Skip to content

Commit

Permalink
Support Windows 32 et 64 bits
Browse files Browse the repository at this point in the history
Ajout du support Wndows compiler en 32 et 64 bits .

Télécharger Cygwin pour utiliser Odysseus vidéo a venir pour plus de
précision.
  • Loading branch information
Dev Jam committed Oct 23, 2015
1 parent 30ec2b9 commit acf7bf2
Show file tree
Hide file tree
Showing 1,347 changed files with 26,493 additions and 0 deletions.
91 changes: 91 additions & 0 deletions README
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
Odysseus

WARNING: do not do it, unless you have read and understood these instructions.
If *anything* goes wrong during the restore process, you will have to restore
to the latest, most likely unjailbreakable firmware. Basically, you are on
your own. I will not be held responsible for anything YOU do.

This works only on certain jailbroken 32bit devices. By that, I mean devices
I have keys for. Also, this will *not* change your baseband. If you go too
far up/down with iOS version, it may be that the main OS doesn't understand
the baseband anymore. If that happens, you won't get past activation and
you cannot re-jailbreak the device. As a consequence, the device will remain
in activation limbo and you'll have to restore.

The untether on your device must have tfp0 enabled. Early versions of Pangu
did not enable tfp0, but latest versions of Pangu, TaiG and evasi0n all have
tfp0 activated.

You need to have the valid ticket/blob for the desired firmware. To validate
the ticket/blob against the desired firmware, you have to:
a) download desired firmware:
computer$ curl -O http://path/to/desired.ipsw
b) convert your precious.shsh to xml:
computer$ cat precious.shsh | zcat -fc > precious.plist
computer$ plutil -convert xml1 precious.plist
c) validate the ticket/blob:
computer$ ./validate precious.plist desired.ipsw -z
If you see any ERROR message, then your ticket/blob is probably screwed and you
should NOT attempt to downgrade.

Install OpenSSH and Core Utilities (coreutils) on the device, using Cydia or
whatever app store is the rage these days.

Save your baseband (enter your device root password, default is alpine):
computer$ ./sshtool -s baseband.tar -p 22 device_ip_or_name
It's ok if baseband.tar is a zero sized file if you have an Infineon baseband
(that is, <= iPhone4) but for Qualcomm (that is >= iPhone4S), your device must
have the baseband on main filesystem. In this case, any error or empty archive
means trouble.

Build the custom firmware. This will take a while. The -memory parameter is
optional. Use it only if your machine has sufficient physical memory (>=4GB).
Make sure you have the right bundle in FirmwareBundles/. If the bundle is not
there, ask for it.
computer$ ./ipsw desired.ipsw custom.ipsw -memory baseband.tar
or
computer$ ./ipsw desired.ipsw custom.ipsw -memory baseband.tar jb.tar ssh.tar
The latter is meant to save your device if there's a baseband mismatch. Do NOT
attempt to install Cydia (jailbreak or otherwise) over it even if signal works.
Its sole purpose is to allow you to re-downgrade to a different iOS version.
If the ipsw creation fails, try increasing rootfs with `-s' or `-S' options.

Extract back the pwned iBSS from the custom-built firmware:
computer$ ./xpwntool `unzip -j custom.ipsw 'Firmware/dfu/iBSS*' | awk '/inflating/{print $2}'` pwnediBSS

Kickstart the pwned restore (enter your device root password):
computer$ ./sshtool -k ../kloader -b pwnediBSS -p 22 device_ip_or_name

Wait for the device to enter DFU. Do NOT press any button. Just plug/unplug
it, until it is seen as DFU. If it does not appear, do a cold boot by holding
both Home and Power button until the Apple logo appears and then repeat the
previous step. Kill iTunes before continuing. You may want to disable iTunes
Helper by removing it from System Preferences -> Users & Groups -> Login Items
or simply kill it:
computer$ killall iTunesHelper

Restore the custom firmware. Make sure you have your precious ticket/blob file
copied as shsh/ECID-DEVICE-VERSION.shsh before starting. For example, the shsh
file can be 2144637826347-iPad3,1-7.1.2.shsh. Please note that you may need to
be root to access USB:
computer# ./idevicerestore -d -w custom.ipsw

Enjoy!

In theory, the last step can be replaced by starting TinyUmbrella and doing the
restore via iTunes, but I have not tested it that way (and most probably, you'd
have to downgrade iTunes).

Credits:
@planetbeing, dborca for the awesome xpwn
@winocm for ios-kexec-utils
@westbaer, p0sixninja, iH8sn0w, GreySyntax for irecovery
@libimobiledevice people for libimobiledevice
@iH8sn0w for some ideas and code
@iH8sn0w, SquiffyPwn, winocm for p0sixspwn
@daytonhasty for some ideas, testing and writeup
@JonathanSeals for some ideas
@tihmstar, CPVideoMaker, SashaKirichenko for testing
@citrusui for the cool name

-xerub
35 changes: 35 additions & 0 deletions README.FIRST
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
NOT working: iOS5
- kloader does not work properly on iOS5. May be fixed in the future, but
until then, there is no way to kickstart this if your device is on iOS5.
- the baseband for iPhone4,1 is stored differently on iOS5 vs higher iOS
versions. An extra step is needed to prepare baseband.tar

NOT working: El Capitan
- idevicerestore cannot switch from DFU to Recovery. Until it gets fixed,
there is no way to kickstart this if your computer is running El Capitan.

Do NOT attempt this if you don't know what you are doing. In case of
baseband mismatch, there is no way to get past activation screen and
re-jailbreak the device. To overcome this, a jailbreak.tar and ssh.tar
must be preinstalled to rootfs.

iPhone3,1:
probably ok

iPhone3,3:
probably ok

iPhone4,1:
6.1.3 -> 7.1.2 ok
7.1.2 -> 6.1.3 BB mismatch (to succeed with this restore, just use README.OTA)
8.1.1 -> 6.1.3 BB mismatch (to succeed with this restore, just use README.OTA)
8.1.1 -> 7.1.2 ok

iPhone5,2:
8.1.2 -> 7.1.2 ok

iPhone5,4:
8.1.2 -> 7.1.2 ok

iPad2,1:
6.1.3 -> 7.1.2 ok
11 changes: 11 additions & 0 deletions README.OTA
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
blah... blah...

./ipsw iPhone4,1_6.1.3_10B329_Restore.ipsw iPhone4,1_6.1.3_10B329_Downgrade.ipsw -memory -bbupdate -ota iPhone4,1_9A406_10B329.plist

blah... blah...

idevicerestore -d -w iPhone4,1_6.1.3_10B329_Downgrade.ipsw

blah... blah...

-xerub
58 changes: 58 additions & 0 deletions README.blobs
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
This is a (somewhat) complicated process to dump on-device blobs/apticket).

Install OpenSSH and Core Utilities (coreutils) on the device, using Cydia or
whatever app store is the rage these days.

Next, build a custom firmware for your device. It must match your hardware,
but the actual iOS version is not that important. The -memory parameter is
optional, use it only if your machine has sufficient physical memory (>=4GB).
Make sure you have the right bundle in FirmwareBundles/.
computer$ ./ipsw original.ipsw custom.ipsw -memory
Do NOT use this custom ipsw to restore your device, because it has no saved
baseband. See the main README for the proper procedure.

Extract the pwned iBSS from the custom-built firmware:
computer$ ./xpwntool `unzip -j custom.ipsw 'Firmware/dfu/iBSS*' | awk '/inflating/{print $2}'` pwnediBSS

Load the pwned iBSS (enter your device root password):
computer$ ./sshtool -k ../kloader -b pwnediBSS -p 22 device_ip_or_name

Wait for the device to enter DFU. Do NOT press any button. Just plug/unplug
it, until it is seen as DFU. If it does not appear, do a cold boot by holding
both Home and Power button until the Apple logo appears and then repeat the
previous step. Kill iTunes before continuing. You may want to disable iTunes
Helper by removing it from System Preferences -> Users & Groups -> Login Items
or simply kill it:
computer$ killall iTunesHelper

Extract the pwned iBEC from the custom-built firmware:
computer$ mv `unzip -j custom.ipsw 'Firmware/dfu/iBEC*' | awk '/inflating/{print $2}'` pwnediBEC

Load the pwned iBEC:
computer# ./irecovery -f pwnediBEC

Wait for the device to enter Recovery Mode. Do NOT press any button. Just
plug/unplug it, until it is seen as Recovery. If it does not appear, do a
cold boot by holding both Home and Power button until the Apple logo appears
and then repeat the previous steps.

Get them blobs:
computer# ./irecovery -s
iRecovery> /send ../payload
iRecovery> go blobs
iRecovery> /exit
computer# ./irecovery -g precious.dump
computer# ./irecovery -s
iRecovery> reboot

Unpack blobs against a matching ipsw. This ipsw must match the actual version
that is flashed on the device.
computer$ ./ticket precious.dump precious.plist matching.ipsw -z
computer$ ./validate precious.plist matching.ipsw -z

Credits:
@westbaer for irecovery
@winocm for ios-kexec-utils
@iH8sn0w for some ideas and code

-xerub
Binary file added jb/p0sixspwn.tar
Binary file not shown.
Binary file added jb/ssh_small.tar
Binary file not shown.
Binary file added kloader
Binary file not shown.
Binary file added payload
Binary file not shown.
143 changes: 143 additions & 0 deletions windows32/FirmwareBundles/Down_iPad2,1_6.1.3_10B329.bundle/Info.plist
Original file line number Diff line number Diff line change
@@ -0,0 +1,143 @@
<?xml version=1.0 encoding=UTF-8?>
<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd>
<plist version=1.0>
<dict>
<key>FilesystemPatches</key>
<dict/>
<key>FirmwarePatches</key>
<dict>
<key>RestoreKernelCache</key>
<dict>
<key>File</key>
<string>kernelcache.release.k93</string>
<key>IV</key>
<string>247ea923c137404f4faec7da75822b08</string>
<key>Key</key>
<string>2bbdf3fea41600cd7ae46157af7f19b1726900802f2ec2022aa60b9a27a3261f</string>
<!--key>Patch</key>
<string>kernelcache.release.patch</string-->
<key>DecryptPath</key>
<string>Downgrade/kernelcache.release.k93</string>
<key>TypeFlag</key>
<integer>4</integer>
</dict>
<!--key>Update Ramdisk</key>
<dict>
<key>File</key>
<string>048-2679-005.dmg</string>
<key>IV</key>
<string>42012fd13eae0dfdac7cb536e159a372</string>
<key>Key</key>
<string>d5e306661bfaa4d342d599a3494a35b9c3173c5fdcd11752293b2356011652c3</string>
<key>TypeFlag</key>
<integer>8</integer>
</dict-->
<key>Restore Ramdisk</key>
<dict>
<key>File</key>
<string>048-2516-005.dmg</string>
<key>IV</key>
<string>8775b711d2e09e332f8ebfbebe63cce7</string>
<key>Key</key>
<string>d406dc4343eedf9d6567e8303ba39a21f81f99bf701840c888963af58a84fb8f</string>
<key>Decrypt</key>
<true/>
<key>TypeFlag</key>
<integer>8</integer>
</dict>
<key>iBSS</key>
<dict>
<key>File</key>
<string>Firmware/dfu/iBSS.k93ap.RELEASE.dfu</string>
<key>IV</key>
<string>b69f753dccd09c9b98d345ec73bbf044</string>
<key>Key</key>
<string>6e4cce9ea6f2ec346cba0b279beab1b43e44a0680f1fde789a00f66a1e68ffab</string>
<key>Patch</key>
<string>iBSS.k93ap.RELEASE.patch</string>
<key>Decrypt</key>
<true/>
<key>TypeFlag</key>
<integer>8</integer>
</dict>
<key>iBEC</key>
<dict>
<key>File</key>
<string>Firmware/dfu/iBEC.k93ap.RELEASE.dfu</string>
<key>IV</key>
<string>3a0726b7bc091915dd928eed21478728</string>
<key>Key</key>
<string>69eaeb223db61b557c36d65fa7e6e4ec1c0d7547dfce9d46077f7e5b0fcba98f</string>
<key>Patch</key>
<string>iBEC.k93ap.RELEASE.patch</string>
<key>Decrypt</key>
<true/>
<key>TypeFlag</key>
<integer>8</integer>
</dict>
<key>RestoreDeviceTree</key>
<dict>
<key>File</key>
<string>Firmware/all_flash/all_flash.k93ap.production/DeviceTree.k93ap.img3</string>
<key>IV</key>
<string>557d2b8116b04cf93bf7bff023ed6bf2</string>
<key>Key</key>
<string>7c9c0c49075fd6c47e1598f23901266237e30e60dcfc7174b8c2ea6f42532bfb</string>
<key>DecryptPath</key>
<string>Downgrade/DeviceTree.k93ap.img3</string>
</dict>
<key>RestoreLogo</key>
<dict>
<key>File</key>
<string>Firmware/all_flash/all_flash.k93ap.production/applelogo.s5l8940x.img3</string>
<key>IV</key>
<string>623b2592ad563ea16bd8a86af6960bcb</string>
<key>Key</key>
<string>0e7aa7bbcfddc88dfe0e56e021363028502621c52c709afc3744850977e2fb9f</string>
<key>DecryptPath</key>
<string>Downgrade/[email protected]</string>
</dict>
</dict>
<key>RamdiskPatches</key>
<dict>
<key>asr</key>
<dict>
<key>File</key>
<string>usr/sbin/asr</string>
<key>Patch</key>
<string>asr.patch</string>
</dict>
<!--key>restored_external</key>
<dict>
<key>File</key>
<string>usr/local/bin/restored_external</string>
<key>Patch</key>
<string>restored.patch</string>
</dict-->
</dict>
<key>RamdiskMountVolume</key>
<string>ramdisk</string>
<key>RamdiskOptionsPath</key>
<string>/usr/local/share/restore/options.k93.plist</string>
<key>RootFilesystem</key>
<string>048-2634-005.dmg</string>
<key>RootFilesystemSize</key>
<integer>1063</integer>
<key>RootFilesystemKey</key>
<string>70f5ac054bf50a522fd39071f6acbd92954804599c1507b881d7d9c4026005e3867bfab0</string>
<key>RootFilesystemMountVolume</key>
<string>BrightonMaps10B329.K93OS</string>
<key>SHA1</key>
<string>241a02bb446c21e44e8470b77e09b5fbfba7d6c4</string>
<key>Filename</key>
<string>iPad2,1_6.1.3_10B329_Restore.ipsw</string>
<key>Name</key>
<string>iPad2,1_6.1.3_10B329</string>
<key>DownloadUrl</key>
<string></string>
<key>Platform</key>
<integer>1</integer>
<key>SubPlatform</key>
<integer>6</integer>
</dict>
</plist>
Binary file not shown.
Binary file not shown.
Binary file not shown.
Loading

0 comments on commit acf7bf2

Please sign in to comment.