Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to extract system dynamic libraries files #8

Open
dnne opened this issue May 13, 2019 · 0 comments
Open

Unable to extract system dynamic libraries files #8

dnne opened this issue May 13, 2019 · 0 comments

Comments

@dnne
Copy link
Contributor

dnne commented May 13, 2019

I tried to extract system dynamic libraries files using the command ./run_no_pack_fs iPhone5,1_9.3_13E237. However the extraction of libraries fails as shown in the output bellow:

$ ./run_no_pack_fs iPhone5,1_9.3_13E237
* Change working directory to scripts/
* Download firmware image
Firmware file already exists at .././ipsw/iPhone5,1_9.3_13E237_Restore.ipsw Do you want to continue?[y/N] Not continuing.
* Unpack firmware image
[debug] Creating folder .././out/iPhone5,1_9.3_13E237 if does not exist ...
[debug] Unpacking ipsw file .././ipsw/iPhone5,1_9.3_13E237_Restore.ipsw to .././out/iPhone5,1_9.3_13E237 ...
[debug] unzip -o -qq .././ipsw/iPhone5,1_9.3_13E237_Restore.ipsw -d .././out/iPhone5,1_9.3_13E237
* Decrypt disk image file
[debug] Change working directory to bin/
[debug] ./decrypt_fs .././out/iPhone5,1_9.3_13E237/058-25512-331.dmg 2a66fd6377af8f60d5e300ac3aa8d9c44a1c0dee94579ad3f8a26515debbf381bb971ae8
[debug] Decrypting dmg file .././out/iPhone5,1_9.3_13E237/058-25512-331.dmg to .././out/iPhone5,1_9.3_13E237/decrypted.dmg ...
[debug] ../tools/vfdecrypt/vfdecrypt -k2a66fd6377af8f60d5e300ac3aa8d9c44a1c0dee94579ad3f8a26515debbf381bb971ae8 -i.././out/iPhone5,1_9.3_13E237/058-25512-331.dmg -o.././out/iPhone5,1_9.3_13E237/decrypted.dmg
[info] macOS is able to attach and mount .dmg files. Not converting .././out/iPhone5,1_9.3_13E237/decrypted.dmg to .././out/iPhone5,1_9.3_13E237/rootfs.img
* Decrypt kernelcache
[debug] Change working directory to bin/
[debug] ./decrypt_kernel .././out/iPhone5,1_9.3_13E237/kernelcache.release.n41 17026ef62f8da01dc0f4e7d2b8b54d4c 4ca5ec9e8dc9c5f77412c699fe724a5bfe101a79e1f2134e53bbb990e62a8c96
[debug] Decrypting kernelcache file .././out/iPhone5,1_9.3_13E237/kernelcache.release.n41 to .././out/iPhone5,1_9.3_13E237/kernelcache.decrypted ...
[debug] ../tools/xpwn/builddir/ipsw-patch/xpwntool .././out/iPhone5,1_9.3_13E237/kernelcache.release.n41 .././out/iPhone5,1_9.3_13E237/kernelcache.decrypted -iv 17026ef62f8da01dc0f4e7d2b8b54d4c -k 4ca5ec9e8dc9c5f77412c699fe724a5bfe101a79e1f2134e53bbb990e62a8c96 -decrypt
[debug] Unpacking kernelcache file .././out/iPhone5,1_9.3_13E237/kernelcache.decrypted (offet 448) to .././out/iPhone5,1_9.3_13E237/kernelcache.mach.arm ...
[debug] ../tools/lzssdec/lzssdec -o 448 < .././out/iPhone5,1_9.3_13E237/kernelcache.decrypted > .././out/iPhone5,1_9.3_13E237/kernelcache.mach.arm
* Extract sandbox extension
[debug] Change working directory to bin/
[debug] ./extract_sandbox_extension .././out/iPhone5,1_9.3_13E237/kernelcache.mach.arm
[debug] Extracting sandbox extension from .././out/iPhone5,1_9.3_13E237/kernelcache.mach.arm to .././out/iPhone5,1_9.3_13E237/com.apple.security.sandbox.kext ...
[debug] ../tools/joker/joker.universal -K com.apple.security.sandbox .././out/iPhone5,1_9.3_13E237/kernelcache.mach.arm
* Mount root filesystem
Password:
[debug] Change working directory to bin/
[debug] ./mount_fs .././out/iPhone5,1_9.3_13E237/decrypted.dmg /mnt/ios/iPhone5,1_9.3_13E237
[debug] Mounting disk image file .././out/iPhone5,1_9.3_13E237/decrypted.dmg to /mnt/ios/iPhone5,1_9.3_13E237 ...
[debug] hdiutil attach -noverify -mountpoint /mnt/ios/iPhone5,1_9.3_13E237 .././out/iPhone5,1_9.3_13E237/decrypted.dmg
* Copy sandboxd
[info] There is no sandboxd file (/usr/libexec/sandboxd) in /mnt/ios/iPhone5,1_9.3_13E237
* Extract dynamic library cache
[debug] Change working directory to bin/
[debug] ./extract_dyld_shared_cache /mnt/ios/iPhone5,1_9.3_13E237//System/Library/Caches/com.apple.dyld/dyld_shared_cache_armv7s .././out/iPhone5,1_9.3_13E237/dyld_shared_cache
[debug] Extracting libraries from /mnt/ios/iPhone5,1_9.3_13E237//System/Library/Caches/com.apple.dyld/dyld_shared_cache_armv7s to .././out/iPhone5,1_9.3_13E237/dyld_shared_cache ...
[debug] ../tools/dyld/dsc_extractor /mnt/ios/iPhone5,1_9.3_13E237//System/Library/Caches/com.apple.dyld/dyld_shared_cache_armv7s .././out/iPhone5,1_9.3_13E237/dyld_shared_cache
[error] Previous command ended with error. Turn on debugging and run manually to investigate.
* Unmount root filesystem
[debug] Change working directory to bin/
[debug] ./unmount_fs /mnt/ios/iPhone5,1_9.3_13E237
[debug] Unmounting disks for mount point /mnt/ios/iPhone5,1_9.3_13E237 ...
[debug] hdiutil detach /dev/disk2
* Extract sandbox profiles
[debug] Change working directory to ../tools/sandblaster/helpers/
[debug] ./extract_sandbox_operations ../../.././out/iPhone5,1_9.3_13E237/com.apple.security.sandbox.kext 9.3 > ../../.././out/iPhone5,1_9.3_13E237/sb_ops
[debug] Change working directory to ../tools/sandblaster/helpers/
[debug] ./extract_sandbox_profiles ../../.././out/iPhone5,1_9.3_13E237/com.apple.security.sandbox.kext 9.3 ../../.././out/iPhone5,1_9.3_13E237/sandbox_bundle
[error] Previous command ended with error. Turn on debugging and run manually to investigate.
* Reverse sandbox profiles
[error] There is no sandbox_bundle file in .././out/iPhone5,1_9.3_13E237

I tried to look in dyld_shared_cache directory for any file but it was empty as shown bellow:

$ ls -al out/iPhone5,1_9.3_13E237/dyld_shared_cache/
total 0
drwxr-xr-x   2 test  staff   68 May 12 12:26 .
drwxr-xr-x  16 test  staff  544 May 12 12:26 ..
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant