Fix for iPhone 6?

[metarebel]

This is most likely only a fix for iPhone 7 users, but can iPhone 6 users get some love with these new exploits as well? Yalu is truely unstable with daily kernel panics from myself, as well as others. Are the kernel panics between devices related?
Is the issue being looked at or is the Yalu102 project as final as it gets for 6 users. just asking (: Please see kpwn/yalu102#454
kpwn/yalu102#464

[metarebel]

A few things i've picked up from experience doing trial and error. Although idk if my case is specific to iPhone 6. If executing Yalu102 and trying to jailbreak fails or reboots for you, try this:
Right before opening Yalu and pressing jailbreak, swipe right from homescreen to enter Today View with your widgets (i have 6 to load -weather, etc.), wait a few seconds for your widgets to load, swipe down to open Notification Center just for just a few seconds to load as well, open Yalu app and keep it open for 5 seconds, jailbreak. I found this method to work more consistently (:

I've also found the Dissident tweak to greatly delay the inevitable daily kernel panic when using apps heavily. Again, idk if this issue is from RAM or 32bit apps, etc. since no one has commented on it. But i'm willing to provide more panic logs if someone needs them.

http://cydia.saurik.com/package/org.thebigboss.dissident/

With Dissident installed, the jailbreak with stay stable on the device a lot longer than without it for some reason unknown. In my case, i need to have one app set to "Foreground" in individual settings (my case is YouTube, Skype). You only need to keep one of these apps open in the foreground while keeping open and playing your usual suspect app/game that would case a kernel panic. Also, it's really certain apps such as snapchat, games, tweaks that will case the kernel panic although the device does panic occasionally on random without use. For example, using a tweak like Video Pane 2 with a pip video playing and an app/game in the background will eventually most likely lead to panic as well, at least in my case.

[xerub]

I don't have an iPhone6 on 10.x. If you are interested in testing, let me know.

[metarebel]

Hi xerub! i'd be more than happy to help test with what i can right now, while on vacation atm

[coolstar]

I've got an iPhone 6 on 10.2 here if you need any testing

[FaZeIlLuMiNaTi]

I've got an SE on 10.2 and would be happy to test too.

[coolstar]

iPhone SE is stable under yalu102; testing on that device is not needed. Only 4K devices have problems with yalu102

[FaZeIlLuMiNaTi]

Ah okay.

[xerub]

Finding offsets and testing is gonna be a pain. So I suppose we should support only devices that have problems with yalu102 (the 6s stub is there for the sole reason that I do have that device and can test -- otherwise it's very happy with yalu102). What I'm saying is, we need to prioritize. Once the KPP bypass code is up, I'll let you know and then do some testing. In the meantime, perhaps some you could help me with the offsets. Just follow the pattern for 6s. Thanks!

[Jalohann]

@xerub I am ready to test whatever you have ready to throw at us. Currently jailbroken on my iPhone 6 on yalu102! Whenever support comes out lmk and I would be happy to test it for you :)

[LufyCZ]

What bout the iPad Air ?

[jakeajames]

iPad Air 2 here. This device needs a fix more than ever. Happy to test for you :)

[kpwn]

you guys are missing the entire point of what this is, what yalu102 is, and why this has nothing to do with iphone 6 issues on yalu102.

i'm sure the issues can be solved, but this won't help at all.

[LufyCZ]

kpwn: A bit ot but you have the word "incomplete" in your Yalu description

[metarebel]

@kpwn
I know iPhone 6 users may not be the majority but there's quite a number of us using yalu102. You might notice how most people on /r/jailbreak don't really know how unstable the jailbreak is for some users w/ diff devices, or why their own device might be rebooting. But as you can see, this probably extends to 4k devices like the 6, possibly 6+, and even the Air 2. I can't thank the ones who contributed to yalu102 enough, and i'm always grateful to have my device jailbroken.. i wouldn't trade not having a jb for stock at all, but stability is definitely a problem, especially if it's been recurring for a couple months or however long yalu102's been around now. Pangu might be holding on to something behind the scenes for 10.3.1, but it's never too late to see if yalu102 can get more stable (: I know i might've been impetuous to post about this here when these newly discovered exploits are really for the 7, but there's really no right place to spark discussion on stability and i'd rather not try my luck tweeting at Luca with questions while being drowned out by all the 7 users tweeting back (:

[metarebel]

In the meantime would it help if some of us copied over their kernel panics from settings > privacy > diagnostics/usage?

[coolstar]

@kpwn the issues with yalu102 are pretty much universal on all 4K devices; seems to do with bad page table handling or just with bad patches in yalu102. I was hoping that we'd maybe be able to use extra_recipe instead of yalu102, with newer patches since it is still under active development. I am aware both extra_recipe and yalu102 use the same mach voucher vulnerability; it's simply a matter now of the fact that extra_recipe is a project that is under active development, so we could possibly get new patches here that would make 4K devices more stable

[coolstar]

@metarebel the problem definitely extends to the 6+ and the iPod touch 6 as well. See: https://www.reddit.com/r/jailbreak/comments/6dc1zj/discussion_stability_or_lack_of_yalu102/

[kpwn]

'I was hoping that we'd maybe be able to use extra_recipe instead of yalu102' -> completely unnecessary. if you haven't noticed, this uses:

1. the same bug as yalu102
2. a binary blob (mach_portal b3's mach-o actually) to perform kernel patches.

Kernel exploit strategy is irrelevant for iPhone 6 stability. And regardless he yalu102 kernel exploit is way more reliable than this exploit, 16k or 4k.

And this being actively maintained is absolutely no difference for all intents and purposes.

Hell, @coolstar, as these are opensource projects, technically speaking they can be under development and maintained by anyone, including yourself. If you really care about these issues, maybe actually debugging em and sending a pull request would be a better strategy than reddit posts.

[coolstar]

@kpwn do you have any suggestions on how to start debugging this issue? I don't really have much of an idea of where to start, as most of the kernel-level development I've done has just been device drivers on x86_64 (where debugging is as simple as connecting over ethernet or USB EHCI). Don't have much experience with arm64 or dumping/patching the kernel on iOS.

And yes, I know that the exploit strategy is irrelevant. However, a new set of patches could fix the problems with iPhone 6 (which would be needed to get this to even run on iPhone 6, as the binary blob would need to be replaced)

[xerub]

guys, no need to fight. I haven't had much success with mach-portal binary blob on the 6s. Either I got one offset wrong, or something else is at fault. Either way, I have no desire nor the time to debug a KPP bypass which is already known and public. That said, I might port it here, either by rewriting it or lifting code off yalu102 -- much easier/nicer with dynamic offsets; that of course depends on how much spare time I get. That said, yalu102 will always be more reliable in terms of initial kernel exploit -- something that plagues extra_recipe, much to the frustration of everybody.

[kpwn]

fwiw the kpp bypass used on mach_portal is slightly different and not working in 10.2. but the core concept and shellcode stays the same

[xerub]

Ok, I pushed support for iPhone8,1 (6s) and iPad5,4 (Air2). SSH-only with no SB patches for now. Whoever feels masochistic, give it a try. Support for other devices can be added in offsets.m

[mullak99]

Change the Valid Architectures to (only) arm64.

[coolstar]

@K0guma change the "Architectures" to only arm64

[coolstar]

@xerub testing here on iPhone 6S, it appears most of the time (when it doesn't reboot), it fails here: https://github.com/xerub/extra_recipe/blob/master/extra_recipe/jailbreak.c#L558

Is this just part of the low success rate (and need to keep retrying?) or something wrong on iPhone 6S? (tried about 80 times and it either rebooted or returned there)

[xerub]

@coolstar Unfortunately, yes. That means the "interesting" ports are not contiguous. Just reboot the phone, leave it for a couple of minutes, start extra_recipe, then wait for more several seconds and hit go. It's a hit and miss, probably miss most of the time...
See this for more info: https://bugs.chromium.org/p/project-zero/issues/detail?id=1004#c8

You can play with the value here: https://github.com/xerub/extra_recipe/blob/master/extra_recipe/jailbreak.c#L514
Set it to 15000, 25000, 80000, whetever...

Also, clone the repo again. If your 6s is a Samsung, it will surely panic later, even if the exploit succeeds. You need to tweak AGXCommandQueue_vtable: a different offset needs to be used and there's no easy way to tell which version I am running. The new offset is commented out, but easy to spot. The 6s is for testing anyway, since yalu102 is extremely stable on 6s, so I won't put too much effort into that.

Btw, If it says "failed, reboot" you should really reboot. Even if it eventually succeeds by re-trying, it probably smashed at some point something wrong in the kernel and it won't be stable.

[xerub]

@K0guma this thread is not about compiling extra_recipe, so please don't hijack it. You have been warned! Hint: just plug in the device and hit Run, it'll pick up arm64

[ghost]

sorry

[xerub]

Support for pretty much anything arm64 up to iOS 10.2 can be added in dex.plist, just follow the pattern (there is already support for iPhone7,2).