Windows xpwn

I believe that wizdaz probably put the most sweat into PwnageTool, and the pwnage ramdisk is the work of Turbo. XPwn on Linux would not have been possible without libibooter, which was written by cmw, based on the Linux iPhone recovery driver written by geohot. A special shout-out to cmw, who I have been helping with winpwn. He's put a lot of hard work into winpwn, and should also be credited with doing some of the initial exploratory work with the undocumented DMG format.

There are three utilities in this package, as well as the bundles and FirmwareBundles folders from PwnageTool, and Turbo's autopwn ramdisk. The general series of steps should be to use ipsw to create a custom IPSW with the user's preferences done once per custom ipsw required , then itunespwn done once per computer so that future DFU restores will be made easier. Finally, either dfu-util Mac or Linux or idevice Windows should be used as necessary on the iPhone to perform the actual exploit necessary to allow it to accept our code.

It is technically possible to skip itunespwn and just use idevice or skip idevice and just use itunespwn, but I recommend doing both. NOTE: Important change for 2. This is important, since that's how the jailbreak actually occurs. Yes, I know, confusing syntax. You can also specify actions to exclude from the "FilesystemPatches" section of the Info. The most common use of the '-e' flag is to disable automatic activation, i. Note that the double-quotes are necessary.

This value is specified in megabytes NOT mebibytes. This allows the restore to happen much, much more quickly. This is disabled by default for unlock safety reasons. These provide instructions to BootNeuter which provides unlocking for iPhones. If you choose to use BootNeuter, you must specify the location where the 3. These cannot be included with xpwn due to copyright restrictions. If you do not specify -cleanup, BootNeuter will be accessible via SpringBoard.

The last options are for tar-files to merge. All permissions and ownership will be preserved except for already directories that already exist.

This is to prevent accidental clobbering we're guessing you don't really want to alter permissions on existing directories. This behavior may change in the future. Subsequently, if you place your phone into DFU mode and iTunes recognizes it, Apple will automatically upload an exploit file onto your phone that will allow it to accept custom firmware until it is turned off.

The custom. This utility replaces dfu-util for Windows, sidestepping the libusb requirement and provides a more user-friendly way of guiding them through DFU mode. Its arguments are analogous to dfu-util and more details can be read in that section. The difference is that iTunes' libraries are used rather than the non-proprietary dfu-util. Also, a user-friendly logo is made to appear on the iPhone upon successful completion, so an unambiguous cue can be given to the user that they are ready to use the IPSW they created.

Obviously, a CLI is by its very nature not very newbie friendly, so the primary purpose of this utility is to serve a mock-up for GUI implementors. All GUI implementors are strongly encouraged to reproduce this in their applications. This cannot be fixed by Apple on the current hardware revisions. If we can mess with the device before iTunes sees it, we can have it load a WTF with signature checking disabled with the exploit, and load an iBSS with signature checking disabled over that WTF.

If you switch the order of these steps, iTunes will be able to load software onto your device without this vulnerability, rendering dfu-util useless.

Shut down the device in the normal way if necessary Slide to shutdown. Hold down the Power and Home buttons simultaneously and count slowly to ten. You may need to push down on power an instant before you push down on home. The iPhone will start. At around the time you count to 6, the iPhone will shut down again.

Hold down both buttons until you reach At this point, release the power button ONLY. Keep holding the stand-by button forever this may take up to two minutes. Note Windows: You will know when you can stop holding the button when Windows notifies you via an audible cue that a USB device has connected. Note Linux: In terms of Linux you could do lsusb until it's seen. This is your device in DFU mode. The screen of the device will remain completely powered off.

If your screen powers on and then turns white, then you know it worked. You can now restore with iTunes. If DFU mode is too complicated for you, and you have a first-generation phone, you can still use the legacy xpwn ramdisk method on 1.

The vulnerability used is only available in firmware version 1. Specifying a boot logo and a recovery logo is optional. You can specify both, or just one.

If you do not specify a particular boot logo, the logo will remain the same as the one you currently have. NOT the one you want to upgrade to. The reason it is necessary is to provide a kernel for the ramdisk to boot and to provide template boot logos to replace. That is, it will not be recognized if you have renamed it after downloading it.

The boot and recovery logos need to be PNG formatted files that less than or equal to x in dimension. If you save in PNG and have at least one semi-transparent not fully transparent pixel in your file, you ought to be in good shape. It is safe to use xpwn multiple times consecutively, and that method can be used to swap boot logos without restoring. Both xpwn and ipsw load the entire contents of the IPSW into memory before manipulating it. This is especially useful for ipsw, because it allows all the necessary transformations to be done without writing the intermediate steps to disk and slowing the process down.

However, hefty virtual memory requirements are necessary: MB for xpwn and MB for ipsw. Most modern computers should have that much to spare. Not all of it needs to be free physical, as memory is accessed in a sequential manner so thrashing should be kept to a minimum.

In the worst case, it should be equivalent to just writing intermediate results to disk. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. These are very basic instructions on how to build xpwn related projects , they.

They are not meant to be a substitute. Install a basic build environment compilers , etc. Install some prerequisites libraries required by xpwn :. Install cmake. It is recommended you download and build it from the. Now you are ready to build xpwn.

It is highly recommended that you build. This is much neater and cleaning up is as simple as. Create a build folder. Create Makefiles. These command - lines can be substituted in for step 6. The products are in the.

Windows pwnmetheus library for QuickPwn. These command - lines can be substituted in for step 5.