linushenze / fugu

Fugu is the first open source jailbreak based on the checkm8 exploit

Fugu

Fugu is the first open source jailbreak tool based on the checkm8 exploit.

UPDATE: Fugu will now install Sileo, SSH and Substitute automatically! Additionally, all changes to the root file system are now persistent. Put your iDevice into DFU mode, run Fugu iStrap, unlock your iDevice and follow the on-screen prompts.
IMPORTANT: This jailbreak is currently in development and only meant to be used by developers.

WARNING

!!! ONLY DOWNLOAD FUGU FROM https://github.com/LinusHenze/Fugu AS IT IS VERY EASY TO CREATE A VERSION OF FUGU THAT CONTAINS MALWARE !!!

Supported Devices

Currently, the iPad Pro (2017, every size) and iPhone 7 are the only officially supported devices (on iOS 13 - 13.5.1).
All devices with the A10/A10X CPU should be supported.

Building

Note that you can also download a precompiled version from the releases tab.
To build Fugu, make sure you have Xcode and Homebrew installed.
Using Homebrew, install llvm and binutils:

brew install llvm binutils

Afterwards, open the Fugu Xcode Project, select Fugu as target (if it's not already selected) and build it.
This should generate Fugu and a shellcode folder in the build folder. You're now ready to go!

Usage

I recommend you to just launch Fugu without any parameters to see all the options.
If you would just like to jailbreak your iDevice, run the following:

Fugu iStrap

You may need to run this command multiple times. If it won't work after the 4th try, enter DFU mode again.

This will send iStrap (the kernel bootstrapper) to your iDevice together with iDownload (small application that can be used to upload files to the iDevice or execute commands). See Components for more information.

Installing Sileo, SSH and Substitute

Fugu will now install Sileo, SSH and Substitute automatically! Unlock your iDevice and follow the on-screen prompts. Make sure your iDevice is connected to the internet!

Components

Fugu consists of the following components:

• Fugu: The macOS Application that exploits your iDevice using checkm8 and uploads iStrap, iStrap loader and iDownload.
• iStrap loader: Small shellcode that patches iBoot and loads iStrap after iBoot is done.
• iStrap: The kernel bootstrapper. This is what you see on your iDevice during boot. Patches the kernel, injects boot arguments (if needed) and injects shellcode into the kernel.
• iDownload: Small application running on your iDevice. Will be installed during boot and launched instead of launchd. Forks itself and runs launchd. The forked copy will listen on Port 1337 (only on 127.0.0.1, use iproxy to connect) and provide a simple bash-like interface.

Credits

• @axi0mX for the checkm8 exploit. This jailbreak wouldn't have been possible without it.
• miniz developers for the miniz library

License

All code in this repository, except for third party code (see 3rdParty.txt), is released under the GPL v3.

Fugu - iOS Jailbreaking tool
Copyright (C) 2019/2020 Linus Henze

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see https://www.gnu.org/licenses/.

The full license text can be found in the LICENSE file.

fugu's Issues

Command ExternalBuildToolExecution failed with a nonzero exit code

ExternalBuildToolExecution Shellcode (in target 'Shellcode' from project 'Fugu')
cd /Users/lhaasper/Desktop/Fugu-master/Shellcode
/usr/bin/make

xcrun -sdk iphoneos clang -c -o checkm8_arm64.o checkm8_arm64.S -target arm64-apple-darwin -Wall
/usr/local/opt/binutils/bin/gobjcopy -Obinary checkm8_arm64.o checkm8_arm64.bin
make: /usr/local/opt/binutils/bin/gobjcopy: No such file or directory
make: *** [checkm8_arm64.bin] Error 1
rm checkm8_arm64.o
Command ExternalBuildToolExecution failed with a nonzero exit code

Please help.

Can not found idevice

iPad 7 wifi
IOS15.5

Exploit fails

Exploit just fails with iPhone7 GSM (9,3). I tried to use v0.3 but exploit just fails so I couldn't install it.

Errors while building

Trying to build Fugu on macos catalina, xcode 10.2, but encountering 13 errors like these :

/Users/csg3206/Documents/Pk/myTools/Fugu-master/checkm8/PwnUSB.swift:30:52: error: expression resolves to an unused property
var device: SimpleUSB! { get { _device } }
^~~~~~~
/Users/csg3206/Documents/Pk/myTools/Fugu-master/USB/IOKitUSB.swift:45:34: error: expression resolves to an unused property
var deviceOpen: Bool { get { _deviceOpen } }
^~~~~~~~~~~
/Users/csg3206/Documents/Pk/myTools/Fugu-master/USB/IOKitUSB.swift:56:19: error: value of type 'IOUSBDeviceInterface' (aka 'IOUSBDeviceStruct') has no member 'USBGetSerialNumberStringIndex'
guard deviceInterface.USBGetSerialNumberStringIndex(deviceInterfacePtrPtr, &serialNumberIndex) == KERN_SUCCESS else {
^~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Users/csg3206/Documents/Pk/myTools/Fugu-master/USB/IOKitUSB.swift:82:18: error: value of type 'IOUSBDeviceInterface' (aka 'IOUSBDeviceStruct') has no member 'USBDeviceOpenSeize'; did you mean 'USBDeviceOpen'?
let kr = deviceInterface.USBDeviceOpenSeize(deviceInterfacePtrPtr)
^~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~

On using xcodebuild command to build, got the following additional error message:

** BUILD FAILED **
The following build commands failed:
CompileSwift normal x86_64
CompileSwiftSources normal x86_64 com.apple.xcode.tools.swift.compiler
(2 failures)

How can i get past these errors to successfully build Fugu?

Test

Uninstall?

I'm wondering if there's any way to remove all trace of this jailbreak. I expect had I used it before the last release which added persistence I'd be ok but I'm having issues with an online-banking app which I suspect may be related to this jailbreak (even when not booted into it).

Thanks!

Edit: Is this what --restore-fs does?

Edit2: Doesn't appear to. It showed up "Disabling jailbreak" with [!] next to it but Sileo is still present.

exploit fails

exploit fails on my ipad 6, ipad 7, iphone 7

macOS Mojave

J

Apple logo

Hi, i would like to chenge the boot logo with a png or gif or others.It's possible?

Can i superimpose an image file on the apple logo instead of stripped line color?

Thanks very much.

iPhone reboots at the slightest load

iphone reboots when trying to record the screen, without a jailbreak this does not happen.

as soon as I turn on/off recording while playing the game, the iphone immediately reboots.

struggle with this disease for the third day.

I tried reinstalling jailbreak (ReStore RootFS)

most likely, it's not the record, but the load from it. (reloads during screen recording)

iPhone XR

t8015 support

try to create t8015 loader

return [
// Patch to boot iBoot
0x1000079DC: [ 0x68, 0x00, 0x80, 0x52 ], // movz w8, #0x3

               // Patch for the boot trampoline
               0x180018000: [
                   0xE2, 0x07, 0x61, 0xB2, // mov x2, #0x180000000
                   0x40, 0x00, 0x3F, 0xD6, // blr x2
               ],
               
               // Our loader goes here
               0x180000000: Array<UInt8>(loader),
               
               // Our shellcode goes here
               // Note: This must be 4kB aligned
               0x180001000: Array<UInt8>(iStrap_4x),
           ]

iDevice doesn't load iStrap

Hello, I'm working on fugu to support my devices iPhone 7+ whose the versions are iOS 11.1.1 and 11.4.1.
When I executed 'Fugu iStrap', as I intended, it stop at white screen (iStrap) and was hanging there because it cannot find some of kernel strings. But after several times, now, it doesn't load iStrap anymore, and just boot.

./Fugu iStrap
...
Connecting to iDevice: Done!
Patching SecureROM: Done!
Resetting USB connection: Done!
-> iDevice should load iStrap now

Nothing happened. And just booted.

Devices Support

How to add support for t8015 ?

iPhone 8 Plus (global) iOS 15.1 error

Error!
Status:Launching kexploitd
Status:not running

This is not Fugu14

iPhone 7 (gold) stuck on white screen during boot.

My iphone 7 is getting stuck on a white screen after running ./Fugu iStrap. Pretty sure this is happening whilst the verbose style boot screen should appear.

ios

this jailbreak is becoming obsolete can you update it to support ios 14 and up?

J

what's the difference between fugu and checkra1n/odysseyra1n?

ا

resolveSymbol function not found the symbols

I use the RESOLVE_TEXT_SYMBOL,resolveSymbol, to parse kernel. but not found the symbols like _vnode_open.

here is short log:

linkeditLoadCmd found!
symtab found!
symTable->nsyms : 0

Here symTable->nsyms is 0, but I do not know why is that. I also not found the _vnode_open symbol in ida of loaded kernelcache.
So this mean if the kernel_start not right ?

KERNEL_FULL_BASE is 0x820000000ULL on iPhone8?

env: iPhone8/iOS13.3.1

iPwnDFU on High Sierra 10.13.6 not Support :(

dyld: Library not loaded: @rpath/libswiftCore.dylib
Referenced from: /Users/h3rry5y/Downloads/Fugu_v0.4/./Fugu
Reason: image not found
Abort trap: 6

How to add support for devices

How do I add support for other devices?

Remove bingers repo

Remove his repo as this causes issue with the jailbreak, and will detect it as checkra1n

also. instead of adding the chimera source to the sileo.list

/etc/apt/sources.list.d/chimera.sources is the file

you'll want to add this as the contents:

Types: deb
URIs: https://repo.chimera.sh
Suites: ./
Components:

this causes the Sileo post install script to detect it as a chimera jailbreak, thus causing no issues.

Just a suggesion.

If it would be at all possible, would you allow be access to https://repo.fugujb.dev/bootstrap so i could update everything to include https://github.com/coolstar/Odyssey-bootstrap, i will also be willing to make a pr with the changes needed for it to work. Thanks in advance

Error compiling

CF_EXPORT
const CFStringRef kCFUserNotificationIconURLKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationSoundURLKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationLocalizationURLKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationAlertHeaderKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationAlertMessageKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationDefaultButtonTitleKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationAlternateButtonTitleKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationOtherButtonTitleKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationProgressIndicatorValueKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationPopUpTitlesKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationTextFieldTitlesKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationCheckBoxTitlesKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationTextFieldValuesKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationPopUpSelectionKey API_AVAILABLE(macos(10.3)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationAlertTopMostKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

CF_EXPORT
const CFStringRef kCFUserNotificationKeyboardTypesKey API_AVAILABLE(macos(10.0)) API_UNAVAILABLE(ios, watchos, tvos);

Those are only for macos. It says that its not available on ios

Fugu doesn't manage to remount the root partition as R/W on iPhone7+ iOS 14.0b1

Tried to run Fugu on iOS 14b1. just seeing the apple logo for a few seconds then the screen turns black and then it seem to boot normally again.

didn't see any panic logs in the settings.
Does someone have tips on how to debug the issue?

Yns Leeroy

Bass amp program

LZSS doesn't work !

so I patched kernel and wanted to compress it using Fugu (lzss). I extracted KPP from original kernel and my command was : Fugu -lzss patched_kernel patched_kernel_compressed --kpp kpp_file.
If you see this thanks as I really need it to work.

not working - Exploit failed! Did not enter pwned DFU!

When running fugu it gives me this output:
Connecting to iDevice: Done!
Device is not in pwned DFU. Exploiting now.
Exploiting iDevice: FAILED!
Exploit failed! Did not enter pwned DFU!

-device to jailbreak:
software version: 13.4.1
model name: iPhone 7 Plus
model number: MN522LL/A

-mac version
device type: Macbook Pro (15-inch, 2017)
processor: 2.9 ghz quad-core intel i7
macOS: Catalina
version: 10.15.4

Folded

Not working

When running fugu it gives me this error
“Device has no nonce descriptor“