pwn20wndstuff / Undecimus

unc0ver jailbreak for iOS 11.0 - 12.4
BSD 3-Clause "New" or "Revised" License
6.65k stars 1.3k forks source link

u0 needs to check sed version to avoid firmware.sh failing causing disaster #2209

Open badger200 opened 3 years ago

badger200 commented 3 years ago

Root cause analysis: #2208

unc0ver jailbreak process needs to test sed command to ensure its a compatible GNU version, otherwise /usr/libexec/cydia/firmware.sh will silently fail (and unc0ver oddly doesn’t report this, nor does it trigger a visible jailbreak failure/error), causing critical virtual dependency packages to be missing like cy+cpu.arm64 and Camera packages.

I experienced a nasty cascade of failures that took me a year to finally trace back to a shit non-GNU version of sed installed by CoolStar years ago in /usr/bin/sed which took priority over unc0ver’s /bin/sed.

Again, read #2208 to see the series of catastrophic failures this caused, all with zero clue to the true cause.

ALSO affected via the same exact post-CoolStar state were: /usr/bin/gzip (I think) /usr/bin/tar (I think) And several others I’m forgetting. (Although I’m not aware of those causing me any issues in particular, I definitely still got rid of them as the proper unc0ver ones in /bin were newer anyway.)

I was able to identify the culprits by doing ls -lait /usr/bin which displays the inode of files and sorts them by time, and you should be able to see a continuum of file inodes all closely numbered surrounding the CoolStar-installed sed. If that doesn’t work, remove the “t” from the ls command.

I can’t remember off the top of my head how I ascertained that it was CoolStar that installed that version of sed. I think I did a ls -la | locate /sed and it found a matching size/date version of sed in some random directory I had manually unpacked an old jailbreak in, to acquire the useful tools: fs_usage and filemon.

The-SamminAter commented 3 years ago

How did you manage to run a command? unc0ver broke dpkg on my device, and I need a way to fix it.

badger200 commented 3 years ago

@The-SamminAter It definitely was not easy. The best chance of success is using unc0ver 4.3.1 which has a bunch of advanced functions that Pwn20wnd inexplicably removed with v5.

Try Load Tweaks : OFF Load Daemons: OFF SSH Only: ON

You might need to use Read-Only Root: ON to get in, but then you’re caught between a rock and a hard place. I think I was then able to RE-jailbreak with Read-Only Root OFF, and gain rw access. I don’t know why it doesn’t just work as you’d expect but I had to jump through all kinds of hoops.

NOTE: SSH Only launches dropbear, a shit SSH server that’s incompatible with popular SSH apps like Termius.

I was able to connect to dropbear with PuTTy on Windows, with terminal “ssh root@1.2.3.4” from a 2nd jailbroken device, and with NewTerm2 and MTerminal.

(those last 2 absolutely suck and have their own issues, NewTerm is excruciatingly slow to handle merely 1 full page of output and uses 400-500MB RAM (!), while MTerminal is so stupid it can’t even issue commands you’ll need like “dpkg --configure -a” because it will auto convert the two hyphens into 1 large hyphen special non-ASCII character!! I swear to god you can’t make this up. It also won’t issue CTRL-C or CTRL-Z, so don’t issue any streaming output commands like oslog or you’ll be doomed. I cannot fathom how someone wrote that app and never once needed to issue a --help command etc!)

The-SamminAter commented 3 years ago

Thanks! I completely forgot about unc0ver 4.3.1 and its extra options.