Skip to content

Commit d02a57a

Browse files
LukeZGDLukeZGD
committed
some updates regarding hacktivation
also closes #1124
1 parent 132b353 commit d02a57a

1 file changed

Lines changed: 53 additions & 19 deletions

File tree

‎restore.sh‎

Lines changed: 53 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3303,7 +3303,7 @@ ipsw_prepare_openssh_plist() {
33033303
ipsw_prepare_rebootsh() {
33043304
log "Generating reboot.sh"
33053305
echo '#!/bin/bash' | tee reboot.sh
3306-
echo "mount_hfs /dev/disk0s1s1 /mnt1; mount_hfs /dev/disk0s1s2 /mnt2" | tee -a reboot.sh
3306+
echo "mount_hfs /dev/disk0s1s1 /mnt1; mount_hfs /dev/disk0s1s2 /mnt2; nvram -c" | tee -a reboot.sh
33073307
if [[ $1 == "aquila" ]]; then
33083308
echo "mv /mnt1/System/Library/LaunchDaemons/com.apple.mDNSResponder.plist_ /mnt1/Library/LaunchDaemons/com.apple.mDNSResponder.plist" | tee -a reboot.sh
33093309
echo "mv /mnt1/Library/LaunchDaemons/com.apple.sandboxd.plist /mnt1/System/Library/LaunchDaemons/" | tee -a reboot.sh
@@ -9344,11 +9344,6 @@ menu_ipsw() {
93449344
[76543].* ) ipsw_canhacktivate=1;;
93459345
esac
93469346
;;
9347-
*"powdersn0w"* )
9348-
case $device_latest_vers in
9349-
[76543].* ) ipsw_canhacktivate=1;;
9350-
esac
9351-
;;
93529347
[6543]* )
93539348
device_target_vers="$1"
93549349
if [[ $device_target_vers != "3.0"* ]]; then
@@ -9482,8 +9477,9 @@ menu_ipsw() {
94829477
iPhone3,1 ) lo=4.0; hi=7.1.1;;
94839478
iPhone3,2 ) lo=6.0; hi=7.1.1;;
94849479
iPhone3,3 ) lo=4.2.6; hi=7.1.1;;
9485-
iPhone4,1 | iPad2,[123] ) lo=5.0;;
9486-
iPad2,4 | iPad3,[123] ) lo=5.1;;
9480+
iPhone4,1 ) lo=5.0;;
9481+
iPad2,[123] ) lo=4.3;;
9482+
iPad2,4 | iPad3,[123] ) lo=5.1;;
94879483
iPhone5,[34] ) lo=7.0;;
94889484
iPad1,1 ) lo=3.2; hi=5.1;;
94899485
iPod3,1 ) lo=3.1.1; hi=5.1;;
@@ -10640,7 +10636,7 @@ menu_usefulutilities() {
1064010636
;;
1064110637
iPad1,1 | iPhone[23],* | iPod4,1 )
1064210638
case $device_vers in
10643-
3.1* | [456]* ) menu_items+=("Hacktivate Device" "Revert Hacktivation");;
10639+
[34567].* ) menu_items+=("Hacktivate Device" "Revert Hacktivation");;
1064410640
esac
1064510641
;;
1064610642
esac
@@ -10668,8 +10664,8 @@ menu_usefulutilities() {
1066810664
print "* If this is not what you want, you might be looking for the \"Restore/Downgrade\" option instead."
1066910665
print "* From there, enable both \"Jailbreak Option\" and \"Hacktivate Option.\""
1067010666
echo
10671-
print "* Hacktivate Device: This will patch lockdownd on your device."
10672-
print "* Hacktivation is for iOS versions 3.1 to 6.1.6."
10667+
print "* Hacktivate Device: This will patch lockdownd/skip activation on your device."
10668+
print "* Hacktivation is for iOS versions 3.0 to 7.1.2."
1067310669
select_yesno
1067410670
if [[ $? != 1 ]]; then
1067510671
continue
@@ -11171,20 +11167,28 @@ device_activate() {
1117111167
device_hacktivate() {
1117211168
local type="$device_type"
1117311169
local build="$device_build"
11170+
local dap=
1117411171
if [[ $device_proc == 4 && $device_type != "iPhone2,1" ]]; then
1117511172
type="iPhone2,1"
1117611173
case $device_vers in
1117711174
4.2.1 ) build="8C148a";;
1117811175
5.1.1 ) build="9B206";;
1117911176
6.1 ) build="10B141";;
1118011177
esac
11181-
log "Checking ideviceactivation status..."
11182-
$ideviceactivation activate
1118311178
fi
1118411179
local patch="../resources/firmware/FirmwareBundles/Down_${type}_${device_vers}_${build}.bundle/lockdownd.patch"
11180+
if [[ $device_type == "iPhone3,3" && $device_vers == "4.2"* ]] ||
11181+
[[ $device_type == "iPhone2,1" && $device_vers == "3.0"* ]] ||
11182+
[[ $device_proc == 1 && $device_vers == "3."* && $device_vers != "3.1.3" ]] ||
11183+
[[ $device_vers_maj == 7 ]]; then
11184+
dap=1
11185+
elif [[ ! -s $patch ]]; then
11186+
error "Detected that there is no lockdownd patch for this device/version combination. Cannot continue."
11187+
fi
1118511188
device_iproxy
11189+
device_ssh_message
1118611190
device_sshpass
11187-
if [[ $device_type == "iPhone3,3" && $device_vers == "4.2"* ]]; then
11191+
if [[ $dap == 1 ]]; then
1118811192
echo '<plist><dict><key>com.apple.mobile.lockdown_cache-ActivationState</key><string>FactoryActivated</string></dict></plist>' > data_ark.plist
1118911193
log "Copying data_ark.plist to device"
1119011194
$scp -P $ssh_port data_ark.plist root@127.0.0.1:/var/root/Library/Lockdown/data_ark.plist
@@ -11201,8 +11205,14 @@ device_hacktivate() {
1120111205
fi
1120211206
log "Getting lockdownd"
1120311207
$scp -P $ssh_port root@127.0.0.1:/usr/libexec/lockdownd .
11208+
if [[ ! -s lockdownd ]]; then
11209+
error "Getting lockdownd failed. Cannot continue."
11210+
fi
1120411211
log "Patching lockdownd"
1120511212
$bspatch lockdownd lockdownd.patched "$patch"
11213+
if [[ ! -s lockdownd.patched ]]; then
11214+
error "Patching lockdownd failed. Cannot continue."
11215+
fi
1120611216
log "Renaming original lockdownd"
1120711217
$ssh -p $ssh_port root@127.0.0.1 "[[ ! -e /usr/libexec/lockdownd.orig ]] && mv /usr/libexec/lockdownd /usr/libexec/lockdownd.orig"
1120811218
log "Copying patched lockdownd to device"
@@ -11213,11 +11223,35 @@ device_hacktivate() {
1121311223

1121411224
device_reverthacktivate() {
1121511225
device_iproxy
11216-
print "* The default root password is: alpine"
11226+
device_ssh_message
1121711227
device_sshpass
11218-
log "Reverting lockdownd"
11219-
$ssh -p $ssh_port root@127.0.0.1 "[[ -e /usr/libexec/lockdownd.orig ]] && rm /usr/libexec/lockdownd && mv /usr/libexec/lockdownd.orig /usr/libexec/lockdownd"
11220-
$ssh -p $ssh_port root@127.0.0.1 "chmod +x /usr/libexec/lockdownd; reboot"
11228+
if (( device_vers_maj <= 6 )); then
11229+
log "Getting lockdownd.orig"
11230+
$scp -P $ssh_port root@127.0.0.1:/usr/libexec/lockdownd.orig .
11231+
if [[ -s lockdownd.orig ]]; then
11232+
mv lockdownd.orig lockdownd
11233+
else
11234+
warn "Getting lockdownd.orig failed. Will need to grab lockdownd from IPSW for $device_type-$device_vers."
11235+
ipsw_path="../${device_type}_${device_vers}_${device_build}_Restore"
11236+
if [[ ! -s "$ipsw_path.ipsw" ]]; then
11237+
ipsw_download "$ipsw_path" $device_vers $device_build
11238+
fi
11239+
device_target_build="$device_build"
11240+
device_fw_key_check
11241+
local name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "RootFS") | .filename')
11242+
local key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "RootFS") | .key')
11243+
file_extract_from_archive "$ipsw_path.ipsw" $name
11244+
"$dir/dmg" extract $name rootfs.dec -k $key
11245+
"$dir/hfsplus" rootfs.dec extract usr/libexec/lockdownd
11246+
rm $name rootfs.dec
11247+
fi
11248+
if [[ ! -s lockdownd ]]; then
11249+
error "Getting lockdownd failed. Cannot continue."
11250+
fi
11251+
log "Copying lockdownd to device"
11252+
$scp -P $ssh_port lockdownd root@127.0.0.1:/usr/libexec/lockdownd
11253+
fi
11254+
$ssh -p $ssh_port root@127.0.0.1 "chmod +x /usr/libexec/lockdownd; rm -f /usr/libexec/lockdownd.orig /var/root/Library/Lockdown/data_ark.plist; reboot"
1122111255
log "Done. Your device should reboot now"
1122211256
}
1122311257

@@ -11310,7 +11344,7 @@ device_dfuipsw() {
1131011344
ipsw_path="../$ipsw_latest_path"
1131111345
if [[ -s "$ipsw_path.ipsw" && ! -e "$ipsw_dfuipsw.ipsw" ]]; then
1131211346
ipsw_verify "$ipsw_path" "$device_target_build"
11313-
elif [[ ! -e "$ipsw_path.ipsw" ]]; then
11347+
elif [[ ! -s "$ipsw_path.ipsw" ]]; then
1131411348
ipsw_download "$ipsw_path"
1131511349
fi
1131611350
if [[ -s "$ipsw_dfuipsw.ipsw" ]]; then

0 commit comments

Comments
 (0)