geosn0w / osiris-jailbreak Goto Github PK

View Code? Open in Web Editor NEW

162.0 35.0 47.0 10.56 MB

An incomplete iOS 11.2 -> iOS 11.3.1 Jailbreak

Home Page: https://idevicecentral.com

License: Other

Objective-C 14.81% C 85.19%

jailbreak ios incomplete qilin exploit hacktoberfest

osiris-jailbreak's Introduction

Osiris-Jailbreak

ONLY FOR DEVELOPERS!

An incomplete iOS 11.2 -> iOS 11.3.1 Jailbreak by GeoSn0w (@FCE365) using multi_path (CVE-2018-4241) by Ian Beer and #QiLin by Jonathan Levin.

This jailbreak is under development and in no way whatsoever intended for general public usage. Please don't run this jailbreak on your device until I finish it as it has the potential to mess stuff up. If you're an average iOS user, please stick with Electra Jailbreak. It is safer and more stable. This is my first public jailbreak, and I am doing it just for learning purposes. Yes, this won't jailbreak your device in the true sense of the word.

Current Development (Help needed)

-> Tested on iOS 11.2.1 iPod Touch 6th Generation and iPhone 6 iOS 11.3.1

May take a few attempts for the exploit to run properly.

Update 3:

Swapped back to multi_path because empty_list is very unstable and this is a developer-only jailbreak anyways
FIXED DROPBEAR
FIXED UICACHE

Update 2:

Big improvements to the code base.
Swapped the exploit with the empty_list one. No more dev account.
Got its own website

Update 1:

Big improvements to the code base.
Can now pop a remote shell. Feel free to run commands.

### What works:

Properly runs the exploit and grants QiLin SEND right to the Kernel task_port (aka tfp0).
Nukes the Sandbox.
Nukes AMFI for CodeSign bypass
Successfully remounts the ROOTFS as R/W on iOS 11.2.6 and lower. Waiting for QiLin to be updated soon for iOS 11.3.x
Contains Jonathan Levin's binpack for 64-Bit and drops it. <-- Could be improved.
Disables iOS Updates (iOS 11.2.6 and older)
Gets you remote terminal to run commands using netcat. `nc your phone's IP 69`

What doesn't work:

Has no Cydia and I doubt I'll even bother with the current status Cydia's in.
No Substrate.
Doesn't remount the FS on iOS 11.3.x (to be fixed soon).
General code structure. This is just a sketch and code can be greatly improved.

Just in case it isn't clear for everyone yet:

THIS COMES "AS-IS". NO FURTHER SUPPORT SHOULD BE EXPECTED OR WILL BE GIVEN. USE AT YOUR OWN RISK! I AM NOT RESPONSIBLE IF IT FUCKS YOUR DEVICE!

Updates:

I'll be posting updates on the progress on my Twitter (@FCE365) and my iOS Channel: https://www.youtube.com/fce365official

Contact me

GeoSn0w (@FCE365): https://twitter.com/FCE365

Nickname etymology

GeoSn0w

Geo - Represents short for "George", my real name.

Sn0w - A common suffix used by developers in the pre-iOS 7 Jailbreak community for their utilities or their nicknames. It is almost like a magic from a header, helping someone to place you in the right category by your nickname alone (iOS Development / Jailbreaking).

Disambiguation

Some people believe I took geo from a famous iOS Hacker, George Hotz who goes by the name geohot. It is not true. As explained previously, geo is short for George. It just happens both me and Hotz have the same name.

Others believe I took Sn0w from another iOS developer, iH8Sn0w. Again, untrue. He took it from the same place I took it, where it was originally used: UltraSn0w - an iOS unlock payload from back in the days

References

QiLin: http://newosxbook.com/QiLin/
multi_path: https://bugs.chromium.org/p/project-zero/issues/detail?id=1558

My Websites

osiris-jailbreak's People

Contributors

Stargazers

Watchers

osiris-jailbreak's Issues

Should we branch it with two version?

as the vfs may always crash.

Irrelevant / Closed

out of your 48 commits, over 35(40?) are only editing README.md. And the rest were copying code from existing project done by others, do you even have a hundred line of code of your own? I doubt it. seriously, what a joke. Don't call yourself an experienced developer and offer paid courses when you're still struggling with basic syntax and programming ideas.

easy_list :P

it would be really nice if you could have a second branch with empty_list instead of multi_path for us who want to look at the stuff and learn, but don't have a developer account :P

11.3.1 remount

Hello, do you plan on working on 11.3.1 remount?
https://blog.umangis.me/persistent-r-w-on-ios-11-2-6/

Geosnow

Osiris thinks its remounting FS on 11.3.1 - iPhone 6s

Seems like Osiris thinks (presumably incorrectly) that it is remounting the FS on my device and trying to do the 'auxiliary stuff' afterwards. Not sure if this is intentional or a bug in the if (remountRootFS() == 0){ check.

[!] tfp0 read failed (os/kern) invalid address addr: 0xa681d35320003e9 err:1 port:ddc103\

Hi
Seems to fail after I click Jailbreak. Then the phone reboots. Iphone 8 global / ios 11.1.3

I'm seeing errors like this in xcode

[!] tfp0 read failed (os/kern) invalid address addr: 0xa681d35320003e9 err:1 port:ddc103
[!] tfp0 read failed (os/kern) invalid address addr: 0xa681d35320003ed err:1 port:ddc103
[!] tfp0 read failed (os/kern) invalid address addr: 0x1 err:1 port:ddc103\

The last few lines in the log before the phone reboots.

v_mount=0x0
v_flag_location=0x70
v_flag_value=0x0
setting v_flag to 0x0
Found SpringBoard's PID 55\

Kiser

Ksdf

I’m

Panic reboot at the end of process , mostly at remount or preparing the file system

https://pastebin.com/3cSNWBdQ

get [!] fork() error: Interrupted system call

fork() failed in fuckdropbear.c

2018-06-13 09:05:37.344575 yalu102[209:3585] enabled patches

2018-06-13 09:05:37.380470 yalu102[209:3585] remounting: 0

2018-06-13 09:05:37.520848 yalu102[209:3585] pid = d7

Finished unzip bootstrap.tar in /tmp

[!] fork error: Interrupted system call

NETCAT nc error

after the jailbreak succeeds the nc command throws this error.

nc 192.168.11.69 69

The process has forked and you cannot use this CoreFoundation functionality safely. You MUST exec().Break on THE_PROCESS_HAS_FORKED_AND_YOU_CANNOT_USE_THIS_COREFOUNDATION_FUNCTIONALITY___YOU_MUST_EXEC() to debug.objc[322]: +[UIAlertController initialize] may have been in progress in another thread when fork() was called.objc[322]: +[UIAlertController initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug.

Failed read from 0x5a6272302b4d3554 - kr : 0x1 Error - (os/kern) invalid address

Works fine until Bitch-Slapping AMFI

Full log: https://pastebin.com/SJJPhzBZ

add-license-1 branch unusable

You may want to delete the add-license-1 branch since you do not need it anymore!

Kiser

Tried to run it on an iPhone X

Well, bricked my device, seems to be the file system...
(swipe up to recover and can't enter passcode)

I'm absolutely not complaining, just giving info

Log:
[i] OSIRIS Jailbreak Initialized.
by GeoSn0w (@FCE365)
Thanks to Ian Beer, Jonathan Levin and Hacker Fantastic
[i] Initializing multi_path exploit by Ian Beer!.
[i] Offsets selected for iOS 11.3 or above
rlim.cur: 256
rlim.max: 9223372036854775807
rlim.cur: 10240
rlim.max: 9223372036854775807
[i] Allocating early sockets
[i] Trying to force a 16MB aligned 0x800 kalloc on to freelist
0/6...
1/6...
2/6...
3/6...
4/6...
5/6...
6/6...
1697 1698
[i] Waiting for early mptcp gc...
[i] Trying first free
doing partial overwrite with target value: 0000000000000000, length 3
err: -1
[i] Waiting for mptcp gc...
[i] trying to refill ****************
[i] Hopefully we got a pipe buffer in there... now freeing one of them
[i] Trying second free
doing partial overwrite with target value: 0000000000000000, length 3
err: -1
[i] Waiting for second mptcp gc...
[i] Checking....
full read
full read
full read
full read
full read
full read
full read
full read
full read
full read
full read
full read
full read
full read
full read
full read
full read
found an unexpected value: deadbeef000007a8
found an unexpected value: ffffffe010000228
found an unexpected value: 0000000000000000
found an unexpected value: 0000000000000000
found an unexpected value: 0000000000000000
found an unexpected value: 0000000000000000
found an unexpected value: 0000000000000000
[!] This should be the empty prealloc message
+00000000 deadbeef000007a8
+00000008 4242424242424242
+00000010 4242424242424242
+00000018 ffffffe010000228
+00000020 0000000000000000
+00000028 0000000000000000
+00000030 0000000000000000
+00000038 0000000000000000
+00000040 4242424242424242
+00000048 4242424242424242
+00000050 0000000000000000
+00000058 4242424242424242
+00000060 4242424242424242
+00000068 4242424242424242
+00000070 4242424242424242
+00000078 4242424242424242
+00000080 4242424242424242
+00000088 4242424242424242
+00000090 4242424242424242
+00000098 4242424242424242
+000000a0 4242424242424242
+000000a8 4242424242424242
+000000b0 4242424242424242
+000000b8 4242424242424242
+000000c0 4242424242424242
+000000c8 4242424242424242
+000000d0 4242424242424242
+000000d8 4242424242424242
+000000e0 4242424242424242
+000000e8 4242424242424242
+000000f0 4242424242424242
+000000f8 4242424242424242
+00000100 4242424242424242
+00000108 4242424242424242
+00000110 4242424242424242
+00000118 4242424242424242
+00000120 4242424242424242
+00000128 4242424242424242
+00000130 4242424242424242
+00000138 4242424242424242
+00000140 4242424242424242
+00000148 4242424242424242
+00000150 4242424242424242
+00000158 4242424242424242
+00000160 4242424242424242
+00000168 4242424242424242
+00000170 4242424242424242
+00000178 4242424242424242
+00000180 4242424242424242
+00000188 4242424242424242
+00000190 4242424242424242
+00000198 4242424242424242
+000001a0 4242424242424242
+000001a8 4242424242424242
+000001b0 4242424242424242
+000001b8 4242424242424242
+000001c0 4242424242424242
+000001c8 4242424242424242
+000001d0 4242424242424242
+000001d8 4242424242424242
+000001e0 4242424242424242
+000001e8 4242424242424242
+000001f0 4242424242424242
+000001f8 4242424242424242
+00000200 4242424242424242
+00000208 4242424242424242
+00000210 4242424242424242
+00000218 4242424242424242
+00000220 4242424242424242
+00000228 4242424242424242
+00000230 4242424242424242
+00000238 4242424242424242
+00000240 4242424242424242
+00000248 4242424242424242
+00000250 4242424242424242
+00000258 4242424242424242
+00000260 4242424242424242
+00000268 4242424242424242
+00000270 4242424242424242
+00000278 4242424242424242
+00000280 4242424242424242
+00000288 4242424242424242
+00000290 4242424242424242
+00000298 4242424242424242
+000002a0 4242424242424242
+000002a8 4242424242424242
+000002b0 4242424242424242
+000002b8 4242424242424242
+000002c0 4242424242424242
+000002c8 4242424242424242
+000002d0 4242424242424242
+000002d8 4242424242424242
+000002e0 4242424242424242
+000002e8 4242424242424242
+000002f0 4242424242424242
+000002f8 4242424242424242
+00000300 4242424242424242
+00000308 4242424242424242
+00000310 4242424242424242
+00000318 4242424242424242
+00000320 4242424242424242
+00000328 4242424242424242
+00000330 4242424242424242
+00000338 4242424242424242
+00000340 4242424242424242
+00000348 4242424242424242
+00000350 4242424242424242
+00000358 4242424242424242
+00000360 4242424242424242
+00000368 4242424242424242
+00000370 4242424242424242
+00000378 4242424242424242
+00000380 4242424242424242
+00000388 4242424242424242
+00000390 4242424242424242
+00000398 4242424242424242
+000003a0 4242424242424242
+000003a8 4242424242424242
+000003b0 4242424242424242
+000003b8 4242424242424242
+000003c0 4242424242424242
+000003c8 4242424242424242
+000003d0 4242424242424242
+000003d8 4242424242424242
+000003e0 4242424242424242
+000003e8 4242424242424242
+000003f0 4242424242424242
+000003f8 4242424242424242
+00000400 4242424242424242
+00000408 4242424242424242
+00000410 4242424242424242
+00000418 4242424242424242
+00000420 4242424242424242
+00000428 4242424242424242
+00000430 4242424242424242
+00000438 4242424242424242
+00000440 4242424242424242
+00000448 4242424242424242
+00000450 4242424242424242
+00000458 4242424242424242
+00000460 4242424242424242
+00000468 4242424242424242
+00000470 4242424242424242
+00000478 4242424242424242
+00000480 4242424242424242
+00000488 4242424242424242
+00000490 4242424242424242
+00000498 4242424242424242
+000004a0 4242424242424242
+000004a8 4242424242424242
+000004b0 4242424242424242
+000004b8 4242424242424242
+000004c0 4242424242424242
+000004c8 4242424242424242
+000004d0 4242424242424242
+000004d8 4242424242424242
+000004e0 4242424242424242
+000004e8 4242424242424242
+000004f0 4242424242424242
+000004f8 4242424242424242
+00000500 4242424242424242
+00000508 4242424242424242
+00000510 4242424242424242
+00000518 4242424242424242
+00000520 4242424242424242
+00000528 4242424242424242
+00000530 4242424242424242
+00000538 4242424242424242
+00000540 4242424242424242
+00000548 4242424242424242
+00000550 4242424242424242
+00000558 4242424242424242
+00000560 4242424242424242
+00000568 4242424242424242
+00000570 4242424242424242
+00000578 4242424242424242
+00000580 4242424242424242
+00000588 4242424242424242
+00000590 4242424242424242
+00000598 4242424242424242
+000005a0 4242424242424242
+000005a8 4242424242424242
+000005b0 4242424242424242
+000005b8 4242424242424242
+000005c0 4242424242424242
+000005c8 4242424242424242
+000005d0 4242424242424242
+000005d8 4242424242424242
+000005e0 4242424242424242
+000005e8 4242424242424242
+000005f0 4242424242424242
+000005f8 4242424242424242
+00000600 4242424242424242
+00000608 4242424242424242
+00000610 4242424242424242
+00000618 4242424242424242
+00000620 4242424242424242
+00000628 4242424242424242
+00000630 4242424242424242
+00000638 4242424242424242
+00000640 4242424242424242
+00000648 4242424242424242
+00000650 4242424242424242
+00000658 4242424242424242
+00000660 4242424242424242
+00000668 4242424242424242
+00000670 4242424242424242
+00000678 4242424242424242
+00000680 4242424242424242
+00000688 4242424242424242
+00000690 4242424242424242
+00000698 4242424242424242
+000006a0 4242424242424242
+000006a8 4242424242424242
+000006b0 4242424242424242
+000006b8 4242424242424242
+000006c0 4242424242424242
+000006c8 4242424242424242
+000006d0 4242424242424242
+000006d8 4242424242424242
+000006e0 4242424242424242
+000006e8 4242424242424242
+000006f0 4242424242424242
+000006f8 4242424242424242
+00000700 4242424242424242
+00000708 4242424242424242
+00000710 4242424242424242
+00000718 4242424242424242
+00000720 4242424242424242
+00000728 4242424242424242
+00000730 4242424242424242
+00000738 4242424242424242
+00000740 4242424242424242
+00000748 4242424242424242
+00000750 4242424242424242
+00000758 4242424242424242
+00000760 4242424242424242
+00000768 4242424242424242
+00000770 4242424242424242
+00000778 4242424242424242
+00000780 4242424242424242
+00000788 4242424242424242
+00000790 4242424242424242
+00000798 4242424242424242
+000007a0 4242424242424242
+000007a8 4242424242424242
+000007b0 4242424242424242
+000007b8 4242424242424242
+000007c0 4242424242424242
+000007c8 4242424242424242
+000007d0 4242424242424242
+000007d8 4242424242424242
+000007e0 4242424242424242
+000007e8 4242424242424242
+000007f0 4242424242424242
+000007f8 00adbeefdeadbeef
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
catch_exception_raise_state_identity
thread: 903
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 903
set context
message was sent
found replacer port
pipe buf and prealloc message are at ffffffe010000000
catch_exception_raise_state_identity
thread: e20e03
receive_prealloc_msg: (os/kern) successful
read val via pid_for_task: 000007a8
000007a8
read val via pid_for_task: 0030e1b0
read val via pid_for_task: ffffffe0
ipc_space_kernel: ffffffe00030e1b0
host port is on second page
WE OUT THERE
first port is at ffffffe000324000
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000000
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000000
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000013
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000014
read val via pid_for_task: 80000007
read val via pid_for_task: 80000003
read val via pid_for_task: 80000011
read val via pid_for_task: 80000004
read val via pid_for_task: 80000006
read val via pid_for_task: 80000005
read val via pid_for_task: 80000002
read val via pid_for_task: 0035a878
read val via pid_for_task: ffffffe0
read val via pid_for_task: 1acaee20
read val via pid_for_task: fffffff0
read val via pid_for_task: 00000000
read val via pid_for_task: 16b22780
read val via pid_for_task: fffffff1
[i] Kernel map:fffffff116b22780
[i] tfp0: e20e03
kernel read via second tfp0 port worked?
0x0000000000420000
0x0000000000000000
0xfffffff116b4a2d0
0xffffffe006118690
clearing premsg from port ffffffe006404dc8
[i] Clearing kmsg from port ffffffe00ffe4b28
[i] Going to try to clear up the pipes now
clearing pipebuf: ffffffe00dc012b0
clearing pipebuf: ffffffe00dc011f8
[i] Current uid=0x1f5 euid=0x1f5 gid=0x1f5 egid=0x1f5
Got root? uid=0x0 euid=0x0 gid=0x1f5 egid=0x1f5
[i] Walking kernel memory for magic address
[i] Kernel magic is at 0xfffffff01a604000
[i] KASLR slide 0x13744398
[i] Walking kernel memory for magic address
[i] Kernel magic is at 0xfffffff01a604000
[i] KASLR slide 0x13744398
Here - Kernel Base: 0xfffffff01a604000

Compressed Size: 16543356, Uncompressed: 33570816. Unknown (CRC?): 0xd9cd5aa3, Unknown 1: 0x1
2018-06-14 14:26:27.035704+0200 multi_path[7477:2732404] STATUS: Loading symbols...
64-bit2018-06-14 14:26:27.036387+0200 multi_path[7477:2732404] STATUS: Adding symbol _kernproc at address 0xfffffff0076450a8
2018-06-14 14:26:27.036408+0200 multi_path[7477:2732404] STATUS: INDEX 0
2018-06-14 14:26:27.036487+0200 multi_path[7477:2732404] STATUS: Adding symbol _rootvnode at address 0xfffffff007645090
2018-06-14 14:26:27.036542+0200 multi_path[7477:2732404] STATUS: INDEX 1
2018-06-14 14:26:27.036703+0200 multi_path[7477:2732404] STATUS: Got 64-bit kernel. Great
2018-06-14 14:26:27.036744+0200 multi_path[7477:2732404] STATUS: Loaded The QiLin Toolkit for Darwin 17.5.0 Darwin Kernel Version 17.5.0: Tue Mar 13 21:32:12 PDT 2018; root:xnu-4570.52.2~8/RELEASE_ARM64_T8015 iPhone10,6 - Dorsale-Oceanique
2018-06-14 14:26:27.036760+0200 multi_path[7477:2732404] STATUS: Adding symbol _kernproc at address 0xfffffff0075dd0a0
2018-06-14 14:26:27.036768+0200 multi_path[7477:2732404] STATUS: INDEX 2
2018-06-14 14:26:27.036775+0200 multi_path[7477:2732404] STATUS: Adding symbol _rootvnode at address 0xfffffff0075dd088
2018-06-14 14:26:27.036800+0200 multi_path[7477:2732404] STATUS: INDEX 3
2018-06-14 14:26:27.036807+0200 multi_path[7477:2732404] STATUS: Adding symbol _vfs_rootnode at address 0xfffffff0071ff700
2018-06-14 14:26:27.036815+0200 multi_path[7477:2732404] STATUS: INDEX 4
SH2:
looking for me..
2018-06-14 14:26:27.036858+0200 multi_path[7477:2732404] Symbol _kernproc for iPhone10,6, 11.3.1 - 0xfffffff0076450a8 + 0x13600000
KernCredAddr : 0xffffffe000641dd0
Got AMFI: PID 7419@0xffffffe001c80100, Task: 0xffffffe003d7f9d0
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe001c803a8): 0x0
-- process CS Flags @0xffffffe001c803a8 set to 0x22000005 (RC: 4)
VNODE INFO :
My blob is @0xffffffe001a18b40
BLOB CS FLAGS: 0x3000024
BLOB CS FLAGS NOW: 0x23000025
2018-06-14 14:26:27.037463+0200 multi_path[7477:2732404] DEBUG: Found multi_path (7477) @0xffffffe0060a8510. DAMN! Is this what processes look like in the kernel?!
procCredAddr of PID 7477: 0xffffffe0064c2d90
2018-06-14 14:26:27.037488+0200 multi_path[7477:2732404] DEBUG: SH2: MAC LABEL @0xffffffe00d13e500:
2018-06-14 14:26:27.037503+0200 multi_path[7477:2732404] STATUS: No one can contain Shai Hulud @0xffffffe00d13e510..
2018-06-14 14:26:27.037511+0200 multi_path[7477:2732404] Platformizing me...
Using cached me @0xffffffe0060a8510
2018-06-14 14:26:27.037519+0200 multi_path[7477:2732404] STATUS: Platformizing process at address 0xffffffe0060a8510
PID platformized : 7477
2018-06-14 14:26:27.037579+0200 multi_path[7477:2732404] Flicking on task @0xffffffe003d7dce8 t->flags to have TF_PLATFORM (0x401)..
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe0060a87b8): 0x0
-- process CS Flags @0xffffffe0060a87b8 set to 0x24004001 (RC: 4)
VNODE INFO :
My blob is @0xffffffe002f85b00
BLOB CS FLAGS: 0x5000020
BLOB CS FLAGS NOW: 0x25004021
[i] Borrowing entitlements...
2018-06-14 14:26:29.237247+0200 multi_path[7477:2732404] STATUS: Spawned /usr/bin/sysdiagnose -u (null)... as PID : 7479
Progress:
�[J�[2K[00%]
KILL TO SD : 0
will process list
2018-06-14 14:26:32.247876+0200 multi_path[7477:2732404] Symbol _kernproc for iPhone10,6, 11.3.1 - 0xfffffff0076450a8 + 0x13600000
KernCredAddr : 0xffffffe000641dd0
Got AMFI: PID 7419@0xffffffe001c80100, Task: 0xffffffe003d7f9d0
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe001c803a8): 0x0
-- process CS Flags @0xffffffe001c803a8 set to 0x22000005 (RC: 4)
VNODE INFO :
My blob is @0xffffffe001a18b40
BLOB CS FLAGS: 0x23000025
BLOB CS FLAGS NOW: 0x23000025
2018-06-14 14:26:32.250454+0200 multi_path[7477:2732404] DEBUG: Found multi_path (7477) @0xffffffe0060a8510. DAMN! Is this what processes look like in the kernel?!
Restoring creds from address 0xffffffe00391a9a0 to process at 0xffffffe0060a8510
procCredAddr of PID 7477: 0xffffffe0064c2d90
[i] Nuking AMFID...
2018-06-14 14:26:36.255021+0200 multi_path[7477:2732404] STATUS: i_can_haz_task_for_pid_in_user_mode, AAPL. UP YOURS
2018-06-14 14:26:36.255161+0200 multi_path[7477:2732404] STATUS: Got AMFId's port - let's castrate this bastard
SET EXCEPTION HANDLER
2018-06-14 14:26:36.256300+0200 multi_path[7477:2732404] STATUS: patched AMFI @0x104624150
2018-06-14 14:26:36.256392+0200 multi_path[7477:2732404] got amfi!
2018-06-14 14:26:38.434422+0200 multi_path[7477:2732404] STATUS: Attempting to remount rootFS...
2018-06-14 14:26:38.434597+0200 multi_path[7477:2732404] Symbol _rootvnode for iPhone10,6, 11.3.1 - 0xfffffff007645090 + 0x13600000
Actual vnode address is 0xffffffe0010b63a0
2018-06-14 14:26:38.434792+0200 multi_path[7477:2732404] DEBUG: OFFSET OF v_mount: 0xd8
2018-06-14 14:26:38.434882+0200 multi_path[7477:2732404] DEBUG: Mount flags (0xffffffe0009dde00 + 0x70) : 1480d009
2018-06-14 14:26:38.438500+0200 multi_path[7477:2732404] STATUS: Mounted / as read write :-)

Please release a basic jailbreak tool for iOS12

Dear author:
I just want to delete some annoying sound files located /System/Library/Audio/UISounds.
(such as low_power.caf, photoshutter.caf)
and completely remove the jailbreak tool as Osiris-Jailbreak do.
I do not need cydia or sileo (form chimera/unc0ver), and also the apfs snapshot made by them.
if i use restore rootfs to unjailbreak, the files i deleted will be back.
they might be good jailbreak tools, but are useless to me.
i'm not a developer, i can only hope you to release the full r/w tool you mentioned https://twitter.com/FCE365/status/1120475011649867776
btw, my iphone8+ os version is 12.0.1, which should be fully compatible with your tool.

missing qilin.o for complie

Problems building.

Your development team, "Donovan Bell", does not support the Multipath capability.
Cannot create a iOS App Development provisioning profile for "com.mid66".
Your development team, "Donovan Bell", does not support the Multipath capability.
No profiles for 'com.mid66' were found
Xcode couldn't find any iOS App Development provisioning profiles matching 'com.mid66'.

Got a white board when run it.

It says can not found references image 456456 to load a nib.....
Detail needs later when I go home.
Seems to be issue when complian it using Xcode newest beta.

zsh: failed to load module

The ssh was out here:

sh-3.2# ssh 192.168.6.86
The authenticity of host '192.168.6.86 (192.168.6.86)' can't be established.
ECDSA key fingerprint is SHA256:vAgxhpd74EcNS0cEvmN37RLtAwrI9kNP6xxzgt/TKkI.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.6.86' (ECDSA) to the list of known hosts.
[email protected]'s password: 
[319] Jun 18 09:24:30 lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
[319] Jun 18 09:24:30 lastlog_openseek: /var/log/lastlog is not a file or directory!
zsh: failed to load module `zsh/zle': dlopen(/usr/local/lib/zsh/5.0.8/zsh/zle.so, 9): image not found

The app was out here:

[i] OSIRIS Jailbreak Initialized.
by GeoSn0w (@FCE365)
Thanks to Ian Beer, Jonathan Levin and Hacker Fantastic
[i] Initializing multi_path exploit by Ian Beer!.
[i] Offsets selected for iOS 11.0 to 11.2.6
rlim.cur: 256
rlim.max: 9223372036854775807
rlim.cur: 10240
rlim.max: 9223372036854775807
[i] Allocating early sockets
[i] Trying to force a 16MB aligned 0x800 kalloc on to freelist
0/6...
1/6...
2/6...
3/6...
4/6...
5/6...
6/6...
1697 1698
[i] Waiting for early mptcp gc...
[i] Trying first free
doing partial overwrite with target value: 0000000000000000, length 3
err: -1
[i] Waiting for mptcp gc...
[i] trying to refill ****************
[i] Hopefully we got a pipe buffer in there... now freeing one of them
[i] Trying second free
doing partial overwrite with target value: 0000000000000000, length 3
err: -1
[i] Waiting for second mptcp gc...
[i] Checking....
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[i] Full read
[!] Found an unexpected value: deadbeef000007a8
[!] Found an unexpected value: ffffffe00e000228
[!] Found an unexpected value: 0000000000000000
[!] Found an unexpected value: 0000000000000000
[!] Found an unexpected value: 0000000000000000
[!] Found an unexpected value: 0000000000000000
[!] Found an unexpected value: 0000000000000000
[!] This should be the empty prealloc message
+00000000 deadbeef000007a8
+00000008 4242424242424242
+00000010 4242424242424242
+00000018 ffffffe00e000228
+00000020 0000000000000000
+00000028 0000000000000000
+00000030 0000000000000000
+00000038 0000000000000000
+00000040 4242424242424242
+00000048 4242424242424242
+00000050 0000000000000000
+00000058 4242424242424242
+00000060 4242424242424242
+00000068 4242424242424242
+00000070 4242424242424242
+00000078 4242424242424242
+00000080 4242424242424242
+00000088 4242424242424242
+00000090 4242424242424242
+00000098 4242424242424242
+000000a0 4242424242424242
+000000a8 4242424242424242
+000000b0 4242424242424242
+000000b8 4242424242424242
+000000c0 4242424242424242
+000000c8 4242424242424242
+000000d0 4242424242424242
+000000d8 4242424242424242
+000000e0 4242424242424242
+000000e8 4242424242424242
+000000f0 4242424242424242
+000000f8 4242424242424242
+00000100 4242424242424242
+00000108 4242424242424242
+00000110 4242424242424242
+00000118 4242424242424242
+00000120 4242424242424242
+00000128 4242424242424242
+00000130 4242424242424242
+00000138 4242424242424242
+00000140 4242424242424242
+00000148 4242424242424242
+00000150 4242424242424242
+00000158 4242424242424242
+00000160 4242424242424242
+00000168 4242424242424242
+00000170 4242424242424242
+00000178 4242424242424242
+00000180 4242424242424242
+00000188 4242424242424242
+00000190 4242424242424242
+00000198 4242424242424242
+000001a0 4242424242424242
+000001a8 4242424242424242
+000001b0 4242424242424242
+000001b8 4242424242424242
+000001c0 4242424242424242
+000001c8 4242424242424242
+000001d0 4242424242424242
+000001d8 4242424242424242
+000001e0 4242424242424242
+000001e8 4242424242424242
+000001f0 4242424242424242
+000001f8 4242424242424242
+00000200 4242424242424242
+00000208 4242424242424242
+00000210 4242424242424242
+00000218 4242424242424242
+00000220 4242424242424242
+00000228 4242424242424242
+00000230 4242424242424242
+00000238 4242424242424242
+00000240 4242424242424242
+00000248 4242424242424242
+00000250 4242424242424242
+00000258 4242424242424242
+00000260 4242424242424242
+00000268 4242424242424242
+00000270 4242424242424242
+00000278 4242424242424242
+00000280 4242424242424242
+00000288 4242424242424242
+00000290 4242424242424242
+00000298 4242424242424242
+000002a0 4242424242424242
+000002a8 4242424242424242
+000002b0 4242424242424242
+000002b8 4242424242424242
+000002c0 4242424242424242
+000002c8 4242424242424242
+000002d0 4242424242424242
+000002d8 4242424242424242
+000002e0 4242424242424242
+000002e8 4242424242424242
+000002f0 4242424242424242
+000002f8 4242424242424242
+00000300 4242424242424242
+00000308 4242424242424242
+00000310 4242424242424242
+00000318 4242424242424242
+00000320 4242424242424242
+00000328 4242424242424242
+00000330 4242424242424242
+00000338 4242424242424242
+00000340 4242424242424242
+00000348 4242424242424242
+00000350 4242424242424242
+00000358 4242424242424242
+00000360 4242424242424242
+00000368 4242424242424242
+00000370 4242424242424242
+00000378 4242424242424242
+00000380 4242424242424242
+00000388 4242424242424242
+00000390 4242424242424242
+00000398 4242424242424242
+000003a0 4242424242424242
+000003a8 4242424242424242
+000003b0 4242424242424242
+000003b8 4242424242424242
+000003c0 4242424242424242
+000003c8 4242424242424242
+000003d0 4242424242424242
+000003d8 4242424242424242
+000003e0 4242424242424242
+000003e8 4242424242424242
+000003f0 4242424242424242
+000003f8 4242424242424242
+00000400 4242424242424242
+00000408 4242424242424242
+00000410 4242424242424242
+00000418 4242424242424242
+00000420 4242424242424242
+00000428 4242424242424242
+00000430 4242424242424242
+00000438 4242424242424242
+00000440 4242424242424242
+00000448 4242424242424242
+00000450 4242424242424242
+00000458 4242424242424242
+00000460 4242424242424242
+00000468 4242424242424242
+00000470 4242424242424242
+00000478 4242424242424242
+00000480 4242424242424242
+00000488 4242424242424242
+00000490 4242424242424242
+00000498 4242424242424242
+000004a0 4242424242424242
+000004a8 4242424242424242
+000004b0 4242424242424242
+000004b8 4242424242424242
+000004c0 4242424242424242
+000004c8 4242424242424242
+000004d0 4242424242424242
+000004d8 4242424242424242
+000004e0 4242424242424242
+000004e8 4242424242424242
+000004f0 4242424242424242
+000004f8 4242424242424242
+00000500 4242424242424242
+00000508 4242424242424242
+00000510 4242424242424242
+00000518 4242424242424242
+00000520 4242424242424242
+00000528 4242424242424242
+00000530 4242424242424242
+00000538 4242424242424242
+00000540 4242424242424242
+00000548 4242424242424242
+00000550 4242424242424242
+00000558 4242424242424242
+00000560 4242424242424242
+00000568 4242424242424242
+00000570 4242424242424242
+00000578 4242424242424242
+00000580 4242424242424242
+00000588 4242424242424242
+00000590 4242424242424242
+00000598 4242424242424242
+000005a0 4242424242424242
+000005a8 4242424242424242
+000005b0 4242424242424242
+000005b8 4242424242424242
+000005c0 4242424242424242
+000005c8 4242424242424242
+000005d0 4242424242424242
+000005d8 4242424242424242
+000005e0 4242424242424242
+000005e8 4242424242424242
+000005f0 4242424242424242
+000005f8 4242424242424242
+00000600 4242424242424242
+00000608 4242424242424242
+00000610 4242424242424242
+00000618 4242424242424242
+00000620 4242424242424242
+00000628 4242424242424242
+00000630 4242424242424242
+00000638 4242424242424242
+00000640 4242424242424242
+00000648 4242424242424242
+00000650 4242424242424242
+00000658 4242424242424242
+00000660 4242424242424242
+00000668 4242424242424242
+00000670 4242424242424242
+00000678 4242424242424242
+00000680 4242424242424242
+00000688 4242424242424242
+00000690 4242424242424242
+00000698 4242424242424242
+000006a0 4242424242424242
+000006a8 4242424242424242
+000006b0 4242424242424242
+000006b8 4242424242424242
+000006c0 4242424242424242
+000006c8 4242424242424242
+000006d0 4242424242424242
+000006d8 4242424242424242
+000006e0 4242424242424242
+000006e8 4242424242424242
+000006f0 4242424242424242
+000006f8 4242424242424242
+00000700 4242424242424242
+00000708 4242424242424242
+00000710 4242424242424242
+00000718 4242424242424242
+00000720 4242424242424242
+00000728 4242424242424242
+00000730 4242424242424242
+00000738 4242424242424242
+00000740 4242424242424242
+00000748 4242424242424242
+00000750 4242424242424242
+00000758 4242424242424242
+00000760 4242424242424242
+00000768 4242424242424242
+00000770 4242424242424242
+00000778 4242424242424242
+00000780 4242424242424242
+00000788 4242424242424242
+00000790 4242424242424242
+00000798 4242424242424242
+000007a0 4242424242424242
+000007a8 4242424242424242
+000007b0 4242424242424242
+000007b8 4242424242424242
+000007c0 4242424242424242
+000007c8 4242424242424242
+000007d0 4242424242424242
+000007d8 4242424242424242
+000007e0 4242424242424242
+000007e8 4242424242424242
+000007f0 4242424242424242
+000007f8 00adbeefdeadbeef
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
catch_exception_raise_state_identity
thread: 1303
receive_prealloc_msg: (os/kern) successful
received prealloc message via an exception with this thread port: 1303
set context
message was sent
found replacer port
pipe buf and prealloc message are at ffffffe00e000000
catch_exception_raise_state_identity
thread: ddc203
receive_prealloc_msg: (os/kern) successful
read val via pid_for_task: 000007a8
000007a8
read val via pid_for_task: 008a5f10
read val via pid_for_task: ffffffe0
ipc_space_kernel: ffffffe0008a5f10
host port is on third page
WE OUT THERE
first port is at ffffffe0008bc000
read val via pid_for_task: 80000000
read val via pid_for_task: 80000000
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000000
read val via pid_for_task: 80000002
read val via pid_for_task: 01ae80e0
read val via pid_for_task: ffffffe0
read val via pid_for_task: 014edc70
read val via pid_for_task: ffffffe0
read val via pid_for_task: 00000021
task isn't the kernel task
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000000
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000000
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000000
read val via pid_for_task: 80000000
read val via pid_for_task: 8000001c
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001c
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 8000001a
read val via pid_for_task: 80000019
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000001
read val via pid_for_task: 80000014
read val via pid_for_task: 80000005
read val via pid_for_task: 80000004
read val via pid_for_task: 80000011
read val via pid_for_task: 80000003
read val via pid_for_task: 80000006
read val via pid_for_task: 80000007
read val via pid_for_task: 80000002
read val via pid_for_task: 008f3610
read val via pid_for_task: ffffffe0
read val via pid_for_task: 10c6c550
read val via pid_for_task: fffffff0
read val via pid_for_task: 00000000
read val via pid_for_task: 0c889e80
read val via pid_for_task: fffffff1
[i] Kernel map:fffffff10c889e80
[i] tfp0: ddc203
kernel read via second tfp0 port worked?
0x0000000000420000
0x0000000000000000
0xfffffff10c8b1c40
0xfffffff10c8b1c90
clearing premsg from port ffffffe0029eae98
[i] Clearing kmsg from port ffffffe00dfd8348
[i] Going to try to clear up the pipes now
clearing pipebuf: ffffffe00e0ae338
clearing pipebuf: ffffffe00e0ae3f0
[i] Current uid=0x1f5 euid=0x1f5 gid=0x1f5 egid=0x1f5
Got root? uid=0x0 euid=0x0 gid=0x1f5 egid=0x1f5
[i] Walking kernel memory for magic address
[i] Kernel magic is at 0xfffffff010604000
[i] KASLR slide 0x9744398
[i] Walking kernel memory for magic address
[i] Kernel magic is at 0xfffffff010604000
[i] KASLR slide 0x9744398
Here - Kernel Base: 0xfffffff010604000

Compressed Size: 15385299, Uncompressed: 30982144. Unknown (CRC?): 0x3597ab22, Unknown 1: 0x1
2018-06-18 09:22:48.580873+0800 multi_path[264:6301] STATUS: Loading symbols...
64-bit2018-06-18 09:22:48.581605+0800 multi_path[264:6301] STATUS: Adding symbol _kernproc at address 0xfffffff0076740a0
2018-06-18 09:22:48.581646+0800 multi_path[264:6301] STATUS: INDEX 0
2018-06-18 09:22:48.581769+0800 multi_path[264:6301] STATUS: Adding symbol _rootvnode at address 0xfffffff007674088
2018-06-18 09:22:48.581778+0800 multi_path[264:6301] STATUS: INDEX 1
2018-06-18 09:22:48.581941+0800 multi_path[264:6301] STATUS: Got 64-bit kernel. Great
2018-06-18 09:22:48.581978+0800 multi_path[264:6301] STATUS: Loaded The QiLin Toolkit for Darwin 17.3.0 Darwin Kernel Version 17.3.0: Mon Nov  6 21:19:18 PST 2017; root:xnu-4570.32.1~1/RELEASE_ARM64_T8010 iPhone9,2 - iPhone
2018-06-18 09:22:48.582009+0800 multi_path[264:6301] STATUS: Adding symbol _kernproc at address 0xfffffff0075dd0a0
2018-06-18 09:22:48.582032+0800 multi_path[264:6301] STATUS: INDEX 2
2018-06-18 09:22:48.582040+0800 multi_path[264:6301] STATUS: Adding symbol _rootvnode at address 0xfffffff0075dd088
2018-06-18 09:22:48.582053+0800 multi_path[264:6301] STATUS: INDEX 3
2018-06-18 09:22:48.582059+0800 multi_path[264:6301] STATUS: Adding symbol _vfs_rootnode at address 0xfffffff0071ff700
2018-06-18 09:22:48.582067+0800 multi_path[264:6301] STATUS: INDEX 4
SH2:
looking for me..
2018-06-18 09:22:48.582104+0800 multi_path[264:6301] Symbol _kernproc for iPhone9,2, 11.2.1 - 0xfffffff0076740a0 + 0x9600000
KernCredAddr : 0xffffffe000b7a010
Got AMFI: PID 219@0xffffffe00553b8e0, Task: 0xffffffe005367610
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe00553bb88): 0x79
-- process CS Flags @0xffffffe00553bb88 set to  0x22000005 (RC: 4)
VNODE INFO : 
My blob is @0xffffffe0054ff480
BLOB CS FLAGS: 0x3000024
BLOB CS FLAGS NOW: 0x23000025
2018-06-18 09:22:48.582672+0800 multi_path[264:6301] DEBUG: Found multi_path (264) @0xffffffe001b58510. DAMN! Is this what processes look like in the kernel?!
procCredAddr of PID 264:  0xffffffe0059d5680
2018-06-18 09:22:48.582700+0800 multi_path[264:6301] DEBUG: SH2: MAC LABEL @0xffffffe002b161a0:
2018-06-18 09:22:48.582710+0800 multi_path[264:6301] STATUS: No one can contain Shai Hulud @0xffffffe002b161b0..
2018-06-18 09:22:48.582718+0800 multi_path[264:6301] Platformizing me...
Using cached me @0xffffffe001b58510
2018-06-18 09:22:48.582726+0800 multi_path[264:6301] STATUS: Platformizing process at address 0xffffffe001b58510
PID platformized : 264
2018-06-18 09:22:48.582742+0800 multi_path[264:6301] Flicking on task @0xffffffe005edbb78 t->flags to have TF_PLATFORM (0x401)..
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe001b587b8): 0x0
-- process CS Flags @0xffffffe001b587b8 set to  0x24004001 (RC: 4)
VNODE INFO : 
My blob is @0xffffffe005f97000
BLOB CS FLAGS: 0x5000020
BLOB CS FLAGS NOW: 0x25004021
[i] Borrowing entitlements...
2018-06-18 09:22:50.794176+0800 multi_path[264:6301] STATUS: Spawned /usr/bin/sysdiagnose -u (null)... as PID : 266
sysdiagnose version 3.0 (510)
The case is Companion only

Enter TIME SENSITIVE phase
Executing container: tailspin...
Executing container: spindump...
KILL TO SD : 0
will process list
2018-06-18 09:22:53.808816+0800 multi_path[264:6301] Symbol _kernproc for iPhone9,2, 11.2.1 - 0xfffffff0076740a0 + 0x9600000
KernCredAddr : 0xffffffe000b7a010
Got AMFI: PID 219@0xffffffe00553b8e0, Task: 0xffffffe005367610
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe00553bb88): 0x0
-- process CS Flags @0xffffffe00553bb88 set to  0x22000005 (RC: 4)
VNODE INFO : 
My blob is @0xffffffe0054ff480
BLOB CS FLAGS: 0x23000025
BLOB CS FLAGS NOW: 0x23000025
2018-06-18 09:22:53.809444+0800 multi_path[264:6301] DEBUG: Found sysdiagnose (266) @0xffffffe005538c30. DAMN! Is this what processes look like in the kernel?!
PID 266 PROC STRUCT IS AT ffffffe005538c30. CREDS (0xffffffe005538d30) are 0xffffffe0059d5950
got cred addr ffffffe0059d5950
2018-06-18 09:22:53.809464+0800 multi_path[264:6301] Symbol _kernproc for iPhone9,2, 11.2.1 - 0xfffffff0076740a0 + 0x9600000
KernCredAddr : 0xffffffe000b7a010
Got AMFI: PID 219@0xffffffe00553b8e0, Task: 0xffffffe005367610
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe00553bb88): 0x0
-- process CS Flags @0xffffffe00553bb88 set to  0x22000005 (RC: 4)
VNODE INFO : 
My blob is @0xffffffe0054ff480
BLOB CS FLAGS: 0x23000025
BLOB CS FLAGS NOW: 0x23000025
2018-06-18 09:22:53.810257+0800 multi_path[264:6301] DEBUG: Found multi_path (264) @0xffffffe001b58510. DAMN! Is this what processes look like in the kernel?!
Restoring creds from address 0xffffffe0059d5950 to process at 0xffffffe001b58510
procCredAddr of PID 264:  0xffffffe0059d5680
Executing container: tailspin-history...
Executing container: processesInfo...
Executing container: systemInfo...
[i] Drop Kicking AMFID...
2018-06-18 09:22:58.812899+0800 multi_path[264:6301] STATUS: i_can_haz_task_for_pid_in_user_mode, AAPL. UP YOURS
2018-06-18 09:22:58.813069+0800 multi_path[264:6301] STATUS: Got AMFId's port - let's castrate this bastard
SET EXCEPTION HANDLER
2018-06-18 09:22:58.813470+0800 multi_path[264:6301] STATUS: patched AMFI @0x100da8150
2018-06-18 09:22:58.813526+0800 multi_path[264:6301] got amfi!
Executing container: powermetrics...
Executing container: smcdiagnose...

Enter LOG GENERATION & LOG COPYING phases
Executing container: Panics...
Executing container: process crashes and spins...
Executing container: HCI...
Executing container: internalLogs...
Executing container: logs/Bluetooth/CoreCapture...
Executing container: logs/Bluetooth/CoreCapture...
Executing container: MobileInstallation...
Executing container: MobileContainerManager...
Executing container: Utility...
Executing container: Networking...
Executing container: MobileActivation...
Executing container: MobileLockdown...
Executing container: MobileBackup...
Executing container: itunesstored...
Executing container: appinstallation...
Executing container: LaunchServices...
Executing container: AppConduit...
Executing container: Accounts...
Executing container: process proxied device logs...
Executing container: ProtectedCloudStorage...
Executing container: AVConference...
Executing container: Siri...
Executing container: ATVUpdateLog...
Executing container: AccessibilityPrefs...
Executing container: parsecd...
Executing container: keyboard cache...
Executing container: CloudKitBookmarks...
Executing container: demod...
Executing container: WatchConnectivity...
Executing container: SystemVersion...
Executing container: stackshots...
Executing container: ioreg...
2018-06-18 09:23:00.991322+0800 multi_path[264:6301] STATUS: Attempting to remount rootFS...
2018-06-18 09:23:00.991366+0800 multi_path[264:6301] Symbol _rootvnode for iPhone9,2, 11.2.1 - 0xfffffff007674088 + 0x9600000
Actual vnode address is 0xffffffe0014923a0
2018-06-18 09:23:00.991392+0800 multi_path[264:6301] DEBUG: OFFSET OF v_mount: 0xd8
2018-06-18 09:23:00.991404+0800 multi_path[264:6301] DEBUG: Mount flags (0xffffffe000fb1400 + 0x70) : 1480d009
2018-06-18 09:23:00.993136+0800 multi_path[264:6301] STATUS: Mounted / as read write :-)
Executing container: suggestToolTasks...
Executing container: brctl...
Executing container: brctl...
Executing container: nightshift...
Executing container: logs/StoreServices...
Executing container: logs/StoreServices...
Executing container: /var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/sysdiagnose/IN_PROGRESS_sysdiagnose_2018.06.18_09-22-50+0800_iPhone_OS_iPhone_15C153.tmp/logs/AWD...
Executing container: logs/AWD...
Executing container: /var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/sysdiagnose/IN_PROGRESS_sysdiagnose_2018.06.18_09-22-50+0800_iPhone_OS_iPhone_15C153.tmp/logs/CoreMedia...
Executing container: logs/CoreMedia/...
Executing container: /var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/sysdiagnose/IN_PROGRESS_sysdiagnose_2018.06.18_09-22-50+0800_iPhone_OS_iPhone_15C153.tmp/logs/powerlogs...
Executing container: logs/powerlogs/...
Executing container: /var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/sysdiagnose/IN_PROGRESS_sysdiagnose_2018.06.18_09-22-50+0800_iPhone_OS_iPhone_15C153.tmp/WiFi...
Move file : /var/containers/Bundle/Application/2A6A038F-CA24-4C2C-897E-E9DC4AA816EB/multi_path.app/tar to /jb/tar - RC :0
Move file : /var/containers/Bundle/Application/2A6A038F-CA24-4C2C-897E-E9DC4AA816EB/multi_path.app/sh to /jb/sh - RC :0
Move file : /var/containers/Bundle/Application/2A6A038F-CA24-4C2C-897E-E9DC4AA816EB/multi_path.app/bash to /jb/bin/bash - RC :0
Move file : /var/containers/Bundle/Application/2A6A038F-CA24-4C2C-897E-E9DC4AA816EB/multi_path.app/binpack64-256.tar to /jb/binpack64-256.tar - RC :0
2018-06-18 09:23:05.355549+0800 multi_path[264:6301] stat on /var/containers/Bundle/Application/2A6A038F-CA24-4C2C-897E-E9DC4AA816EB/multi_path.app/su: No such file or directory
Move file : /var/containers/Bundle/Application/2A6A038F-CA24-4C2C-897E-E9DC4AA816EB/multi_path.app/su to /jb/su - RC :-1
Using cached me @0xffffffe001b58510
Before - My UID: 0 (kernel: 0), My GID: 501 (kernel: 0)
current CS Flags: 0x0
AFTER: 0x20004005
After - My UID: 0 (kernel: 0), My GID: 501 (kernel: 0)
TASK: 0xddc10f, Thread: 0x110000 - CODE: 0xe22c07/0x110000, flavor: 1
2018-06-18 09:23:05.375129+0800 multi_path[264:7036] Got request - kr: 0 - FileName (@0x16f1f8558): /jb/tar
Got Header with 18 Load commands
GOT BLOB, MAGIC: 0xfade0cc0, offset: 24,  type: 0
CD Blob magic: 0x20cdefa
CD Hash: 
d1 21 b2 de 17 78 56 31 83 08 72 38 c4 67 53 16 .!...xV1..r8.gS.
17 6f 15 9d 30 71 99 1d 85 82 cf 8c 28 bd 4b b9 .o..0q......(.K.

2018-06-18 09:23:05.378403+0800 multi_path[264:7036] DEBUG: writing cdhash (ffffffd1 21 ffffffb2... ) to 0x16f1f84c4 - kr 0
will resume at 0x100da7000
set state 0 - Cnt: 68
2018-06-18 09:23:05.391630+0800 multi_path[264:6301] STATUS: Spawned /jb/tar -C /jb... as PID : 303
amfidebilitate
./._bin
bin/
bin/._cat
bin/cat
bin/._launchctl
bin/launchctl
bin/._pwd
bin/pwd
bin/._sleep
bin/sleep
bin/._stty
bin/stty
bin/._date
bin/date
bin/._bash
bin/bash
bin/._kill
bin/kill
bin/._sh
bin/sh
bin/._dd
bin/dd
bin/._mkdir
bin/mkdir
bin/._hostname
bin/hostname
bin/._rmdir
bin/rmdir
bin/._mv
bin/mv
bin/._ln
bin/ln
bin/._ls
bin/ls
bin/._cp
bin/cp
bin/._sync
bin/sync
bin/._zsh
bin/zsh
bin/._chmod
bin/chmod
bin/._rm
bin/rm
default.ent
./._etc
etc/
etc/._ssl
etc/ssl
etc/._zshrc
etc/zshrc
etc/._dropbear
etc/dropbear/
etc/._profile
etc/profile
etc/._apt
etc/apt/
etc/._alternatives
etc/alternatives/
etc/._dpkg
etc/dpkg/
etc/._motd
etc/motd
etc/dpkg/._dselect.cfg.d
etc/dpkg/dselect.cfg.d/
etc/dpkg/._dpkg.cfg.d
etc/dpkg/dpkg.cfg.d/
etc/alternatives/._README
etc/alternatives/README
etc/apt/._sources.list.d
etc/apt/sources.list.d/
etc/apt/._trusted.gpg.d
etc/apt/trusted.gpg.d/
etc/apt/trusted.gpg.d/._zodttd.gpg
etc/apt/trusted.gpg.d/zodttd.gpg
etc/apt/trusted.gpg.d/._bigboss.gpg
etc/apt/trusted.gpg.d/bigboss.gpg
etc/apt/trusted.gpg.d/._modmyi.gpg
etc/apt/trusted.gpg.d/modmyi.gpg
etc/apt/trusted.gpg.d/._saurik.gpg
etc/apt/trusted.gpg.d/saurik.gpg
etc/apt/sources.list.d/._cydia.list
etc/apt/sources.list.d/cydia.list
etc/apt/sources.list.d/._saurik.list
etc/apt/sources.list.d/saurik.list
./._makeMeAtHome.sh
makeMeAtHome.sh
removeMe.sh
./._sbin
sbin/
sbin/._md5
sbin/md5
sbin/._ping
sbin/ping
sbin/._shutdown
sbin/shutdown
sbin/._ifconfig
sbin/ifconfig
sbin/umount
sbin/._kextunload
sbin/kextunload
sbin/._mknod
sbin/mknod
sbin/._dmesg
sbin/dmesg
./._usr
usr/
usr/._bin
usr/bin/
usr/._sbin
usr/sbin/
usr/._local
usr/local/
usr/._share
usr/share/
usr/share/._terminfo
usr/share/terminfo/
usr/share/terminfo/._61
usr/share/terminfo/61/
usr/share/terminfo/._73
usr/share/terminfo/73/
usr/share/terminfo/._6c
usr/share/terminfo/6c/
usr/share/terminfo/._76
usr/share/terminfo/76/
usr/share/terminfo/._78
usr/share/terminfo/78/
usr/share/terminfo/78/._xterm-256color
usr/share/terminfo/78/xterm-256color
usr/share/terminfo/76/._vt100-putty
usr/share/terminfo/76/vt100-putty
usr/share/terminfo/76/._vt100-nav-w
usr/share/terminfo/76/vt100-nav-w
usr/share/terminfo/76/._vt100-s
usr/share/terminfo/76/vt100-s
usr/share/terminfo/76/._vt100+
usr/share/terminfo/76/vt100+
usr/share/terminfo/76/._vt100nam
usr/share/terminfo/76/vt100nam
usr/share/terminfo/76/._vt100-vb
usr/share/terminfo/76/vt100-vb
usr/share/terminfo/76/._vt100+enq
usr/share/terminfo/76/vt100+enq
usr/share/terminfo/76/._vt100-s-top
usr/share/terminfo/76/vt100-s-top
usr/share/terminfo/76/._vt100-nam-w
usr/share/terminfo/76/vt100-nam-w
usr/share/terminfo/76/._vt100+fnkeys
usr/share/terminfo/76/vt100+fnkeys
usr/share/terminfo/76/._vt100-w
usr/share/terminfo/76/vt100-w
usr/share/terminfo/76/._vt100
usr/share/terminfo/76/vt100
usr/share/terminfo/76/._vt100-w-nav
usr/share/terminfo/76/vt100-w-nav
usr/share/terminfo/76/._vt100-bot-s
usr/share/terminfo/76/vt100-bot-s
usr/share/terminfo/76/._vt100-w-nam
usr/share/terminfo/76/vt100-w-nam
usr/share/terminfo/76/._vt100+pfkeys
usr/share/terminfo/76/vt100+pfkeys
usr/share/terminfo/76/._vt100-top-s
usr/share/terminfo/76/vt100-top-s
usr/share/terminfo/76/._vt100-nav
usr/share/terminfo/76/vt100-nav
usr/share/terminfo/76/._vt100-nam
usr/share/terminfo/76/vt100-nam
usr/share/terminfo/76/._vt100-bm-o
usr/share/terminfo/76/vt100-bm-o
usr/share/terminfo/76/._vt100+keypad
usr/share/terminfo/76/vt100+keypad
usr/share/terminfo/76/._vt100-am
usr/share/terminfo/76/vt100-am
usr/share/terminfo/76/._vt100-s-bot
usr/share/terminfo/76/vt100-s-bot
usr/share/terminfo/76/._vt100-w-am
usr/share/terminfo/76/vt100-w-am
usr/share/terminfo/76/._vt100-bm
usr/share/terminfo/76/vt100-bm
usr/share/terminfo/6c/._linux-lat
usr/share/terminfo/6c/linux-lat
usr/share/terminfo/6c/._linux-koi8r
usr/share/terminfo/6c/linux-koi8r
usr/share/terminfo/6c/._linux-vt
usr/share/terminfo/6c/linux-vt
usr/share/terminfo/6c/._linux-basic
usr/share/terminfo/6c/linux-basic
usr/share/terminfo/6c/._linux
usr/share/terminfo/6c/linux
usr/share/terminfo/6c/._linux-c-nc
usr/share/terminfo/6c/linux-c-nc
usr/share/terminfo/6c/._linux2.6.26
usr/share/terminfo/6c/linux2.6.26
usr/share/terminfo/6c/._linux-c
usr/share/terminfo/6c/linux-c
usr/share/terminfo/6c/._linux-m
usr/share/terminfo/6c/linux-m
usr/share/terminfo/6c/._linux-nic
usr/share/terminfo/6c/linux-nic
usr/share/terminfo/6c/._linux-koi8
usr/share/terminfo/6c/linux-koi8
usr/share/terminfo/73/._screen-16color
usr/share/terminfo/73/screen-16color
usr/share/terminfo/73/._screen2
usr/share/terminfo/73/screen2
usr/share/terminfo/73/._screen3
usr/share/terminfo/73/screen3
usr/share/terminfo/73/._screen-16color-bce-s
usr/share/terminfo/73/screen-16color-bce-s
usr/share/terminfo/73/._screen-256color-bce
usr/share/terminfo/73/screen-256color-bce
usr/share/terminfo/73/._screen.rxvt
usr/share/terminfo/73/screen.rxvt
usr/share/terminfo/73/._screen.xterm-r6
usr/share/terminfo/73/screen.xterm-r6
usr/share/terminfo/73/._screen-w
usr/share/terminfo/73/screen-w
usr/share/terminfo/73/._screen.xterm-xfree86
usr/share/terminfo/73/screen.xterm-xfree86
usr/share/terminfo/73/._screen-16color-s
usr/share/terminfo/73/screen-16color-s
usr/share/terminfo/73/._screen.linux
usr/share/terminfo/73/screen.linux
usr/share/terminfo/73/._screen-256color-bce-s
usr/share/terminfo/73/screen-256color-bce-s
usr/share/terminfo/73/._screen
usr/share/terminfo/73/screen
usr/share/terminfo/73/._screen-bce
usr/share/terminfo/73/screen-bce
usr/share/terminfo/73/._screen-256color-s
usr/share/terminfo/73/screen-256color-s
usr/share/terminfo/73/._screen.mlterm
usr/share/terminfo/73/screen.mlterm
usr/share/terminfo/73/._screen-s
usr/share/terminfo/73/screen-s
usr/share/terminfo/73/._screen.teraterm
usr/share/terminfo/73/screen.teraterm
usr/share/terminfo/73/._screen-16color-bce
usr/share/terminfo/73/screen-16color-bce
usr/share/terminfo/73/._screen.xterm-new
usr/share/terminfo/73/screen.xterm-new
usr/share/terminfo/73/._screen-256color
usr/share/terminfo/73/screen-256color
usr/share/terminfo/73/._screen+fkeys
usr/share/terminfo/73/screen+fkeys
usr/share/terminfo/61/._ansi80x50-mono
usr/share/terminfo/61/ansi80x50-mono
usr/share/terminfo/61/._ansi+idl1
usr/share/terminfo/61/ansi+idl1
usr/share/terminfo/61/._ansil
usr/share/terminfo/61/ansil
usr/share/terminfo/61/._ansi+idc
usr/share/terminfo/61/ansi+idc
usr/share/terminfo/61/._ansiw
usr/share/terminfo/61/ansiw
usr/share/terminfo/61/._ansi80x30
usr/share/terminfo/61/ansi80x30
usr/share/terminfo/61/._ansi-mono
usr/share/terminfo/61/ansi-mono
usr/share/terminfo/61/._ansi+pp
usr/share/terminfo/61/ansi+pp
usr/share/terminfo/61/._ansi+idl
usr/share/terminfo/61/ansi+idl
usr/share/terminfo/61/._ansil-mono
usr/share/terminfo/61/ansil-mono
usr/share/terminfo/61/._ansi80x30-mono
usr/share/terminfo/61/ansi80x30-mono
usr/share/terminfo/61/._ansi80x25-raw
usr/share/terminfo/61/ansi80x25-raw
usr/share/terminfo/61/._ansi+csr
usr/share/terminfo/61/ansi+csr
usr/share/terminfo/61/._ansi-generic
usr/share/terminfo/61/ansi-generic
usr/share/terminfo/61/._ansi+sgr
usr/share/terminfo/61/ansi+sgr
usr/share/terminfo/61/._ansi+cup
usr/share/terminfo/61/ansi+cup
usr/share/terminfo/61/._ansi-emx
usr/share/terminfo/61/ansi-emx
usr/share/terminfo/61/._ansi+sgrbold
usr/share/terminfo/61/ansi+sgrbold
usr/share/terminfo/61/._ansi+sgrul
usr/share/terminfo/61/ansi+sgrul
usr/share/terminfo/61/._ansi80x60-mono
usr/share/terminfo/61/ansi80x60-mono
usr/share/terminfo/61/._ansi+sgrso
usr/share/terminfo/61/ansi+sgrso
usr/share/terminfo/61/._ansi
usr/share/terminfo/61/ansi
usr/share/terminfo/61/._ansi-color-2-emx
usr/share/terminfo/61/ansi-color-2-emx
usr/share/terminfo/61/._ansis-mono
usr/share/terminfo/61/ansis-mono
usr/share/terminfo/61/._ansi-color-3-emx
usr/share/terminfo/61/ansi-color-3-emx
usr/share/terminfo/61/._ansisysk
usr/share/terminfo/61/ansisysk
usr/share/terminfo/61/._ansi43m
usr/share/terminfo/61/ansi43m
usr/share/terminfo/61/._ansi-mtabs
usr/share/terminfo/61/ansi-mtabs
usr/share/terminfo/61/._ansi+sgrdim
usr/share/terminfo/61/ansi+sgrdim
usr/share/terminfo/61/._ansi80x25
usr/share/terminfo/61/ansi80x25
usr/share/terminfo/61/._ansi+erase
usr/share/terminfo/61/ansi+erase
usr/share/terminfo/61/._ansi+rep
usr/share/terminfo/61/ansi+rep
usr/share/terminfo/61/._ansis
usr/share/terminfo/61/ansis
usr/share/terminfo/61/._ansi80x50
usr/share/terminfo/61/ansi80x50
usr/share/terminfo/61/._ansi+tabs
usr/share/terminfo/61/ansi+tabs
usr/share/terminfo/61/._ansi+local1
usr/share/terminfo/61/ansi+local1
usr/share/terminfo/61/._ansi80x60
usr/share/terminfo/61/ansi80x60
usr/share/terminfo/61/._ansi+rca
usr/share/terminfo/61/ansi+rca
usr/share/terminfo/61/._ansi-mini
usr/share/terminfo/61/ansi-mini
usr/share/terminfo/61/._ansi+enq
usr/share/terminfo/61/ansi+enq
usr/share/terminfo/61/._ansi-nt
usr/share/terminfo/61/ansi-nt
usr/share/terminfo/61/._ansi77
usr/share/terminfo/61/ansi77
usr/share/terminfo/61/._ansi-mr
usr/share/terminfo/61/ansi-mr
usr/share/terminfo/61/._ansi80x43-mono
usr/share/terminfo/61/ansi80x43-mono
usr/share/terminfo/61/._ansi.sys
usr/share/terminfo/61/ansi.sys
usr/share/terminfo/61/._ansi.sys-old
usr/share/terminfo/61/ansi.sys-old
usr/share/terminfo/61/._ansi.sysk
usr/share/terminfo/61/ansi.sysk
usr/share/terminfo/61/._ansi80x25-mono
usr/share/terminfo/61/ansi80x25-mono
usr/share/terminfo/61/._ansi+inittabs
usr/share/terminfo/61/ansi+inittabs
usr/share/terminfo/61/._ansi+local
usr/share/terminfo/61/ansi+local
usr/share/terminfo/61/._ansi-m
usr/share/terminfo/61/ansi-m
usr/share/terminfo/61/._ansi80x43
usr/share/terminfo/61/ansi80x43
usr/share/terminfo/61/._ansi+arrows
usr/share/terminfo/61/ansi+arrows
usr/local/._bin
usr/local/bin/
usr/local/._lib
usr/local/lib/
usr/local/lib/._zsh
usr/local/lib/zsh/
usr/local/lib/zsh/._5.0.8
usr/local/lib/zsh/5.0.8/
usr/local/lib/zsh/5.0.8/._zsh
usr/local/lib/zsh/5.0.8/zsh/
usr/local/lib/zsh/5.0.8/zsh/._termcap.so
usr/local/lib/zsh/5.0.8/zsh/termcap.so
usr/local/lib/zsh/5.0.8/zsh/._zleparameter.so
usr/local/lib/zsh/5.0.8/zsh/zleparameter.so
usr/local/lib/zsh/5.0.8/zsh/._example.so
usr/local/lib/zsh/5.0.8/zsh/example.so
usr/local/lib/zsh/5.0.8/zsh/._tcp.so
usr/local/lib/zsh/5.0.8/zsh/tcp.so
usr/local/lib/zsh/5.0.8/zsh/._newuser.so
usr/local/lib/zsh/5.0.8/zsh/newuser.so
usr/local/lib/zsh/5.0.8/zsh/._deltochar.so
usr/local/lib/zsh/5.0.8/zsh/deltochar.so
usr/local/lib/zsh/5.0.8/zsh/._complete.so
usr/local/lib/zsh/5.0.8/zsh/complete.so
usr/local/lib/zsh/5.0.8/zsh/._mapfile.so
usr/local/lib/zsh/5.0.8/zsh/mapfile.so
usr/local/lib/zsh/5.0.8/zsh/._stat.so
usr/local/lib/zsh/5.0.8/zsh/stat.so
usr/local/lib/zsh/5.0.8/zsh/._compctl.so
usr/local/lib/zsh/5.0.8/zsh/compctl.so
usr/local/lib/zsh/5.0.8/zsh/._zselect.so
usr/local/lib/zsh/5.0.8/zsh/zselect.so
usr/local/lib/zsh/5.0.8/zsh/._parameter.so
usr/local/lib/zsh/5.0.8/zsh/parameter.so
usr/local/lib/zsh/5.0.8/zsh/._datetime.so
usr/local/lib/zsh/5.0.8/zsh/datetime.so
usr/local/lib/zsh/5.0.8/zsh/._socket.so
usr/local/lib/zsh/5.0.8/zsh/socket.so
usr/local/lib/zsh/5.0.8/zsh/._terminfo.so
usr/local/lib/zsh/5.0.8/zsh/terminfo.so
usr/local/lib/zsh/5.0.8/zsh/._clone.so
usr/local/lib/zsh/5.0.8/zsh/clone.so
usr/local/lib/zsh/5.0.8/zsh/._regex.so
usr/local/lib/zsh/5.0.8/zsh/regex.so
usr/local/lib/zsh/5.0.8/zsh/._attr.so
usr/local/lib/zsh/5.0.8/zsh/attr.so
usr/local/lib/zsh/5.0.8/zsh/._curses.so
usr/local/lib/zsh/5.0.8/zsh/curses.so
usr/local/lib/zsh/5.0.8/zsh/._files.so
usr/local/lib/zsh/5.0.8/zsh/files.so
usr/local/lib/zsh/5.0.8/zsh/._system.so
usr/local/lib/zsh/5.0.8/zsh/system.so
usr/local/lib/zsh/5.0.8/zsh/._zpty.so
usr/local/lib/zsh/5.0.8/zsh/zpty.so
usr/local/lib/zsh/5.0.8/zsh/._zle.so
usr/local/lib/zsh/5.0.8/zsh/zle.so
usr/local/lib/zsh/5.0.8/zsh/._mathfunc.so
usr/local/lib/zsh/5.0.8/zsh/mathfunc.so
usr/local/lib/zsh/5.0.8/zsh/._zutil.so
usr/local/lib/zsh/5.0.8/zsh/zutil.so
usr/local/lib/zsh/5.0.8/zsh/._complist.so
usr/local/lib/zsh/5.0.8/zsh/complist.so
usr/local/lib/zsh/5.0.8/zsh/._zftp.so
usr/local/lib/zsh/5.0.8/zsh/zftp.so
usr/local/lib/zsh/5.0.8/zsh/._cap.so
usr/local/lib/zsh/5.0.8/zsh/cap.so
usr/local/lib/zsh/5.0.8/zsh/._computil.so
usr/local/lib/zsh/5.0.8/zsh/computil.so
usr/local/lib/zsh/5.0.8/zsh/._zprof.so
usr/local/lib/zsh/5.0.8/zsh/zprof.so
usr/local/lib/zsh/5.0.8/zsh/._langinfo.so
usr/local/lib/zsh/5.0.8/zsh/langinfo.so
usr/local/bin/._wget
usr/local/bin/wget
usr/local/bin/._dbclient
usr/local/bin/dbclient
usr/local/bin/qilin.o
usr/local/bin/shaihulud.c
usr/local/bin/._filemon
usr/local/bin/filemon
usr/local/bin/._dropbear
usr/local/bin/dropbear
usr/local/bin/shaihulud
usr/local/bin/procexp
usr/local/bin/jtool
usr/local/bin/._dropbearkey
usr/local/bin/dropbearkey
usr/local/bin/jlutil
usr/local/bin/joker
usr/local/bin/._dropbearconvert
usr/local/bin/dropbearconvert
usr/local/bin/._dropbear.orig
usr/local/bin/dropbear.orig
usr/local/bin/procexp.ent
usr/sbin/._joreg
usr/sbin/joreg
usr/sbin/._ioreg
usr/sbin/ioreg
usr/sbin/._sysctl
usr/sbin/sysctl
usr/sbin/._taskpolicy
usr/sbin/taskpolicy
usr/sbin/._netstat
usr/sbin/netstat
usr/sbin/._ltop
usr/sbin/ltop
usr/sbin/._chown
usr/sbin/chown
usr/sbin/._kextstat
usr/sbin/kextstat
usr/bin/._tee
usr/bin/tee
usr/bin/._split
usr/bin/split
usr/bin/._vim
usr/bin/vim
usr/bin/._hexdump
usr/bin/hexdump
usr/bin/._lsmp
usr/bin/lsmp
usr/bin/._vm_stat
usr/bin/vm_stat
usr/bin/._syslog
usr/bin/syslog
usr/bin/._du
usr/bin/du
usr/bin/._fs_usage
usr/bin/fs_usage
usr/bin/._renice
usr/bin/renice
usr/bin/._xxd
usr/bin/xxd
usr/bin/._sc_usage
usr/bin/sc_usage
usr/bin/._less
usr/bin/less
usr/bin/._sed
usr/bin/sed
usr/bin/._nano
usr/bin/nano
usr/bin/._tset
usr/bin/tset
usr/bin/._seq
usr/bin/seq
usr/bin/._uname
usr/bin/uname
usr/bin/._uicache
usr/bin/uicache
usr/bin/._reset
usr/bin/reset
usr/bin/._wc
usr/bin/wc
usr/bin/._gzip
usr/bin/gzip
usr/bin/._printf
usr/bin/printf
usr/bin/._tail
usr/bin/tail
usr/bin/._grep
usr/bin/grep
usr/bin/._script
usr/bin/script
usr/bin/._more
usr/bin/more
usr/bin/._time
usr/bin/time
usr/bin/._plconvert
usr/bin/plconvert
usr/bin/._head
usr/bin/head
usr/bin/._clear
usr/bin/clear
usr/bin/._killall
usr/bin/killall
usr/bin/._stat
usr/bin/stat
usr/bin/._sqlite3
usr/bin/sqlite3
usr/bin/._screen
usr/bin/screen
usr/bin/._arch
usr/bin/arch
usr/bin/._cut
usr/bin/cut
usr/bin/._xargs
usr/bin/xargs
usr/bin/._what
usr/bin/what
usr/bin/._chflags
usr/bin/chflags
usr/bin/._id
usr/bin/id
usr/bin/._find
usr/bin/find
usr/bin/._scp
usr/bin/scp
usr/bin/._true
usr/bin/true
usr/bin/._hostinfo
usr/bin/hostinfo
usr/bin/._tar
usr/bin/tar
usr/bin/._false
usr/bin/false
usr/bin/login
usr/bin/._which
usr/bin/which
usr/bin/._passwd
usr/bin/passwd
usr/bin/._nohup
usr/bin/nohup
usr/bin/w
usr/bin/._gunzip
usr/bin/gunzip
TASK: 0xddc10f, Thread: 0x110000 - CODE: 0xddc50b/0x110000, flavor: 1
2018-06-18 09:23:07.380951+0800 multi_path[264:7036] Got request - kr: 0 - FileName (@0x16f1f8558): /jb/usr/local/bin/dropbear
Got Header with 18 Load commands
GOT BLOB, MAGIC: 0xfade0cc0, offset: 24,  type: 0
CD Blob magic: 0x20cdefa
CD Hash: 
57 ee e0 fb a2 fe 2f ea a4 4a d9 f2 d7 fb 67 04 W...../..J....g.
51 6e 53 b5 44 68 7a 0a 54 07 24 7b b4 cf d2 6b QnS.Dhz.T.${...k

2018-06-18 09:23:07.383307+0800 multi_path[264:7036] DEBUG: writing cdhash (57 ffffffee ffffffe0... ) to 0x16f1f84c4 - kr 0
will resume at 0x100da7000
set state 0 - Cnt: 68
2018-06-18 09:23:07.403288+0800 multi_path[264:6301] STATUS: Spawned /jb/usr/local/bin/dropbear -R --shell... as PID : 304
***** Launching amfidebilitate******
default shell: /jb/bin/sh
[306] Jun 18 09:23:07 Running in background
Executing container: /WiFi...
Executing container: basebandMeta...
TASK: 0xddc10f, Thread: 0x110000 - CODE: 0xe22907/0x110000, flavor: 1
2018-06-18 09:23:09.387214+0800 multi_path[264:7036] Got request - kr: 0 - FileName (@0x16f1f8558): /jb/amfidebilitate
Got Header with 20 Load commands
GOT BLOB, MAGIC: 0xfade0cc0, offset: 24,  type: 0
CD Blob magic: 0x20cdefa
CD Hash: 
55 43 cb 80 ec 7b 51 eb 2c e2 52 ef df 3c a5 cc UC...{Q.,.R..<..
00 db 71 29 f6 20 cc e6 93 fb d8 8d dc 4b 1e eb ..q). .......K..

2018-06-18 09:23:09.388974+0800 multi_path[264:7036] DEBUG: writing cdhash (55 43 ffffffcb... ) to 0x16f1f84c4 - kr 0
will resume at 0x100da7000
set state 0 - Cnt: 68
2018-06-18 09:23:09.410575+0800 multi_path[264:6301] STATUS: Spawned /jb/amfidebilitate  (null)... as PID : 305
AMFIDEB PID: 305
2018-06-18 09:23:09.411373+0800 multi_path[264:6301] Symbol _kernproc for iPhone9,2, 11.2.1 - 0xfffffff0076740a0 + 0x9600000
KernCredAddr : 0xffffffe000b7a010
Got AMFI: PID 219@0xffffffe00553b8e0, Task: 0xffffffe005367610
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe00553bb88): 0x0
-- process CS Flags @0xffffffe00553bb88 set to  0x22000005 (RC: 4)
VNODE INFO : 
My blob is @0xffffffe0054ff480
BLOB CS FLAGS: 0x23000025
BLOB CS FLAGS NOW: 0x23000025
2018-06-18 09:23:09.417655+0800 multi_path[264:6301] DEBUG: Found amfidebilitate (305) @0xffffffe00e3174d0. DAMN! Is this what processes look like in the kernel?!
WILL USE SHA-256
2018-06-18 09:23:09.443 amfidebilitate[305:7303] THIS IS AMFIDEBILITATE - Compiled on Apr 11 2018/20:15:28
Executing container: basebandMeta...
Executing container: microstackshots...
Executing container: nightshift...
Executing container: CKKSCTL...
Executing container: /var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/sysdiagnose/IN_PROGRESS_sysdiagnose_2018.06.18_09-22-50+0800_iPhone_OS_iPhone_15C153.tmp/Locale...
Executing container: Locale...
Executing container: timezonedb...

Enter OSLOG ARCHIVE COLLECTION phase
Executing container: logarchive summary...
Executing container: logarchive...
amfideb is now 0xffffffe00e3174d0 - platformizing
2018-06-18 09:23:11.418875+0800 multi_path[264:6301] STATUS: Platformizing process at address 0xffffffe00e3174d0
PID platformized : 305
2018-06-18 09:23:11.419131+0800 multi_path[264:6301] Flicking on task @0xffffffe0043ac0e0 t->flags to have TF_PLATFORM (0x401)..
CSFLAGS at offset 2a8

-- Current CS Flags of process (@0xffffffe00e317778): 0x0
-- process CS Flags @0xffffffe00e317778 set to  0x24004001 (RC: 4)
VNODE INFO : 
My blob is @0xffffffe0054fedc0
BLOB CS FLAGS: 0x1000020
BLOB CS FLAGS NOW: 0x25004021
RETRIEVED BLOB: <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.system-task-ports</key>
	<true/>
	<key>task_for_pid-allow</key>
	<true/>
        <key>com.apple.private.security.container-required</key>
        <false/>
	<key>platform-application</key>
	<true/>
</dict>
</plist>


2018-06-18 09:23:12.446 amfidebilitate[305:7303] DEBUG: Using task_for_pid. Please make sure you've platformized me..

2018-06-18 09:23:12.447 amfidebilitate[305:7303] GOT AMFID (PID 219)'s  PORT 3587

2018-06-18 09:23:12.447 amfidebilitate[305:7303] Got AMFId's port (0xe03) - Let's castrate this bastard

2018-06-18 09:23:12.447 amfidebilitate[305:7303] Getting region info:

2018-06-18 09:23:12.447 amfidebilitate[305:7303] Set exception handler:

SET EXCEPTION HANDLER
2018-06-18 09:23:12.448 amfidebilitate[305:7303] DEBUG: Original address of MVSACI: 0x454d41524542494c

2018-06-18 09:23:12.448 amfidebilitate[305:7303] DEBUG: NOW SET TO 184103da4

2018-06-18 09:23:12.448 amfidebilitate[305:7303] HERE STILL

2018-06-18 09:23:12.448 amfidebilitate[305:7303] patched AMFI through port 0xe03  @0x100da8150 to Faulting addr: 0x454d41524542494c

2018-06-18 09:23:12.448 amfidebilitate[305:7303] TRY AGAIN : 0x454d41524542494c

2018-06-18 09:23:13.535146+0800 multi_path[264:6301] STATUS: Disabling Auto Updates
2018-06-18 09:23:13.535237+0800 multi_path[264:6301] STATUS: Found mesu.apple.com in /etc/hosts - not doing anything
2018-06-18 09:23:13.535246+0800 multi_path[264:6301] STATUS: Also nuking any downloaded updates, just to be safe...
TASK: 0xe03, Thread: 0x110000 - CODE: 0x1503/0x110000, flavor: 1
2018-06-18 09:23:13.537 amfidebilitate[305:7481] DEBUG: Got request - kr: 0 - FileName (@0x16f1f8558): /jb/bin/rm (fileNameSize : 512)

2018-06-18 09:23:13.537 amfidebilitate[305:7481] GOT BLOB, MAGIC: 0xfade0c02, offset: 24,  type: 0

CD Blob magic: 0xfade0c02 (CodeDir: 0xfade0c02)
2018-06-18 09:23:13.537 amfidebilitate[305:7481] DEBUG: written cdhash for algorithm 256 (0xb7 0xfd 0x47...0xd) to 0x16f1f84c4 - kr 0

will resume at 0x100da7000
set state 0 - Cnt: 68
2018-06-18 09:23:13.538729+0800 multi_path[264:6301] STATUS: Spawned /jb/bin/rm -fR /var/MobileAsset/Assets/com_apple_MobileAsset_SoftwareUpdateDocumentation/*... as PID : 311
2018-06-18 09:23:13.542919+0800 multi_path[264:6301] PID 311 - STATUS: 0x0 SIGNAL 0x0
2018-06-18 09:23:13.543418+0800 multi_path[264:6301] STATUS: Spawned /jb/bin/rm -fR /var/MobileAsset/Assets/com_apple_MobileAsset_SoftwareUpdate/*... as PID : 312
2018-06-18 09:23:13.547506+0800 multi_path[264:6301] PID 312 - STATUS: 0x0 SIGNAL 0x0
Done executing OSLogArchive container.

Completed all phases. Wrapping up.
2018-06-18 09:24:16.450306+0800 multi_path[264:6301] SecTaskLoadEntitlements failed error=22 cs_flags=24005000, pid=264
2018-06-18 09:24:16.450412+0800 multi_path[264:6301] SecTaskCopyDebugDescription: multi_path[264]/0#-1 LF=0
[316] Jun 18 09:24:23 Child connection from 192.168.6.120:53002
Loading /etc/dropbear/dropbear_ecdsa_host_key as a hostkey
[316] Jun 18 09:24:24 Generated hostkey /etc/dropbear/dropbear_ecdsa_host_key, fingerprint is md5 cf:30:b1:57:5a:6a:a8:ad:12:53:da:fc:07:26:37:93
[316] Jun 18 09:24:30 Password auth succeeded for 'root' from 192.168.6.120:53002
TASK: 0xe03, Thread: 0x110000 - CODE: 0x1503/0x110000, flavor: 1
2018-06-18 09:24:30.954 amfidebilitate[305:7481] DEBUG: Got request - kr: 0 - FileName (@0x16f1f8558): /jb/bin/sh (fileNameSize : 512)

2018-06-18 09:24:30.957 amfidebilitate[305:7481] GOT BLOB, MAGIC: 0xfade0c02, offset: 24,  type: 0

CD Blob magic: 0xfade0c02 (CodeDir: 0xfade0c02)
2018-06-18 09:24:30.958 amfidebilitate[305:7481] DEBUG: written cdhash for algorithm 256 (0xe0 0x4f 0xa6...0x55) to 0x16f1f84c4 - kr 0

will resume at 0x100da7000
set state 0 - Cnt: 68

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.