Making PwnageTool Bundles

Creating the template Info.plist

Remove all AES keys/IVs and hashes, replace with TODO Also replace all .dmg filenames, SHA1 hash value and the rootfs volume name.

Getting the AES keys

Using Greenpois0n to get the keys Put the keys into the Info.plist, replacing TODO entries

Decrypting IMG3 files

Use xpwntool to decrypt all img3 files: NOR, kernelcache and the restore ramdisk

Decrypting the rootfs

1. Use GenPass with decrypted ramdisk to get the rootfs vfdecrypt key.
2. Decrypt the rootfs using vfdecrypt, put the key and rootfs volume name into Info.plist

Patches

In most cases you can reuse the patches from a previous firmware version. You can use the fuzzy_patcher tool for that. To extract differences from the previous version of files:

fuzzy_patcher --diff --delta delta_file.json \
--orig original_decrypted_file_vPrev \
--patched patched_decrypted_file_vPrev --verbose

To apply the difference file to the current version:

fuzzy_patcher --patch --delta delta_file.json \
--orig original_decrypted_file \
--patched patched_decrypted_file --fuzz 80 --verbose

You can lower the 'fuzzyness' level to apply lower confidence patches, but it's not a very good idea; you would usually want to inspect the file with IDA in such cases.

ASR

1. Patch ASR from the Restore Ramdisk
2. Fix its page hashes using codesign or ldid (see Bypassing iPhone Code Signature).

ASR can be patched by finding a xref to a string "Image failed signature verification" and patching the first instruction at the preceding label to branch to the previous label, which is the success case "Image passed signature verification". On ARMv7 this branch is usually 'F3 E7'.

iBSS patches - special case

iBSS patch for bundles using user-mode untether exploit (or for tethered bundles) kernelcache file is not patched in those bundles to allow untethered boot with intact NOR. Instead, kernelcache patches required to run the ramdisk are located in iBSS - an iBSS kernelcache_load function is patched to call a proc at ibss_base+0xFC that patches the decrypted and unpacked kernel in memory. You can use this utility to add kernel patches to ibss.

Creating BSDiffs

Use bsdiff to create diffs by diffing unpacked original versus patched files. Example:

bsdiff iBSS.k48ap.RELEASE.dfu.dec iBSS.k48ap.RELEASE.dfu.dec.patched iBSS.k48ap.RELEASE.patch

LLB 24k exploit

iPod touch 2G and iPhone 3GS utilize a different bootrom exploit, so the encrypted LLB for these devices need patching, using the xpwntool option "-x24k" (for iPod touch 2G) or "-xn8824k" (for iPhone 3GS) to patch the file. Example:

xpwntool LLB.n88ap.RELEASE.img3.dec LLB.n88ap.RELEASE.img3.dec.patched \
-t LLB.n88ap.RELEASE.img3 -xn8824k -iv replace_with_iv \
-k replace_with_key

Then bsdiff the encrypted files.

Fixing the ipsw file hash

Run shasum on the original ipsw, paste the result to the 'SHA1' field.