#How would I fix my iPad Mini 4 not working with anything?

310 messages · Page 1 of 1 (latest)

marsh rivetBOT
#

@glass heart thanks for creating a new thread!

Please use /solved to delete this thread when you're done.

glass heart
#

example of SSHRD not working

glass heart
#

fuck

#

deleted the message

compact anchor
#

You can do it with the checkm8 nonce setter

glass heart
#

you know i'm not on macos, right?

compact anchor
#

don't have to be, works with linux

#

or FR can use pwndfu inside the gui

glass heart
#

small issue

#

no firmware keys

compact anchor
#

Not hard to obtain

#

as long as you pwn it

#

(not jailbreak)

glass heart
#

i don't know how to get the keys though

compact anchor
#

I can teach you, but you will need linux

glass heart
#

I'm on Linux

compact anchor
#

cool.

glass heart
#

Should I get out of the ssh ramdisk?

compact anchor
#

you can, you won't need it

glass heart
#

k

compact anchor
#

it does look like what you need is already there.. although I don't know what firmware you set the ramdisk to

glass heart
#

15.7

compact anchor
#

Ah, that's why it won't work

glass heart
#

should i go back to the ramdisk?

compact anchor
#

fear not, as long as you can use gaster

glass heart
#

which i have

compact anchor
#

use it to pwn the device

glass heart
#

I set up sunst0rm, it's futurerestore that's acting up

compact anchor
#

gaster pwn set in DFU mode

glass heart
#

alright

#

what now

compact anchor
#

then you'll need img4

glass heart
#

yup

#

have that and pyimg4

#

so what's next?

compact anchor
#

type in the command img4 -i /location/of/ibec.im4p -b

glass heart
#

where's the ibec?

#

where would it be by default?

compact anchor
#

you could download the ipsw

glass heart
#

15.7?

compact anchor
#

and change it to .zip then extract the files in the DFU folder

compact anchor
#

Yes, after changing the extension of ipsw to .zip, you unzip the contents and you'll have a DFU folder

#

should be in /Firmware

glass heart
#

oh ok

#

So what's next?

#

Do I do the same to all the other files?

compact anchor
#

once you type in that command it'll give you a long alphanumeric code

glass heart
#

Yes

#

85A50B18C6DC1F0C3BB2889D5C3EAAB52E6F3AA4B06B7951F3950760D9ED3B00E4FBC1E7C077E1C3770EFBC577681153
AB0A0C936CF62AA859FF5BF51EE22B83E18C6C845457ACE837FFCB5F6CF521252B2C74F0D534709DC9E92D1782235628

compact anchor
#

you'll then need to enter pongoOS and enter that code in

#

This is done by compiling the pongoterm binary from the checkra1n project pongoOS then execute a few commands in Terminal.

#

If you have linux, you can install checkra1n

#

and use checkra1n -cp

glass heart
#

Wait

#

If I already have checkra1n, do I need to compile pongoterm?

compact anchor
#

it's separate. You may or may not have that binary in a folder but if not, you can just download it but I think it needs to be compiled

#

Or wait.. hang on

#

I'll give you the command to use for that

#

I don't know what iPad you have, if it's the cellular or wifi..

glass heart
#

Wi-Fi

compact anchor
#

ipsw_keys.py -i /location/of/ipsw -w -o /location/for/keys.txt -m iPad5,1 -b 08

#

and with your device in PwnDFU mode, run that command (with the respected directories in place) and you'll get your keys

#

you might need to install python if you haven't

glass heart
#

Where woukd keys.txt be?

glass heart
compact anchor
#

that would be up to where you'd like to put them. It's a custom directory meaning any directory of your choosing

glass heart
#

Oh ok

compact anchor
#

the "keys.txt" would be the file name for the keys (or whatever you want) but the directory is where

glass heart
#

Understood

#

ffs

    def asn1_node_next(der, (ixs,ixf,ixl)):
                            ^
SyntaxError: invalid syntax```
#

@compact anchor something in the script is broken...

compact anchor
#

what vers of python are you using?

glass heart
#

3.10.6

compact anchor
#

try a lower one

#

What I did to get it was not use python or py but just ran the .py as-is

glass heart
#

sudo: ./ipsw_keys.py: command not found

#

so that doesn't work

compact anchor
#

oof

#

i hate linux for being soo finicky

glass heart
#

Well what do I do now?

compact anchor
#

does the command work?

glass heart
#

Which?

compact anchor
#

ipsw_keys.py -i /location/of/ipsw -w -o /location/for/keys.txt -m iPad5,1 -b 08

#

with python 2 or lower

glass heart
#

How do I install it again?

compact anchor
#

sudo apt install python2 i would presume

glass heart
#

Different error

#

Missing module

#

Should be easy to fix

compact anchor
#

what module

glass heart
#

dfu

compact anchor
#

error log?

#

probably need the script inside pwndfu folder

#

or a folder with pwndfu in

glass heart
#
  File "./ipsw_keys.py", line 6, in <module>
    import dfu
ImportError: No module named dfu
compact anchor
#

yeah, if you have the ipwndfu folder downloaded

#

put the script inside that

glass heart
#

Uhh

#

Don't I just need to do pip install dfu?

compact anchor
#

this is easier

#

the .py script will find the module automatically

#

the way i have it set up:
folder
ipwndfu folder
script

#

then i just cd to the folder

#

and run the script

glass heart
compact anchor
#

yes

glass heart
#

Do I just clone the repo?

compact anchor
#

sure but do it recursively

glass heart
#

What does that mean again?

compact anchor
#

means all that's forked

glass heart
#

Oh ok

#

Don't I do git clone {link} --recursive?

compact anchor
#

git clone --recursive /.git

#

after running the script, you'll have the keys which then you can use to decrypt and use for sunst0rm, ssh ramdisks and setting the nonce

glass heart
#

Where would I put the keys?

compact anchor
#

You'll have two, IV and KEY

glass heart
#

Script's running

compact anchor
#

you'd use img4 -i /location/of/regular/ibec.im4p -o /location/of/decrypted/ibec.im4p -k IV and KEY (no spaces) -D

glass heart
#

so basically i'd use a fucked with ipsw?

#

Wait

compact anchor
#

no, you just extract those files from it

glass heart
#

Wouldn't I give the keys to Cryptic so he could update the firmwarejson?

compact anchor
#

copy/paste

compact anchor
glass heart
#

ERROR: No Apple device in DFU Mode 0x1227 detected after 5.00 second timeout. Exiting.

#

tf

#

it's in DFU...

compact anchor
#

unplug, replug

#

what version are you trying to downgrade to?

glass heart
#

I'm trying to set the nonce and then tether downgrading to 14.3

#

The problem is that it's not setting the nonce when I have the 14.3 IPSW

compact anchor
#

Why not untether to 15.1 and use trollstore/fugu15?

#

(if you have blobs)

glass heart
#

I prefer rooted + no blobs

compact anchor
#

oof okay, sunst0rm is your only hope

glass heart
#

Should I run it as sudo?

glass heart
#

futurerestore just doesn't work

compact anchor
#

don't know why you need FR when you can't downgrade without blobs

glass heart
#

you need FR for the downgrade...

compact anchor
#

and blobs to downgrade with...

glass heart
#

yeah

compact anchor
#

unless you're using sunst0rm futurerestore

glass heart
#

yeah

compact anchor
#

I thought you were using FR as-is

#

Once you get the keys, submit it to a greenie

#

they'll update the site

#

then you can use sunst0rm automatically

glass heart
#

small problem

#

it doesn't see my device

compact anchor
#

is it in DFU?

glass heart
#

yes

compact anchor
#

take it out, re-enter

#

then run ipwndfu separately

glass heart
#

until it works?

#

could i use gaster?

compact anchor
#

you could

#

whatevers easier

glass heart
#

ERROR: Device seems to be in pwned DFU Mode, but a matching configuration was not found.

#

@compact anchor Wait, isn't -b meant to be the board config?

compact anchor
#

yes

#

your ipads board config is 08

glass heart
#

huh

glass heart
compact anchor
#

you could try 0A

glass heart
#

Nope

#

No dice

#

Isn't the Mini 4's config J96AP?

compact anchor
#

no

glass heart
#

So what's the issue then?

compact anchor
#

or wait -b is board id

#

not board config

glass heart
#

Oh

#

Right

#

Wait, no

#

08 is the BDID

compact anchor
#

yes

glass heart
#

Then why is it failing

compact anchor
#

you can try matty's ipwndfu

glass heart
#

Sure

compact anchor
#

i think spit-balling the issue is the orig ipwndfu doesn't have your particular device registered

glass heart
compact anchor
#

did you download the right ipsw?

glass heart
#

Yeah

compact anchor
#

are you using -x?

glass heart
#

No

#

getopt.GetoptError: option -x not recognized

compact anchor
#

when you run checkm8, what's it say? just that?

glass heart
#

running checkm8 outputs nothing.

compact anchor
#

it'd have to, at least see the device

#

do you have any type of mac?

glass heart
#

Nope

compact anchor
#

and where's that error coming from? the script?

glass heart
#

when inputting -x?

compact anchor
#

no the other error

glass heart
#

checkm8?

#

No error

#

It's just blank

compact anchor
#

ERROR: Device seems to be in pwned DFU Mode, but a matching configuration was not found.

glass heart
#

Oh

#

Uhh

#

Yeah I think so

compact anchor
#

I think that's fine

#

as long as the device is in pwndfu

glass heart
#

Yeah, it's pwned

compact anchor
#

then the command should run regardless

glass heart
#

So what should I do?

compact anchor
#

... run the command

glass heart
#

which? the keys thingy?

compact anchor
#

yes

glass heart
#
Reading manifest...
Reading keys...
ERROR: Device seems to be in pwned DFU Mode, but a matching configuration was not found.
compact anchor
#

try not pwning it gaster

#

maybe that could be an issue..

glass heart
#

Maybe

#

bash: ./ipwndfu: /usr/bin/python: bad interpreter: No such file or directory odd

#

ERROR: This device is not supported. tf

compact anchor
#

odd indeed

glass heart
#

used a different fork: ERROR: Exploit failed. Device did not enter pwned DFU Mode.

#

@compact anchor Any idea how I could fix this?

compact anchor
#

you could dump the keys manually

glass heart
#

ah

compact anchor
#

'tis a lot of work though

glass heart
#

why not

#

fuck

compact anchor
#

You'd need to do the img4 command to get the keybags

#

which is a long code

glass heart
#

how difficult would it be?

compact anchor
#

not difficult at all

#

i'd keep it organized though, ibec, ibss kernelcache, trustcache, devicetree etc

glass heart
#

Would I put it all in a text file?

compact anchor
#

i would

glass heart
#

And do I need to use pogo

compact anchor
#

then you'd use ./ipwndfu --decrypt-gid Keybag key

glass heart
#

What's the difference between keybag and key?

compact anchor
#

oh... I should reiterate, the keybag key is the long code that you get from the img4 command

glass heart
#

wait wait wait

#

just how many things do I have to decrypt?

compact anchor
#

6.. i believe

#

computer does all the work, you just gotta write down the codes

glass heart
#

are they all in the dfu folder?

compact anchor
#

they're the files you extracted earlier

glass heart
#

everything?

compact anchor
#

oh no, they're in the /Firmware/DFU folder

glass heart
#

this?

compact anchor
#

yes but not the .plists

glass heart
#

Alright

#

So is it only the stuff in /Firmware/DFU?

compact anchor
#

iBEC.ipad5.RELEASE.im4p

#

iBoot.ipad5.RELEASE.im4p

#

iBSS.ipad5.RELEASE.im4p

#

kernelcache.release.ipad5

#

LLB.ipad5.RELEASE.im4p

glass heart
#

is that all?

compact anchor
#

and the last one is the ramdisk.. but we'll do that after you do those

#

those other files are easy to decrypt

#

another one you'll need is trustcache

#

that one doesn't need to be decrypted AFAIK, just patched

glass heart
compact anchor
#

you don't need to

compact anchor
glass heart
#

So what do I do with kernelcache then?

compact anchor
#

you're good with that one, just needs to be patched

glass heart
#

Alright

#

Tell me how once I have all the values

compact anchor
#

img4 -i kernelcache -o kcache.raw
Kernel64Patcher kcache.raw kcache.patched -a

glass heart
compact anchor
#

for the values:
/ipwndfu --decrypt-gid value the code is both the IV and Key. The IV is 32 characters and the key is 64 characters

compact anchor
glass heart
#
Kernel: Adding AMFI_get_out_of_my_way patch...
get_amfi_out_of_my_way_patch: Entering ...
get_amfi_out_of_my_way_patch: Kernel-8020 inputted
get_amfi_out_of_my_way_patch: Found Internal Error: No cdhash found. str loc at 0x95ec61
get_amfi_out_of_my_way_patch: Found Internal Error: No cdhash found. str ref at 0x1052c64
get_amfi_out_of_my_way_patch: Patching AMFI at 0x104e2a8
main: Writing out patched file to kcache.patched...
main: Quitting...
#

Is that normal?

compact anchor
#

no but it looks like it worked-ish?

#

i guess only one way to find out

glass heart
#

The file generated asks me to open it with a program

#

Is that good?

glass heart
compact anchor
#

do them separatley

glass heart
#

K

compact anchor
#

or you'll have a huge list of unorganized numbers

glass heart
#

/usr/bin/python2: can't find '__main__' module in './ipwndfu' odd

compact anchor
#

it'll be like going into a ball pit looking for a dime

#

are you cd-ed into ipwndfu?

glass heart
#

wait

#

ERROR: Device seems to be in pwned DFU Mode, but a matching configuration was not found. bruh

#

are you sure you're meant to do it in ipwndfu?

#

@compact anchor Congrats on member + by the way!

compact anchor
glass heart
#

lol

#

I'm going to shut down my computer

#

It's 3 AM

compact anchor
#

yeah.. recharge the batteries (both of them)

glass heart
#

true

compact anchor
#

you could... sneak in an apple store and use ipwndfu there 😛

glass heart
#

I'll decrypt the stuff tomorrow

compact anchor
#

or an apple authorized retailer

#

or make a hackintosh

glass heart
#

Well

#

I do have a big sur KVM troll

compact anchor
#

you wouldn't need the latest mac.. just anything that's on high sierra

#

and i don't think a KVM will work seeing as it's a virtual machine

glass heart
#

ig

#

anwyays, gn