Browse Source

theoretically electra should print out some logs to our shiny console text view that we got for free by merging it in to the original meridian project, still needs testing

Kevin Bradley 5 years ago
parent
commit
d68521a64d

+ 2 - 2
Meridian/Meridian/views/ViewController.h

@@ -19,8 +19,8 @@
 + (instancetype)currentViewController;
 - (void)removingLiberiOS;
 - (void)removingElectraBeta;
-- (void)installingCydia;
-- (void)cydiaDone;
+- (void)installingNitoTV;
+- (void)nitoTVDone;
 - (void)displaySnapshotNotice;
 - (void)displaySnapshotWarning;
 

BIN
Meridian/meridian.xcodeproj/project.xcworkspace/xcuserdata/kevinbradley.xcuserdatad/UserInterfaceState.xcuserstate


+ 4 - 4
Meridian/meridian.xcodeproj/xcuserdata/kevinbradley.xcuserdatad/xcschemes/xcschememanagement.plist

@@ -7,17 +7,17 @@
 		<key>Meridian.xcscheme</key>
 		<dict>
 			<key>orderHint</key>
-			<integer>0</integer>
+			<integer>1</integer>
 		</dict>
 		<key>amfid.xcscheme</key>
 		<dict>
 			<key>orderHint</key>
-			<integer>1</integer>
+			<integer>0</integer>
 		</dict>
 		<key>jailbreakd.xcscheme</key>
 		<dict>
 			<key>orderHint</key>
-			<integer>3</integer>
+			<integer>2</integer>
 		</dict>
 		<key>meridianTV.xcscheme</key>
 		<dict>
@@ -27,7 +27,7 @@
 		<key>pspawn_hook.xcscheme</key>
 		<dict>
 			<key>orderHint</key>
-			<integer>2</integer>
+			<integer>3</integer>
 		</dict>
 	</dict>
 </dict>

+ 2 - 2
Meridian/meridianTV/ViewController.h

@@ -29,8 +29,8 @@
 + (instancetype)currentViewController;
 - (void)removingLiberiOS;
 - (void)removingElectraBeta;
-- (void)installingCydia;
-- (void)cydiaDone;
+- (void)installingNitoTV;
+- (void)nitoTVDone;
 - (void)displaySnapshotNotice;
 - (void)displaySnapshotWarning;
 - (void)writeText:(NSString *)message;

+ 7 - 4
Meridian/meridianTV/ViewController.m

@@ -649,19 +649,22 @@ void log_message(NSString *message) {
 
 - (void)removingLiberiOS {
     dispatch_async(dispatch_get_main_queue(), ^{
-        [self.goButton setTitle:@"Removing liberiOS" forState:UIControlStateNormal];
+        //[self.goButton setTitle:@"Removing liberiOS" forState:UIControlStateNormal];
+        [self writeText:@"Removing liberiOS"];
     });
 }
 
 - (void)removingElectraBeta {
     dispatch_async(dispatch_get_main_queue(), ^{
-        [self.goButton setTitle:@"Removing beta" forState:UIControlStateNormal];
+        //[self.goButton setTitle:@"Removing beta" forState:UIControlStateNormal];
+         [self writeText:@"Removing beta"];
     });
 }
 
-- (void)installingCydia {
+- (void)installingNitoTV {
     dispatch_async(dispatch_get_main_queue(), ^{
-        [self.goButton setTitle:@"Installing Cydia" forState:UIControlStateNormal];
+        //[self.goButton setTitle:@"Installing Cydia" forState:UIControlStateNormal];
+        [self writeText:@"Installing nitoTV"];
     });
 }
 

+ 5 - 4
Meridian/meridianTV/electra/the fun part/bootstrap.c

@@ -51,7 +51,7 @@ void copy_basebinaries() {
     posix_spawn(&pd, tar, NULL, NULL, (char **)&(const char*[]){ tar, "-xpf", progname("basebinaries.tar"), "-C", "/electra", NULL }, NULL);
     waitpid(pd, NULL, 0);
     
-    printf("[bootstrapper] copied the required binaries into the right places\n");
+    writeMessage("[bootstrapper] copied the required binaries into the right places\n");
     
     inject_trusts(4, (const char **)&(const char*[]){
         "/electra/inject_criticald",
@@ -82,7 +82,7 @@ void extract_bootstrap() {
     }
     close(bootstrapped);
     
-    installingCydia();
+    installingNitoTV();
     
     extractGz("bootstrap.tar", "/electra/bootstrap.tar");
     
@@ -121,7 +121,8 @@ void extract_bootstrap() {
     rv = open("/var/mobile/Library/Preferences/.kickstart",O_RDWR|O_CREAT);
     close(rv);
     
-    printf("[bootstrapper] extracted bootstrap to / \n");
+    //printf("[bootstrapper] extracted bootstrap to / \n");
+    writeMessage("[bootstrapper] extracted bootstrap to / \n");
     post_bootstrap(true);
 }
 
@@ -185,6 +186,6 @@ void post_bootstrap(const bool runUICache) {
     printf("[bootstrapper] device has been bootstrapped!\n");
     
     if (runUICache){
-        cydiaDone();
+        nitoTVDone();
     }
 }

+ 29 - 28
Meridian/meridianTV/electra/the fun part/fun.c

@@ -25,6 +25,7 @@
 #include "topangadetect.h"
 #include "unliberios.h"
 #include "removeElectrabeta.h"
+#include "fun_objc.h"
 
 mach_port_t tfpzero;
 
@@ -60,7 +61,7 @@ int begin_fun(mach_port_t tfp0, mach_port_t user_client, bool enable_tweaks) {
     uint64_t kernel_base_electra = find_kernel_base();
 	uint64_t slide = kernel_base_electra - 0xFFFFFFF007004000;
 	printf("slide: 0x%016llx\n", slide);
-	
+    writeMessagePlain("slide: 0x%016llx\n", slide);
 	// From v0rtex - get the IOSurfaceRootUserClient port, and then the address of the actual client, and vtable
 	uint64_t IOSurfaceRootUserClient_port = find_port_address_electra(user_client, MACH_MSG_TYPE_MAKE_SEND); // UserClients are just mach_ports, so we find its address
 	uint64_t IOSurfaceRootUserClient_addr = rk64_electra(IOSurfaceRootUserClient_port + koffset(KSTRUCT_OFFSET_IPC_PORT_IP_KOBJECT)); // The UserClient itself (the C++ object) is at the kobject field
@@ -71,23 +72,23 @@ int begin_fun(mach_port_t tfp0, mach_port_t user_client, bool enable_tweaks) {
 	
 	// Create the vtable in the kernel memory, then copy the existing vtable into there
 	uint64_t fake_vtable = kalloc(0x1000);
-	printf("Created fake_vtable at %016llx\n", fake_vtable);
+	writeMessagePlain("Created fake_vtable at %016llx\n", fake_vtable);
 	
 	for (int i = 0; i < 0x200; i++) {
 		wk64_electra(fake_vtable+i*8, rk64_electra(IOSurfaceRootUserClient_vtab+i*8));
 	}
 	
-	printf("Copied some of the vtable over\n");
+	writeMessagePlain("Copied some of the vtable over\n");
 	
 	// Create the fake user client
 	uint64_t fake_client = kalloc(0x1000);
-	printf("Created fake_client at %016llx\n", fake_client);
+	writeMessagePlain("Created fake_client at %016llx\n", fake_client);
 	
 	for (int i = 0; i < 0x200; i++) {
 		wk64_electra(fake_client+i*8, rk64_electra(IOSurfaceRootUserClient_addr+i*8));
 	}
 	
-	printf("Copied the user client over\n");
+	writeMessagePlain("Copied the user client over\n");
 	
 	// Write our fake vtable into the fake user client
 	wk64_electra(fake_client, fake_vtable);
@@ -100,7 +101,7 @@ int begin_fun(mach_port_t tfp0, mach_port_t user_client, bool enable_tweaks) {
 	// Replace IOUserClient::getExternalTrapForIndex with our ROP gadget (add x0, x0, #0x40; ret;)
 	wk64_electra(fake_vtable+8*0xB7, find_add_x0_x0_0x40_ret());
 	
-	printf("Wrote the `add x0, x0, #0x40; ret;` gadget over getExternalTrapForIndex\n");
+	writeMessagePlain("Wrote the `add x0, x0, #0x40; ret;` gadget over getExternalTrapForIndex\n");
 	
 	// When calling IOConnectTrapX, this makes a call to iokit_user_client_trap, which is the user->kernel call (MIG). This then calls IOUserClient::getTargetAndTrapForIndex
 	// to get the trap struct (which contains an object and the function pointer itself). This function calls IOUserClient::getExternalTrapForIndex, which is expected to return a trap.
@@ -143,25 +144,25 @@ do { \
 		} else if (pid == 0) {
 			kern_proc = proc;
         } else if (pid == 1){
-            printf("found launchd\n");
+            writeMessagePlain("found launchd\n");
             
             uint32_t csflags = rk32_electra(proc + offsetof_p_csflags);
             wk32_electra(proc + offsetof_p_csflags, (csflags | CS_PLATFORM_BINARY | CS_INSTALLER | CS_GET_TASK_ALLOW) & ~(CS_RESTRICT | CS_HARD));
 		} else if (strstr(name, "amfid")) {
-			printf("found amfid - getting task\n");
+			writeMessagePlain("found amfid - getting task\n");
             amfid_proc = proc;
             amfid_pid = pid;
             
             uint32_t csflags = rk32_electra(proc + offsetof_p_csflags);
             wk32_electra(proc + offsetof_p_csflags, (csflags | CS_PLATFORM_BINARY | CS_INSTALLER | CS_GET_TASK_ALLOW) & ~(CS_RESTRICT | CS_HARD));
         } else if (strstr(name, "cfprefsd")){
-            printf("found cfprefsd. keeping PID\n");
+            writeMessagePlain("found cfprefsd. keeping PID\n");
             cfprefsd_pid = pid;
         } else if (strstr(name, "backboardd")){
-            printf("found backboardd. keeping PID\n");
+            writeMessagePlain("found backboardd. keeping PID\n");
             backboardd_pid = pid;
         } else if (strstr(name, "jailbreakd")){
-            printf("found jailbreakd. already jailbroken!\n");
+            writeMessagePlain("found jailbreakd. already jailbroken!\n");
             found_jailbreakd = true;
         }
 		proc = rk64_electra(proc);
@@ -172,8 +173,8 @@ do { \
         return -1;
     }
 	
-	printf("our proc is at 0x%016llx\n", our_proc);
-	printf("kern proc is at 0x%016llx\n", kern_proc);
+	writeMessagePlain("our proc is at 0x%016llx\n", our_proc);
+	writeMessagePlain("kern proc is at 0x%016llx\n", kern_proc);
 	
 	// Properly copy the kernel's credentials so setuid(0) doesn't crash
 	uint64_t kern_ucred = 0;
@@ -187,15 +188,15 @@ do { \
 	
 	setuid(0);
 	
-	printf("our uid is %d\n", getuid());
+	writeMessagePlain("our uid is %d\n", getuid());
 	
     // Test writing to file
     {
         FILE *f = fopen("/var/mobile/test.txt", "w");
         if (f == 0) {
-            printf("failed to write test file");
+            writeMessagePlain("failed to write test file");
         } else {
-            printf("wrote test file: %p\n", f);
+            writeMessagePlain("wrote test file: %p\n", f);
         }
         
         unlink("/var/mobile/test.txt");
@@ -207,7 +208,7 @@ do { \
         if (remap_tfp0_set_hsp4(&real_tfp0)) {
             real_tfp0 = MACH_PORT_NULL;
         }
-        printf("remapped tfp0: 0x%x\n", real_tfp0);
+        writeMessagePlain("remapped tfp0: 0x%x\n", real_tfp0);
     }
 
 	// Remount / as rw - patch by xerub with nosuid patch added by coolstar
@@ -224,7 +225,7 @@ do { \
 		
 		char *nmz = strdup("/dev/disk0s1s1");
                 int rv = mount("apfs", "/", MNT_UPDATE, (void *)&nmz);
-		printf("remounting: %d\n", rv);
+		writeMessagePlain("remounting: %d\n", rv);
 		
 		v_mount = rk64_electra(rootfs_vnode + offsetof_v_mount);
 		wk32_electra(v_mount + offsetof_mnt_flag, v_flag);
@@ -233,7 +234,7 @@ do { \
 		if (fd == -1) {
 			fd = creat("/.bit_of_fun", 0644);
 		} else {
-			printf("File already exists!\n");
+			writeMessagePlain("File already exists!\n");
 		}
 		close(fd);
 	}
@@ -283,14 +284,14 @@ do { \
         removingElectraBeta();
         removeElectraBeta();
         
-        printf("APFS Snapshots: \n");
-        printf("=========\n");
+        writeMessagePlain("APFS Snapshots: \n");
+        writeMessagePlain("=========\n");
         list_snapshots("/");
-        printf("=========\n");
+        writeMessagePlain("=========\n");
         
         int snapshot = check_snapshot("/", "electra-prejailbreak");
         if (snapshot == 1){
-            printf("Snapshot exists!\n");
+            writeMessagePlain("Snapshot exists!\n");
         } else if (snapshot == 0){
             rename("/electra/createSnapshot", "/createSnapshot");
             rv = posix_spawn(&pd, "/electra/rm", NULL, NULL, (char **)&(const char*[]){ "rm", "-rf", "/electra", NULL }, NULL);
@@ -299,11 +300,11 @@ do { \
             rv = posix_spawn(&pd, "/createSnapshot", NULL, NULL, (char **)&(const char*[]){ "createSnapshot", NULL }, NULL);
             waitpid(pd, NULL, 0);
             
-            printf("APFS Snapshots: \n");
+            writeMessagePlain("APFS Snapshots: \n");
             
-            printf("=========\n");
+            writeMessagePlain("=========\n");
             list_snapshots("/");
-            printf("=========\n");
+            writeMessagePlain("=========\n");
             
             snapshot = check_snapshot("/", "electra-prejailbreak");
             if (snapshot != 1){
@@ -342,11 +343,11 @@ do { \
     
     wk64_electra(IOSurfaceRootUserClient_port + koffset(KSTRUCT_OFFSET_IPC_PORT_IP_KOBJECT), IOSurfaceRootUserClient_addr);
     
-    printf("Starting server...\n");
+    writeMessagePlain("Starting server...\n");
     start_jailbreakd(kernel_base_electra);
 
     while (!file_exists_electra("/var/run/jailbreakd.pid")){
-        printf("Waiting for jailbreakd...\n");
+        writeMessagePlain("Waiting for jailbreakd...\n");
         usleep(100000); //100 ms
     }
 

+ 4 - 3
Meridian/meridianTV/electra/the fun part/fun_objc.h

@@ -16,10 +16,11 @@ void startDaemons(void);
 void displaySnapshotWarning(void);
 void displaySnapshotNotice(void);
 
+void writeMessage(char *message);
 void removingLiberiOS(void);
 void removingElectraBeta(void);
-void installingCydia(void);
-void cydiaDone(void);
-
+void installingNitoTV(void);
+void nitoTVDone(void);
+void writeMessagePlain(char *message, ...);
 void blockSaurikRepo(void);
 #endif /* fun_objc_h */

+ 19 - 4
Meridian/meridianTV/electra/the fun part/fun_objc.m

@@ -81,6 +81,21 @@ void startDaemons(){
     }
 }
 
+void writeMessagePlain(char *message, ...) {
+    va_list args;
+    va_start(args, message);
+    NSString *string;
+    string = [[NSString alloc] initWithFormat: [NSString stringWithUTF8String:message]  arguments: args];;
+    va_end(args);
+    [[ViewController currentViewController] writeText:string];
+}
+
+void writeMessage(char *message) {
+    
+    [[ViewController currentViewController] writeText:[NSString stringWithUTF8String:message]];
+    
+}
+
 void displaySnapshotNotice(){
     [[ViewController currentViewController] displaySnapshotNotice];
 }
@@ -97,12 +112,12 @@ void removingElectraBeta(){
     [[ViewController currentViewController] removingElectraBeta];
 }
 
-void installingCydia(){
-    [[ViewController currentViewController] installingCydia];
+void installingNitoTV(){
+    [[ViewController currentViewController] installingNitoTV];
 }
 
-void cydiaDone(){
-    [[ViewController currentViewController] cydiaDone];
+void nitoTVDone(){
+    [[ViewController currentViewController] nitoTVDone];
 }
 
 void blockSaurikRepo(){