checkra1n / BugTracker

checkra1n bug tracker
720 stars 108 forks source link

Blackbird/XNU boot issue on BridgeOS 5.5 on T8012 #2183

Open BogChanos opened 2 years ago

BogChanos commented 2 years ago

Tell us about your setup:

  1. What iDevice are you using? - Apple T2 (T8012)
  2. On what version of iOS is it? - BridgeOS 5.5 ( iBoot-6723.140.2)
  3. What version of checkra1n are you using? - 0.12.4
  4. What is your host system - Ubuntu 18.04
  5. How are you connecting to the device - USB-C to USB A cable

What are the steps to reproduce the issue?

  1. Run Checkra1n/Boot to PongoOS
  2. Attempt to boot to XNU or pwn SEP in PongoOS
  3. Device powers off (I assume because of a crash) / 'Registers are locked' error ...

I am trying to run Checkra1n on my MacBook Air A2179 in order to ssh into BridgeOS or manage to access SEP tools from PongoOS. Checkra1n always causes the machine to crash when booting to XNU(patched or unpatched), and PongoOS does boot however cannot run Blackbird/sep pwn. I see 'Registers are locked'. Which I suspect is behind the crashes for checkra1n on its own.

See shell output for PongoOS below.

'#==================' '#' '# pongoOS 2.5.0-0cb6126f' '#' '# https://checkra.in' '#' '#==================' 'Booted by: iBoot-6723.140.2' 'Built with: Clang 10.0.0 ' 'Running on: Apple T2 (T8012)' '[modload_macho:i] Attempting to load a module' '[modload_macho:+] Loaded module checkra1n-kpf2-12.0,14.5'

'#==================' '#' '# checkra1n kpf 0.12.3' '#' '# Proudly written in nano' '# (c) 2019-2021 Kim Jong Cracks' '#' '# This software is not for sale' '# If you purchased this, please' '# report the seller.' '#' '# Get it for free at https://checkra.in' '#' '#==== Made by ===' '# argp, axi0mx, danyl931, jaywalker, kirb, littlelailo, nitoTV' '# never_released, nullpixel, pimskeks, qwertyoruiop, sbingner, siguza' '#==== Thanks to ===' '# haifisch, jndok, jonseals, xerub, lilstevie, psychotea, sferrini' '# Cellebrite (ih8sn0w, cjori, ronyrus et al.)' '#==================' 'Found old-style rdsk!' 'Pongo shell requested, stopping here!' 'pongoOS> set xnu boot arg cmdline to: [rootdev=md0]' 'pongoOS> sep pwn'

'Registers are locked' 'pongoOS> '

Is Checkra1n just not supported for BridgeOS 5.5/iBoot 6723.140.2? I can't see it in known issues. I'd love to downgrade it however it seems you need a version signed by Apple of which there aren't any previous ones around, is there a way around this do you think?