This repository has been archived by the owner on Apr 14, 2023. It is now read-only.
unencrypted data volume is not allowed - iOS 15.3.1 restore #31
Comments
|
It appears to get stuck trying to create the encrypted data volume. idevicerestore printed these lines repeatedly I suppose we need a kernel patch to allow unencrypted data partition... |
|
Umm, this one is complicated. It is not like we can't make a kernel patch but I also saw messages after restore from apfs that it is rejecting open because of content protect so there might be more issues down the line. I am not really sure if we can do encrypted data partition without SEP... |
|
Temporary solution: set_dtb_prop(child, "product-name", 8, (uint8_t *)"FastSim");after this line and the mount should got through... Undo the change mentioned above:
|
|
that didn't do anything (the original panic happened again) |
|
@asdfugil, I just tested mounting manually using the command from the ramdisk. It should work... xnu.c: static const char *REM_PROPS[] = {
"function-error_handler", "nvme-coastguard", "nand-debug",
"function-spi0_sclk_config", "function-spi0_mosi_config",
"function-pmp_control", "function-mcc_ctrl", "pmp",
"function-vbus_voltage",
"function-brick_id_voltage", "function-ldcm_bypass_en",
"content-protect", /* We don't want encrypted data volume */
};
...
child = get_dtb_node(root, "product");
assert(child);
data = 1;
// TODO: Workaround: AppleKeyStore SEP(?)
set_dtb_prop(child, "boot-ios-diagnostics", sizeof(data), (uint8_t *)&data);
set_dtb_prop(child, "product-name", 8, (uint8_t *)"FastSim"); |
|
manually mounting just makes the vm panic earlier for me (note |
|
really weird. The only way I could explain that was you forgot to run |
So I definitely did not forgot and it did get compiled in. |
|
Add these lines to the end of FILE* fd = fopen("deviceTree-processed", "wb");
fwrite(buf, info->dtb_size, 1, fd);
fclose(fd);This should produce a |
|
(gzipped file) also |
|
@asdfugil you put the FastSim thing in the wrong position. |
|
I see, there's two |
|
the restore seems to have worked...ish. It says it failed but then the system seemed to work. |
|
idevicerestore log serial output |
|
Doesnt look quite successful to me ngl |
|
I can't seem to restore iOS 14.3 successfully as well, however the restored system still work. Both iOS 15.3.1 and 14.3 restore fails at sealing the system volume afaik is introduced with iOS 14.2 |
|
This is the serial output for the iOS 14.3 restore: |
|
@asdfugil, the sealing problem is quite problematic on 15.3.1 since it is enforced by default and there is no override from outside possible... but we can patch |
|
A file named |
|
@asdfugil, well, I don't think sealing is possible with the current setup though... |
Closed
the most obvious side effect is that there are no snapshots created |
|
i had the same issue, it can't create an encrypted fs, |
|
@iTheGentle this is another issue first reported in #37, but please make a new issue anyways |
shannon2893
pushed a commit
to shannon2893/qemu-t8030
that referenced
this issue
Jul 25, 2022
Include the qtest reproducer provided by Alexander Bulekov in https://gitlab.com/qemu-project/qemu/-/issues/542. Without the previous commit, we get: $ make check-qtest-i386 ... Running test tests/qtest/intel-hda-test AddressSanitizer:DEADLYSIGNAL ================================================================= ==1580408==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc3d566fe0 #0 0x63d297cf in address_space_translate_internal softmmu/physmem.c:356 TrungNguyen1909#1 0x63d27260 in flatview_do_translate softmmu/physmem.c:499:15 TrungNguyen1909#2 0x63d27af5 in flatview_translate softmmu/physmem.c:565:15 TrungNguyen1909#3 0x63d4ce84 in flatview_write softmmu/physmem.c:2850:10 TrungNguyen1909#4 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18 TrungNguyen1909#5 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16 TrungNguyen1909#6 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 TrungNguyen1909#7 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12 TrungNguyen1909#8 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12 TrungNguyen1909#9 0x62ae5ec0 in stl_le_dma include/sysemu/dma.h:275:1 TrungNguyen1909#10 0x62ae5ba2 in stl_le_pci_dma include/hw/pci/pci.h:871:1 TrungNguyen1909#11 0x62ad59a6 in intel_hda_response hw/audio/intel-hda.c:372:12 TrungNguyen1909#12 0x62ad2afb in hda_codec_response hw/audio/intel-hda.c:107:5 TrungNguyen1909#13 0x62aec4e1 in hda_audio_command hw/audio/hda-codec.c:655:5 TrungNguyen1909#14 0x62ae05d9 in intel_hda_send_command hw/audio/intel-hda.c:307:5 TrungNguyen1909#15 0x62adff54 in intel_hda_corb_run hw/audio/intel-hda.c:342:9 TrungNguyen1909#16 0x62adc13b in intel_hda_set_corb_wp hw/audio/intel-hda.c:548:5 TrungNguyen1909#17 0x62ae5942 in intel_hda_reg_write hw/audio/intel-hda.c:977:9 TrungNguyen1909#18 0x62ada10a in intel_hda_mmio_write hw/audio/intel-hda.c:1054:5 TrungNguyen1909#19 0x63d8f383 in memory_region_write_accessor softmmu/memory.c:492:5 TrungNguyen1909#20 0x63d8ecc1 in access_with_adjusted_size softmmu/memory.c:554:18 TrungNguyen1909#21 0x63d8d5d6 in memory_region_dispatch_write softmmu/memory.c:1504:16 TrungNguyen1909#22 0x63d5e85e in flatview_write_continue softmmu/physmem.c:2812:23 TrungNguyen1909#23 0x63d4d05b in flatview_write softmmu/physmem.c:2854:12 TrungNguyen1909#24 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18 TrungNguyen1909#25 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16 TrungNguyen1909#26 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 #27 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12 TrungNguyen1909#28 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12 TrungNguyen1909#29 0x62ae5ec0 in stl_le_dma include/sysemu/dma.h:275:1 TrungNguyen1909#30 0x62ae5ba2 in stl_le_pci_dma include/hw/pci/pci.h:871:1 TrungNguyen1909#31 0x62ad59a6 in intel_hda_response hw/audio/intel-hda.c:372:12 TrungNguyen1909#32 0x62ad2afb in hda_codec_response hw/audio/intel-hda.c:107:5 TrungNguyen1909#33 0x62aec4e1 in hda_audio_command hw/audio/hda-codec.c:655:5 TrungNguyen1909#34 0x62ae05d9 in intel_hda_send_command hw/audio/intel-hda.c:307:5 TrungNguyen1909#35 0x62adff54 in intel_hda_corb_run hw/audio/intel-hda.c:342:9 TrungNguyen1909#36 0x62adc13b in intel_hda_set_corb_wp hw/audio/intel-hda.c:548:5 TrungNguyen1909#37 0x62ae5942 in intel_hda_reg_write hw/audio/intel-hda.c:977:9 TrungNguyen1909#38 0x62ada10a in intel_hda_mmio_write hw/audio/intel-hda.c:1054:5 TrungNguyen1909#39 0x63d8f383 in memory_region_write_accessor softmmu/memory.c:492:5 TrungNguyen1909#40 0x63d8ecc1 in access_with_adjusted_size softmmu/memory.c:554:18 TrungNguyen1909#41 0x63d8d5d6 in memory_region_dispatch_write softmmu/memory.c:1504:16 TrungNguyen1909#42 0x63d5e85e in flatview_write_continue softmmu/physmem.c:2812:23 TrungNguyen1909#43 0x63d4d05b in flatview_write softmmu/physmem.c:2854:12 TrungNguyen1909#44 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18 TrungNguyen1909#45 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16 TrungNguyen1909#46 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 TrungNguyen1909#47 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12 TrungNguyen1909#48 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12 ... SUMMARY: AddressSanitizer: stack-overflow softmmu/physmem.c:356 in address_space_translate_internal ==1580408==ABORTING Broken pipe Aborted (core dumped) Signed-off-by: Philippe Mathieu-Daudé <[email protected]> Acked-by: Thomas Huth <[email protected]> Message-Id: <[email protected]> Signed-off-by: Thomas Huth <[email protected]>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
iOS 15.3.1 cannot be restored -
unencrypted data volume is not allowedpanicKernel is a research kernel
xnu cmdline:
-restore kextlog=0xffff debug=0x14e -v rd=md0 launchd_missing_exec_no_panic=1 serial=3 wdt=-1 keepsyms=1 launchd_unsecure_cache=1IPSW download
root_ticket.der generated with BuildManifest in ipsw and the ticket.shsh2 in qemu-t8030-tools
Host is Debian bullseye Linux 5.15.0-0.bpo.3-amd64 #1 SMP Debian 5.15.15-2~bpo11+1 (2022-02-03) x86_64
qemu-t8030 commit: 42fedc7
boot command:
Serial port output right before panic
idevicerestore log
The text was updated successfully, but these errors were encountered: