* Device: iPhone 4S (iPhone4,1 - n94ap) in DFU mode
* iOS Version: Unknown
* To get iOS version, go to: Misc Utilities -> Get iOS Version
* ECID: xxxxxxxxxxxxx
* Pwned: checkm8
> Main Menu > Useful Utilities
[Input] Select an option:
Send Pwned iBSS
Clear NVRAM
Disable/Enable Exploit
-> SSH Ramdisk
Update DateTime
Console
DFU Mode Helper
Go Back
* To mount /var (/mnt2) for iOS 9-10, I recommend using version 9.0.2 (13A452).
* Do not use iOS 9+ ramdisks if your device is on iOS 8 or lower, and vice versa.
* If not sure, just leave it blank and press Enter/Return. This will select the default version.
[Input] Enter build version (eg. 10B329): 13A452
[Log] Checking firmware keys in ../saved/firmware/iPhone4,1/13A452
[Log] Checking URL in ../saved/firmware/iPhone4,1/13A452/url
[Log] iBSS
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 604ca9a4aca0dc1fb90b851a72b1724318b71387353ee95594858693eaa1cc8578f8b1e2ef631fd6699bf904d9e7c14e
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 604ca9a4aca0dc1fb90b851a72b1724318b71387353ee95594858693eaa1cc8578f8b1e2ef631fd6699bf904d9e7c14e
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 604ca9a4aca0dc1fb90b851a72b1724318b71387353ee95594858693eaa1cc8578f8b1e2ef631fd6699bf904d9e7c14e
[Log] iBEC
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 48d818c42d6af34f6df17b632be74731847aaf45a4f8ca24168a52f2fc4273884e3e486101703ae742d6d6f0559eaef9
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 48d818c42d6af34f6df17b632be74731847aaf45a4f8ca24168a52f2fc4273884e3e486101703ae742d6d6f0559eaef9
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 48d818c42d6af34f6df17b632be74731847aaf45a4f8ca24168a52f2fc4273884e3e486101703ae742d6d6f0559eaef9
[Log] DeviceTree
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 8396a6238977905748e9954b46c89583d80884cf88055e36010aab932d07f858f1504dd789eefa3d1c87bf1dd0443e6c
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 8396a6238977905748e9954b46c89583d80884cf88055e36010aab932d07f858f1504dd789eefa3d1c87bf1dd0443e6c
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 8396a6238977905748e9954b46c89583d80884cf88055e36010aab932d07f858f1504dd789eefa3d1c87bf1dd0443e6c
[Log] Kernelcache
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 2c0e2bbeb2bec3bcdde1ecfb7012a81342d41d2412acbea5b5881e9ee718bbdaca40d265412230652b58b513085f8b2a
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 2c0e2bbeb2bec3bcdde1ecfb7012a81342d41d2412acbea5b5881e9ee718bbdaca40d265412230652b58b513085f8b2a
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 2c0e2bbeb2bec3bcdde1ecfb7012a81342d41d2412acbea5b5881e9ee718bbdaca40d265412230652b58b513085f8b2a
[Log] RestoreRamdisk
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: d5346d366f6c80d8b1b8fc452074b81b03df1cc3a7c149544eb663d9cb043544bdab91275f98e908bbf0eb52dbb15885
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: d5346d366f6c80d8b1b8fc452074b81b03df1cc3a7c149544eb663d9cb043544bdab91275f98e908bbf0eb52dbb15885
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: d5346d366f6c80d8b1b8fc452074b81b03df1cc3a7c149544eb663d9cb043544bdab91275f98e908bbf0eb52dbb15885
[Log] Patch RestoreRamdisk
grew volume: 30000000
file: com.apple.springboard.plist (0644), size = 333
ignoring usr, type = 5
ignoring usr/bin, type = 5
file: usr/bin/gptfdisk (0755), size = 164368
file: usr/bin/du (0755), size = 178736
file: usr/bin/df (0755), size = 143296
file: usr/bin/nano (0755), size = 209008
file: usr/bin/date (0755), size = 140704
file: usr/bin/device_infos (0755), size = 75936
file: usr/bin/ibsspatch (0755), size = 51840
file: usr/bin/scp (0755), size = 49008
file: usr/bin/hfs_resize (0755), size = 12960
symlink: usr/bin/rnano (0777) -> nano
ignoring usr/libexec, type = 5
file: usr/libexec/sftp-server (0755), size = 44240
ignoring usr/lib, type = 5
symlink: usr/lib/libncursesw.dylib (0755) -> libncursesw.5.dylib
symlink: usr/lib/libncurses.5.dylib (0755) -> libncurses.5.4.dylib
file: usr/lib/libiconv.2.dylib (0755), size = 1022528
file: usr/lib/libncurses.5.4.dylib (0755), size = 335968
file: usr/lib/libhistory.6.0.dylib (0755), size = 54752
file: usr/lib/libreadline.6.0.dylib (0755), size = 198112
file: usr/lib/libcrypto.0.9.8.dylib (0755), size = 1604336
file: usr/lib/libncursesw.5.dylib (0755), size = 390032
ignoring bin, type = 5
file: bin/mount.sh (0755), size = 1366
file: bin/bash (0755), size = 546768
symlink: bin/sh (0777) -> bash
file: bin/dd (0755), size = 124896
file: bin/ls (0755), size = 152096
file: bin/cp (0755), size = 162560
file: bin/chown (0755), size = 125616
file: bin/chmod (0755), size = 125168
file: bin/tar (0755), size = 430304
ignoring sbin, type = 5
file: sbin/sshd (0755), size = 722848
file: sbin/umount (4755), size = 22784
ignoring private, type = 5
ignoring private/etc, type = 5
file: private/etc/rc.boot (0755), size = 369
directory: private/etc/ssh (0700)
file: private/etc/ssh/ssh_host_rsa_key (0600), size = 1675
file: private/etc/ssh/ssh_host_dsa_key.pub (0644), size = 590
file: private/etc/ssh/sshd_config (0644), size = 3227
file: private/etc/ssh/ssh_host_key.pub (0644), size = 627
file: private/etc/ssh/ssh_config (0644), size = 1526
file: private/etc/ssh/ssh_host_dsa_key (0600), size = 668
file: private/etc/ssh/ssh_host_rsa_key.pub (0644), size = 382
file: private/etc/ssh/moduli (0644), size = 125811
file: private/etc/ssh/ssh_host_key (0600), size = 963
ignoring private/var, type = 5
directory: private/var/root (0700)
file: private/var/root/.profile (0644), size = 391
[Log] Patch iBSS
main: Starting...
main: iBoot-2817 inputted.
patch_rsa_check: Entering...
find_bl_verify_shsh_generic: Entering...
find_bl_verify_shsh_generic: Found LDR instruction at 0x6066
find_bl_verify_shsh_generic: Found BL verify_shsh at 0x6392
find_bl_verify_shsh_generic: Leaving...
patch_rsa_check: Patching BL verify_shsh at 0x6392...
patch_rsa_check: Leaving...
main: Writing out patched file to iBSS.patched...
main: Quitting...
[Log] Patch iBEC
main: Starting...
main: iBoot-2817 inputted.
patch_boot_args: Entering...
patch_boot_args: Default boot-args string is at 0x3cf48
patch_boot_args: boot-args xref is at 0x1990c
patch_boot_args: Relocating boot-args string...
patch_boot_args: "Reliance on this certificate" string found at 0x41a04
patch_boot_args: Pointing default boot-args xref to 0x9ff41a04...
patch_boot_args: Applying custom boot-args "rd=md0 -v amfi=0xff amfi_get_out_of_my_way=1 cs_enforcement_disable=1 pio-error=0"
patch_boot_args: Found LDR R1, =boot_args at 0x1969a
patch_boot_args: Found IT instruction at 0x196ba
patch_boot_args: Found CMP Rx, #0 at 0x196b8
patch_boot_args: Found MOV R6, R1 at 0x196bc
patch_boot_args: Found LDR R6, =null_str at 0x196b6
patch_boot_args: Pointing LDR R6, =null_str to boot-args xref...
patch_boot_args: Leaving...
patch_debug_enabled: Entering...
find_dtre_get_value_bl_insn: Entering...
find_dtre_get_value_bl_insn: debug-enabled string is at 0x3c955
find_dtre_get_value_bl_insn: "debug-enabled" xref is at 0x1871c
find_dtre_get_value_bl_insn: Found LDR R0, ="debug-enabled" at 0x18700
find_dtre_get_value_bl_insn: Found BL instruction at 0x18722
find_dtre_get_value_bl_insn: Leaving...
patch_debug_enabled: Patching BL insn at 0x18722...
patch_debug_enabled: Leaving...
patch_rsa_check: Entering...
find_bl_verify_shsh_generic: Entering...
find_bl_verify_shsh_generic: Found LDR instruction at 0x17492
find_bl_verify_shsh_generic: Found BL verify_shsh at 0x17bc4
find_bl_verify_shsh_generic: Leaving...
patch_rsa_check: Patching BL verify_shsh at 0x17bc4...
patch_rsa_check: Leaving...
main: Writing out patched file to iBEC.patched...
main: Quitting...
[Log] Device seems to be already in pwned DFU mode
* Pwned: checkm8
[Log] Checking URL in ../saved/firmware/iPhone4,1/12H321/url
[Log] Checking firmware keys in ../saved/firmware/iPhone4,1/12H321
[Log] Decrypting iBSS...
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f
[Log] Patching iBSS...
main: Starting...
main: iBoot-2261 inputted.
patch_rsa_check: Entering...
find_bl_verify_shsh_generic: Entering...
find_bl_verify_shsh_generic: Found LDR instruction at 0x60ac
find_bl_verify_shsh_generic: Found BL verify_shsh at 0x6452
find_bl_verify_shsh_generic: Leaving...
patch_rsa_check: Patching BL verify_shsh at 0x6452...
patch_rsa_check: Leaving...
main: Writing out patched file to pwnediBSS...
main: Quitting...
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f
[Log] Pwned iBSS saved at: saved/iPhone4,1/pwnediBSS
[Log] Pwned iBSS img3 saved at: saved/iPhone4,1/pwnediBSS.dfu
[Log] Sending unpacked iBSS...
Acquiring device handle.
iBSS file found: pwnediBSS
Sending 0x10 bytes of data to device.
Sending 0x13000 bytes of data to device.
Releasing device handle.
[Log] Checking for device
[Log] Device should now be in pwned iBSS mode.
[Log] Sending iBEC...
[==================================================] 100.0%
[Log] Finding device in Recovery mode...
[Log] Found device in Recovery mode.
[Log] Sending ramdisk...
[==================================================] 100.0%
[Log] Running ramdisk
[Log] Sending DeviceTree...
[==================================================] 100.0%
[Log] Running devicetree
[Log] Sending KernelCache...
[==================================================] 100.0%
[Log] Booting, please wait...
[Log] Running iproxy for SSH...
[Log] iproxy PID: 7857
[Log] Waiting for device...
* You may need to unplug and replug your device.
kex_exchange_identification: read: Connection reset by peer
Connection reset by 127.0.0.1 port 6414
Connection closed by 127.0.0.1 port 6414
Warning: Permanently added '[127.0.0.1]:6414' (RSA) to the list of known hosts.
[Log] Device should now boot to SSH ramdisk mode.
* Mount filesystems with this command:
mount.sh
* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/SSH-Ramdisk
* For accessing data, note the following:
* Host: sftp://127.0.0.1 | User: root | Password: alpine | Port: 6414
* Other Useful SSH Ramdisk commands:
* Clear NVRAM with this command:
nvram -c
* Erase All Content and Settings with this command (iOS 9+ only):
nvram oblit-inprogress=5
* To reboot, use this command:
reboot_bak
* SSH Ramdisk Menu
[Input] Select an option:
-> Connect to SSH
Dump Blobs
Dump Baseband/Activation
Erase All (iOS 7 and 8)
Erase All (iOS 9+)
Disable/Enable Exploit
Clear NVRAM
Get iOS Version
Update DateTime
Reboot Device
Exit
[Log] Use the "exit" command to go back to SSH Ramdisk Menu
Warning: Permanently added '[127.0.0.1]:6414' (RSA) to the list of known hosts.
Use mount.sh script to mount the partitions
Use reboot_bak to reboot
Use 'device_infos' to dump EMF keys (when imaging user volume)
-sh-4.0# mount.sh
/bin/mount.sh: line 26: cannot create temp file for here-document: Read-only file system
Waiting for disks...
Mounting /dev/disk0s1s1 on /mnt1
mount_hfs: Could not create property for re-key environment check: No such file or directory
Mounting /dev/disk0s1s2 on /mnt2
mount_hfs: Could not create property for re-key environment check: No such file or directory
-sh-4.0# ls -la /mnt2/tmp
total 100
drwxrwxrwt 4 root wheel 374 Apr 1 09:10 .
drwxr-xr-x 25 root wheel 986 Mar 25 18:36 ..
drwx------ 2 mobile wheel 102 Dec 2 2025 MediaCache
-rw-r--r-- 1 _wireless wheel 0 Dec 2 2025 abm.shutdown
-rw-r--r-- 1 root wheel 93200 Apr 1 09:10 bruteforce
-rw-rw-rw- 1 mobile wheel 181 Apr 1 09:01 com.apple.audio.hogmode.plist
drwx------ 2 mobile wheel 68 Apr 1 09:01 com.apple.tccd
-rw-r--r-- 1 mobile wheel 51 Dec 2 2025 com.apple.timed.plist
-rw------- 1 _wireless wheel 0 Apr 1 09:01 csilock
-rw-r--r-- 1 _wireless wheel 0 Dec 2 2025 ct.shutdown
-rw-r--r-- 1 _wireless wheel 0 Apr 1 09:01 libETL.log
-sh-4.0# chmod +x /mnt2/tmp/bruteforce
-sh-4.0# time /mnt2/tmp/bruteforce -u
Writing results to (null).plist
keyboardType=0
0000
0001
...
1006
1007
Found passcode : 1007
Keybag version : 4
Keybag keys : 11
Class Wrap Key
12 0 189d822afd022a8bf63c094a0963744f7464a0ff8b7c003c0fa84dabb9d3e0cb
11 0 59fc7da999bcfe5b2d38ad48f3e57c814786380e91305bd02052b0be8a6950a0
10 0 b4039d0d208ff90d829b814f3b6e9fc958407e83f5b24f447fc8af2782ca579d
9 0 e5978ddadc6a263cef37b2bded8d0eb1c677f929c02665afef9b2a43f17fec9d
8 0 dd6cb07d58d6e493f086c1ecfd7006b82b86daf60f57ce18f6d4201bfd90a6ef
7 0 de58400e3447621685d1468661d8adf01fc3b518569ecf9d50732412a3cec22f
6 0 d6714e6373f44a7e96aafb5df7542adf4521fa23432c06c336e363f68863347c
5 0 a28e0ec0f2ff6718060f6e9a8d01aa19fa75468ab6af8b3c065c63abe1b26d7b
3 0 04cffa61f99fc1ea3a094c961151a3fa13a864c7f38f59c7e0b57be32b59eb2d
2 0 89ca0f676be097de9dd17f40af966a0795ffdbfa0ab5093eb40fa61d5d8542ab
1 0 e0d59e87918fdd47f0c9d755f2e28f0e4c08dc5238c599b9c884728ce1e053e3
Nemůžete odesílat nové téma do tohoto fóra. Nemůžete odpovídat na témata v tomto fóru. Nemůžete upravovat své příspěvky v tomto fóru. Nemůžete mazat své příspěvky v tomto fóru. Nemůžete hlasovat v tomto fóru. Nemůžete připojovat soubory k příspěvkům Můžete stahovat a prohlížet přiložené soubory
Informace na portálu Elektro bastlírny jsou prezentovány za účelem vzdělání čtenářů a rozšíření zájmu o elektroniku. Autoři článků na serveru neberou žádnou zodpovědnost za škody vzniklé těmito zapojeními. Rovněž neberou žádnou odpovědnost za případnou újmu na zdraví vzniklou úrazem elektrickým proudem. Autoři a správci těchto stránek nepřejímají záruku za správnost zveřejněných materiálů. Předkládané informace a zapojení jsou zveřejněny bez ohledu na případné patenty třetích osob. Nároky na odškodnění na základě změn, chyb nebo vynechání jsou zásadně vyloučeny. Všechny registrované nebo jiné obchodní známky zde použité jsou majetkem jejich vlastníků. Uvedením nejsou zpochybněna z toho vyplývající vlastnická práva. Použití konstrukcí v rozporu se zákonem je přísně zakázáno. Vzhledem k tomu, že původ předkládaných materiálů nelze žádným způsobem dohledat, nelze je použít pro komerční účely! Tento nekomerční server nemá z uvedených zapojení či konstrukcí žádný zisk. Nezodpovídáme za pravost předkládaných materiálů třetími osobami a jejich původ. V případě, že zjistíte porušení autorského práva či jiné nesrovnalosti, kontaktujte administrátory na diskuzním fóru EB.
FAQ
Hledat
Uživatelské skupiny
Profil
Soukromé zprávy
Přihlášení
