#How would I fix my iPad Mini 4 not working with anything?
310 messages · Page 1 of 1 (latest)
example of SSHRD not working
You can do it with the checkm8 nonce setter
you know i'm not on macos, right?
i don't know how to get the keys though
I can teach you, but you will need linux
I'm on Linux
cool.
Should I get out of the ssh ramdisk?
you can, you won't need it
k
it does look like what you need is already there.. although I don't know what firmware you set the ramdisk to
15.7
Ah, that's why it won't work
should i go back to the ramdisk?
fear not, as long as you can use gaster
which i have
use it to pwn the device
I set up sunst0rm, it's futurerestore that's acting up
gaster pwn set in DFU mode
then you'll need img4
type in the command img4 -i /location/of/ibec.im4p -b
you could download the ipsw
15.7?
and change it to .zip then extract the files in the DFU folder
DFU folder?
Yes, after changing the extension of ipsw to .zip, you unzip the contents and you'll have a DFU folder
should be in /Firmware
once you type in that command it'll give you a long alphanumeric code
Yes
85A50B18C6DC1F0C3BB2889D5C3EAAB52E6F3AA4B06B7951F3950760D9ED3B00E4FBC1E7C077E1C3770EFBC577681153
AB0A0C936CF62AA859FF5BF51EE22B83E18C6C845457ACE837FFCB5F6CF521252B2C74F0D534709DC9E92D1782235628
you'll then need to enter pongoOS and enter that code in
This is done by compiling the pongoterm binary from the checkra1n project pongoOS then execute a few commands in Terminal.
If you have linux, you can install checkra1n
and use checkra1n -cp
it's separate. You may or may not have that binary in a folder but if not, you can just download it but I think it needs to be compiled
Or wait.. hang on
you can use this to grab your keys https://github.com/nicolas17/ipsw_keys
I'll give you the command to use for that
I don't know what iPad you have, if it's the cellular or wifi..
Wi-Fi
ipsw_keys.py -i /location/of/ipsw -w -o /location/for/keys.txt -m iPad5,1 -b 08
and with your device in PwnDFU mode, run that command (with the respected directories in place) and you'll get your keys
you might need to install python if you haven't
Where woukd keys.txt be?
If I didn't have it installed, how do you think I got sunst0rm working lol
that would be up to where you'd like to put them. It's a custom directory meaning any directory of your choosing
Oh ok
the "keys.txt" would be the file name for the keys (or whatever you want) but the directory is where
Understood
ffs
def asn1_node_next(der, (ixs,ixf,ixl)):
^
SyntaxError: invalid syntax```
@compact anchor something in the script is broken...
what vers of python are you using?
3.10.6
try a lower one
What I did to get it was not use python or py but just ran the .py as-is
Well what do I do now?
does the command work?
Which?
ipsw_keys.py -i /location/of/ipsw -w -o /location/for/keys.txt -m iPad5,1 -b 08
with python 2 or lower
No
Oh wait, let me try
How do I install it again?
sudo apt install python2 i would presume
what module
dfu
error log?
probably need the script inside pwndfu folder
or a folder with pwndfu in
File "./ipsw_keys.py", line 6, in <module>
import dfu
ImportError: No module named dfu
this is easier
the .py script will find the module automatically
the way i have it set up:
folder
ipwndfu folder
script
then i just cd to the folder
and run the script
yes
Do I just clone the repo?
sure but do it recursively
What does that mean again?
means all that's forked
git clone --recursive /.git
after running the script, you'll have the keys which then you can use to decrypt and use for sunst0rm, ssh ramdisks and setting the nonce
Where would I put the keys?
You'll have two, IV and KEY
Script's running
you'd use img4 -i /location/of/regular/ibec.im4p -o /location/of/decrypted/ibec.im4p -k IV and KEY (no spaces) -D
no, you just extract those files from it
Wouldn't I give the keys to Cryptic so he could update the firmwarejson?
copy/paste
you could, then then iphonewiki will be updated
ERROR: No Apple device in DFU Mode 0x1227 detected after 5.00 second timeout. Exiting.
tf
it's in DFU...
I'm trying to set the nonce and then tether downgrading to 14.3
The problem is that it's not setting the nonce when I have the 14.3 IPSW
I prefer rooted + no blobs
Same error
oof okay, sunst0rm is your only hope
Should I run it as sudo?
Everything's done
futurerestore just doesn't work
don't know why you need FR when you can't downgrade without blobs
you need FR for the downgrade...
and blobs to downgrade with...
yeah
unless you're using sunst0rm futurerestore
yeah
I thought you were using FR as-is
Once you get the keys, submit it to a greenie
they'll update the site
then you can use sunst0rm automatically
is it in DFU?
yes
ERROR: Device seems to be in pwned DFU Mode, but a matching configuration was not found.
@compact anchor Wait, isn't -b meant to be the board config?
huh
why is it showing this though...
you could try 0A
no
So what's the issue then?
yes
Then why is it failing
you can try matty's ipwndfu
Sure
i think spit-balling the issue is the orig ipwndfu doesn't have your particular device registered
Same error
did you download the right ipsw?
Yeah
are you using -x?
when you run checkm8, what's it say? just that?
running checkm8 outputs nothing.
Nope
and where's that error coming from? the script?
when inputting -x?
no the other error
ERROR: Device seems to be in pwned DFU Mode, but a matching configuration was not found.
Yeah, it's pwned
then the command should run regardless
So what should I do?
... run the command
which? the keys thingy?
yes
Reading manifest...
Reading keys...
ERROR: Device seems to be in pwned DFU Mode, but a matching configuration was not found.
Maybe
bash: ./ipwndfu: /usr/bin/python: bad interpreter: No such file or directory odd
ERROR: This device is not supported. tf
odd indeed
used a different fork: ERROR: Exploit failed. Device did not enter pwned DFU Mode.
@compact anchor Any idea how I could fix this?
you could dump the keys manually
ah
'tis a lot of work though
how difficult would it be?
not difficult at all
i'd keep it organized though, ibec, ibss kernelcache, trustcache, devicetree etc
Would I put it all in a text file?
i would
And do I need to use pogo
then you'd use ./ipwndfu --decrypt-gid Keybag key
What's the difference between keybag and key?
oh... I should reiterate, the keybag key is the long code that you get from the img4 command
are they all in the dfu folder?
they're the files you extracted earlier
everything?
oh no, they're in the /Firmware/DFU folder
yes but not the .plists
iBEC.ipad5.RELEASE.im4p
iBoot.ipad5.RELEASE.im4p
iBSS.ipad5.RELEASE.im4p
kernelcache.release.ipad5
LLB.ipad5.RELEASE.im4p
is that all?
and the last one is the ramdisk.. but we'll do that after you do those
those other files are easy to decrypt
another one you'll need is trustcache
that one doesn't need to be decrypted AFAIK, just patched
Can't get the keybag. It's not an im4p file...
you don't need to
i was mistaken, kernelcache isn't encrypted
So what do I do with kernelcache then?
you're good with that one, just needs to be patched
img4 -i kernelcache -o kcache.raw
Kernel64Patcher kcache.raw kcache.patched -a
Where's kcache.patched?
for the values:
/ipwndfu --decrypt-gid value the code is both the IV and Key. The IV is 32 characters and the key is 64 characters
.patched is the output of your new file
Kernel: Adding AMFI_get_out_of_my_way patch...
get_amfi_out_of_my_way_patch: Entering ...
get_amfi_out_of_my_way_patch: Kernel-8020 inputted
get_amfi_out_of_my_way_patch: Found Internal Error: No cdhash found. str loc at 0x95ec61
get_amfi_out_of_my_way_patch: Found Internal Error: No cdhash found. str ref at 0x1052c64
get_amfi_out_of_my_way_patch: Patching AMFI at 0x104e2a8
main: Writing out patched file to kcache.patched...
main: Quitting...
Is that normal?
So do I combine the two values or do them separately?
do them separatley
K
or you'll have a huge list of unorganized numbers
/usr/bin/python2: can't find '__main__' module in './ipwndfu' odd
it'll be like going into a ball pit looking for a dime
are you cd-ed into ipwndfu?
wait
ERROR: Device seems to be in pwned DFU Mode, but a matching configuration was not found. bruh
are you sure you're meant to do it in ipwndfu?
@compact anchor Congrats on member + by the way!
meh.. was mainly for repeating myself and telling a mod to be more respectful but thanks anyways
yeah.. recharge the batteries (both of them)
true
you could... sneak in an apple store and use ipwndfu there 😛
I'll decrypt the stuff tomorrow
