
So, it seems pwning A6 devices is impossible atm.
It has an issue can’t load ibec on s8001
I have been trying to use gaster on linux with an old ipad 4. sudo dmesg | bat
prints the following.
88 │ [39614.655352] apple-mfi-fastcharge 1-6: device descriptor read/8, error 2
2189 │ [39614.785556] apple-mfi-fastcharge 1-6: device descriptor read/8, error -75
2190 │ [39614.890103] apple-mfi-fastcharge 1-6: USB disconnect, device number 31
2191 │ [39615.018307] usb 1-6: new high-speed USB device number 32 using xhci_hcd
2192 │ [39615.167018] usb 1-6: device descriptor read/all, error 2
2193 │ [39615.302051] usb 1-6: new high-speed USB device number 33 using xhci_hcd
2194 │ [39615.450597] usb 1-6: device descriptor read/all, error 2
Gaster seems to have gotten to the PATCH stage and then hangs on waiting for usb handle
forever.
Haven't had any more luck on my ipod 6th gen either 😢
By the way, do you happen to know if project sandcastle, or more specifically, PongoOS would work with irecovery
?
I am actually trying to see if I can get it to work with the latest linux kernel. I already tried just using PongoOS with checkra1n (didn't work) but then I found this tool and it's open source unlike checkra1n... If this ends up working I will post my current progress on my repository here:
https://github.com/theo-os/sandcastle/issues/1
title
title
Close
$ gcc -Wall -Wextra -Wpedantic -DHAVE_LIBUSB gaster.c lzfse.c -o gaster -lusb-1.0 -lcrypto -Os
gaster.c:196:10: fatal error: payload_A9.h: No such file or directory
196 | #include "payload_A9.h"
| ^~~~~~~~~~~~~~
compilation terminated.
Anyone know, how to build in windows
tried 8960/8650, stuck on spray stage and usb display : unknown device descriptor, when unplug then plug
Hi sir, 0x8960 device reboots after patch...
usb_timeout: 5
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:00 ECID:000000B6F437ED14 IBFL:1C SRTG:[iBoot-1704.10]
Found the USB handle.
Stage: RESET
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:00 ECID:000000B6F437ED14 IBFL:1C SRTG:[iBoot-1704.10]
Found the USB handle.
Stage: SPRAY
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:00 ECID:000000B6F437ED14 IBFL:1C SRTG:[iBoot-1704.10]
Found the USB handle.
Stage: SETUP
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:00 ECID:000000B6F437ED14 IBFL:1C SRTG:[iBoot-1704.10]
Found the USB handle.
Stage: PATCH
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
output in kmsg gives:
6,1050,83212389,-;usb 1-1: new high-speed USB device number 4 using xhci_hcd
SUBSYSTEM=usb
DEVICE=+usb:1-1
6,1051,83361052,-;usb 1-1: New USB device found, idVendor=05ac, idProduct=1227, bcdDevice= 0.00
SUBSYSTEM=usb
DEVICE=c189:3
6,1052,83361060,-;usb 1-1: New USB device strings: Mfr=2, Product=3, SerialNumber=4
SUBSYSTEM=usb
DEVICE=c189:3
6,1053,83361063,-;usb 1-1: Product: Apple Mobile Device (DFU Mode)
SUBSYSTEM=usb
DEVICE=c189:3
6,1054,83361065,-;usb 1-1: Manufacturer: Apple Inc.
SUBSYSTEM=usb
DEVICE=c189:3
6,1055,83361067,-;usb 1-1: SerialNumber: CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:0A ECID:0000078D8A0C8A98 IBFL:1C SRTG:[iBoot-1704.10]
SUBSYSTEM=usb
DEVICE=c189:3
6,1056,83372515,-;usbcore: registered new device driver apple-mfi-fastcharge
6,1057,178436938,-;apple-mfi-fastcharge 1-1: reset high-speed USB device number 4 using xhci_hcd
SUBSYSTEM=usb
DEVICE=c189:3
6,1058,188933074,-;apple-mfi-fastcharge 1-1: reset high-speed USB device number 4 using xhci_hcd
SUBSYSTEM=usb
DEVICE=c189:3
6,1059,189425117,-;apple-mfi-fastcharge 1-1: reset high-speed USB device number 4 using xhci_hcd
SUBSYSTEM=usb
DEVICE=c189:3
6,1060,189713104,-;apple-mfi-fastcharge 1-1: reset high-speed USB device number 4 using xhci_hcd
SUBSYSTEM=usb
DEVICE=c189:3
6,1061,189860842,-;apple-mfi-fastcharge 1-1: device firmware changed
SUBSYSTEM=usb
DEVICE=c189:3
6,1062,189860921,-;apple-mfi-fastcharge 1-1: USB disconnect, device number 4
SUBSYSTEM=usb
DEVICE=c189:3
6,1063,189988727,-;usb 1-1: new high-speed USB device number 5 using xhci_hcd
SUBSYSTEM=usb
DEVICE=+usb:1-1
4,1064,190137372,-;usb 1-1: config index 0 descriptor too short (expected 25, got 9)
SUBSYSTEM=usb
DEVICE=+usb:1-1
4,1065,190137384,-;usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1
SUBSYSTEM=usb
DEVICE=+usb:1-1
6,1066,190137738,-;usb 1-1: New USB device found, idVendor=05ac, idProduct=1227, bcdDevice= 0.00
SUBSYSTEM=usb
DEVICE=c189:4
6,1067,190137749,-;usb 1-1: New USB device strings: Mfr=2, Product=3, SerialNumber=6
SUBSYSTEM=usb
DEVICE=c189:4
6,1068,190137755,-;usb 1-1: Product: \xd0\x89
SUBSYSTEM=usb
DEVICE=c189:4
6,1069,190137759,-;usb 1-1: Manufacturer: Apple Mobile Device (DFU Mode)
SUBSYSTEM=usb
DEVICE=c189:4
6,1070,190137763,-;usb 1-1: SerialNumber: Apple Inc.
SUBSYSTEM=usb
DEVICE=c189:4
3,1071,195172866,-;apple-mfi-fastcharge 1-1: can't set config #1, error -110
SUBSYSTEM=usb
DEVICE=c189:4
6,1072,236138787,-;apple-mfi-fastcharge 1-1: USB disconnect, device number 5
SUBSYSTEM=usb
DEVICE=c189:4
6,1073,442930647,-;usb 1-1: new high-speed USB device number 6 using xhci_hcd
SUBSYSTEM=usb
DEVICE=+usb:1-1
6,1074,443079369,-;usb 1-1: New USB device found, idVendor=05ac, idProduct=1227, bcdDevice= 0.00
SUBSYSTEM=usb
DEVICE=c189:5
6,1075,443079377,-;usb 1-1: New USB device strings: Mfr=2, Product=3, SerialNumber=4
SUBSYSTEM=usb
DEVICE=c189:5
6,1076,443079380,-;usb 1-1: Product: Apple Mobile Device (DFU Mode)
SUBSYSTEM=usb
DEVICE=c189:5
6,1077,443079383,-;usb 1-1: Manufacturer: Apple Inc.
SUBSYSTEM=usb
DEVICE=c189:5
6,1078,443079385,-;usb 1-1: SerialNumber: CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:0A ECID:0000078D8A0C8A98 IBFL:1C SRTG:[iBoot-1704.10]
SUBSYSTEM=usb
DEVICE=c189:5
6,1079,446891100,-;apple-mfi-fastcharge 1-1: reset high-speed USB device number 6 using xhci_hcd
SUBSYSTEM=usb
DEVICE=c189:5
6,1080,457375178,-;apple-mfi-fastcharge 1-1: reset high-speed USB device number 6 using xhci_hcd
SUBSYSTEM=usb
DEVICE=c189:5
6,1081,457655206,-;apple-mfi-fastcharge 1-1: reset high-speed USB device number 6 using xhci_hcd
SUBSYSTEM=usb
DEVICE=c189:5
6,1082,457943236,-;apple-mfi-fastcharge 1-1: reset high-speed USB device number 6 using xhci_hcd
SUBSYSTEM=usb
DEVICE=c189:5
6,1083,458091019,-;apple-mfi-fastcharge 1-1: device firmware changed
SUBSYSTEM=usb
DEVICE=c189:5
6,1084,458091090,-;apple-mfi-fastcharge 1-1: USB disconnect, device number 6
SUBSYSTEM=usb
DEVICE=c189:5
6,1085,458218879,-;usb 1-1: new high-speed USB device number 7 using xhci_hcd
SUBSYSTEM=usb
DEVICE=+usb:1-1
4,1086,458367447,-;usb 1-1: config index 0 descriptor too short (expected 25, got 9)
SUBSYSTEM=usb
DEVICE=+usb:1-1
4,1087,458367457,-;usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1
SUBSYSTEM=usb
DEVICE=+usb:1-1
6,1088,458368122,-;usb 1-1: New USB device found, idVendor=05ac, idProduct=1227, bcdDevice= 0.00
SUBSYSTEM=usb
DEVICE=c189:6
6,1089,458368132,-;usb 1-1: New USB device strings: Mfr=2, Product=3, SerialNumber=6
SUBSYSTEM=usb
DEVICE=c189:6
6,1090,458368137,-;usb 1-1: Product: \xd0\x89
SUBSYSTEM=usb
DEVICE=c189:6
6,1091,458368140,-;usb 1-1: Manufacturer: Apple Mobile Device (DFU Mode)
SUBSYSTEM=usb
DEVICE=c189:6
6,1092,458368143,-;usb 1-1: SerialNumber: Apple Inc.
SUBSYSTEM=usb
DEVICE=c189:6
3,1093,463463016,-;apple-mfi-fastcharge 1-1: can't set config #1, error -110
SUBSYSTEM=usb
DEVICE=c189:6
6,1094,504428614,-;apple-mfi-fastcharge 1-1: USB disconnect, device number 7
SUBSYSTEM=usb
DEVICE=c189:6
i think is because of this?
4,1064,190137372,-;usb 1-1: config index 0 descriptor too short (expected 25, got 9)
SUBSYSTEM=usb
DEVICE=+usb:1-1
4,1065,190137384,-;usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1
I tested after Boot Pwnd mode success, send ramdisk done, i can connect ssh on A11 devices, but on A9, A10 i can't connect SSH. Pls help me!
Simplified command (run during jailbreaking with palera1n):
gaster decrypt iBSS.n69u.RELEASE.im4p iBSS.dec
Output:
usb_timeout: 5
usb_abort_timeout_min: 0
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8000
Found the USB handle.
Now you can boot untrusted images.
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
Environment: macOS Ventura 13.2 (22D49)
Device: iPhone SE 1st generation (N69u) iOS 15.1
when u boot ibss or ibec on T2 MacBooks it stays in dfu and doesn’t go in recovery
Hello, does it works at M1 Max? I tried A9 and it works fine but A10 and above always it stucks at this
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8010
Found the USB handle.
Stage: RESET
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8010
Found the USB handle.
Stage: SPRAY
The programmer is genius hope to fix booting in diag mode or purple in A10 devices i tried iPhone 7plus not booting in diag mode
CPID: 0x8010
Found the USB handle.
Stage: RESET
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8010
Found the USB handle.
Stage: SPRAY
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Need to confirm this when I get home but seems to be happening to these cpids
Please add support for booting in purple mode/diag files
#include "payload_A9.h"
#include "payload_notA9.h"
#include "payload_notA9_armv7.h"
#include "payload_handle_checkm8_request.h"
#include "payload_handle_checkm8_request_armv7.h"
title
Hey @0x7ff!
Having issue with the A10 pwned DFU.
The exploit work on A10 but when sending iBSS there is no device action... The device do not accept the iBSS files, when using them with ipwndfu + rmsigchecks they work fine.
After sending iBSS (even after multiple tries) it stays here:
irecovery -q
CPID: 0x8010
CPRV: 0x11
BDID: 0x08
ECID: 0x0019502e24b8403a
CPFM: 0x03
SCEP: 0x01
IBFL: 0x3c
SRTG: iBoot-2696.0.0.1.33
SRNM: N/A
IMEI: N/A
NONC: 50b9f5bf0c750bd0215636489e230222d31b5c032fbd7c4988e02b6a036cdad5
SNON: 83ab8470d08f3644e1cc34468524de16330e1696
PWND: gaster
MODE: DFU
PRODUCT: iPhone9,1
MODEL: d10ap
NAME: iPhone 7 (Global)
Thank you :-)
Mac OS 12.5.1
iPhone 8 (A11 device)
Error: Tries to load a .bin file, please see terminal output below. At the end, it does not go into pwndfu mode.
brandon@Brandons-MacBook-Pro % gaster pwn
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:001129EE08D3A02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: RESET
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:001129EE08D3A02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: SPRAY
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:001129EE08D3A02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: SETUP
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:001129EE08D3A02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: PATCH
Cannot read file "payload_notA9.bin".
Edit:
Just noticed it's call "notA9". Correction, does not load an A9 chip .bin file
Device is an iPad Mini 2 0x8960, trying to load iBSS and iBEC using latest commit but does not continue..
Macs-MacBook-Pro:~ mac$ gaster/gaster load SSHRD_Script/sshramdisk/iBSS.img4 SSHRD_Script/sshramdisk/iBEC.img4
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8960
Found the USB handle.
Now you can boot untrusted images.
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1281
Please, check iPhone 7
Product type: iPhone9,1
Chip ID: 0x8010
Board ID: 0x08
When I do "gaster pwn", the device does not start after I upload all the files: ibec, ibss, devicetree, kernel.
For example when I do pwn mode through "ipwndfu -p && ipwndfu --patch" and upload the same files then the device starts correctly.
How to compile on windows
Would love to see iWatch support in gaster :-)
usb_timeout: 5
usb_abort_timeout_min: 0
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8010
Found the USB handle.
Stage: RESET
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8010
Found the USB handle.
Stage: SETUP
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8010
Found the USB handle.
Stage: SPRAY
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8010
Found the USB handle.
Stage: PATCH
ret: true
[libusb] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
DMESG
[ 1714.357473] usb 1-1.4.2: usbfs: process 1571 (gaster) did not claim interface 0 before use
[ 1714.451318] usb 1-1.4.2: reset full-speed USB device number 18 using xhci_hcd
[ 1714.575547] usb 1-1.4.2: usbfs: process 1571 (gaster) did not claim interface 0 before use
[ 1718.631318] usb 1-1.4.2: reset full-speed USB device number 18 using xhci_hcd
[ 1718.773877] usb 1-1.4.2: usbfs: process 1571 (gaster) did not claim interface 0 before use
[ 1719.319349] usb 1-1.4.2: reset full-speed USB device number 18 using xhci_hcd
[ 1719.456916] usb 1-1.4.2: usbfs: process 1571 (gaster) did not claim interface 0 before use
[ 1720.170139] usb 1-1.4.2: USB disconnect, device number 18
after writing :
irecovery -f kernel
irecovery -c bootx
phone can't get out of recovery mode
Okay, so not sure how I can possibly contact you but. I have an iPad mini 4 that I ran the command gaster MANUAL_RESET on and now it's stuck in dfu mode, won't restore, and I have no clue how to fix it
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.