iDevice doesn't load iStrap

[cragy0516]

Hello, I'm working on fugu to support my devices iPhone 7+ whose the versions are iOS 11.1.1 and 11.4.1.
When I executed 'Fugu iStrap', as I intended, it stop at white screen (iStrap) and was hanging there because it cannot find some of kernel strings. But after several times, now, it doesn't load iStrap anymore, and just boot.

./Fugu iStrap
...
Connecting to iDevice: Done!
Patching SecureROM: Done!
Resetting USB connection: Done!
-> iDevice should load iStrap now

Nothing happened. And just booted.

[Xoloth]

Same. It just sends me back to recovery mode.

[cragy0516]

In my case, it just crash (or panic) and boot to Spring Board automatically.
Here is the crash report of panic. The device was iPhone 7 Plus, and the iOS version was 13.3.1
You can find and download full log here. (Google Drive)

{"bug_type":"151","timestamp":"2020-03-24 06:19:15.63 +0900","os_version":"iPhone OS 13.3.1 (17D50)","incident_id":"4A9CA360-070C-416F-B113-8201758A2668"} { "build" : "iPhone OS 13.3.1 (17D50)", "product" : "iPhone9,4", "kernel" : "Darwin Kernel Version 19.3.0: Thu Jan 9 21:10:55 PST 2020; root:xnu-6153.82.3~1\/RELEASE_ARM64_T8010", "string" : "panic(cpu 1 caller 0xfffffff01e9a5e48): btn_rst\nDebugger message: panic\nMemory ID: 0x1\nOS version: 17D50\nKernel version: Darwin Kernel Version 19.3.0: Thu Jan 9 21:10:55 PST 2020; root:xnu-6153.82.3~1\/RELEASE_ARM64_T8010\nKernelCache UUID: A3A60B8E68F568FA55EF09AB490796AE\nKernel UUID: F41FE208-3F32-3BF0-BFDF-187790264E99\niBoot version: iBoot-5540.80.2\nsecure boot?: YES\nPaniclog version: 13\nKernel slide: 0x0000000017c74000\nKernel text base: 0xfffffff01ec78000\nmach_absolute_time: 0xaaea5263\nEpoch Time: sec usec\n Boot : 0x5e791318 0x00098e57\n Sleep : 0x5e79212e 0x000bce1b\n Wake : 0x5e792787 0x000000ba\n Calendar: 0x5e792799 0x000ac879\n\nPanicked task 0xffffffe0008bfc00: 11142 pages, 236 threads: pid 0: kernel_task\nPanicked thread: 0xffffffe00350ca90, backtrace: 0xffffffe0560135e0, tid: 4716\n\t\t lr: 0xfffffff01eda9e70 fp: 0xffffffe056013620\n\t\t lr: 0xfffffff01eda9cd0 fp: 0xffffffe056013690\n\t\t lr: 0xfffffff01eea8890 fp: 0xffffffe056013740\n\t\t lr: 0xfffffff01ed6d610 fp: 0xffffffe056013750\n\t\t lr: 0xfffffff01eda9648 fp: 0xffffffe056013ac0\n\t\t lr: 0xfffffff01eda9990 fp: 0xffffffe056013b10\n\t\t lr: 0xfffffff01f35461c fp: 0xffffffe056013b30\n\t\t lr: 0xfffffff01e9a5e48 fp: 0xffffffe056013b70\n\t\t lr: 0xfffffff01e99af18 fp: 0xffffffe056013ba0\n\t\t lr: 0xfffffff01f2dd5cc fp: 0xffffffe056013bd0\n\t\t lr: 0xfffffff01ede2460 fp: 0xffffffe056013bf0\n\t\t lr: 0xfffffff01ede2064 fp: 0xffffffe056013c90\n\t\t lr: 0xfffffff01ed78654 fp: 0x0000000000000000\n\n", "incident" : "4A9CA360-070C-416F-B113-8201758A2668", "crashReporterKey" : "a9ae5d476987cbc23eac0a8852e81c788d01f601", "date" : "2020-03-24 06:19:05.16 +0900", "panicFlags" : "0x82", "otherString" : "\n** Stackshot Succeeded ** Bytes Traced 432256 **\n", "memoryStatus" : {"compressorSize":464,"compressions":2398,"decompressions":643,"busyBufferCount":1,"pageSize":16384,"memoryPressure":false,"memoryPages":{"active":53514,"throttled":0,"fileBacked":68063,"wired":16275,"purgeable":887,"inactive":19807,"free":47206,"speculative":33750}}, "processByPid" : { "0" : {"timesThrottled":0,"pageIns":0,"waitInfo":["thread 4613: semaphore port 0 with unknown owner"],"timesDidThrottle":0,"procname":"kernel_task","copyOnWriteFaults":0,"threadById":{"356":{"continuation":[0,68843616080],"userTime":0.045040790999999997,"systemTime":0,"id":356,"basePriority":81,"name":"AppleD2333PMU","user_usec":45040,"schedPriority":81,"system_usec":0,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551778085027]},"445":{"continuation":[0,68841983552],"userTime":1.2500000000000001e-06,"systemTime":0,"id":445,"basePriority":81,"user_usec":1,"system_usec":0,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[0,68844859768]},"259":{"continuation":[0,68843616080],"userTime":0.000100083,"systemTime":0,"id":259,"basePriority":81,"name":"AppleT700XTempSensor","user_usec":100,"schedPriority":81,"system_usec":0,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551778393683]},"348":{"continuation":[0,68843616080],"userTime":0.00068120799999999999,"systemTime":0,"id":348,"basePriority":81,"name":"AppleSEPManager","user_usec":681,"schedPriority":81,"system_usec":0,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551778177267]},"461":{"continuation":[0,68843616080],"userTime":1.4580000000000001e-06,"systemTime":0,"id":461,"basePriority":81,"user_usec":1,"system_usec":0,"schedPriority":81,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551777788995]},"276":{"continuation":[0,68843616080],"userTime":0.010151916,"systemTime":0,"id":276,"basePriority":81,"name":"AppleS5L8940XI2CController","user_usec":10151,"schedPriority":81,"system_usec":0,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551778310483]},"551":{"continuation":[0,68840091892],"userTime":2.2910000000000002e-06,"systemTime":0,"id":551,"basePriority":81,"name":"dlil_input_pdp_ip4","user_usec":2,"schedPriority":81,"system_usec":0,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551784930987]},"454":{"continuation":[0,68842279848],"userTime":8.541e-06,"systemTime":0,"id":454,"basePriority":95,"name":"VM_memorystatus_1","user_usec":8,"schedPriority":95,"system_usec":0,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551783043519]},"268":{"continuation":[0,68843616080],"userTime":0.00339625,"systemTime":0,"id":268,"basePriority":81,"name":"AppleS5L8960XUSBArbitrator","user_usec":3396,"schedPriority":81,"system_usec":0,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551778397283]},"357":{"continuation":[0,68843616080],"userTime":0.01083625,"systemTime":0,"id":357,"basePriority":81,"name":"AppleSN2400Charger","user_usec":10836,"schedPriority":81,"system_usec":0,"state":["TH_WAIT","TH_UNINT"],"waitEvent":[1,4087202551778089347]},"446":{"continuation":[0,68842257800],"userTime":8.6291000000000004e-05,"systemTime":0,"id":446,"basePriority":81,"user_usec":86,"system_usec":0,"schedPriority":81,"state" ...

[cragy0516]

I think there is the problem while I write something on memory... not sure, but I guess.

[LinusHenze]

Maybe iOS 13.4 support broke support for older versions. Can you check if Fugu 0.2 causes a panic as well? (You can see if it panics by running Fugu iStrap --boot-args "-v debug=0x146")

[cragy0516]

okay, it still crash on v0.2. I saw iStrap screen and verbose boot logs, but the device doesn't appear to be jailbroken. (sileo, notification messages.... etc) how could I check 'the verbose boot logs'? (it disappeared too fast :<)

[cragy0516]

Nevermind, I found them in system logs from settings. I uploaded them.

[rls1004]

Same issue in iPhone 7, iOS 13.5.1.