Git Product home page Git Product logo

fugu15's Introduction

Fugu15

Fugu15 is a semi-untethered permasigned jailbreak for iOS 15.
It contains a code-signing bypass, kernel exploit, kernel PAC bypass and PPL bypass.
Additionally, it can be installed via Safari, i.e. a computer is not required, except for a Web Server that hosts Fugu15.
Please note that Fugu15 does not support tweaks (no tweak injection library).

Tested Devices and iOS Versions

  • iPhone Xs Max: iOS 15.4.1
  • iPhone 11 (SRD): iOS 15.4.1
  • iPhone 12 (SRD): iOS 15.4.1
  • iPhone 12 Pro Max: iOS 15.4.1
  • iPhone 13: iOS 15.1 (offline edition - see bugs below [WiFi bug])

Other devices are probably supported as well.
Non-arm64e devices are not supported.

Building

Prerequisites:

  1. Make sure you have Xcode 13/14 14.1 installed
  2. Import the fastPath arm certificate (Exploits/fastPath/arm.pfx) into your Keychain (double click on the file). The password is "password" (without quotes)
  3. You need a validly signed copy of Apple's Developer App from the AppStore (with DRM!). Copy the IPA to Server/orig.ipa. Note that if you would like to use a different AppStore App you will need to get it's Team ID and add TEAMID=<the App's Team ID> to all make commands

Now you can simply run make to build Fugu15 (internet connection required to download dependencies).
Please note that you will be asked to grant "fastPathSign" access to the Keychain item "privateKey" (the private key of the fastPath certificate). Enter your password and select "Always allow".

Building Tools

Building Fugu15 requires multiple Tools which can be found in the Tools directory. Building them is entirely optional because I've already compiled them.
If you want to build them yourself, simply run make in the Tools directory.

Installing

There are two ways to install Fugu15 on your device: Via Safari or via USB

Installing via Safari

To install Fugu15 via Safari, do the following (requires you to own a domain):

  1. Make sure your device is connected to the same network as your computer
  2. Change the DNS A record for a domain you own to the local IP-Address of your computer
  3. Obtain a certificate for your domain (e.g. via Let's Encrypt) and copy it to Server/serverCert/fullchain.cer (the certificate itself) and Server/serverCert/server.key (private key)
  4. Make sure you have Flask installed (pip3 install Flask)
  5. Change serverUrl in Server/server.py to your domain
  6. Run python3 server.py in the Server directory
  7. Visit https://<your domain> on your iPhone and follow the instructions

Installing via USB

  1. Install Fugu15_Developer.ipa, e.g. via ideviceinstaller -i Fugu15_Developer.ipa. Alternatively, install Fugu15/Fugu15.ipa via TrollStore.
  2. Open the newly installed "Developer" App (or whatever AppStore App you used) on your iPhone

iDownload

Like all Fugu jailbreaks, Fugu15 ships with iDownload. The iDownload shell can be accessed on port 1337 (run iproxy 1337 1337 & and then nc 127.1 1337 to connect to iDownload).
Type help to see a list of supported commands.
The following commands are especially useful:

  • r64/r32/r16/r8 <address>: Read a 64/32/16/8 bit integer at the given kernel address. Add the @S suffix to slide the given address or @P to read from a physical address.
  • w64/w32/w16/w8 <address> <value>: Write the given 64/32/16/8 bit integer to the given kernel address. Also supports the suffixes described above and additionally @PPL to write to a PPL protected address (see krwhelp).
  • kcall <address> <up to 8 arguments>: Call the kernel function at the given address, passing up to 8 64-Bit integer arguments.
  • tcload <path to TrustCache>: Load the given TrustCache into the kernel

Procursus Bootstrap and Sileo

Fugu15 also ships with the procursus bootstrap and Sileo. Run the bootstrap command in iDownload to install both. Afterwards, you might have to respring to force Sileo to show up on the Home Screen (uicache -r).

Procursus is installed into the /private/preboot/jb directory and /var/jb is a symlink to it.

Known Issues/Bugs

  1. If oobPCI (the process exploiting the kernel) exits, the system might be left in an inconsistent state and panic at some point. This usually occurs about 5 seconds after running the exit_full command in iDownload.
    Workaround: Don't quit oobPCI or make sure to do it as fast as possible to reduce the chance of a kernel panic. The reason for this panic is currently unknown.
  2. When not connected to power, entering deep sleep will cause a kernel panic due to a bug in DriverKit (also happened with Fugu14). Unfortunately, the fix from Fugu14 does not work on iOS 15.
    Workaround: This bug will not occur when quitting oobPCI. However, the bug described above may occur when oobPCI exits.
  3. Some iOS versions (at least iOS 15.1 and below, maybe 15.2 and 15.3 too) have a DriverKit bug which causes bus mastering to be disabled for the WiFi chip when running oobPCI, causing a kernel panic when WiFi is used. This bug can be fixed but a fix is not included in Fugu15 at the moment.
    Workaround: Disable WiFi.

FAQ

Q: I'm an end user. Is Fugu15 useful to me?
A: No.

Q: My iOS version/device is not supported by Fugu15, will you add support for it?
A: No. (I'm done with iOS 15)

Q: Will you ever add support for tweak injection?
A: No.

Q: Do you provide official support for Fugu15? Are any updates planned?
A: No.

Q: I installed/updated something through Sileo but it won't launch. How can I fix that?
A: Fugu15 uses TrustCache injection to bypass code signing. Therefore, if you install or update something, it's code signature must be in a TrustCache. You can load additional TrustCaches from the iDownload shell via the tcload command.

Q: Wen eta Fugu16??????
A: ...

Credits

The following open-source software is used by Fugu15:

  • Procursus Bootstrap: The bootstrap used by Fugu15. License: BSD 0-Clause. The tools included in the bootstrap are released under many different licenses, please see the procursus repo for more information
  • Sileo: The package manager included in Fugu15. License: BSD 4-Clause
  • ZIPFoundation: Swift library for working with ZIP archives. Used in FuguInstall to install the Fugu15 App. License: MIT

License

MIT. See the LICENSE file.

fugu15's People

Contributors

linushenze avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

fugu15's Issues

Question / help

So i watched videos like 3 months ago saying i should downgrade to 15.5 beta 4 that fugu15 would support that, but when i went to jailbreak it said it only supports till 15.4.1, so will 15.5 beta 4 be supported for the fugu15 jailbreak or no?

15.5B4

Not to far from where you got it to work for
Do you think would be ae to support beta4?

ima copy this

things i will add choose package manager tweak injection support anti update notifications so the thing when your ti far behihnd on a ios version it will say their is a new ios version install it soon

question

Where is the ipa for trollstore i cant find it

iPhone 12 reboot

Works only on airplane mode. When you turn it off iPhone reboot and jailbreak is not done.

When you do it in normal mode iPhone reboot and of course jailbreak is not done.

I hope solve it in a future. It crashes.

iPhone 12, iOS 15.1

iPad Pro 11 Gen 1 immediately restarts

OS version 15.3.1. The screen flashes and restarts immediately, already turned of wifi and bluetooth. Already tried both troll store and Sideloadly install from MacBook Pro M1.

Kernel panic on “Patchfinding” step

Device: iPad Air, Generation 4
Version: iPadOS 15.2 - Fugu15.tipa installed via Trollstore 1.3.4

A kernel panic will occur on the Patchfinding step regardless of any combination of user-changeable settings.
I think this might be because of the first oobPCI bug listed, but I’m very unsure. It happens even with airplane mode turned on, etc…
Any help would be greatly appreciated!

{"bug_type":"210","timestamp":"2022-11-01 23:29:29.00 -0700","os_version":"iPhone OS 15.2 (19C56)","incident_id":"03BBCDB3-2055-4E69-878D-FCDC4998E091"}
{
  "build" : "iPhone OS 15.2 (19C56)",
  "product" : "iPad13,1",
  "kernel" : "Darwin Kernel Version 21.2.0: Sun Nov 28 20:43:38 PST 2021; root:xnu-8019.62.2~1\/RELEASE_ARM64_T8101",
  "incident" : "03BBCDB3-2055-4E69-878D-FCDC4998E091",
  "crashReporterKey" : "fe56b06c21aba7e83b3a08ee0847902793ab7c51",
  "date" : "2022-11-01 23:29:29.90 -0700",
  "panicString" : "panic(cpu 0 caller 0xfffffff00e3004f4): Kernel data abort.” 

panic-full-2022-11-01-232929.000.zip

iPhone13mini / 15.1

I installed Fugu15 via Trollstore

Restarts after a few seconds after jailbreaking succeeded

Running `make` failed

image

I imported the cert and put the Apple Developer app inside the the Server folder and renamed it to orig.ipa

iPhone XR kernel panic

iPhone XR (15.0) kernel panic on click even with Wi-Fi off, airplane mode on, and Safari cache cleared. Should I update my iPhone to fix this?

Data abort at ml_io_write, iPhone 11 running iOS 15.3.1

Running the exploit on an iPhone 11 running iOS 15.3.1 semi-consistently results in a data abort panic inside ml_io_write. In a few other cases, I seem to get an "Unexpected fault in kernel static region" panic in a function I could not identify yet (It consists of an LDR X0, [X0] instruction, which crashes, followed a RET, where X0 is some page-aligned address that doesn't seem to be relative to the kernel base). Last thing I manage to see in the log before the phone reboots is Pos 26:. Any quick pointers (no pun intended) to where should I be looking at to fix this? Two sample panics included.

panic-full-2022-11-01-182210.000.ips
panic-full-2022-11-01-182314.0002.ips

iPhone XR reboot

I have iPhone XR on ios 15.0 and I have Problems with Fugu15:
I downloaded it and installed via Trollstore. After opening the app I clicked the Jailbreak button. It restarted and after opening the App it just said:
Status: Not running

Please help me, thanks

PS: I know it's a developer Jailbreak but I am curious and I just want to try it cause I want to get "deeper" into the jailbreak stuff.

iPhone 11 iOS 15.2

After pathfinding it reboots
Wifi off
Airplane tested
Wifi off threw settings

image

iPhone 11 Pro Max - iOS 15.0.2

The jailbreak worked successfully, only with Wi-Fi disabled.

As soon as I enabled Wi-Fi, there was a kernel panic and it reset (removing the jailbreak).

I used the USB install method, and was able to get iDownload shell successfully working.

See attached:

  • Full Panic Log

iOS 14.8 support?

Is this compatible with iOS 14.8 I have an iPhone 12 Pro sitting on that firmware hoping for something to break me free before I’m forced to update to iOS whatever latest at time

App Store apps not installing after Jailbrak

After the jailbreak happened I can no longer install App Store apps on my iPhone 12 pro max 15.1.1 no but works fine on my iPad. I did use I download to uninstall bootstrap still nothing

iPhone 11 pro - 15.3.1 restart issue

iPhone 11 Pro on iOS 15.3.1 (RC build) seems to be restarting on the finding kernel patch stage, no panic-full log is found.

Ps: yes I did turn on airplane mode and turn made sure wifi, Bluetooth, cellular data are off. Strange thing happened is each time the phone restarts it’s 2x slower than the original starting speed.

No fugu15 logs can be retrieved sadly.

ATV Support

Will support be extended for ATV 4K 2GEN?

Question

In the FAQ, Linus said he is done with iOS 15 and that no further updates are planned for iOS 15. Does this mean when new exploits are found, Linus won't update Fugu15?

Reboot after gaining r/w

Device: iPad 9 Wi-Fi
Method: TrollStore
Version: 15.3.1
Last Status: Gaining r/w

It’s airplane mode.
Bluetooth off.
WiFi off.
AirDrop off.

tried it 15 times with the Jailbreak button but sadly no luck

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.