search

MatthewPierson / PyBoot

Tool for tether booting Checkm8 vulnerable iOS devices
GNU Lesser General Public License v3.0
284 stars 52 forks source link

Device should be booting... #26

Open zsbai opened 4 years ago

zsbai commented 4 years ago

But the device didn’t respond,stay in dfu

MatthewPierson commented 4 years ago

I need more information before I help you

0nenZer0 commented 4 years ago

Hi,

I have the same issue with my iPhone 6s (n71ap). Seems like it's rejecting ibec

Current version is: Beta 0.6 Make sure your device is connected in DFU mode. .

`Waiting for the USB device with VID: 0x5AC, PID: 0x1227, SRTG: iBoot-2234.0.0.3.3 Found the USB device. Stage: RESET, ret: 0x0 Found the USB device. transfer_ret: 0xE00002EB, transfer_sz: 0x0 Stage: SETUP, ret: 0x0 Found the USB device. Stage: PATCH, ret: 0x0

Eclipsa doesn't allow me to see if the exploit worked or not =( Just have to assume it did, if it didn't then reboot into DFU mode and re-run PyBoot Sending boot files to the device and booting [==================================================] 100.0% [==================================================] 100.0% ERROR: Unable to connect to device ERROR: Unable to connect to device ERROR: Unable to connect to device ERROR: Unable to connect to device ERROR: Unable to connect to device Device should be booting! ERROR: Unable to connect to device`

Any advise on this. device still in dfu mode... thanks a lot

MatthewPierson commented 4 years ago

@0nenZer0 Please show the full log, just part of it isn't enough for me to see whats wrong

0nenZer0 commented 4 years ago

@MatthewPierson here is the complete log.

`$./pyboot.py -i iPhone8,1 13.4 -a PyBoot - A tool for tether booting Checkm8 vulnerable iOS devices by Matty, @mosk_i

Current version is: Beta 0.6 Please enter the boot-args you want to use then press enter: -v Make sure your device is connected in DFU mode Checking theiphonewiki for 13.4 keys... Found Keys! Found a keys page with multiple models... Which is your device? 1: N71AP 2: N71mAP Enter 1 or 2: 1 User chose N71AP, grabbing those keys... Downloading 13.4's BuildManifest.plist Extracting: BuildManifest.plist, from iPhone_4.7_13.4_17E255_Restore.ipsw Getting SHSH for signing images Downloading and patching 13.4's iBSS/iBEC Extracting: Firmware/dfu/iBEC.n71.RELEASE.im4p, from iPhone_4.7_13.4_17E255_Restore.ipsw Extracting: Firmware/dfu/iBSS.n71.RELEASE.im4p, from iPhone_4.7_13.4_17E255_Restore.ipsw Downloading 13.4's KernelCache Extracting: kernelcache.release.n71, from iPhone_4.7_13.4_17E255_Restore.ipsw Downloading 13.4's DeviceTree Extracting: Firmware/all_flash/DeviceTree.n71ap.im4p, from iPhone_4.7_13.4_17E255_Restore.ipsw

Failed to get RootFS name Please look up the RootFS filename on the key page for iPhone8,1 - iOS 13.4 theiphonewiki and type it here then press enter:

048-64266-316.dmg Extracting: Firmware/048-64266-316.dmg.trustcache, from iPhone_4.7_13.4_17E255_Restore.ipsw Patching Kernel's type from krnl to rkrn Patching TrustCache's type from trst to rtsc Patching Devicetree's type from dtre to rdtr Signing boot files Exploiting device with checkm8 Waiting for the USB device with VID: 0x5AC, PID: 0x1227, SRTG: iBoot-2234.0.0.3.3 Found the USB device. Stage: RESET, ret: 0x0 Found the USB device. transfer_ret: 0xE00002EB, transfer_sz: 0x40 Stage: SETUP, ret: 0x0 Found the USB device. Stage: PATCH, ret: 0x0

Eclipsa doesn't allow me to see if the exploit worked or not =( Just have to assume it did, if it didn't then reboot into DFU mode and re-run PyBoot Sending boot files to the device and booting [==================================================] 100.0% [==================================================] 100.0% ERROR: Unable to connect to device ERROR: Unable to connect to device ERROR: Unable to connect to device ERROR: Unable to connect to device ERROR: Unable to connect to device Device should be booting! ERROR: Unable to connect to device $

device still in DFU mode. Pls advise. Thanks`

MatthewPierson commented 4 years ago

Are you sure your device is an N71AP and not a N71mAP?

0nenZer0 commented 4 years ago

@MatthewPierson confirmed it's N71AP. BTW I managed to boot the device already and seen your boot logo after couple of tries. Seems eclipsa8000 sometimes fail does rejecting ibex and not putting device to recovery mode. Anyway thanks for your response.. and Great work on Pyboot.