Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

iPhone 5s (6,2) - 0% success rate when pwning DFU #96

Closed
ghost opened this issue Sep 30, 2019 · 93 comments
Closed

iPhone 5s (6,2) - 0% success rate when pwning DFU #96

ghost opened this issue Sep 30, 2019 · 93 comments

Comments

@ghost
Copy link

ghost commented Sep 30, 2019

After retrying 20 times, I still haven't managed to get my 5s to enter pwned DFU. The phone reboots around 7 seconds after the tool has been run, then it returns this timeout error:

Found: CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:000005F5A9D9BCD0 IBFL:1C SRTG:[iBoot-1704.10]
ERROR: No Apple device in DFU Mode 0x1227 detected after 5.00 second timeout. Exiting.

Do I need to keep trying, or is this a common issue with A7 devices?

@EWouters
Copy link

Your device was likely not in DFU mode.

@ghost
Copy link
Author

ghost commented Sep 30, 2019

Your device was likely not in DFU mode.

?
Trust me, it was. It wouldn't have kickstarted the exploit in the first place at all if the phone was in recovery mode or was booted from iBSS.

@EWouters
Copy link

EWouters commented Sep 30, 2019

Can you post more of the terminal output, including the commands you used?

@ghost
Copy link
Author

ghost commented Sep 30, 2019

Can you post more of the terminal output?

Admins-MacBook-Pro:ipwndfu admin$ cd
Admins-MacBook-Pro:~ admin$ cd ipwndfu
Admins-MacBook-Pro:ipwndfu admin$ ./ipwndfu -p
*** checkm8 exploit by axi0mX ***
Found: CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:000005F5A9D9BCD0 IBFL:1C SRTG:[iBoot-1704.10]
ERROR: No Apple device in DFU Mode 0x1227 detected after 5.00 second timeout. Exiting.
Admins-MacBook-Pro:ipwndfu admin$ 

This exploit works perfectly fine on my iPhone 5 and iPad 4 using the same cable and machine, so I don't think they're the problem.

@timonline
Copy link

timonline commented Sep 30, 2019

I’m glad I’m not alone, I’ve tried over 100 times on my iPhone 5S

Put the device in DFU fine and even confirm with “lsusb -v | grep -i apple” that shows the iPhone in DFU mode

But then in the middle of running the exploit, my phone reboots into normal mode and shows that error

@ghost
Copy link
Author

ghost commented Sep 30, 2019

Do you also have the 6,2 model? Probably the exploit works fine on 6,1, especially seeing how other people have managed to pwn their 5s phones.

@timonline
Copy link

Yes 6,2 model

@ghost
Copy link
Author

ghost commented Sep 30, 2019

Well, it looks like only 6,1 works right now. :/

@ghost
Copy link
Author

ghost commented Sep 30, 2019

I've got an another device here (iPad mini 2 Wi-Fi only aka iPad4,4) and it doesn't work either. Perhaps the support for A7 devices is simply not finished yet.

@EWouters
Copy link

EWouters commented Sep 30, 2019

Can you try this in your python interpreter and post the output (if any)?

import sys, time
import usb # pyusb: use 'pip install pyusb' to install this module
import usb.backend.libusb1
import libusbfinder

backend = usb.backend.libusb1.get_backend(find_library=lambda x:libusbfinder.libusb1_path())
list(usb.core.find(find_all=True, idVendor=0x5AC, idProduct=0x1226, backend=backend))
list(usb.core.find(find_all=True, idVendor=0x5AC, idProduct=0x1227, backend=backend))
list(usb.core.find(find_all=True, idVendor=0x5AC, idProduct=0x1228, backend=backend))

@ghost
Copy link
Author

ghost commented Sep 30, 2019

I don't get any output (tried iPhone 5s and iPad 4.)

@EWouters
Copy link

EWouters commented Sep 30, 2019

Also please post the output of sudo lsusb -v | grep -i apple as @timonline suggested.

@ghost
Copy link
Author

ghost commented Sep 30, 2019

2019-09-30 22:19:08.869 system_profiler[12785:206544] SPUSBDevice: IOCreatePlugInInterfaceForService failed 0xe00002be
      Host Controller Driver: AppleUSBEHCIPCI
              Vendor ID: 0x05ac (Apple Inc.)
              Manufacturer: Apple Inc.
      Host Controller Driver: AppleUSBEHCIPCI
                Apple Internal Keyboard / Trackpad:
                  Vendor ID: 0x05ac (Apple Inc.)
                  Manufacturer: Apple Inc.
                  Manufacturer: Apple Inc.
                      Vendor ID: 0x05ac (Apple Inc.)
                      Manufacturer: Apple Inc.
      Host Controller Driver: AppleUSBXHCIPPT
        Apple Mobile Device (DFU Mode):
          Vendor ID: 0x05ac (Apple Inc.)
          Manufacturer: Apple Inc.

@EWouters
Copy link

EWouters commented Sep 30, 2019

I'm interested to know if your device has been recognized with idProduct 0x1227. I can get my idProduct by running:

$ sudo lsusb -v | egrep "idProduct.*DFU"
  idProduct          0x1227 Mobile Device (DFU Mode)

Can you try if your device also returns 0x1227?

@ghost
Copy link
Author

ghost commented Sep 30, 2019

Yes, it does return 0x1227.

@ghost
Copy link
Author

ghost commented Sep 30, 2019

(It's quite late in my timezone right now, I'll try to contact you back tomorrow.)

@EWouters
Copy link

EWouters commented Sep 30, 2019

Well thanks for following along, your device is recognized by the OS but not by usb.core.find (as we tried here). I'm not too sure how to proceed from here.

The devices I have show up in usb.core.find when lsusb detects them. Can you see if this shows your device:

import usb, usb.backend.libusb1, libusbfinder
backend = usb.backend.libusb1.get_backend(find_library=lambda x:libusbfinder.libusb1_path())
list(usb.core.find(find_all=True))

(in which case an item similar to this <DEVICE ID 05ac:1227 on Bus 003 Address 011> would be in the list)

@timonline
Copy link

Give me like 2 hours and I’ll be home and I can continue troubleshooting with you and show you the output of the previous commands

@melvyn2
Copy link

melvyn2 commented Sep 30, 2019

I don't have a 6,2 (i have a 6,1), but have you guys tried this PR?

@EWouters
Copy link

@melvyn2 might be worth a shot but it seems their system errors before reaching the lines of code changed in that PR.

@melvyn2
Copy link

melvyn2 commented Sep 30, 2019

Ah okay, sorry.

@timonline
Copy link

Also please post the output of sudo lsusb -v | grep -i apple as @timonline suggested.

tim@tim-Dell:~$ sudo lsusb -v | grep -i apple
Bus 001 Device 010: ID 05ac:1227 Apple, Inc. Mobile Device (DFU Mode)
  idVendor           0x05ac Apple, Inc.
  iManufacturer           2 Apple Inc.
  iProduct                3 Apple Mobile Device (DFU Mode)
    iConfiguration          5 Apple Mobile Device (DFU Mode)
tim@tim-Dell:~$ sudo lsusb -v | egrep "idProduct.*DFU"
  idProduct          0x1227 Mobile Device (DFU Mode)

So mine returns 0x1227 too

And your code snippet provides here no output then the iphone goes to the apple logo and boots normally

@timonline
Copy link

I don't have a 6,2 (i have a 6,1), but have you guys tried this PR?

Tried that PR, didn't work

@ghost
Copy link
Author

ghost commented Oct 1, 2019

My iPad 4, even though got pwned successfully, didn't get detected by the script just like my iPhone 5s. I think I'll try using VM, as it might actually be my MacBook's fault.

@EWouters
Copy link

EWouters commented Oct 1, 2019

I assume you ran Python with sudo? Going from the fact that

$ sudo lsusb -v | egrep "idProduct.*DFU"

detects your device and

$ sudo python -c "import usb; print(str([i for i in usb.core.find(find_all=True) if '0x05ac' in str(i)][0]))"

does not, it seems to be a problem with dependencies. libusb or pyusb maybe.

@timonline
Copy link

What’s strange is that using the same command pwnd my iPhone 8 Plus fine but my iPhone 5S still is facing the same problem

Yes I ran python with sudo

@ghost
Copy link
Author

ghost commented Oct 1, 2019

I don’t think it’s USB problem. The exploit forces the device to reboot, which I think is caused by a BootROM crash. I assume the patches that checkm8 makes are incorrect.

@ghost
Copy link
Author

ghost commented Oct 1, 2019

In addition, A6 devices, even if can be pwned easily, reboot if you try to send a file over USB.

@EWouters
Copy link

EWouters commented Oct 1, 2019

I don’t think it’s USB problem. The exploit forces the device to reboot, which I think is caused by a BootROM crash. I assume the patches that checkm8 makes are incorrect.

The checks I suggested 'prove' that it has nothing to do with the exploit. Your device is simply not detected by pyusb. If $ sudo python -c "import usb; print(str([i for i in usb.core.find(find_all=True) if '0x05ac' in str(i)][0]))" doesn't print a long list of information about your device the exploit will not start.

Edit: I was wrong, this is not related to the problem. I'm sorry to have sidetracked you.

@timonline
Copy link

timonline commented Oct 1, 2019

 sudo python -c "import usb; print(str([i for i in usb.core.find(find_all=True) if '0x05ac' in str(i)][0]))"

The output of the second command is:

~/ipwndfu$  sudo python -c "import usb; print(str([i for i in usb.core.find(find_all=True) if '0x05ac' in str(i)][0]))"
DEVICE ID 05ac:1227 on Bus 001 Address 043 =================
 bLength                :   0x12 (18 bytes)
 bDescriptorType        :    0x1 Device
 bcdUSB                 :  0x200 USB 2.0
 bDeviceClass           :    0x0 Specified at interface
 bDeviceSubClass        :    0x0
 bDeviceProtocol        :    0x0
 bMaxPacketSize0        :   0x40 (64 bytes)
 idVendor               : 0x05ac
 idProduct              : 0x1227
 bcdDevice              :    0x0 Device 0.0
 iManufacturer          :    0x2 Apple Inc.
 iProduct               :    0x3 Apple Mobile Device (DFU Mode)
 iSerialNumber          :    0x4 CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:000004F6C9889830 IBFL:1C SRTG:[iBoot-1704.10]
 bNumConfigurations     :    0x1
  CONFIGURATION 1: 500 mA ==================================
   bLength              :    0x9 (9 bytes)
   bDescriptorType      :    0x2 Configuration
   wTotalLength         :   0x19 (25 bytes)
   bNumInterfaces       :    0x1
   bConfigurationValue  :    0x1
   iConfiguration       :    0x5 Apple Mobile Device (DFU Mode)
   bmAttributes         :   0x80 Bus Powered
   bMaxPower            :   0xfa (500 mA)
    INTERFACE 0: Application Specific ======================
     bLength            :    0x9 (9 bytes)
     bDescriptorType    :    0x4 Interface
     bInterfaceNumber   :    0x0
     bAlternateSetting  :    0x0
     bNumEndpoints      :    0x0
     bInterfaceClass    :   0xfe Application Specific
     bInterfaceSubClass :    0x1
     bInterfaceProtocol :    0x0
     iInterface         :    0x0 

But the exploit still causes the device to reboot

@ghost
Copy link
Author

ghost commented Oct 4, 2019

Considering that qwertyoruiop will release his own set of tools soon (which are written in C), I think I’ll close this issue. I have a theory that libusb is the one to blame here, as it’s the only part of the code that throws exceptions after unsuccessfully running the exploit. In the meantime, if you’re like me and aren’t patient, just get yourself an FMI A10-A11 device for cheap and use that one for experiments, as they seem to work for everyone. For other devices - wait for more stable tools, as this Python-written most likely will not receive any updates regarding the library issues.

@marikuns
Copy link

marikuns commented Oct 4, 2019

@DaJakerBoss my changes is very simple. just added print-messages in different places

marikuns@f33fc4c

ps. sorry for vscode trash in commit. fogot for .gitignore xD

@marikuns
Copy link

marikuns commented Oct 4, 2019

I think. there is trouble in SoC/SecureROM version specifed params, like different offsets, decriptors etc.
After sending payload, it seems like some panic error and undetectable usb device after it

@stratm0r
Copy link

stratm0r commented Oct 4, 2019

iPad Air. Same problem.

@DaJakerBoss
Copy link

DaJakerBoss commented Oct 4, 2019

@marikuns after using your fork I managed to get the exact same faults

*** checkm8 exploit by axi0mX ***
Found: CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:00 ECID:00000474F3C81F50 IBFL:1C SRTG:[iBoot-1704.10]
Prepare exploit
Reset USB device
Acquire device
Send async 1-part
Send 2-part
Release device.. waiting...
Try acquire device
Send 3-part
Sending payload...
Reset USB device
Try acquire device
Traceback (most recent call last):
  File "./ipwndfu", line 69, in <module>
    checkm8.exploit()
  File "/home/dajakerboss/ipwn2/checkm8.py", line 520, in exploit
    if 'PWND:[checkm8]' not in device.serial_number:
  File "/home/dajakerboss/ipwn2/usb/core.py", line 830, in serial_number
    self._serial_number = util.get_string(self, self.iSerialNumber)
  File "/home/dajakerboss/ipwn2/usb/util.py", line 314, in get_string
    raise ValueError("The device has no langid")
ValueError: The device has no langid

Weird. And yet someone managed to (using the Linus Henge fork) get to a pwndfu and set nonce...

PART 2
Ran it again and actually matched the previous outcome

*** checkm8 exploit by axi0mX ***
Found: CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:00 ECID:00000474F3C81F50 IBFL:1C SRTG:[iBoot-1704.10]
Prepare exploit
Reset USB device
Acquire device
Send async 1-part
Send 2-part
Release device.. waiting...
Try acquire device
Send 3-part
Sending payload...
Reset USB device
Try acquire device
ERROR: No Apple device in DFU Mode 0x1227 detected after 5.00 second timeout. Exiting.

@mingyipli
Copy link

@ L0WP1X3L
I have been facing the same problems with my iPhone5S(iPhone6,2) fir a couple days.
I success today after the following moves:

  1. Update the latest iOS(maybe not needed)
  2. Connect to Mac and Enter dfu mode
  3. Close iTunes App in Mac and Kill the iTunes Helper demon process through terminal
  4. Clone the fork from LinusHenze ipwndfu_public (better iPhone5S support).
  5. Run with sudo, eg. sudo ./ipwndfu -p
    I suggest you try above before giving up.
    Hope the above actually help.

@DaJakerBoss
Copy link

DaJakerBoss commented Oct 5, 2019 via email

@ghost
Copy link
Author

ghost commented Oct 5, 2019

@ L0WP1X3L
I have been facing the same problems with my iPhone5S(iPhone6,2) fir a couple days.
I success today after the following moves:

  1. Update the latest iOS(maybe not needed)
  2. Connect to Mac and Enter dfu mode
  3. Close iTunes App in Mac and Kill the iTunes Helper demon process through terminal
  4. Clone the fork from LinusHenze ipwndfu_public (better iPhone5S support).
  5. Run with sudo, eg. sudo ./ipwndfu -p
    I suggest you try above before giving up.
    Hope the above actually help.

Didn't work.

@zodaema
Copy link

zodaema commented Oct 5, 2019

Iphone 6,1 Same Problem (With MacOS 10.15 VMware & Ubuntu 19 Vmware)

@hzdoestech
Copy link

did anyone that got this to work use Linux? if so, which distro?

@DaJakerBoss
Copy link

DaJakerBoss commented Oct 5, 2019 via email

@Saraseti
Copy link

Saraseti commented Oct 5, 2019

I've tried with Kali Live Usb, I was able to put it in pwnd dfu, i was having trouble installing exploit but i was able to demote and get securerom dump but once i restarted i wasnt able to dupilcate the scenario again .

On iPad mini 2

@zodaema
Copy link

zodaema commented Oct 6, 2019

It’s a pretty common saying ‘round these parts that VM’s do not actually work so you may consider an Ubuntu LiveUSB

On Oct 5, 2019, at 04:57, zodaema @.***> wrote:  Iphone 6,1 Same Problem (With MacOS 10.15 VMware & Ubuntu 19 Vmware) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

Today I've tried in Ubuntu 16.

ERROR: No Apple device in DFU Mode 0x1227 detected after 5.00 second timeout. Exiting.

And my iphone automatic reboot

@00p513-dev
Copy link

I have found it'll sometimes just say exploit failed on Linus's fork. But 99% of the time it'll still give me ERROR: No Apple device in DFU Mode 0x1227 detected after 5.00 second timeout. Exiting.

@00p513-dev
Copy link

00p513-dev commented Oct 6, 2019

ooh more stuff

[15467.593321] usb 5-3: New USB device found, idVendor=05ac, idProduct=1227, bcdDevice= 0.00
[15467.593325] usb 5-3: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[15467.593327] usb 5-3: Product: Apple Mobile Device (DFU Mode)
[15467.593329] usb 5-3: Manufacturer: Apple Inc.
[15467.593331] usb 5-3: SerialNumber: CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:02 ECID:000004B749860FB0 IBFL:1C SRTG:[iBoot-1704.10]
[15504.444494] usb 5-3: reset high-speed USB device number 52 using ehci-pci
[15504.622424] usb 5-3: usbfs: process 12993 (ipwndfu) did not claim interface 0 before use
[15504.628177] usb 5-3: USB disconnect, device number 52

@DaJakerBoss
Copy link

DaJakerBoss commented Oct 6, 2019 via email

@fengwenhua
Copy link

when I run ./ipwndfu -p, the following problem has occurred
abc

@hzdoestech
Copy link

alright and so i finally got checkm8 to work on the 5s. I TRIED EVERYTHING on several Linux distos. Before giving up I tried a hackintosh and IT WORKED!

@ghost
Copy link
Author

ghost commented Oct 7, 2019

What version of macOS do you have installed?

@DaJakerBoss
Copy link

@fengwenhua you have to run the tool with superuser powers, run sudo ./ipwndfu -p

@hzdoestech
Copy link

I used MacOS Mojave (10.14)
I used a modified version of MacOS with more Kexts though (olarila).

@ghost
Copy link
Author

ghost commented Oct 8, 2019

After using Linus Henze’s ipwndfu_public, around 15 retries later I’ve actually managed to enter pwned DFU on my iPhone 5s. Took me 10 minutes to do so though, but at least it works.

https://github.com/LinusHenze/ipwndfu_public

@00p513-dev
Copy link

Alex, how did you get that debug? Are you using GeoHot's fork?

Sorry for the late reply, this is the output of sudo dmesg

@LYJSPEEDX
Copy link

alright and so i finally got checkm8 to work on the 5s. I TRIED EVERYTHING on several Linux distos. Before giving up I tried a hackintosh and IT WORKED!

Do U mean that using another macOS version can help solve this problem?

@ghost
Copy link
Author

ghost commented Mar 6, 2020

alright and so i finally got checkm8 to work on the 5s. I TRIED EVERYTHING on several Linux distos. Before giving up I tried a hackintosh and IT WORKED!

Do U mean that using another macOS version can help solve this problem?

It’s hardware dependent, not software. From what I can tell, you need to use a non-Apple PC running either Linux or macOS, since the USB controllers Apple puts in their machines have some serious issues with ipwndfu in particular (every other checkm8 utility that exists right now works fine on every machine, no matter what hardware or software they’re running on.)

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests