siguza / ios-kern-utils Goto Github PK

View Code? Open in Web Editor NEW

This project forked from saelo/ios-kern-utils

238.0 22.0 55.0 215 KB

iOS Kernel utilities

License: MIT License

C 92.73% Makefile 7.27%

ios-kern-utils's Introduction

iOS Kernel Utilities

Beware, chances are the device will panic and reboot.

Download

Just want the binaries?
Head over to Releases. :)

Prerequisites

Jailbroken Device
tfp0 kernel patch (see below)
If you don't have XCode:
- GNU make
- C compiler for iOS
- Code signing utility

`tfp0` compatibility

A kernel patch is required for these tools to work, since access to kernel memory is natively unavailable for obvious reasons.
That patch is normally referred to as task-for-pid-zero (short tfp0), and is included in almost every public jailbreak.

The latest release of these tools is confirmed to work with:

p0sixspwn on 6.1.x
Pangu on 7.1.x
TaiG on 8.4
Pangu9 on 9.1
qwertyoruiop's jailbreakme on 9.3.x
extra_recipe on 10.0-10.2
Yalu102 (beta4 or later) on 10.0.1-10.2

Jailbreaks that DO NOT seem to enable tfp0, and thus DO NOT work with kern-utils:

Pangu9 on 9.0.x (but can be enabled with cl0ver)
Pangu9 on 9.2-9.3.3 (but see qwertyoruiop's jailbreakme)
YaluX on 10.0.1-10.1.1

If you have information about how the kernel task port can be obtained in these versions, please open a ticket and tell me.

Tools

Name	Function
`kdump`	Dump a running iOS kernel to a file
`kinfo`	Display various kernel information
`kmap`	Visualize the kernel address space
`kmem`	Dump kernel memory to the console
`kpatch`	Apply patches to a running kernel
`nvpatch`	Display and patch NVRAM variables permissions

Building

git clone https://github.com/Siguza/ios-kern-utils
cd ios-kern-utils
make        # build just the binaries
make deb    # build a deb file for Cydia
make xz     # package binaries to a .tar.xz
make dist   # deb && xz

For make you may also specify the following environment variables:

Name	Function	Default value
Name	Function	OS X	iOS	Linux
`IGCC`	iOS compiler	`xcrun -sdk iphoneos gcc`	`clang`	`ios-clang`
`IGCC_ARCH`	Target architecture(s)	`-arch armv7 -arch arm64`
`IGCC_FLAGS`	Custom compiler flags	none
`LIBTOOL`	Archive manipulation utility	`xcrun -sdk iphoneos libtool`	`libtool`	`ios-libtool`
`STRIP`	Symbol remover utility	`xcrun -sdk iphoneos strip`	`strip`	`ios-strip`
`SIGN`	Code signing utility	`codesign`	`ldid`
`SIGN_FLAGS`	Code signing flags	`-s - --entitlements misc/ent.xml`	`-Smisc/ent.xml`

macOS

As of late, kern-utils can also be compiled for and used on macOS.
Compile with:

IGCC=gcc IGCC_ARCH='-arch x86_64' SIGN=true STRIP=strip LIBTOOL=libtool make clean all

The SIGN=true is a dirty hack to skip signing, which is necessary because Sierra and later will not allow self-signed binaries with restricted entitlements to run. However, entitlements aren't needed on macOS since the kernel task port is obtained via a different API very much thanks to Jonathan Levin.

In order to use kern-utils, SIP needs to be at least partially disabled. If you don't want to disable it completely, you can use:

csrutil enable --without debug

License

MIT.

Original project by Samuel Groß.
nvpatch is largely based on nvram_patcher by Pupyshev Nikita.
Maintained and updated for iOS 8 and later by Siguza.

TODO

Test on Linux
Keep up with the original repo

ios-kern-utils's People

Contributors

Stargazers

Watchers

ios-kern-utils's Issues

Killed:9

Installed latest commit and get killed: 9 error when running khead and kdump.
This is for the ios 10 branch.
iPhone 6s N71AP 10.2

[!] Failed to get kernel task

I just used cl0ver to patch my device and got the message [*] Successfully installed patch, but wanted to make sure the process was successful with this tool as well. I tried with ./kmap and I'm getting this error:

6S:/private/var/root/sarasa root# ./kmap
[!] Failed to get kernel task
6S:/private/var/root/sarasa root#

Pangu9 on 9.0.x

is there any possible solution for 9.0.2? unfortunately, i have two jb phones, they are all 9.0.2

Kernel Panic

I ran kdump and the kernel paniced but the wierd thing was i still have my themed status bar from anenome and i cant get rid of it Ive tried hardreseting, dfumode, recov mode. Is this my phone or this tool?

compile nvpatch

Hello, i need help. i can't compile this source, i have some error in my terminal, can anyone compile nvpatch please, thank you very much

[IOS 11.1.1] nvrampatch on iPhone9,3

kdump kinfo kmap kmem kpatch can run without any error, but nvram still have problem.

here is a log file.

https://pastebin.com/Zmgsrm7X

i'm using Electra b6.

iOS 10 support ?

Hi Siguza !
Since Luca Todesco added tfp0 support to Yalu102, do you plan to update your stuff to iOS 10 ?
I just tried to run kdump and it rebooted my device.

Thanks

iPad Air 2 iOS 9.0.2 - Failed to get kernel task (invalid port)

Dear Siguza, thank you for this project!
For me now its time to move from iOS 9.0.2 to 12.1 on my iPad Air 2 after its finally jailbroken.

Unfortunately I wasn't able to set the nonce.
At first cl0ver reported a successfull installation.
I tried already two versions of your ios-kern-utils (1.4.1 and one from here #2) and the nvpatch and searched the issues here on Github.
You can see the output below.

iPad-Air:~ root# ./kmap && ./nvpatch -v -d com.apple.System.boot-nonce
[!] Failed to get kernel task ((os/kern) failure, kernel_task = 0)
iPad-Air:~ root# ./nvpatch -v -d com.apple.System.boot-nonce
[DEBUG] Getting kernel task... [src/lib/libkern.c:68]
[DEBUG] Trying task_for_pid(0)... [src/lib/libkern.c:69]
[DEBUG] Failure. Port: 0x00000000, return value: 0x00000005 ((os/kern) failure) [src/lib/libkern.c:72]
[DEBUG] Trying host_get_special_port(4)... [src/lib/libkern.c:76]
[DEBUG] Returned success, but port is invalid (0x00000000) [src/lib/libkern.c:79]
[DEBUG] Returning failure. [src/lib/libkern.c:83]
[!] Failed to get kernel task ((os/kern) failure, kernel_task = 0)

What is wrong with my special port?
I would be glad, if you can help me with this issue.
Many greetings from Germany!

Mob Barley

iPad Air 9.0.2 crash

I'm not sure if I'm doing it right, but my iPad Air (J72AP_13A452) crashes when using any utility except kmap, while ./cl0ver and ./cl0ver dump both work OK.

Kernel panic log attached.
panic-2017-05-14-141930_part.ips.txt

M1 (arm64) for macos

Hi Siguza,
Can you please add support for arm64 arch for macosx? I only trying to use kmem. It seems that the only usage of TARGET_MACOS that is relevant to kmem is in:

arch.h (IMAGE_OFFSET, MACH_TYPE)

If this requires too much work, can you give the highlights of the required modifications and I'll try to do the modifications myself.

When trying to modify it myself, I get an error from vm_read_overwrite
[DEBUG] vm_read error: (os/kern) invalid argument [src/lib/libkern.c:944]

iPhone 6s reboot on 10.2 with yalu102

I want to spoof MAC address with nvram, after patched variable "wifiaddr", but the device reboots. How can I do?
thanks ^-^

nvpatch causes iPad Air 2 to reboot on 9.3.3 with jbme

nvpatch causes iPad Air 2 (wifi) to reboot on 9.3.3 with http://jbme.qwertyoruiop.com

as root I use the command ./nvpatch com.apple.System.boot-nonce

no error message is shown. screen quickly goes dark grey and iPad restarts.

similar behaviour trying to use nonceEnabler

kdump [!] Failed to locate kernel

iPad:~ root# kdump
[!] Failed to locate kernel

kern-utils-utils 1.4.1-1
iOS 13.4.1
iPad 9.7" Pro

Pangu 7.1.x Compatibility

Could you update the readme to reflect compatibility with Pangu 7.1.x JB?

tfp0 is enabled in the latest version of their untether package (v0.3) and in their desktop app since v1.2.0

(Also, thanks for this fork, which allowed me to update my 5S from 7.1.2 to 10.2 via setting my boot-nonce with the included nvpatch tool)

Not Working in my device Pangu9 on 9.1

Hi,I use make deb install my iphone,but I use kdump.I get a kill 9 error.waiting for replaying

Are the commands eventually going to work?

I keep trying and it just panics. Does it log the kernel to a file?

Patching read-only kernel pages

This is most likely not an issue with ios-kern-tools, but I can't find any info on this. Please give some advise!

The latest tools work perfectly on my arm64 iPad Air 9.0.2, including nvpatch.
But when I try using kpatch to modify some bits, the device crashes. The memory is available and can be read with kmem, although it happens to fall into the "big null kernel region". I noticed that nvpatch modifies memory in that region without crashing, so it's not a region problem. My guess is that either mem pages are flagged read-only (but if that's true, why not use vm_protect before calling vm_write in kpatch?), or it's the KPP (is it not disabled by Pangu?), or it's an issue with the A7 TrustZone / Security Extensions / whatever (in that case I guess we just give up?).

Thanks!

ipad air 9.0.2

recently trying to run nvpatch (experimental and master) im getting crashes.
got it work a few days ago. but not anymore. of course running it after ./cl0ver

Failed to get kernel task on iOS 11.1.2

I built and run kdump for iOS 11.1.2, signed it with jtool.
I expected it to not work and this isssue is mostly to ask you if you plan to update to iOS 11 ?

$ ./kdump
[!] Failed to get kernel task ((os/kern) failure, kernel_task = 0)

Question about kernel task

From what iv'e heard, finding the port can be a major security issue when applied to your device so is their a benefit to finding the port?