产品人气榜
-
史宾格安全及隐私合规平台3分钟完成一周工作量 更快实现隐私合规
-
IP信誉查询多因子计算，多维度画像
-
智能数据安全网关为企业数据安全治理提供一体化数据安全解决方案
-
4网址安全检测
-
5SMS短信内容安全
-
6百度漏洞扫描
-
7爬虫流量识别
-
8百度AI多人体温检测
-
9工业大脑解决方案
-
10APP安全解决方案
-
11企业人员安全意识解决方案
-
12安全OTA
-
13大模型安全解决方案
-
14安全知识图谱
热门主题
iOS越狱主要步骤揭秘
2018-10-12 16:35:0713280人阅读
LC 00: LC_SEGMENT_64 Mem: 0x000000000-0x100000000 __PAGEZERO LC 01: LC_SEGMENT_64 Mem: 0x100000000-0x101e71000 __TEXT Mem: 0x100002370-0x1000292cf __TEXT.__text (Normal) Mem: 0x1000292d0-0x10002982e __TEXT.__stubs (Symbol Stubs) Mem: 0x100029830-0x10002a132 __TEXT.__stub_helper (Normal) Mem: 0x10002a140-0x10002a690 __TEXT.__const Mem: 0x10002a690-0x10002b914 __TEXT.__objc_methname (C-String Literals) Mem: 0x10002b914-0x10002b9d5 __TEXT.__objc_classname (C-String Literals) Mem: 0x10002b9d5-0x10002beb6 __TEXT.__objc_methtype (C-String Literals) Mem: 0x10002bec0-0x10002e8d5 __TEXT.__cstring (C-String Literals) Mem: 0x10002e8d6-0x10002e92e __TEXT.__ustring Mem: 0x10002e92e-0x10003dc04 __TEXT.__objc_cons1 Mem: 0x10003dc04-0x10029ed87 __TEXT.__objc_cons2 ; Yeee, see this! Mem: 0x10029ed87-0x1002b71a9 __TEXT.__objc_cons3 Mem: 0x1002b71a9-0x100f11a36 __TEXT.__objc_cons4 Mem: 0x100f11a36-0x10160e0ca __TEXT.__objc_cons5 Mem: 0x10160e0ca-0x101dd6e3f __TEXT.__objc_cons6 Mem: 0x101dd6e3f-0x101dd7152 __TEXT.__objc_cons7 Mem: 0x101dd7152-0x101dd7a17 __TEXT.__objc_cons8 Mem: 0x101dd7a17-0x101e45a6e __TEXT.__objc_cons9 Mem: 0x101e45a6e-0x101e57e74 __TEXT.__objc_cons10 Mem: 0x101e57e74-0x101e69288 __TEXT.__objc_cons11 Mem: 0x101e69288-0x101e699e0 __TEXT.__unwind_info Mem: 0x101e699e0-0x101e71000 __TEXT.__eh_frame LC 02: LC_SEGMENT_64 Mem: 0x101e71000-0x101e75000 __DATA Mem: 0x101e71000-0x101e71028 __DATA.__program_vars Mem: 0x101e71028-0x101e710b8 __DATA.__got (Non-Lazy Symbol Ptrs) Mem: 0x101e710b8-0x101e710c8 __DATA.__nl_symbol_ptr (Non-Lazy Symbol Ptrs) Mem: 0x101e710c8-0x101e717f0 __DATA.__la_symbol_ptr (Lazy Symbol Ptrs) Mem: 0x101e717f0-0x101e717f8 __DATA.__mod_init_func (Module Init Function Ptrs) Mem: 0x101e717f8-0x101e71800 __DATA.__mod_term_func (Module Termination Function Ptrs) Mem: 0x101e71800-0x101e71b40 __DATA.__const Mem: 0x101e71b40-0x101e71b60 __DATA.__objc_classlist (Normal) Mem: 0x101e71b60-0x101e71b68 __DATA.__objc_nlclslist (Normal) Mem: 0x101e71b68-0x101e71b78 __DATA.__objc_catlist (Normal) Mem: 0x101e71b78-0x101e71ba0 __DATA.__objc_protolist Mem: 0x101e71ba0-0x101e71ba8 __DATA.__objc_imageinfo Mem: 0x101e71ba8-0x101e72f90 __DATA.__objc_const Mem: 0x101e72f90-0x101e73590 __DATA.__objc_selrefs (Literal Pointers) Mem: 0x101e73590-0x101e735a0 __DATA.__objc_protorefs Mem: 0x101e735a0-0x101e736f8 __DATA.__objc_classrefs (Normal) Mem: 0x101e736f8-0x101e73718 __DATA.__objc_superrefs (Normal) Mem: 0x101e73718-0x101e738a8 __DATA.__objc_data Mem: 0x101e738a8-0x101e73930 __DATA.__objc_ivar Mem: 0x101e73930-0x101e74390 __DATA.__cfstring Mem: 0x101e74390-0x101e746b8 __DATA.__data Mem: 0x101e746c0-0x101e74b60 __DATA.__bss (Zero Fill) Mem: 0x101e74b60-0x101e74b90 __DATA.__common (Zero Fill)LC 03: LC_SEGMENT_64 Mem: 0x101e75000-0x101eba000 __ui0 LC 04: LC_SEGMENT_64 Mem: 0x101eba000-0x101ebf000 __LINKEDIT LC 05: LC_DYLD_INFO LC 06: LC_SYMTAB Symbol table is at offset 0x1ebbc48 (32226376), 293 entries String table is at offset 0x1ebd610 (32232976), 4776 bytes ....
Saigon:~ geosn0w$ /Users/geosn0w/Desktop/ToolChain/jtool/jtool -e __TEXT.__objc_cons2 /Users/geosn0w/Desktop/pangu.app/Contents/MacOS/pangu Requested section found at Offset 252932 Extracting __TEXT.__objc_cons2 at 252932, 2494851 (261183) bytes into pangu.__TEXT.__objc_cons2 Saigon:~ geosn0w$ file /Users/geosn0w/pangu.__TEXT.__objc_cons2 /Users/geosn0w/pangu.__TEXT.__objc_cons2: gzip compressed data, from Unix Saigon:~ geosn0w$ tar tvf /Users/geosn0w/pangu.__TEXT.__objc_cons2 drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ipa1.app/ drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ipa1.app/_CodeSignature/-rwxrwxrwx 0 0 0 3638 Jun 27 2014 Payload/ipa1.app/_CodeSignature/CodeResources-rwxrwxrwx 0 0 0 15112 Jun 27 2014 Payload/ipa1.app/AppIcon60x60@2x.png-rwxrwxrwx 0 0 0 20753 Jun 27 2014 Payload/ipa1.app/AppIcon76x76@2x~ipad.png-rwxrwxrwx 0 0 0 8017 Jun 27 2014 Payload/ipa1.app/AppIcon76x76~ipad.png-rwxrwxrwx 0 0 0 75320 Jun 27 2014 Payload/ipa1.app/Assets.car-rwxrwxrwx 0 0 0 7399 Jun 27 2014 Payload/ipa1.app/embedded.mobileprovision drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ipa1.app/en.lproj/-rwxrwxrwx 0 0 0 74 Jun 27 2014 Payload/ipa1.app/en.lproj/InfoPlist.strings-rwxrwxrwx 0 0 0 1955 Jun 27 2014 Payload/ipa1.app/Info.plist-rwxrwxrwx 0 0 0 312208 Jun 27 2014 Payload/ipa1.app/ipa1-rwxrwxrwx 0 0 0 968 Jun 27 2014 Payload/ipa1.app/ipa1-Info.plist-rwxrwxrwx 0 0 0 235794 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-568h@2x.png-rwxrwxrwx 0 0 0 785321 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-Landscape@2x~ipad.png-rwxrwxrwx 0 0 0 261481 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-Landscape~ipad.png-rwxrwxrwx 0 0 0 660541 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-Portrait@2x~ipad.png-rwxrwxrwx 0 0 0 244644 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-Portrait~ipad.png-rwxrwxrwx 0 0 0 216627 Jun 27 2014 Payload/ipa1.app/LaunchImage-700@2x.png-rwxrwxrwx 0 0 0 8 Jun 27 2014 Payload/ipa1.app/PkgInfo-rwxrwxrwx 0 0 0 150 Jun 27 2014 Payload/ipa1.app/ResourceRules.plist drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ipa1.app/zh-Hans.lproj/-rwxrwxrwx 0 0 0 73 Jun 27 2014 Payload/ipa1.app/zh-Hans.lproj/InfoPlist.strings Saigon:~ geosn0w$
UIApplication.shared.open(url, options: [:], completionHandler: nil)
int remountRootFS (void){
...
uint64_t rootVnodeAddr = findKernelSymbol("_rootvnode");
uint64_t *actualVnodeAddr;
struct vnode *rootvnode = 0;
char *v_mount;
status("Attempting to remount rootFS...\n");
readKernelMemory(rootVnodeAddr, sizeof(void *), &actualVnodeAddr);
readKernelMemory(*actualVnodeAddr, sizeof(struct vnode), &rootvnode);
readKernelMemory(rootvnode->v_mount, 0x100, &v_mount);
// Disable MNT_ROOTFS momentarily, remounts , and then flips the flag back uint32_t mountFlags = (*(uint32_t * )(v_mount + 0x70)) & ~(MNT_ROOTFS | MNT_RDONLY);
writeKernelMemory(((char *)rootvnode->v_mount) + 0x70 ,sizeof(mountFlags), &mountFlags);
char *opts = strdup("/dev/disk0s1s1");
// Not enough to just change the MNT_RDONLY flag - we have to call // mount(2) again, to refresh the kernel code paths for mounting.. int rc = mount("apfs", "/", MNT_UPDATE, (void *)&opts);
printf("RC: %d (flags: 0x%x) %s \n", rc, mountFlags, strerror(errno));
mountFlags |= MNT_ROOTFS;
writeKernelMemory(((char *)rootvnode->v_mount) + 0x70 ,sizeof(mountFlags), &mountFlags);
// Quick test: int fd = open ("/test.txt", O_TRUNC| O_CREAT);
if (fd < 0) { error ("Failed to remount /"); }
else {
status("Mounted / as read write :-)\n");
unlink("/test.txt"); // clean up }
return 0;ioreg -p IODeviceTree -l | grep boot-manifest-hash
char *copyBootHash(void) {
unsigned char buf[1024];
uint32_t length = 1024;
io_registry_entry_t chosen = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/chosen");
if (!MACH_PORT_VALID(chosen)) {
printf("Unable to get IODeviceTree:/chosen port\n");
return NULL;
}
kern_return_t ret = IORegistryEntryGetProperty(chosen, "boot-manifest-hash", (void*)buf, &length);
IOObjectRelease(chosen);
if (ret != ERR_SUCCESS) {
printf("Unable to read boot-manifest-hash\n");
return NULL;
}
// Make a hex string out of the hash char manifestHash[length*2+1];
bzero(manifestHash, sizeof(manifestHash));
int i;
for (i=0; i<length; i++) {
sprintf(manifestHash+i*2, "%02X", buf[i]);
}
printf("Hash: %s\n", manifestHash);
return strdup(manifestHash);}const char *find_system_snapshot(const char *rootfsmnt) {
char *bootHash = copyBootHash();
char *system_snapshot = malloc(sizeof(char *) + (21 + strlen(bootHash)));
bzero(system_snapshot, sizeof(char *) + (21 + strlen(bootHash)));
if (!bootHash) {
return NULL;
}
sprintf(system_snapshot, "com.apple.os.update-%s", bootHash);
printf("System snapshot: %s\n", system_snapshot);
return system_snapshot;}本文翻译自：https://geosn0w.github.io/Jailbreaks-Demystified/. 翻译作者：lucywang
原文地址： http://www.4hou.com/mobile/13960.html
