From 41f445b2467c5894cca7bc22c744aa654ca01416 Mon Sep 17 00:00:00 2001 From: tihmstar Date: Sat, 27 Jun 2015 12:08:51 +0200 Subject: [PATCH] added 6.1.3 ota downgrade compatibility with baseband downgrade --- .../Info.plist | 169 +++++++++--------- ipsw-patch/main.c | 64 ++++++- 2 files changed, 145 insertions(+), 88 deletions(-) diff --git a/ipsw-patch/FirmwareBundles/Down_iPhone4,1_6.1.3_10B329.bundle/Info.plist b/ipsw-patch/FirmwareBundles/Down_iPhone4,1_6.1.3_10B329.bundle/Info.plist index 6527f143..023b8c3b 100644 --- a/ipsw-patch/FirmwareBundles/Down_iPhone4,1_6.1.3_10B329.bundle/Info.plist +++ b/ipsw-patch/FirmwareBundles/Down_iPhone4,1_6.1.3_10B329.bundle/Info.plist @@ -1,62 +1,72 @@ - - - + + + - FilesystemPatches - - FirmwarePatches + RootFilesystem + 048-2613-005.dmg + RootFilesystemSize + 1220 + Filename + iPhone4,1_6.1.3_10B329_Restore.ipsw + RamdiskMountVolume + ramdisk + Name + iPhone4,1_6.1.3_10B329 + SubPlatform + 6 + Platform + 1 + RamdiskOptionsPath + /usr/local/share/restore/options.n94.plist + SHA1 + 7a62ee60b574301a6aafc48dcc9cccf0894ffb27 + BuildIdentitiesPatches - RestoreKernelCache + UniqueBuildID + 3Usl6yRx4qezMq1vuVZf69RDnU8= + Manifest - File - kernelcache.release.n94 - IV - 8a2c03ef8a0e45947780cdde01be40fb - Key - a374109c958957200f879f7b6ef34437fbde1a9f178b7c2412755cf9a3ed2d72 - - DecryptPath - Downgrade/kernelcache.release.n94 - TypeFlag - 4 + RestoreRamDisk + + Digest + soTe26MUEWqoKnxbAlm9uDrYEA4= + PartialDigest + QAAAAHhwMwEwggsDt8v7VOdjNK99c7EacJVHFA== + - - Restore Ramdisk + + RamdiskPatches + + asr File - 048-2516-005.dmg - IV - d30fa37b6ed56715121337a5fc039801 - Key - 1d8da07783a6f53efbb47657c352b305f0856697c6c824a9132ea0effe1a92a9 - Decrypt - - TypeFlag - 8 + usr/sbin/asr + Patch + asr.patch + + DownloadUrl + + FilesystemPatches + + RootFilesystemMountVolume + BrightonMaps10B329.N94OS + UniqueBuildID + 3Usl6yRx4qezMq1vuVZf69RDnU8= + FirmwarePatches + iBSS File Firmware/dfu/iBSS.n94ap.RELEASE.dfu - IV - d3fe01e99bd0967e80dccfc0739f93d5 Key 35343d5139e0313c81ee59dbae292da26e739ed75b3da5db9da7d4d26046498c - Patch - iBSS.n94ap.RELEASE.patch Decrypt + Patch + iBSS.n94ap.RELEASE.patch + IV + d3fe01e99bd0967e80dccfc0739f93d5 TypeFlag 8 @@ -64,14 +74,14 @@ File Firmware/dfu/iBEC.n94ap.RELEASE.dfu - IV - 1f12075441b7f193c5967c51ede025bf Key aba0d7f3e2d40d2a0039a36086c469e25e1eafb2fee2f50e36a3e5f7cd4d89c9 - Patch - iBEC.n94ap.RELEASE.patch Decrypt + Patch + iBEC.n94ap.RELEASE.patch + IV + 1f12075441b7f193c5967c51ede025bf TypeFlag 8 @@ -79,65 +89,52 @@ File Firmware/all_flash/all_flash.n94ap.production/DeviceTree.n94ap.img3 - IV - fabb698a3b2e845d7ad6849fbc067870 Key bd500bdc2a66aba636311037b9bd2b6ab3bd7374542352225d5be0c23998dd84 DecryptPath Downgrade/DeviceTree.n94ap.img3 + IV + fabb698a3b2e845d7ad6849fbc067870 RestoreLogo File Firmware/all_flash/all_flash.n94ap.production/applelogo@2x.s5l8940x.img3 - IV - 09678f1312084547b5bedce677e6a828 Key e7e9b79f5e6e81ff6d6bf81bf272af56e6ab0f1c691088eff2aca5b1ee31455e DecryptPath Downgrade/applelogo@2x.s5l8940x.img3 + IV + 09678f1312084547b5bedce677e6a828 - - RamdiskPatches - - asr + Restore Ramdisk File - usr/sbin/asr - Patch - asr.patch + 048-2516-005.dmg + Key + 1d8da07783a6f53efbb47657c352b305f0856697c6c824a9132ea0effe1a92a9 + Decrypt + + TypeFlag + 8 + IV + d30fa37b6ed56715121337a5fc039801 - + kernelcache.release.n94 + Key + a374109c958957200f879f7b6ef34437fbde1a9f178b7c2412755cf9a3ed2d72 + DecryptPath + Downgrade/kernelcache.release.n94 + TypeFlag + 4 + IV + 8a2c03ef8a0e45947780cdde01be40fb + - RamdiskMountVolume - ramdisk - RamdiskOptionsPath - /usr/local/share/restore/options.n94.plist - RootFilesystem - 048-2613-005.dmg - RootFilesystemSize - 1220 RootFilesystemKey d4685a3c01a0b6f762350191d98b8964d4c7af349aa84bacef828be9683514ccf44a8426 - RootFilesystemMountVolume - BrightonMaps10B329.N94OS - SHA1 - 7a62ee60b574301a6aafc48dcc9cccf0894ffb27 - Filename - iPhone4,1_6.1.3_10B329_Restore.ipsw - Name - iPhone4,1_6.1.3_10B329 - DownloadUrl - - Platform - 1 - SubPlatform - 6 diff --git a/ipsw-patch/main.c b/ipsw-patch/main.c index 513c7bee..e7fcbdff 100644 --- a/ipsw-patch/main.c +++ b/ipsw-patch/main.c @@ -57,12 +57,55 @@ void closeRoot(void* buffer) { } } +int replaceMatching(Dictionary* orig, Dictionary *new){ + DictValue *patchDict = new->values; + int dirty = FALSE; + + while(patchDict != NULL) { + char *key = ((DictValue*)patchDict)->key; + + if (patchDict->type == DictionaryType) { + Dictionary *norig = (Dictionary *)getValueByKey(orig,key); + if (norig) { + XLOG(0, "+ key=%s\n",key); + replaceMatching(norig,(Dictionary *)patchDict); + XLOG(0, "- key=%s\n",key); + } + }else{ + DictValue *origValue = getValueByKey(orig,key); + if (origValue) { + if (origValue->type == DataType) { + DataValue *newValue = (DataValue *)getValueByKey(new,key); //assuming replacing with same type + + free(((DataValue*)origValue)->value); + unsigned char *buf = malloc(newValue->len); + memcpy(buf,newValue->value,newValue->len); + + ((DataValue *)origValue)->value = buf; + + XLOG(0, "replacing key=%s\n",key); + }else{ + XLOG(0, "Error: replacing values of type %d currently not implemented\n",origValue->type); + return -1; + } + } + } + + patchDict = ((Dictionary*)patchDict)->dValue.next; + } + + return dirty; +} + + + int main(int argc, char* argv[]) { init_libxpwn(&argc, argv); Dictionary* info; Dictionary* firmwarePatches; Dictionary* patchDict; + Dictionary* BuildIdentitiesPatches; ArrayValue* patchArray; void* buffer; @@ -272,7 +315,7 @@ int main(int argc, char* argv[]) { } firmwarePatches = (Dictionary*)getValueByKey(info, "FilesystemPatches"); - + int j; for(j = 0; j < numToRemove; j++) { removeKey(firmwarePatches, argv[toRemove[j]]); @@ -398,6 +441,23 @@ int main(int argc, char* argv[]) { patchDict = (Dictionary*) patchDict->dValue.next; } + + ArrayValue *buildIdentities = (ArrayValue *)getValueByKey(manifest, "BuildIdentities"); + if (buildIdentities) { + BuildIdentitiesPatches = (Dictionary*)getValueByKey(info, "BuildIdentitiesPatches"); + for (i = 0; i < buildIdentities->size; i++) { + StringValue *path; + Dictionary *dict = (Dictionary *)buildIdentities->values[i]; + BuildIdentitiesPatches = (Dictionary*)getValueByKey(info, "BuildIdentitiesPatches"); + int myret = replaceMatching(dict,BuildIdentitiesPatches); + XLOG(0, "\n"); + if (myret == -1) { + XLOG(0, "Error: something went wrong\n"); + return -1; + }else if (myret >0) manifestDirty = TRUE; + } + } + if (manifestDirty && manifest) { manifestFile = getFileFromOutputStateForReplace(&outputState, "BuildManifest.plist"); @@ -409,7 +469,7 @@ int main(int argc, char* argv[]) { } releaseDictionary(manifest); } - + fileValue = (StringValue*) getValueByKey(info, "RootFilesystem"); rootFSPathInIPSW = fileValue->value;