Print more details when installing alloc8 exploit

ErrLogic · Jun 9, 2017 · 75b0f23 · 75b0f23
1 parent 735c2ce
commit 75b0f23
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/dfuexec.py b/dfuexec.py
@@ -309,7 +309,7 @@ def add_24Kpwn_exploit_to_nor(self, nor):
         assert len(nor) == len(new_nor)
         return new_nor
 
-    def add_alloc8_exploit_to_nor(self, nor):
+    def add_alloc8_exploit_to_nor(self, nor, securerom):
         SHELLCODE_ADDRESS = 0x84026214 + 1
         MAX_SHELLCODE_LENGTH = 460
         REQUIRED_IMG3_COUNT = 714
@@ -377,7 +377,6 @@ def add_alloc8_exploit_to_nor(self, nor):
         new_nor_firmware += empty_img3_data(final_size)
 
         # Only override data abort handler, keep the rest
-        securerom = self.securerom_dump()
         securerom_block = securerom[8:8+NOR_READ_SIZE]
         new_nor_firmware += securerom_block[:40] + struct.pack('<I', SHELLCODE_ADDRESS) + securerom_block[44:]
         new_nor_firmware += '\xff' * (len(nor_firmware) - len(new_nor_firmware))

diff --git a/ipwndfu b/ipwndfu
@@ -64,9 +64,17 @@ if __name__ == '__main__':
             if device.config.version == '359.3':
                 print 'WARNING: iPhone 3GS (old bootrom) was detected. Use 24Kpwn exploit for faster boots. alloc8 exploit is supported for testing purposes only.'
                 raw_input("Press ENTER to continue.")
+
             print 'Installing alloc8 exploit to NOR.'
+
+            print 'Dumping SecureROM.'
+            securerom = device.securerom_dump()
+
             nor = device.nor_dump(saveBackup=True)
-            new_nor = device.add_alloc8_exploit_to_nor(nor)
+
+            print 'Preparing modified NOR with alloc8 exploit.'
+            new_nor = device.add_alloc8_exploit_to_nor(nor, securerom)
+
             device.flash_nor(new_nor)
 
         if opt == '--send':