checkra1n / BugTracker

checkra1n bug tracker
729 stars 104 forks source link

Checkrain cli does not work, however gui works. #1602

Open wendyisgr33n opened 4 years ago

wendyisgr33n commented 4 years ago

Tell us about your setup:

  1. What iDevice are you using? 6s
  2. On what version of iOS is it? 13.4
  3. What version of checkra1n are you using? 0.10.2
  4. What is your host system (OS version? Hackintosh? VM? etc.)? 10.15
  5. How are you connecting to the device (USB-A? USB-C? Apple/3rd party cable? Through a USB hub?)? Apple USB Cable

What are the steps to reproduce the issue?

  1. Run checkra1n in cli mode
  2. ...

What do you expect, and what is happening instead? Checkra1n cli does not jailbreak the device. No errors. Checkra1n gui works without issue.

Does the issue also occur if you tick "Safe Mode" in the checkra1n options? Yes I did. No changes to results.

Any other info, error logs, screenshots, ...?

Siguza commented 4 years ago

What's logged to console?

wendyisgr33n commented 4 years ago

I just re-ran it this morning. This was the output. There was one error, but just that it was timing out after boot.

./checkra1n -c -s -v
#
# Checkra1n beta 0.10.2
#
# Proudly written in nano
# (c) 2019-2020 Kim Jong Cracks
#
#========  Made by  =======
# argp, axi0mx, danyl931, jaywalker, kirb, littlelailo, nitoTV
# never_released, nullpixel, pimskeks, qwertyoruiop, sbingner, siguza
#======== Thanks to =======
# haifisch, jndok, jonseals, xerub, lilstevie, psychotea, sferrini
# Cellebrite (ih8sn0w, cjori, ronyrus et al.)
#==========================

 - [08/10/20 10:45:26] <Info>: Waiting for DFU devices
 - [08/10/20 10:45:27] <Verbose>: DFU mode device found
 - [08/10/20 10:45:27] <Info>: Exploiting
 - [08/10/20 10:45:27] <Verbose>: Attempting to perform checkm8 on 8000 20...
 - [08/10/20 10:45:27] <Info>: Checking if device is ready
 - [08/10/20 10:45:27] <Verbose>: == Checkm8 Preparation stage ==
 - [08/10/20 10:45:27] <Verbose>: DFU device disconnected
 - [08/10/20 10:45:27] <Verbose>: DFU mode device found
 - [08/10/20 10:45:27] <Info>: Setting up the exploit (this is the heap spray)
 - [08/10/20 10:45:27] <Verbose>: == Checkm8 Setup stage ==
 - [08/10/20 10:45:27] <Info>: Right before trigger (this is the real bug setup)
 - [08/10/20 10:45:27] <Verbose>: Entered initial checkm8 state after 3 steps, issuing DFU abort..
 - [08/10/20 10:45:28] <Verbose>: DFU device disconnected
 - [08/10/20 10:45:28] <Verbose>: DFU mode device found
 - [08/10/20 10:45:28] <Verbose>: == Checkm8 Trigger stage ==
 - [08/10/20 10:45:28] <Verbose>: Checkmate!
 - [08/10/20 10:45:28] <Verbose>: DFU device disconnected
 - [08/10/20 10:45:28] <Verbose>: DFU mode device found
 - [08/10/20 10:45:28] <Verbose>: == Checkm8 Trying to run payload... ==
 - [08/10/20 10:45:28] <Verbose>: If everything went correctly, you should now have code execution.
 - [08/10/20 10:45:28] <Verbose>: DFU device disconnected
 - [08/10/20 10:45:29] <Info>: Entered download mode
 - [08/10/20 10:45:29] <Verbose>: Download mode device found
 - [08/10/20 10:45:29] <Info>: Booting...
 - [08/10/20 10:45:29] <Verbose>: Setting bootargs to: rootdev=md0
 - [08/10/20 10:45:30] <Verbose>: Download mode device disconnected
 - [08/10/20 10:46:58] <Error>: Timed out waiting for bootstrap upload (error code: -20)
Siguza commented 4 years ago

How are you entering DFU? If it's via shutting the device down and doing the DFU button combo right away, then you need to briefly hold the power button once you reach that stage, otherwise LLB will wait for a cable disconnect and turn the device off.

wendyisgr33n commented 4 years ago

To enter DFU, I have the phone booted and connected to my Mac. Then, from the home screen, I hold Home + Power for about 8 seconds, then release Power and continue holding Home for about 8 more seconds.

Is there anything that is different between the way Checkra1n runs in cli mode, compared to terminal ui or gui mode?

Siguza commented 4 years ago

The only real difference is that the CLI expects a device in DFU mode, whereas the GUI does not.