t8015 support

[minacrissdev]

try to create t8015 loader

return [ // Patch to boot iBoot 0x1000079DC: [ 0x68, 0x00, 0x80, 0x52 ], // movz w8, #0x3

               // Patch for the boot trampoline
               0x180018000: [
                   0xE2, 0x07, 0x61, 0xB2, // mov x2, #0x180000000
                   0x40, 0x00, 0x3F, 0xD6, // blr x2
               ],

               // Our loader goes here
               0x180000000: Array<UInt8>(loader),

               // Our shellcode goes here
               // Note: This must be 4kB aligned
               0x180001000: Array<UInt8>(iStrap_4x),
           ]

[sitay1]

Did it worked for you?

[ash1n2]

Hello.

I have a question.

I cannot write memory at address 0x1000079DC.

I tried to using GDB and BONOBO cable.

(gdb) target remote :3333 Remote debugging using :3333 warning: No executable has been specified and target does not support determining executable automatically. Try using the "file" command. 0x0000000100000568 in ?? () (gdb) x/10x 0x1000079DC 0x1000079dc: 0x528000a8 0xb9000028 0xb900007f 0x320003e8 0x1000079ec: 0xaa0803e0 0xd65f03c0 0xffffffb8 0xffffffac 0x1000079fc: 0xffffffc0 0xffffffd0 (gdb) set 0x1000079DC=0x00000061 Cannot access memory at address 0x1000079dc (gdb) x/10x 0x1000079DC 0x1000079dc: 0x528000a8 0xb9000028 0xb900007f 0x320003e8 0x1000079ec: 0xaa0803e0 0xd65f03c0 0xffffffb8 0xffffffac 0x1000079fc: 0xffffffc0 0xffffffd0 (gdb) x/10x 0x180018000 0x180018000: 0xd5034fdf 0xaa0003fd 0xaa0103fc 0x58001820 0x180018010: 0x58001841 0xd50b7420 0x91010000 0xeb01001f 0x180018020: 0x54ffffa3 0x580017e0 (gdb) set 0x180018000=0x00000061 (gdb) x/10x 0x180018000 0x180018000: 0x00000061 0xaa0003fd 0xaa0103fc 0x58001820 0x180018010: 0x58001841 0xd50b7420 0x91010000 0xeb01001f 0x180018020: 0x54ffffa3 0x580017e0 (gdb)

so I tried another way. It was successful.

m.insert(pair<uint64_t, vector>(0x180000000, { 0x61,
}));

iphone.ecore0 arp_halt iphone.ecore0 cluster 0 core 0 multi core target halted in AArch64 state due to debug-request, current mode: EL1T cpsr: 0x800002c4 pc: 0x100000568 MMU: enabled, D-Cache: enabled, I-Cache: enabled iphone.ecore0 mdw 0x180000000 4 0x180000000: ffffff61 ffffffff 00000000 00000000

However, The iPhone X reboot occurred when the below code was executed.

m.insert(pair<uint64_t, vector>(0x1000079DC, { 0x61,
}));

How can I write patch-code on 8015 ?