|
|
@@ -20,6 +20,8 @@
|
|
|
#include <mach/mach_types.h>
|
|
|
#include <sys/stat.h>
|
|
|
#import <Foundation/Foundation.h>
|
|
|
+#import "NSData+GZip.h"
|
|
|
+#include <sys/spawn.h>
|
|
|
|
|
|
NSFileManager *fileMgr;
|
|
|
|
|
|
@@ -83,6 +85,32 @@ int makeShitHappen(ViewController *view) {
|
|
|
[fileMgr removeItemAtPath:@"/meridian" error:nil];
|
|
|
}
|
|
|
|
|
|
+
|
|
|
+ if (file_exists("/meridian/.bootstrap") == 0) {
|
|
|
+
|
|
|
+ unlink("/meridian/.bootstrap");
|
|
|
+
|
|
|
+ }
|
|
|
+
|
|
|
+ if (file_exists("/Library/LaunchDaemons/._dropbear.plist") == 0) {
|
|
|
+
|
|
|
+ unlink("/Library/LaunchDaemons/._dropbear.plist");
|
|
|
+
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+// if (file_exists("/usr/lib/TweakInject.dylib") == 0) {
|
|
|
+// ret = unlink("/usr/lib/TweakInject.dylib");
|
|
|
+// if (ret != 0) {
|
|
|
+// [view writeText:@"failed!"];
|
|
|
+// [view writeTextPlain:@"removing /usr/lib/TweakInject.dylib failed with error %d: %s", errno, strerror(errno)];
|
|
|
+// return 1;
|
|
|
+// }
|
|
|
+//
|
|
|
+// }
|
|
|
+
|
|
|
if (file_exists("/meridian") != 0) {
|
|
|
ret = mkdir("/meridian", 0755);
|
|
|
if (ret != 0) {
|
|
|
@@ -177,7 +205,7 @@ int makeShitHappen(ViewController *view) {
|
|
|
touch_file("/.cydia_no_stash");
|
|
|
|
|
|
// symlink /Library/MobileSubstrate/DynamicLibraries -> /usr/lib/tweaks
|
|
|
- setUpSymLinks();
|
|
|
+ //setUpSymLinks();
|
|
|
|
|
|
// remove Substrate's SafeMode (MobileSafety) if it's installed
|
|
|
// removing from dpkg will be handled by Cydia conflicts later
|
|
|
@@ -222,9 +250,15 @@ int makeShitHappen(ViewController *view) {
|
|
|
return 1;
|
|
|
}
|
|
|
|
|
|
+
|
|
|
+
|
|
|
[view writeText:@"done!"];
|
|
|
}
|
|
|
|
|
|
+ //unlink("/usr/lib/libjailbreak.dylib");
|
|
|
+ //cp("/usr/lib/libjailbreak.dylib","/electra/libjailbreak.dylib");
|
|
|
+
|
|
|
+ /*
|
|
|
// add the midnight repo
|
|
|
if (file_exists("/etc/apt/sources.list.d/meridian.list") != 0) {
|
|
|
FILE *fd = fopen("/etc/apt/sources.list.d/meridian.list", "w+");
|
|
|
@@ -232,6 +266,19 @@ int makeShitHappen(ViewController *view) {
|
|
|
fwrite(text, strlen(text) + 1, 1, fd);
|
|
|
fclose(fd);
|
|
|
}
|
|
|
+ */
|
|
|
+
|
|
|
+ pid_t pd;
|
|
|
+ posix_spawn(&pd, "/bin/bash", NULL, NULL, (char **)&(const char*[]){ "bash", "/usr/libexec/nito/firmware.sh", NULL }, NULL);
|
|
|
+ waitpid(pd, NULL, 0);
|
|
|
+
|
|
|
+ posix_spawn(&pd, "/bin/bash", NULL, NULL, (char **)&(const char*[]){ "bash", "/Library/dpkg/info/openssh.postinst", NULL }, NULL);
|
|
|
+ waitpid(pd, NULL, 0);
|
|
|
+
|
|
|
+// posix_spawn(&pd, "/bin/launchctl", NULL, NULL, (char **)&(const char*[]){ "launchctl", "load", "/Library/LaunchDaemons/com.openssh.sshd.plist", NULL }, NULL);
|
|
|
+// waitpid(pd, NULL, 0);
|
|
|
+
|
|
|
+ //fixPerms();
|
|
|
|
|
|
// launch dropbear
|
|
|
[view writeText:@"launching dropbear..."];
|
|
|
@@ -241,12 +288,39 @@ int makeShitHappen(ViewController *view) {
|
|
|
[view writeTextPlain:@"exit code: %d", ret];
|
|
|
return 1;
|
|
|
}
|
|
|
+
|
|
|
+
|
|
|
+ //launch openssh
|
|
|
+
|
|
|
+ [view writeText:@"Launching openssh..."];
|
|
|
+ ret = start_launchdaemon("/Library/LaunchDaemons/com.openssh.sshd.plist");
|
|
|
+ if (ret != 0) {
|
|
|
+ [view writeText:@"failed!"];
|
|
|
+ [view writeTextPlain:@"exit code: %d", ret];
|
|
|
+ //return 1;
|
|
|
+ }
|
|
|
+
|
|
|
[view writeText:@"done!"];
|
|
|
|
|
|
// link substitute stuff
|
|
|
- setUpSubstitute();
|
|
|
+ //setUpSubstitute();
|
|
|
|
|
|
// start jailbreakd
|
|
|
+
|
|
|
+ ret = inject_trust("/electra/inject_criticald");
|
|
|
+ //ret = inject_trust("/electra/amfid_payload.dylib");
|
|
|
+ //ret = inject_trust("/electra/pspawn_payload.dylib");
|
|
|
+ //ret = inject_trust("/electra/libjailbreak.dylib");
|
|
|
+ /*
|
|
|
+ "/electra/inject_criticald",
|
|
|
+ "/electra/amfid_payload.dylib",
|
|
|
+ "/electra/pspawn_payload.dylib",
|
|
|
+ "/electra/libjailbreak.dylib"
|
|
|
+
|
|
|
+ */
|
|
|
+ //if (ret != 0) return -1;
|
|
|
+
|
|
|
+
|
|
|
[view writeText:@"starting jailbreakd..."];
|
|
|
ret = startJailbreakd();
|
|
|
if (ret != 0) {
|
|
|
@@ -281,6 +355,27 @@ int makeShitHappen(ViewController *view) {
|
|
|
return 0;
|
|
|
}
|
|
|
|
|
|
+void fixPerms() {
|
|
|
+
|
|
|
+ int rv = execprog("/usr/bin/chmod", (const char **)&(const char*[]) {
|
|
|
+ "/usr/bin/chmod",
|
|
|
+ "-R",
|
|
|
+ "0700",
|
|
|
+ "/private/var/root/.ssh",
|
|
|
+ NULL
|
|
|
+ });
|
|
|
+
|
|
|
+ rv = execprog("/usr/bin/chmod", (const char **)&(const char*[]) {
|
|
|
+ "/usr/bin/chmod",
|
|
|
+ "-R",
|
|
|
+ "0700",
|
|
|
+ "/private/etc/dropbear",
|
|
|
+ NULL
|
|
|
+ });
|
|
|
+
|
|
|
+
|
|
|
+}
|
|
|
+
|
|
|
kern_return_t callback(task_t kern_task, kptr_t kbase, void *cb_data) {
|
|
|
tfp0 = kern_task;
|
|
|
kernel_base = kbase;
|
|
|
@@ -339,7 +434,9 @@ int remountRootFs() {
|
|
|
}
|
|
|
|
|
|
int extractMeridianData() {
|
|
|
- return extract_bundle_tar("meridian-bootstrap.tar");
|
|
|
+ int rv = extract_bundle_tar("meridian-bootstrap.tar");
|
|
|
+ //rv = extract_bundle_tar("basebinaries.tar");
|
|
|
+ return rv;
|
|
|
}
|
|
|
|
|
|
void setUpSymLinks() {
|
|
|
@@ -382,7 +479,38 @@ void setUpSymLinks() {
|
|
|
symlink("/usr/lib/tweaks", "/Library/MobileSubstrate/DynamicLibraries");
|
|
|
}
|
|
|
|
|
|
+void extractGz(const char *from, const char *to) {
|
|
|
+ NSData *gz = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@(from) ofType:@"gz"]];
|
|
|
+ NSData *extracted = [gz gunzippedData];
|
|
|
+ [extracted writeToFile:@(to) atomically:YES];
|
|
|
+}
|
|
|
+
|
|
|
int extractBootstrap(int *exitCode) {
|
|
|
+
|
|
|
+ int rv;
|
|
|
+
|
|
|
+ unlink("/meridian/bootstrap.tar");
|
|
|
+
|
|
|
+ extractGz("bootstrap.tar", "/meridian/bootstrap.tar");
|
|
|
+
|
|
|
+ rv = extract_tar("/meridian/bootstrap.tar");
|
|
|
+ if (rv != 0) {
|
|
|
+ *exitCode = rv;
|
|
|
+ return 1; //FIXME: make sure this is working later.
|
|
|
+ }
|
|
|
+
|
|
|
+// rv = uicache();
|
|
|
+// if (rv != 0) {
|
|
|
+// *exitCode = rv;
|
|
|
+// return 6;
|
|
|
+// }
|
|
|
+
|
|
|
+ touch_file("/meridian/.bootstrap");
|
|
|
+
|
|
|
+ return 0;
|
|
|
+}
|
|
|
+
|
|
|
+int old_extractBootstrap(int *exitCode) {
|
|
|
int rv;
|
|
|
|
|
|
// extract system-base.tar
|
|
|
@@ -421,7 +549,7 @@ int extractBootstrap(int *exitCode) {
|
|
|
return 5;
|
|
|
}
|
|
|
|
|
|
- enableHiddenApps();
|
|
|
+ //enableHiddenApps();
|
|
|
|
|
|
touch_file("/meridian/.bootstrap");
|
|
|
|
|
|
@@ -434,6 +562,34 @@ int extractBootstrap(int *exitCode) {
|
|
|
return 0;
|
|
|
}
|
|
|
|
|
|
+int newdefecateAmfi() {
|
|
|
+
|
|
|
+#define BinaryLocation "/electra/inject_criticald"
|
|
|
+
|
|
|
+ pid_t amfid_pid = get_pid_for_name("amfid");
|
|
|
+ if (amfid_pid == 0) {
|
|
|
+ return -2;
|
|
|
+ }
|
|
|
+
|
|
|
+ pid_t pd;
|
|
|
+ int rv = 0;
|
|
|
+
|
|
|
+ const char* args_amfid[] = {BinaryLocation, itoa(amfid_pid), "/electra/amfid_payload.dylib", NULL};
|
|
|
+ rv = posix_spawn(&pd, BinaryLocation, NULL, NULL, (char **)&args_amfid, NULL);
|
|
|
+ waitpid(pd, NULL, 0);
|
|
|
+
|
|
|
+ unlink("/.amfid_success");
|
|
|
+ const char *args_helloworld[] = {"helloworld", NULL};
|
|
|
+ rv = posix_spawn(&pd, "/electra/helloworld", NULL, NULL, (char **)&args_helloworld, NULL);
|
|
|
+ waitpid(pd, NULL, 0);
|
|
|
+
|
|
|
+ if (!file_exists("/.amfid_success")){
|
|
|
+ return -3;
|
|
|
+ }
|
|
|
+ unlink("/.amfid_success");
|
|
|
+ return 0;
|
|
|
+}
|
|
|
+
|
|
|
int defecateAmfi() {
|
|
|
// write kslide to file
|
|
|
unlink("/meridian/kernel_slide");
|
|
|
@@ -441,10 +597,15 @@ int defecateAmfi() {
|
|
|
fprintf(fd, "%016llx", kslide);
|
|
|
fclose(fd);
|
|
|
|
|
|
+ int ret = inject_trust("/meridian/inject_criticald");
|
|
|
+ if (ret != 0) return -1;
|
|
|
+
|
|
|
+
|
|
|
// trust our payload
|
|
|
- int ret = inject_trust("/meridian/amfid_payload.dylib");
|
|
|
+ ret = inject_trust("/meridian/amfid_payload.dylib");
|
|
|
if (ret != 0) return -1;
|
|
|
|
|
|
+
|
|
|
unlink("/var/tmp/amfid_payload.alive");
|
|
|
|
|
|
pid_t pid = get_pid_for_name("amfid");
|
|
|
@@ -471,7 +632,7 @@ int defecateAmfi() {
|
|
|
}
|
|
|
|
|
|
int launchDropbear() {
|
|
|
- return start_launchdaemon("/meridian/dropbear/dropbear.plist");
|
|
|
+ return start_launchdaemon("/Library/LaunchDaemons/dropbear.plist");
|
|
|
}
|
|
|
|
|
|
void setUpSubstitute() {
|
|
|
@@ -484,6 +645,35 @@ void setUpSubstitute() {
|
|
|
symlink("/usr/lib/libsubstrate.dylib", "/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate");
|
|
|
}
|
|
|
|
|
|
+int start_jailbreakd() {
|
|
|
+ unlink("/var/tmp/jailbreakd.pid");
|
|
|
+ unlink("/var/run/jailbreakd.pid");
|
|
|
+ unlink("/var/log/jailbreakd-stderr.log");
|
|
|
+ unlink("/var/log/jailbreakd-stdout.log");
|
|
|
+
|
|
|
+ NSData *blob = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"jailbreakd" ofType:@"plist"]];
|
|
|
+ NSMutableDictionary *job = [NSPropertyListSerialization propertyListWithData:blob options:NSPropertyListMutableContainers format:nil error:nil];
|
|
|
+
|
|
|
+ job[@"EnvironmentVariables"][@"KernelBase"] = [NSString stringWithFormat:@"0x%16llx", kernel_base];
|
|
|
+ [job writeToFile:@"/Library/LaunchDaemons/jailbreakd.plist" atomically:YES];
|
|
|
+ chmod("/Library/LaunchDaemons/jailbreakd.plist", 0644);
|
|
|
+ chown("/Library/LaunchDaemons/jailbreakd.plist", 0, 0);
|
|
|
+
|
|
|
+ pid_t pid = 0;
|
|
|
+
|
|
|
+ //int rv = run("/bin/launchctl load /Library/LaunchDaemons/jailbreakd.plist");
|
|
|
+ int rv = start_launchdaemon("/Library/LaunchDaemons/jailbreakd.plist");
|
|
|
+ if (rv == -1) {
|
|
|
+ return -1;
|
|
|
+ }
|
|
|
+
|
|
|
+ int ex = 0;
|
|
|
+ waitpid(pid, &ex, 0);
|
|
|
+ NSLog(@"The dragon becomes me!");
|
|
|
+ NSLog(@"once it is drawn, it cannot be sheathed without causing death");
|
|
|
+ return 0;
|
|
|
+}
|
|
|
+
|
|
|
int startJailbreakd() {
|
|
|
unlink("/var/tmp/jailbreakd.pid");
|
|
|
|
|
|
@@ -514,6 +704,7 @@ int startJailbreakd() {
|
|
|
|
|
|
usleep(100000);
|
|
|
|
|
|
+
|
|
|
// tell jailbreakd to platformize launchd
|
|
|
// this adds skip-lib-val to MACF slot and allows us
|
|
|
// to inject pspawn without it being in trust cache
|
|
|
@@ -523,8 +714,18 @@ int startJailbreakd() {
|
|
|
|
|
|
// inject pspawn_hook.dylib to launchd
|
|
|
rv = inject_library(1, "/usr/lib/pspawn_hook.dylib");
|
|
|
+ //rv = inject_library(1, "/meridian/pspawn_payload.dylib");
|
|
|
if (rv != 0) return 3;
|
|
|
|
|
|
+ /*
|
|
|
+ rv = execprog("/meridian/inject_criticald", (const char **)&(const char*[]) {
|
|
|
+ "/meridian/inject_criticald",
|
|
|
+ "1",
|
|
|
+ "/meridian/pspawn_payload.dylib",
|
|
|
+ NULL
|
|
|
+ });
|
|
|
+ if (rv != 0) return 3;
|
|
|
+ */
|
|
|
return 0;
|
|
|
}
|
|
|
|