search

kpwn / yalu102

incomplete iOS 10.2 jailbreak for 64 bit devices by qwertyoruiopz and marcograssi
Do What The F*ck You Want To Public License
1.77k stars 554 forks source link

Offset missing on 6s plus, 10.0 #432

Closed judge2020 closed 7 years ago

judge2020 commented 7 years ago

I read the issue posting guidelines. This is an issue regarding the actual Yalu process.

Device model: iPhone 8,2
Device info: iPhone 6s Plus on iOS 10.0
Method of install: Both impactor and manual build
Certificate: Paid developer account personal team

Issue:

When opening yalu I see a strange message detailing that the app is not compatible with 64-bit devices. Strange because the app was exclusively built for 64-bit devices.

When dismissing the notification and then clicking "go" it then hangs there. I can still go to app switcher and close Yalu, however, the jailbreak does not complete.

judge2020 commented 7 years ago

Looks like the offset is missing for the 6s plus 10.0. Is there a way I could find an offset myself or should I wait for someone else to contribute it?

sysname: Darwin
nodename: huntes-iPhone
release: 16.0.0
version: Darwin Kernel Version 16.0.0: Wed Jul 27 19:44:34 PDT 2016; root:xnu-3789.1.4.2.1~2/RELEASE_ARM64_S8000
machine: iPhone8,2
--> missing offset, prob crashing

Thanks for any help.

Mila432 commented 7 years ago

Strange because the app was exclusively built for 64-bit devices.

no the project was build for armv7

all offsets are there why would anyone use ios beta ..

judge2020 commented 7 years ago

Oh ok, I recently received this phone from a relative so I wasn't aware it was on beta 4. Which offset is the 6s plus 10.0 I should try to see if it works on beta 4?

OothecaPickle commented 7 years ago

I'll find the correct offsets right now.

OothecaPickle commented 7 years ago

Sorry it's taking so long; in school right now.

judge2020 commented 7 years ago

No that's completely fine. Take your time.

OothecaPickle commented 7 years ago

But, I have opened a decompressed iOS 10 beta 4 kernelcache in Hopper, so I should be done soon. :)

OothecaPickle commented 7 years ago

Use this exploit.c: https://gist.github.com/OothecaPickleGNUrmsTUXFSF/c19f947ff3cb3c94445b071666ad8eda

OothecaPickle commented 7 years ago

Let me know if this works. :)

judge2020 commented 7 years ago

2017-02-13 17:43:22.113904 yalu102[813:199138] found corruption 38103

or 38203

btw, i put that into offsets.c, not exploit.c. this is off of the main branch.

OothecaPickle commented 7 years ago

Did it work? ; you edited your comment.

OothecaPickle commented 7 years ago

Try my fork: https://github.com/OothecaPickleGNUrmsTUXFSF/yalu102

judge2020 commented 7 years ago

Any time while trying the offsets the debug log is "corruption found 19103"

jtv7 commented 7 years ago

It means the offsets are incorrect. Send me the kernel and I'll give the correct offsets. Also, this issue should be closed because its not an issue with yalu itself.

jtv7 commented 7 years ago

Nevermind, your offsets were correct.

This issue should be closed then, especially because the OP is using a beta.

OothecaPickle commented 7 years ago

@jtv7 Could this be an issue with hard-coded offsets, though?

jtv7 commented 7 years ago

@OothecaPickleGNUrmsTUXFSF I doubt it, especially because it works on such a large range of iOS versions. The OP might be building something incorrectly.

OothecaPickle commented 7 years ago

Alright, thanks. :)

judge2020 commented 7 years ago

sorry for this then. thanks for all the help.

judge2020 commented 7 years ago

Sorry this is such an old issue, I made a screen cap of trying to do this https://youtu.be/8l6y5QDGwYQ.

OothecaPickle commented 7 years ago

@judge2020 is this device still on iOS 10 beta 4? if so i have something for you to try. :)

judge2020 commented 7 years ago

Darn @OothecaPickle, sorry. Updated to 11.0.

OothecaPickle commented 7 years ago

@judge2020 oh, never mind then :(