New Signature Bypass + Fixed iTunes Restarting Device

decrypt_shellcode/src/main.rs

@@ -18,17 +18,17 @@ pub extern "C" fn custom_handler() {
     let input = 0x08492a50 as *mut u8;
 
     // n6g
-    let aes_func = unsafe { core::mem::transmute::<u32, extern "C" fn(u32, u32, *mut u8, *mut u8, *mut u8, u32, u32)>(0x0822215c | 1) };
+    let aes_func = unsafe { core::mem::transmute::<u32, extern "C" fn(u32, u32, *mut u8, *mut u8, *mut u8, u32, *mut u8)>(0x0822215c | 1) };
     // n7g
-    let aes_func = unsafe { core::mem::transmute::<u32, extern "C" fn(u32, u32, *mut u8, *mut u8, *mut u8, u32, u32)>(0x0841140c | 1) };
+    let aes_func = unsafe { core::mem::transmute::<u32, extern "C" fn(u32, u32, *mut u8, *mut u8, *mut u8, u32, *mut u8)>(0x0841140c | 1) };
 
     aes_func(
         0, /* Decrypt*/
         1, /* global key */
-        core::ptr::null_mut(), /* no IV */
+        core::ptr::null_mut(), /* no user-specified key */
         input, /* In-place decrypt */
         input,
         512, /* Size*/
-        0 /* flags? */
+        core::ptr::null_mut() /* IV buffer */
     );
 }

src/img1.rs

@@ -16,6 +16,10 @@ impl Img1 {
         out.extend_from_slice(&self.body);
         out.extend_from_slice(&self.cert);
     }
+
+    pub fn update_format(&mut self, format: u8) {
+        self.head[0x08] = format;
+    }
 }
 
 pub fn img1_parse(orig_data: &[u8], device: &Device) -> Img1 {

src/main.rs

@@ -105,6 +105,13 @@ fn main() -> anyhow::Result<()> {
             std::fs::remove_file("./in-otf.bin")?;
             img1.body = rsrc_data;
         }
+
+        if let Device::Nano7Refresh = args.device {
+            // On n7g, changing the format from 'Signed' to 'Encrypted+Signed' will result in the signature of rsrc not being checked
+            img1.update_format(0x03);
+            info!("Updated rsrc format to Encrypted+Signed to allow free modifications of rsrc");
+        }
+
         info!("Repacking RSRC Img1");
         rsrc.body.clear();
         img1.write(&mut rsrc.body);
@@ -120,7 +127,9 @@ fn main() -> anyhow::Result<()> {
     if let Device::Nano6 = args.device {
         mse_out[0x5004..][..4].copy_from_slice(b"soso");
         mse_out[0x5144..][..4].copy_from_slice(b"ksid");
-    } else {
+    } else if let Device::Nano7Refresh = args.device {
+        info!("Swap is no longer required for n7g!");
+    }  else {
         mse_out[0x5004..][..4].copy_from_slice(b"soso");
         mse_out[0x5194..][..4].copy_from_slice(b"ksid");
     }

src/payload/exploit_config.rs

@@ -50,8 +50,8 @@ impl ExploitConfig for ExploitConfigN7G {
     const SWAP_COUNT: usize = 128;
     const DROP_COUNT: usize = Self::SWAP_COUNT + 17;
     const PATCH_MFG_STR: bool = false;
-    const BUILDCHAR_OVERWRITE_ADDR: u32 = 0x0819_c458_u32;
-    const BUILDCHAR_WRITE_OFFSET: u16 = 0;
+    const BUILDCHAR_OVERWRITE_ADDR: u32 = 0x0819_0000_u32;
+    const BUILDCHAR_WRITE_OFFSET: u16 = 0xc1d6_u16; 
 }
 
 pub struct ExploitConfigN5GEmu;

tools/scsi_decrypter/src/main.rs

@@ -29,7 +29,7 @@ fn main() -> Result<(), Box<dyn Error>> {
         .arg("44")
         .arg("/dev/sdc")
         .arg("c6")
-        .arg("96")
+        .arg("98")
         .arg("01")
         .arg(CODE_ADDR[0])
         .arg(CODE_ADDR[1])
@@ -69,7 +69,7 @@ fn main() -> Result<(), Box<dyn Error>> {
             .arg(&format!("{}", CHUNK_SIZE))
             .arg("/dev/sdc")
             .arg("c6")
-            .arg("96")
+            .arg("98")
             .arg("01")
             .arg(INPUT_ADDR[0])
             .arg(INPUT_ADDR[1])
@@ -86,7 +86,7 @@ fn main() -> Result<(), Box<dyn Error>> {
             .stderr(Stdio::null())
             .arg("/dev/sdc")
             .arg("c6")
-            .arg("96")
+            .arg("98")
             .arg("03")
             .arg(CALL_ADDR[0])
             .arg(CALL_ADDR[1])
@@ -107,7 +107,7 @@ fn main() -> Result<(), Box<dyn Error>> {
             .arg(&format!("{}", CHUNK_SIZE))
             .arg("/dev/sdc")
             .arg("c6")
-            .arg("96")
+            .arg("98")
             .arg("02")
             .arg(INPUT_ADDR[0])
             .arg(INPUT_ADDR[1])

tools/scsi_dumper/src/main.rs

@@ -35,7 +35,7 @@ fn main() -> Result<(), Box<dyn Error>> {
             .arg("-v")
             .arg("/dev/sdc")
             .arg("c6")
-            .arg("96")
+            .arg("98")
             .arg("02")
             .arg(&format!("{:02x}", b[0]))
             .arg(&format!("{:02x}", b[1]))