linushenze / fugu14 Goto Github PK

Fugu14 is an untethered iOS 14.3-14.5.1 jailbreak

License: MIT License

Swift 67.33% JavaScript 4.90% C 23.07% Shell 0.29% Assembly 0.09% Python 0.92% Objective-C 3.40%

fugu14's Introduction

Fugu14 - Untethered iOS 14 Jailbreak

Fugu14 is an (incomplete) iOS 14 Jailbreak, including an untether (persistence), kernel exploit, kernel PAC bypass and PPL bypass. The CVE numbers of the vulnerabilities are: CVE-2021-30740, CVE-2021-30768, CVE-2021-30769, CVE-2021-30770 and CVE-2021-30773.

Supported Devices/iOS Versions

Fugu14 should support all arm64e devices (iPhone XS and newer) on iOS 14.3 - 14.5.1.
Support for lower versions (down to 14.2) can be added by editing arm/shared/ClosurePwn/Sources/ClosurePwn/PwnClosure.swift and arm/shared/KernelExploit/Sources/KernelExploit/offsets.swift.

arm64 devices are not supported because the exploit to install the Fugu14 App does not work on these devices.
However, it is in theory possible to install the untether on them (e.g. via checkra1n).
Note that all of this code was written specifically for arm64e, so some changes are required to add arm64 support to the untether.

Features

The kernel exploit is extremely reliable (it will never trigger a kernel panic)
A simple TCP shell is available on port 1337
Trustcaches put in /.Fugu14Untether/trustcaches/ will be loaded automatically
Executables put in /.Fugu14Untether/autorun/ will be launched during boot (make sure to also create a trust cache for your executable!)
Supports Siguza's libkrw library (load /usr/lib/libkrw/libFugu14Krw.dylib and call krw_initializer)
(Jailbreak Developers: You can make your jailbreak untethered just by creating a CLI version that supports libkrw, copying it to /.Fugu14Untether/autorun/ and writing a trust cache to /.Fugu14Untether/trustcaches/)

WARNING

Messing around with the untether may BOOTLOOP your device
The fast untether (disabled unless you edit the source code) HAS NOT BEEN TESTED ON A REAL DEVICE -- DO NOT USE IT
Additionally, the fast untether (in case it actually works) is more UNSAFE than the "slow" untether
Developers: PLEASE TEST ANY CHANGES YOU MAKE TO THE UNTETHER ON A VIRTUAL DEVICE FIRST

Building and Running

Requirements:

You need a supported device running a supported iOS version (see above)
The device must be connected via USB
You need the IPSW for your device, unzipped
You need to have Xcode installed
You need to have iproxy and ideviceinstaller installed (brew install usbmuxd ideviceinstaller)

To build and run the iOS Jailbreak, all you have to do is run the ios_install.py script and follow the instructions. In case you get a code signing error, open arm/iOS/Fugu14App/Fugu14App.xcodeproj and edit the code signing options.

Recovery

So you didn't read the warning section and your device is now in a bootloop. Let's hope you didn't enable the fast untether.
Anyway, before updating your device to the latest iOS version, try the following first:

Install irecovery on your computer
Connect your device via USB and boot into the recovery mode
Run irecovery -s on your computer, then enter the following commands:

setenv boot-args no_untether
saveenv
reboot

Your device should now boot again. If it doesn't, repeat step two again, run irecovery -s and then enter these commands:

setenv boot-args untether_force_restore
saveenv
reboot

Device still won't boot? Then you'll have to update it to the latest version unfortunately :/

Credits

Like most software, Fugu14 contains (derived) code which was written by others.
I would therefore like to thank the people below for open-sourcing their code:

Samuel Groß: SLOP technique (as used in the dyld exploit) and the JavaScript Int64 library (+ utils)

Currently, the remount patch has copyright issues which I'm trying to resolve ASAP. Apparently, multiple parties think the code is theirs so I don't know what to do right now. I just write this here and hope no one DMCA's me.

Fugu14 also includes various header files from Apple.

For more information, please see credits.txt.

License

Fugu14 is released under the MIT license. Please see the LICENSE file for more information.

fugu14's People

Contributors

Stargazers

Watchers

Forkers

midnightchip p-x9 baw-appie devprestigious meblackhat iplayforher turlodales 80036nd planetminguez coolstar nb100 cristianorusu alka0707 4ch12dy yftkhk zignixx aspauldingcode best-feng resistor4u melanprince nahtedetihw peterpan0927 christophersiler1980 wjllz border-fork-saver bb33bb elvis-ios zhangximufeng applohah baljeethakur weinanhu wcwcwc1920 420xnu leanwastaken jackbro jeromeyoung 4cce1er evilbitse mytfx alexsandershaw killvxk davinjs crackercat gavz ognz wendstation muyesen nowyouare xtiankisutsa kimocoder irratz prathumca binnydevel gerriarob 940842546 ktgo ajorpheus jobheger ckiosprocjet halo-michael moj3ve itjhin pangfd serendo iphone5sc b159732000 aboraid ipd805 ish4ra connorhalstead kano03 datetome geekonion piowind j2zl narakai nono473 bo0ogus dr-entropy bbhunter puppywang dianli-moli xpl0itu rompetotord ims212 callanbr r00tl34k gravitationyw h0ahuynh cjantonio59 filipk-cz ihkn neoncloud flyh2004 xcbjky narcyzzo gfam2801 cristian0b12 mayochacon emirap

fugu14's Issues

im on 14.5_18E5140k fugu14 wont launch a second time, it instantly closes...any ideas?

im on iPhone13,4_14.5_18E5140k, got all the way to the end except that i cant launch the app the second time...it seems to instantly close? anything you need from me in order to help diagnose whats going on?

Apple Dev

what do i do on the "What is the name of your iOS Signing Certificate? [Apple Dev]" part?

Phone sometimes doesn't wake from sleep.

As the title says. Only ran Fugu14. Sometimes when I try to turn on the phone it doesn't work.

List of arm64e/supported devices?

The file Fugu14App.closure doesn't exist

unc0ver still UNSUPPORTED while Fugu14 installed

Device: iPhone 12 ProMax
OS version:14.5.1

Tried several times, also have wiped all data and re-jailbreak.

Nothing changed.

Pics listed below:

I got stuck at here, please help

Please help me, almost got to the end of jailbreak but got stuck at he

re

error after entering ios signing certificate

After I enter my ios signing certificate I get the following error:
Traceback (most recent call last):
File "/Users/Stef/Downloads/Fugu14-master/ios_install.py", line 43, in
with open("arm/iOS/jailbreakd/build.sh", "r") as f:
FileNotFoundError: [Errno 2] No such file or directory: 'arm/iOS/jailbreakd/build.sh'

I have no idea how to fix this any help is appreciated!

How long does it take from "Untether/jailbreak"?

threads created step is last step?
What should I do after that?

ARM64 Support

do we have an eta for A8X-A11 ARM64 support?

Unable to build chain

[8/8] Build complete!
Signing jailbreakd
Warning: unable to build chain to self-signed root for signer "Apple Development: [email protected] (NUMBER_ID)"
.build/release/jailbreakd: errSecInternalComponent
Failed to build jailbreakd! Exit status: 1

Is it required to be an apple developer?

iOS 14.3 Unc0ver Run cicuta instead of Fugu

When I Press Jailbreak in u0 after Fugu14, u0 load cicuta exploit instead of Fugu.
this makes the jailbreak not untethered.

on iphone 11 pro 14.5.1 this does not happen as it is not compatible with cicuta.
do you have to wait for an update of u0?

Failed to set up kernel gadget

Failed to parse entitlements: AMFIUnserializeXML: syntax error near line 1

Failed to build Fugu14App! Exit status: 65

sup, what should I do after that erro

r?

how to solve it?

1.Where should I put the ipsw(unzip) file?

2.how to solve it?

com.apple.analyticsd.plist doesn't exist

iPhone Xs
iOS 14.3

The untether failed to install. Error:
Failed to install untether: Error
Domain=NSCocoaErrorDomain
Code=4 "The file
*com.apple.analyticsd.plist" doesn't
exist." Userlnfo=(NSSourceFilePathEr-
rorKey=/private/var/containers/Bundle/
Application/532A207C-8001-4810-
B5D9-71A6B7B4BBD2/
Fugu14App.app/
com.apple.analyticsd.plist,
NSUserStringVariant=(
Copy
), NSDestinationFilePath=/private/var/
mnt/Library/LaunchDaemons/
com.apple.analyticsd.plist,
NSFilePath=/private/var/containers/
Bundle/Application/
532A207C-8001-4810-
B5D9-71A6B7B4BBD2/
Fugu14App.app/
com.apple.analyticsd.plist,
NSUnderlyingError=0x10321ad60
(Error Domain=NSPOSIXErrorDomain
Code=2 "No such file or directory"))

Not Untethered(?)

I have successfully jailbroken iPhone 11 Pro 14.5.1 via unc0ver.
I installed tweaks like Filza Snowboard and other basic ones (from official repo)

I wanted to try a reboot of the phone and to my surprise on reboot it was JB-free.

still running Unc0ver Untethe jailbroken but still not untethered.

McDonalds app detects device is jailbroken

Support devices that have been jailbroken before by using unc0ver.

Due to I have already renamed the rootfs snapshot's name, Fugu14 will always shows "Already installed, Fugu14 has already been installed. Please restore the root fs if you're experienceing any problems." even it doesn't actually write any files. I think this part of the program logic should be revised.

Keep getting error 255

No matter how many times I run it, how many usb ports/cables I use, I keep getting no device found, failed to install fugu14app! Exit status 255

Failed to install Fugu14App! Exit status: -4

When running the install script I get an exit status -4 error when attempting to install from a 2009 MacBook running macOS Catalina 10.15.7 (patched using the dosdude1 Catalina Patcher). Fugu compiles but is not able to be loaded onto the iPhone.

The target device is an iPhone 12 (iPhone13,2) running iOS 14.4.2 (18D70) and is a Hong Kong variant (A2404 with physical dual SIM).

Output from the Terminal:

<output omitted>
** BUILD SUCCEEDED **

Successfully built Fugu14App
Please open the folder containing your unzipped IPSW now.
Afterwards, open the *largest* dmg in it (containing the root file system)
Press enter once you are done or Ctrl+C to abort...
Please enter the path where the dmg is mounted: /Volumes/AzulD18D70.D53gD53pOS
Creating IPAs...
  adding: Payload/ (stored 0%)
  adding: Payload/Fugu14App.app/ (stored 0%)
  adding: Payload/Fugu14App.app/_CodeSignature/ (stored 0%)
  adding: Payload/Fugu14App.app/_CodeSignature/CodeResources (deflated 69%)
  adding: Payload/Fugu14App.app/[email protected] (deflated 12%)
  adding: Payload/Fugu14App.app/jailbreakd (deflated 75%)
  adding: Payload/Fugu14App.app/Fugu14App (deflated 77%)
  adding: Payload/Fugu14App.app/Assets.car (deflated 9%)
  adding: Payload/Fugu14App.app/AppIcon76x76@2x~ipad.png (deflated 10%)
  adding: Payload/Fugu14App.app/com.apple.analyticsd.plist (deflated 25%)
  adding: Payload/Fugu14App.app/utils.js (deflated 70%)
  adding: Payload/Fugu14App.app/setup.js (deflated 75%)
  adding: Payload/Fugu14App.app/runJailbreakd.js (deflated 76%)
  adding: Payload/Fugu14App.app/trustcache (deflated 3%)
  adding: Payload/Fugu14App.app/embedded.mobileprovision (deflated 38%)
  adding: Payload/Fugu14App.app/tar (deflated 59%)
  adding: Payload/Fugu14App.app/bootstrap.tar (deflated 76%)
  adding: Payload/Fugu14App.app/Info.plist (deflated 36%)
  adding: Payload/Fugu14App.app/PkgInfo (stored 0%)
updating: Payload/Fugu14App.app/Fugu14App (deflated 77%)
IPAs created
Please make sure your device is connected via USB, unlocked and paired to this Mac
Press enter to continue or Ctrl+C to abort...
Removing Fugu14App in case it is installed...
Installing Fugu14 Setup
Failed to install Fugu14App! Exit status: -4

Trouble with 'ideviceinstaller'

I'm stuck in here, is this Xcode error or else? Thanks!

Failed to build jailbreakd! Exit status: 1

Build Completed!Signing jailbreakd
a**********@gmail.com: ambiguous (matches "Apple Development: a**********@gmail.com (78)" and "Apple Development: a**********@gmail.com (78)" in /Users/mac/Library/Keychains/login.keychain-db)
Failed to build jailbreakd! Exit status: 1

Blank app

When I open the open only a black background with a search bar on top shows up.

Linux Support

Hello there,

Thank you for releasing this project. I was wondering, would it be possible to add support for linux devices to build this? If not, why is this the case. Thank you!

xcode couldn’t find any ios app development provisioning profile

i get through everything except the signing, where it reads exactly what the title of this post says. and i know that in the read me it says to edit it with xcode editor, but i have and i’ve talked to a few people about it on jailbreak discord and no one seems to have a solution

Device Support.

I have 2 devices I want to jailbreak with Fugu14. I was wondering if I could use Fugu14 or another tool with the Fugu14 exploit (any method that makes Fugu14 work).

iPad (5th Generation) on 14.4.2 (using checkra1n atm)
iPhone 7 on 14.2 (using Taurine/unc0ver atm)

I was wondering if I could use Fugu14 at all on these devices?

Analysts

It stopped here.

Failed to build jailbreakd! Exit status: 1

Hi, what should I do?

IPSW ver must match with iDevice version?

Console log "Fugu14App' is adhoc signed.", then exit.

can not run python

Terminal.app：

python /Users/xxx/Desktop/Fugu14-master/ios_install.py

the consle is:

ios_install.py
  File "/Users/xxx/Desktop/Fugu14-master/ios_install.py", line 49
    lines.append(f'CODESIGN_IDENTITY="{csIdentity}"')
                                                   ^
SyntaxError: invalid syntax

What should I do？

SDK "iphoneos" cannot be located

can someone help me explain what path here is ment?

no file?!?!

Traceback (most recent call last):
File "/Users/user/Desktop/Fugu14-master/ios_install.py", line 43, in
with open("arm/iOS/jailbreakd/build.sh", "r") as f:
FileNotFoundError: [Errno 2] No such file or directory: 'arm/iOS/jailbreakd/build.sh'

Where do the files go

I’m trying to install this on checkra1n but I don’t know where to put the files on the device and I can’t use the app because I’m on an iPhone 7 which is arm64 and not arm64e. Where to put files?

Stuck on "Threads created" - iPhone XR 14.5.0 - Missing Offsets

I've done all the steps correctly, but it gets stuck on "Threads created" after running the Fugu14 app. Any ideas?

Failed to build Fugu14App! Exit status: 65

error: Provisioning profile "iOS Team Provisioning Profile: de.linushenze.Fugu14cb" doesn't include the currently selected device "My iMac" (identifier 00008103-001A15D90ED1001E). (in target 'Fugu14App' from project 'Fugu14App')

Please help

Error with provisioning file, I tried all I know.

after many errors, I can't find what its wrong with this one.
im sure this must be something very easy to someone who knows, I'm really sorry
this is the error

error: Provisioning profile "iOS Team Provisioning Profile: de.linushenze.Fugu14App" doesn't include the currently selected device "MY MACBOOK" (identifier XXXXXXXC-XXXXX-XXXX-XXXX-XXXXXXXXXXX). (in target 'Fugu14App' from project 'Fugu14App')

Untether/Jailbreak fails on iOS 14.3.

I have installed the app on a iPhone XS Max (iPhone11,6). I have compiled with jailbreakd successfully, however after I had pressed the "jailbreak + untether" button and rebooted, I tried connecting to the device via netcat on port 1337 and it fails to connect. My iOS version is 14.3. I had also been jailbroken with unc0ver on the latest version. I have not restored the root filesystem however.

iOS_install.py: command not found

Not sure what exactly I'm doing wrong but I have my Mac setup from previous jailbreaks. I have home-brew and all things required but for some odd reason I'm getting this
/Users/username/Desktop/GitHub/Fugu14/ios_install.py: command not found

opened terminal at fugu14 dragged and dropped file into terminal and still... any help will do.

we did a little too much trolling

trolling.mov

Device keeps turning off / Sleep Issue

iPhone 12 w 14.5

the device is not completely shut off it is in a deep sleep state I would say when the device is locked for a few minutes.
I have to press the power button like 20 times to get back to the lock screen. Is there a way to fix this sleep issue?

Reddit where its also posted: https://www.reddit.com/r/jailbreak/comments/qffn4h/help_iphone_keeps_turning_off_after_a_while_after/

remark: Incremental compilation has been disabled: it is not compatible with who and Failed to build jailbreakd! Exit status: 1

I get the two errors from the title even though I set up the signing in xcode.
Thank you for your help in advance!

what's the next step?

It says that the unc0ver app unsupport it yet. What should I d

After jailbreak and reboot can't get root shell-Exit status 255

@Brians-iMac ~ % nc localhost 1337
iDownload version 1.2 ready.
iDownload> bash
Running bash.
Although you might not see a prompt, you can still run commands.
child: Failed to launch! Error: No such file or directory
exec: Bash exit status: 255

.

The Fugu14 exploit failed on iPhone X with checkra1n jailbreak.

I know it's too early to ask for non-arm64e support, but can someone please tell me how does the dyld exploit work? I mananged to install the Fugu14 on my device (iPhone X 14.4.2) but I only got Setup failed! Error:noChainedFixups and stuck at there. It seems that the (Spotlight entitlement trustcache exploit??) doesn't work?!?

I am a noob at this. :P

Sorry for my bad English.

error: The specified item could not be found in the keychain.

not sure what I'm doing wrong again but not sure what specified item it is talking about what I run iOS_install.py it runs through process and then I get hit with:

Signing jailbreakd
error: The specified item could not be found in the keychain.
Failed to build jailbreakd! Exit status: 1

Once again any help will do...

only fugu14 app

when I reboot the iPhone, the phone desktop only Fugu14 one app, Is there something wrong？

Missing offsets for iPadOS

(ps. You should probably make an issue form for this repo so people can’t do stupid issues without context)

title says everything, iPad Mini 5 on iOS 14.5.1 fails after creating threads due to missing offsets.