mirror of
https://github.com/leminlimez/Nugget.git
synced 2025-04-07 20:23:05 +00:00
Initial commit
This commit is contained in:
leminlimez
commit
bf1b47eed2
2
.gitattributes
vendored
Normal file
2
.gitattributes
vendored
Normal file
@ -0,0 +1,2 @@
|
||||
# Auto detect text files and perform LF normalization
|
||||
* text=auto
|
||||
44
CODENAME Nugget.spec
Normal file
44
CODENAME Nugget.spec
Normal file
@ -0,0 +1,44 @@
|
||||
# -*- mode: python ; coding: utf-8 -*-
|
||||
|
||||
|
||||
a = Analysis(
|
||||
['main_app.py'],
|
||||
pathex=[],
|
||||
binaries=[],
|
||||
datas=[],
|
||||
hiddenimports=['zeroconf', 'zeroconf._utils.ipaddress', 'zeroconf._handlers.answers'],
|
||||
hookspath=[],
|
||||
hooksconfig={},
|
||||
runtime_hooks=[],
|
||||
excludes=[],
|
||||
noarchive=False,
|
||||
optimize=0,
|
||||
)
|
||||
pyz = PYZ(a.pure)
|
||||
|
||||
exe = EXE(
|
||||
pyz,
|
||||
a.scripts,
|
||||
[],
|
||||
exclude_binaries=True,
|
||||
name='CODENAME Nugget',
|
||||
debug=False,
|
||||
bootloader_ignore_signals=False,
|
||||
strip=False,
|
||||
upx=True,
|
||||
console=True,
|
||||
disable_windowed_traceback=False,
|
||||
argv_emulation=False,
|
||||
target_arch=None,
|
||||
codesign_identity=None,
|
||||
entitlements_file=None,
|
||||
)
|
||||
coll = COLLECT(
|
||||
exe,
|
||||
a.binaries,
|
||||
a.datas,
|
||||
strip=False,
|
||||
upx=True,
|
||||
upx_exclude=[],
|
||||
name='CODENAME Nugget',
|
||||
)
|
||||
21
LICENSE
Normal file
21
LICENSE
Normal file
@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2024 leminlimez
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
28
README.md
Normal file
28
README.md
Normal file
@ -0,0 +1,28 @@
|
||||
# CODENAME Nugget
|
||||
Unlock your device's full potential! Works on all versions iOS 16.0+
|
||||
|
||||
Note: I am not responsible if your device bootloops. Please back up your data before using.
|
||||
|
||||
## Running the Program
|
||||
Requirements:
|
||||
- pymobiledevice3
|
||||
|
||||
Note: It is highly recommended to use a virtual environment:
|
||||
```
|
||||
python -m venv .env # only needed once
|
||||
source .env/bin/activate
|
||||
pip install -r requirements.txt # only needed once
|
||||
python main_app.py
|
||||
```
|
||||
|
||||
## Getting the File
|
||||
You need to get the mobilegestalt file that is specific to your device. To do that, follow these steps:
|
||||
1. Install the `Shortcuts` app from the iOS app store.
|
||||
2. Download this shortcut: https://www.icloud.com/shortcuts/d6f0a136ddda4714a80750512911c53b
|
||||
3. Save the file and share it to your computer.
|
||||
4. Place it in the same folder as the python file (or specify the path in the program)
|
||||
|
||||
## Credits
|
||||
- [JJTech](https://github.com/JJTech0130) for Sparserestore/[TrollRestore](https://github.com/JJTech0130/TrollRestore)
|
||||
- [pymobiledevice3](https://github.com/doronz88/pymobiledevice3)
|
||||
|
||||
344
com.apple.MobileGestalt.plist
Normal file
344
com.apple.MobileGestalt.plist
Normal file
@ -0,0 +1,344 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>CacheData</key>
|
||||
<data>
|
||||
AAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAA
|
||||
AAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAA
|
||||
AAABAAAAAAAAAAEAAAAAAAAAQx8AAAAAAAACAAAAAAAAAAEAAAAAAAAAuAsAAAAAAAAI
|
||||
BwAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAA
|
||||
AAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAIAaAAAAAQAAAAAAAAAAAAAAAAAA
|
||||
AHAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAA
|
||||
AAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AQAAAAAAAAABAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAADAAAAQAA
|
||||
AAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAB
|
||||
AAAAAAAAAAAAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAEIEAAAAAAAAAAAAAAAAA
|
||||
AAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVVU9QgAAAAABAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAA
|
||||
AAABAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU
|
||||
AAAAAAAAAAAAAIABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAA
|
||||
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEA
|
||||
AAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||
AAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAA
|
||||
AAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAA
|
||||
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAA
|
||||
AAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEA
|
||||
AAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAA
|
||||
AAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAA
|
||||
AAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAA
|
||||
AAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEA
|
||||
AAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA
|
||||
AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAAAAAAAAQAAAAAA
|
||||
AAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEA
|
||||
AAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAEAAAAAAAAACgAAAAAAAABkAAAAAAAAAOQAAAAAAAAA5AAAAAAA
|
||||
AADQBwAAAAAAAAAAAAAAAAAAAQAAAAAAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAA
|
||||
AAAAAAEAAAAAAAAAAQAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAAQAAAAAAAAAAAAAAAAAA
|
||||
AAEAAAAAAAAAZAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAPAAAAAAAAAA8AAAAAAAAADwA
|
||||
AAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||
AQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAACAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAA
|
||||
AAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAA
|
||||
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAA
|
||||
AJqZmT4AAAAAAAAAAAAAAAACAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAA
|
||||
AAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAADM
|
||||
AQAAAAAAAAAAQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAA
|
||||
AAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAA
|
||||
AAAAAAAAAAMAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAB
|
||||
AAAAAAAAAAIAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAA
|
||||
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFAAAAAAAAAAAAAAAA
|
||||
AAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||
AAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAADwAAAAAAAAAPAAAAAAAAAAAwAA
|
||||
AAAAAAABAAAAAAAAAGQAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAPAAAAAAA
|
||||
AAA8AAAAAAAAADwAAAAAAAAAPAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||
AQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAA
|
||||
AAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAB
|
||||
AAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAA
|
||||
AAAAYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||
AAAAZAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA
|
||||
AAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAZAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEA
|
||||
AAAAAAAAAAAAAAAAAAD/////AAAAAAEBAQEBAQEBAQAAAQABAQEBAQEBAQEBAQEBAAEA
|
||||
AQEBAQEAAAEBAQEAAAABAAEAAAEAAAEBAQAAAAABAAAAAQEBAAAAAQEBAQEBAQABAQEB
|
||||
AQEAAQEAAAEBAQAAAQABAQEBAQEAAQABAQEBAQEBAAEAAQABAQABAQABAQAAAQEBAQEB
|
||||
AAEBAQABAQEBAQEBAQEBAQEAAQABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAQEBAQEB
|
||||
AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAEBAQEBAQEBAQEBAAEBAQEBAQEBAQEBAQEB
|
||||
AQEBAQEBAQEBAQEBAQEBAQEAAQABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAEA
|
||||
AQEBAAEBAQEAAQABAAABAAAAAQEBAQEAAAAAAAABAQEBAQEBAQEBAAABAAABAQEBAQEB
|
||||
AQEBAQEBAQEBAQEBAQABAQEBAQEBAQEBAQEAAQABAQEAAQEBAQEBAQEBAQEBAQEBAQEB
|
||||
AQEBAQEBAQEBAQAAAQEAAAEAAQEBAQEBAQEBAQEAAQAAAQAAAQEAAQEBAQAAAAAAAAEB
|
||||
AQEBAQEBAQEAAAABAQEAAQEBAQEBAQEBAQEBAQEBAQEAAQAAAQEBAQABAQEBAQEBAQEB
|
||||
AQEAAQAAAQEBAAAAAAEBAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAAAAAAAAQEB
|
||||
AQEBAAABAAEAAQEAAAAAAAABAQABAQEBAQEBAAEBAAAAAQEAAQEBAQEBAQEBAQEAAAAB
|
||||
AQABAQABAAAAAAAAAQEBAQEBAQEBAAAAAAAAAAEBAQEBAAAAAAEBAQABAQEBAQEBAQEA
|
||||
AAAAAAABAQEBAQEB
|
||||
</data>
|
||||
<key>CacheExtra</key>
|
||||
<dict>
|
||||
<key>+3Uf0Pm5F8Xy7Onyvko0vA</key>
|
||||
<string>iPhone</string>
|
||||
<key>/YYygAofPDbhrwToVsXdeA</key>
|
||||
<string>D63AP</string>
|
||||
<key>0+nc/Udy4WNG8S+Q7a/s1A</key>
|
||||
<string>iPhone14,2</string>
|
||||
<key>0GizaJLOyfzgAbxQ/5aniA</key>
|
||||
<data>
|
||||
AQAAAAAAAAAAAAAAAwAAAA==
|
||||
</data>
|
||||
<key>37NVydb//GP/GrhuTN+exg</key>
|
||||
<true/>
|
||||
<key>4W7X4OWHjri5PGaAGsCWxw</key>
|
||||
<integer>52</integer>
|
||||
<key>4qfpxrvLtWillIHpIsVgMA</key>
|
||||
<string>BFFBB735-EC01-4194-82D1-39153313541C</string>
|
||||
<key>5pYKlGnYYBzGvAlIU8RjEQ</key>
|
||||
<string>t8110</string>
|
||||
<key>913P3Zsei09w0GSSOaBD+w</key>
|
||||
<data>
|
||||
AAAAAAAAAAAAAADgi73QPwAAAAAAAAAAAAAAALsltD8=
|
||||
</data>
|
||||
<key>91LyMcx4z1w3SGVeqteMnA</key>
|
||||
<data>
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAA==
|
||||
</data>
|
||||
<key>96GRvvjuBKkU4HzNsYcHPA</key>
|
||||
<string>11.2.0</string>
|
||||
<key>97JDvERpVwO+GHtthIh7hA</key>
|
||||
<string>A2483</string>
|
||||
<key>9MZ5AdH43csAUajl/dU+IQ</key>
|
||||
<array>
|
||||
<integer>1</integer>
|
||||
</array>
|
||||
<key>9UCjT7Qfi4xLVvPAKIzTCQ</key>
|
||||
<string>Beta</string>
|
||||
<key>9s45ldrCC1WF+7b6C4H2BA</key>
|
||||
<string>iPhone</string>
|
||||
<key>AoKnINTLPoKML3ctoP0AZg</key>
|
||||
<dict>
|
||||
<key>buffer-compression</key>
|
||||
<false/>
|
||||
<key>media-compression</key>
|
||||
<false/>
|
||||
<key>universal-buffer-compression</key>
|
||||
<true/>
|
||||
<key>universal-buffer-compression-requires-plane-alignment-2048</key>
|
||||
<false/>
|
||||
<key>universal-lossy-buffer-compression</key>
|
||||
<true/>
|
||||
<key>universal-multislice-buffer-compression</key>
|
||||
<false/>
|
||||
<key>universal-pARGB10101010-buffer-compression</key>
|
||||
<false/>
|
||||
</dict>
|
||||
<key>DViRIxZ/ZwO007CLcEYvZw</key>
|
||||
<string></string>
|
||||
<key>HXTqT3UXOKuTEklxz+wMAA</key>
|
||||
<data>
|
||||
KwAAAE9JUEekAAAAAAEAAA==
|
||||
</data>
|
||||
<key>IMLaTlxS7ITtwfbRfPYWuA</key>
|
||||
<string>A</string>
|
||||
<key>J1QHVh74Nnd6Rqyiq71/yw</key>
|
||||
<integer>1841299456</integer>
|
||||
<key>JHXk7RXOxvlqK+SxkwcM2A</key>
|
||||
<array>
|
||||
<string>nfc-express</string>
|
||||
<string>alisha</string>
|
||||
<string>find-my</string>
|
||||
</array>
|
||||
<key>JUWcn+5Ss0nvr5w/jk4WEg</key>
|
||||
<string>iPhone</string>
|
||||
<key>JhEU414EIaDvAz8ki5DSqw</key>
|
||||
<string>3</string>
|
||||
<key>LTI8wHvEYKy8zR1IXBW1uQ</key>
|
||||
<string>P3</string>
|
||||
<key>LeSRsiLoJCMhjn6nd6GWbQ</key>
|
||||
<string>iBoot-11881.2.10</string>
|
||||
<key>NUYAz1eq3Flzt7ZQxXC/ng</key>
|
||||
<real>1.0</real>
|
||||
<key>NaA/zJV7myg2w4YNmSe4yQ</key>
|
||||
<string>4387</string>
|
||||
<key>Nzu4E/VsXjEIa83CkRdZrQ</key>
|
||||
<string>sha2-384</string>
|
||||
<key>PdprWthPO6YyrO6p1vLRgQ</key>
|
||||
<data>
|
||||
AAAAAAAAAAAAAICV2RRzQAAAAAAAAAAAAAAAIRmbUEA=
|
||||
</data>
|
||||
<key>QHxt+hGLaBPbQJbXiUJX3w</key>
|
||||
<true/>
|
||||
<key>QbQzuIbef01P4JeoL9EmKg</key>
|
||||
<real>1.0</real>
|
||||
<key>SbXytSPZXB1jQ8GLZOxCPw</key>
|
||||
<data>
|
||||
AAAAAAAAAAAAAACApCbXPwAAAAAAAAAAAAAAALsltD8=
|
||||
</data>
|
||||
<key>TZ/0j62wM3D0CuRt+Nc/Lw</key>
|
||||
<data>
|
||||
HuVX26BXTN1Zf+WnPGp7JcMyhyo=
|
||||
</data>
|
||||
<key>VuGdqp8UBpi9vPWHlPluVQ</key>
|
||||
<array>
|
||||
<string>iPhone14,2</string>
|
||||
<string>iPhone13,3</string>
|
||||
</array>
|
||||
<key>WPEkba78QeFFU/wgqpOx6w</key>
|
||||
<data>
|
||||
AAAAAAAA8D8AAABgSHXSPwAAAAAAAAAAAAAAgOIFwD8=
|
||||
</data>
|
||||
<key>Z/dqyWS6OZTRy10UcmUAhw</key>
|
||||
<string>iPhone 13 Pro</string>
|
||||
<key>aD51uqjUwgRKjAC04BCrxg</key>
|
||||
<data>
|
||||
AAAAAAAAAAAAAECTdJhrQAAAAAAAAAAAAAAAIRmbUEA=
|
||||
</data>
|
||||
<key>bbtR9jQx50Fv5Af/affNtA</key>
|
||||
<string>iPhone 13 Pro</string>
|
||||
<key>c7fCSBIbX1mFaRoKT5zTIw</key>
|
||||
<string>USI</string>
|
||||
<key>emXA9B552rnSoI7xXE91DA</key>
|
||||
<real>1.0</real>
|
||||
<key>gBw7IWiBnLHaA+lBrZBgWw</key>
|
||||
<integer>600</integer>
|
||||
<key>gD8SNRcHQeIxCAvsp+2vjA</key>
|
||||
<data>
|
||||
AQAAAAAAAABNV1dKAAAAAA==
|
||||
</data>
|
||||
<key>h63QSdBCiT/z0WU6rdQv6Q</key>
|
||||
<string>LL</string>
|
||||
<key>h9jDsbgj7xIVeIQ8S3/X3Q</key>
|
||||
<string>iPhone14,2</string>
|
||||
<key>ivIu8YTDnBSrYv/SN4G8Ag</key>
|
||||
<string>iPhone OS</string>
|
||||
<key>k+KTni1jrwErpcDMEnn3aw</key>
|
||||
<string>1754</string>
|
||||
<key>k7QIBwZJJOVw+Sej/8h8VA</key>
|
||||
<string>arm64e</string>
|
||||
<key>mZfUC7qo4pURNhyMHZ62RQ</key>
|
||||
<string>22A5350a</string>
|
||||
<key>mumHZHMLEfAuTkkd28fHlQ</key>
|
||||
<string>1</string>
|
||||
<key>nSo8opze5rFk+EdBoR6tBw</key>
|
||||
<array>
|
||||
<string>CU</string>
|
||||
<string>IR</string>
|
||||
<string>SD</string>
|
||||
<string>SY</string>
|
||||
<string>KP</string>
|
||||
</array>
|
||||
<key>oBbtJ8x+s1q0OkaiocPuog</key>
|
||||
<data>
|
||||
kgQAAOQJAADMAQAAAABAQAAAAAAYAAAA
|
||||
</data>
|
||||
<key>oPeik/9e8lQWMszEjbPzng</key>
|
||||
<dict>
|
||||
<key>ArtworkDeviceIdiom</key>
|
||||
<string>phone</string>
|
||||
<key>ArtworkDeviceProductDescription</key>
|
||||
<string>Huawei P40 Pro</string>
|
||||
<key>ArtworkDeviceScaleFactor</key>
|
||||
<integer>3</integer>
|
||||
<key>ArtworkDeviceSubType</key>
|
||||
<integer>2556</integer>
|
||||
<key>ArtworkDisplayGamut</key>
|
||||
<string>P3</string>
|
||||
<key>ArtworkDynamicDisplayMode</key>
|
||||
<string>0</string>
|
||||
<key>CompatibleDeviceFallback</key>
|
||||
<string>iPhone13,3</string>
|
||||
<key>DevicePerformanceMemoryClass</key>
|
||||
<integer>6</integer>
|
||||
<key>GraphicsFeatureSetClass</key>
|
||||
<string>APPLE8</string>
|
||||
<key>GraphicsFeatureSetFallbacks</key>
|
||||
<string>APPLE7:APPLE6:APPLE5:APPLE4:APPLE3:APPLE3v1:APPLE2:APPLE1:GLES2,0</string>
|
||||
</dict>
|
||||
<key>oYicEKzVTz4/CxxE05pEgQ</key>
|
||||
<string>D63AP</string>
|
||||
<key>pB5sZVvnp+QjZQtt2KfQvA</key>
|
||||
<string>mav21</string>
|
||||
<key>pMeQxE5szZTjLMk10TisDQ</key>
|
||||
<data>
|
||||
AAAAAABgeEAAAEBOVW1uQAAAAAAAAAAAAAAAX7NpWkA=
|
||||
</data>
|
||||
<key>qNNddlUK+B/YlooNoymwgA</key>
|
||||
<string>18.0</string>
|
||||
<key>qwXfFvH5jPXPxrny0XuGtQ</key>
|
||||
<string>B909B792-6119-11EF-BE32-5D5563D4FA58</string>
|
||||
<key>rJkMAGeVLdhP5+10G5hVcA</key>
|
||||
<string>{ x: 390.000000, y: 243.416663, width: 0.000000, height: 105.651573 }</string>
|
||||
<key>rkqlwPcRHwixY4gapPjanw</key>
|
||||
<string>iPhone</string>
|
||||
<key>vme9Buk6XiWFCXoHApxNFA</key>
|
||||
<string>iPhone</string>
|
||||
<key>wYMBabAO8VguyDDVgCsPdg</key>
|
||||
<string>s=C2</string>
|
||||
<key>xUHcyT2/HE8oi/4LaOI+Sw</key>
|
||||
<string>GUID_partition_scheme</string>
|
||||
<key>xojWvSTQWT7Icy+xfVzjAQ</key>
|
||||
<string>9A0C207C-B633-46E3-ACF9-D32963533173</string>
|
||||
<key>yUqD8AXE/c+IggkuYoxrqA</key>
|
||||
<string>com.apple.dt.devicekit.chrome.phone4</string>
|
||||
<key>ybGkijAwLTwevankfVzsDQ</key>
|
||||
<data>
|
||||
AAAAAABIkkAAAAAAAMijQA==
|
||||
</data>
|
||||
<key>yjP8DgByZmLk04Ta6f6DWQ</key>
|
||||
<string>iOS</string>
|
||||
<key>zHeENZu+wbg7PUprwNwBWg</key>
|
||||
<string>LL/A</string>
|
||||
</dict>
|
||||
<key>CacheUUID</key>
|
||||
<string>E16FFD24-14A8-41B2-9D70-9BD96C5E88F2</string>
|
||||
<key>CacheVersion</key>
|
||||
<string>22A5350a</string>
|
||||
</dict>
|
||||
</plist>
|
||||
15
compile.py
Normal file
15
compile.py
Normal file
@ -0,0 +1,15 @@
|
||||
from sys import platform
|
||||
|
||||
import PyInstaller.__main__
|
||||
|
||||
args = [
|
||||
'main_app.py',
|
||||
# '--hidden-import=ipsw_parser',
|
||||
'--hidden-import=zeroconf',
|
||||
'--hidden-import=zeroconf._utils.ipaddress',
|
||||
'--hidden-import=zeroconf._handlers.answers',
|
||||
'--onedir',
|
||||
'--name=CODENAME Nugget',
|
||||
]
|
||||
|
||||
PyInstaller.__main__.run(args)
|
||||
1
exploit/__init__.py
Normal file
1
exploit/__init__.py
Normal file
@ -0,0 +1 @@
|
||||
from . import backup
|
||||
BIN
exploit/__pycache__/__init__.cpython-312.pyc
Normal file
BIN
exploit/__pycache__/__init__.cpython-312.pyc
Normal file
Binary file not shown.
BIN
exploit/__pycache__/backup.cpython-312.pyc
Normal file
BIN
exploit/__pycache__/backup.cpython-312.pyc
Normal file
Binary file not shown.
BIN
exploit/__pycache__/mbdb.cpython-312.pyc
Normal file
BIN
exploit/__pycache__/mbdb.cpython-312.pyc
Normal file
Binary file not shown.
BIN
exploit/__pycache__/restore.cpython-312.pyc
Normal file
BIN
exploit/__pycache__/restore.cpython-312.pyc
Normal file
Binary file not shown.
185
exploit/backup.py
Normal file
185
exploit/backup.py
Normal file
@ -0,0 +1,185 @@
|
||||
from dataclasses import dataclass
|
||||
from datetime import datetime
|
||||
import plistlib
|
||||
from pathlib import Path
|
||||
from base64 import b64decode
|
||||
from hashlib import sha1
|
||||
from . import mbdb
|
||||
from .mbdb import _FileMode
|
||||
from random import randbytes
|
||||
from typing import Optional
|
||||
|
||||
# RWX:RX:RX
|
||||
DEFAULT = _FileMode.S_IRUSR | _FileMode.S_IWUSR | _FileMode.S_IXUSR | _FileMode.S_IRGRP | _FileMode.S_IXGRP | _FileMode.S_IROTH | _FileMode.S_IXOTH
|
||||
|
||||
@dataclass
|
||||
class BackupFile:
|
||||
path: str
|
||||
domain: str
|
||||
|
||||
def to_record(self) -> mbdb.MbdbRecord:
|
||||
raise NotImplementedError()
|
||||
|
||||
@dataclass
|
||||
class ConcreteFile(BackupFile):
|
||||
contents: bytes
|
||||
owner: int = 0
|
||||
group: int = 0
|
||||
inode: Optional[int] = None
|
||||
mode: _FileMode = DEFAULT
|
||||
|
||||
def to_record(self) -> mbdb.MbdbRecord:
|
||||
if self.inode is None:
|
||||
self.inode = int.from_bytes(randbytes(8), "big")
|
||||
return mbdb.MbdbRecord(
|
||||
domain=self.domain,
|
||||
filename=self.path,
|
||||
link="",
|
||||
hash=sha1(self.contents).digest(),
|
||||
key=b"",
|
||||
mode=self.mode | _FileMode.S_IFREG,
|
||||
#unknown2=0,
|
||||
#unknown3=0,
|
||||
inode=self.inode,
|
||||
user_id=self.owner,
|
||||
group_id=self.group,
|
||||
mtime=int(datetime.now().timestamp()),
|
||||
atime=int(datetime.now().timestamp()),
|
||||
ctime=int(datetime.now().timestamp()),
|
||||
size=len(self.contents),
|
||||
flags=4,
|
||||
properties=[]
|
||||
)
|
||||
|
||||
@dataclass
|
||||
class Directory(BackupFile):
|
||||
owner: int = 0
|
||||
group: int = 0
|
||||
mode: _FileMode = DEFAULT
|
||||
|
||||
def to_record(self) -> mbdb.MbdbRecord:
|
||||
return mbdb.MbdbRecord(
|
||||
domain=self.domain,
|
||||
filename=self.path,
|
||||
link="",
|
||||
hash=b"",
|
||||
key=b"",
|
||||
mode=self.mode | _FileMode.S_IFDIR,
|
||||
#unknown2=0,
|
||||
#unknown3=0,
|
||||
inode=0, # inode is not respected for directories
|
||||
user_id=self.owner,
|
||||
group_id=self.group,
|
||||
mtime=int(datetime.now().timestamp()),
|
||||
atime=int(datetime.now().timestamp()),
|
||||
ctime=int(datetime.now().timestamp()),
|
||||
size=0,
|
||||
flags=4,
|
||||
properties=[]
|
||||
)
|
||||
|
||||
@dataclass
|
||||
class SymbolicLink(BackupFile):
|
||||
target: str
|
||||
owner: int = 0
|
||||
group: int = 0
|
||||
inode: Optional[int] = None
|
||||
mode: _FileMode = DEFAULT
|
||||
|
||||
def to_record(self) -> mbdb.MbdbRecord:
|
||||
if self.inode is None:
|
||||
self.inode = int.from_bytes(randbytes(8), "big")
|
||||
return mbdb.MbdbRecord(
|
||||
domain=self.domain,
|
||||
filename=self.path,
|
||||
link=self.target,
|
||||
hash=b"",
|
||||
key=b"",
|
||||
mode=self.mode | _FileMode.S_IFLNK,
|
||||
#unknown2=0,
|
||||
#unknown3=0,
|
||||
inode=self.inode,
|
||||
user_id=self.owner,
|
||||
group_id=self.group,
|
||||
mtime=int(datetime.now().timestamp()),
|
||||
atime=int(datetime.now().timestamp()),
|
||||
ctime=int(datetime.now().timestamp()),
|
||||
size=0,
|
||||
flags=4,
|
||||
properties=[]
|
||||
)
|
||||
|
||||
@dataclass
|
||||
class Backup:
|
||||
files: list[BackupFile]
|
||||
|
||||
def write_to_directory(self, directory: Path):
|
||||
for file in self.files:
|
||||
if isinstance(file, ConcreteFile):
|
||||
#print("Writing", file.path, "to", directory / sha1((file.domain + "-" + file.path).encode()).digest().hex())
|
||||
with open(directory / sha1((file.domain + "-" + file.path).encode()).digest().hex(), "wb") as f:
|
||||
f.write(file.contents)
|
||||
|
||||
with open(directory / "Manifest.mbdb", "wb") as f:
|
||||
f.write(self.generate_manifest_db().to_bytes())
|
||||
|
||||
with open(directory / "Status.plist", "wb") as f:
|
||||
f.write(self.generate_status())
|
||||
|
||||
with open(directory / "Manifest.plist", "wb") as f:
|
||||
f.write(self.generate_manifest())
|
||||
|
||||
with open(directory / "Info.plist", "wb") as f:
|
||||
f.write(plistlib.dumps({}))
|
||||
|
||||
|
||||
def generate_manifest_db(self): # Manifest.mbdb
|
||||
records = []
|
||||
for file in self.files:
|
||||
records.append(file.to_record())
|
||||
return mbdb.Mbdb(records=records)
|
||||
|
||||
def generate_status(self) -> bytes: # Status.plist
|
||||
return plistlib.dumps({
|
||||
"BackupState": "new",
|
||||
"Date": datetime.fromisoformat("1970-01-01T00:00:00+00:00"),
|
||||
"IsFullBackup": False,
|
||||
"SnapshotState": "finished",
|
||||
"UUID": "00000000-0000-0000-0000-000000000000",
|
||||
"Version": "2.4"
|
||||
})
|
||||
|
||||
def generate_manifest(self) -> bytes: # Manifest.plist
|
||||
return plistlib.dumps({
|
||||
"BackupKeyBag": b64decode("""
|
||||
VkVSUwAAAAQAAAAFVFlQRQAAAAQAAAABVVVJRAAAABDud41d1b9NBICR1BH9JfVtSE1D
|
||||
SwAAACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAV1JBUAAA
|
||||
AAQAAAAAU0FMVAAAABRY5Ne2bthGQ5rf4O3gikep1e6tZUlURVIAAAAEAAAnEFVVSUQA
|
||||
AAAQB7R8awiGR9aba1UuVahGPENMQVMAAAAEAAAAAVdSQVAAAAAEAAAAAktUWVAAAAAE
|
||||
AAAAAFdQS1kAAAAoN3kQAJloFg+ukEUY+v5P+dhc/Welw/oucsyS40UBh67ZHef5ZMk9
|
||||
UVVVSUQAAAAQgd0cg0hSTgaxR3PVUbcEkUNMQVMAAAAEAAAAAldSQVAAAAAEAAAAAktU
|
||||
WVAAAAAEAAAAAFdQS1kAAAAoMiQTXx0SJlyrGJzdKZQ+SfL124w+2Tf/3d1R2i9yNj9z
|
||||
ZCHNJhnorVVVSUQAAAAQf7JFQiBOS12JDD7qwKNTSkNMQVMAAAAEAAAAA1dSQVAAAAAE
|
||||
AAAAAktUWVAAAAAEAAAAAFdQS1kAAAAoSEelorROJA46ZUdwDHhMKiRguQyqHukotrxh
|
||||
jIfqiZ5ESBXX9txi51VVSUQAAAAQfF0G/837QLq01xH9+66vx0NMQVMAAAAEAAAABFdS
|
||||
QVAAAAAEAAAAAktUWVAAAAAEAAAAAFdQS1kAAAAol0BvFhd5bu4Hr75XqzNf4g0fMqZA
|
||||
ie6OxI+x/pgm6Y95XW17N+ZIDVVVSUQAAAAQimkT2dp1QeadMu1KhJKNTUNMQVMAAAAE
|
||||
AAAABVdSQVAAAAAEAAAAA0tUWVAAAAAEAAAAAFdQS1kAAAAo2N2DZarQ6GPoWRgTiy/t
|
||||
djKArOqTaH0tPSG9KLbIjGTOcLodhx23xFVVSUQAAAAQQV37JVZHQFiKpoNiGmT6+ENM
|
||||
QVMAAAAEAAAABldSQVAAAAAEAAAAA0tUWVAAAAAEAAAAAFdQS1kAAAAofe2QSvDC2cV7
|
||||
Etk4fSBbgqDx5ne/z1VHwmJ6NdVrTyWi80Sy869DM1VVSUQAAAAQFzkdH+VgSOmTj3yE
|
||||
cfWmMUNMQVMAAAAEAAAAB1dSQVAAAAAEAAAAA0tUWVAAAAAEAAAAAFdQS1kAAAAo7kLY
|
||||
PQ/DnHBERGpaz37eyntIX/XzovsS0mpHW3SoHvrb9RBgOB+WblVVSUQAAAAQEBpgKOz9
|
||||
Tni8F9kmSXd0sENMQVMAAAAEAAAACFdSQVAAAAAEAAAAA0tUWVAAAAAEAAAAAFdQS1kA
|
||||
AAAo5mxVoyNFgPMzphYhm1VG8Fhsin/xX+r6mCd9gByF5SxeolAIT/ICF1VVSUQAAAAQ
|
||||
rfKB2uPSQtWh82yx6w4BoUNMQVMAAAAEAAAACVdSQVAAAAAEAAAAA0tUWVAAAAAEAAAA
|
||||
AFdQS1kAAAAo5iayZBwcRa1c1MMx7vh6lOYux3oDI/bdxFCW1WHCQR/Ub1MOv+QaYFVV
|
||||
SUQAAAAQiLXvK3qvQza/mea5inss/0NMQVMAAAAEAAAACldSQVAAAAAEAAAAA0tUWVAA
|
||||
AAAEAAAAAFdQS1kAAAAoD2wHX7KriEe1E31z7SQ7/+AVymcpARMYnQgegtZD0Mq2U55u
|
||||
xwNr2FVVSUQAAAAQ/Q9feZxLS++qSe/a4emRRENMQVMAAAAEAAAAC1dSQVAAAAAEAAAA
|
||||
A0tUWVAAAAAEAAAAAFdQS1kAAAAocYda2jyYzzSKggRPw/qgh6QPESlkZedgDUKpTr4Z
|
||||
Z8FDgd7YoALY1g=="""),
|
||||
"Lockdown": {},
|
||||
"SystemDomainsVersion": "20.0",
|
||||
"Version": "9.1"
|
||||
})
|
||||
168
exploit/mbdb.py
Normal file
168
exploit/mbdb.py
Normal file
@ -0,0 +1,168 @@
|
||||
from dataclasses import dataclass
|
||||
from io import BytesIO
|
||||
|
||||
# Mode bitfield
|
||||
from enum import IntFlag
|
||||
class _FileMode(IntFlag):
|
||||
S_IFMT = 0o0170000
|
||||
S_IFIFO = 0o0010000
|
||||
S_IFCHR = 0o0020000
|
||||
S_IFDIR = 0o0040000
|
||||
S_IFBLK = 0o0060000
|
||||
S_IFREG = 0o0100000
|
||||
S_IFLNK = 0o0120000
|
||||
S_IFSOCK = 0o0140000
|
||||
|
||||
#S_IRWXU = 0o0000700
|
||||
S_IRUSR = 0o0000400
|
||||
S_IWUSR = 0o0000200
|
||||
S_IXUSR = 0o0000100
|
||||
|
||||
#S_IRWXG = 0o0000070
|
||||
S_IRGRP = 0o0000040
|
||||
S_IWGRP = 0o0000020
|
||||
S_IXGRP = 0o0000010
|
||||
|
||||
#S_IRWXO = 0o0000007
|
||||
S_IROTH = 0o0000004
|
||||
S_IWOTH = 0o0000002
|
||||
S_IXOTH = 0o0000001
|
||||
|
||||
S_ISUID = 0o0004000
|
||||
S_ISGID = 0o0002000
|
||||
S_ISVTX = 0o0001000
|
||||
|
||||
@dataclass
|
||||
class MbdbRecord:
|
||||
domain: str
|
||||
filename: str
|
||||
link: str
|
||||
hash: bytes
|
||||
key: bytes
|
||||
mode: _FileMode
|
||||
inode: int
|
||||
user_id: int
|
||||
group_id: int
|
||||
mtime: int
|
||||
atime: int
|
||||
ctime: int
|
||||
size: int
|
||||
flags: int
|
||||
properties: list
|
||||
|
||||
@classmethod
|
||||
def from_stream(cls, d: BytesIO):
|
||||
#d = BytesIO(data)
|
||||
|
||||
domain_len = int.from_bytes(d.read(2), "big")
|
||||
domain = d.read(domain_len).decode("utf-8")
|
||||
|
||||
filename_len = int.from_bytes(d.read(2), "big")
|
||||
filename = d.read(filename_len).decode("utf-8")
|
||||
|
||||
link_len = int.from_bytes(d.read(2), "big")
|
||||
link = d.read(link_len).decode("utf-8") if link_len != 0xffff else ""
|
||||
|
||||
hash_len = int.from_bytes(d.read(2), "big")
|
||||
hash = d.read(hash_len) if hash_len != 0xffff else b""
|
||||
|
||||
key_len = int.from_bytes(d.read(2), "big")
|
||||
key = d.read(key_len) if key_len != 0xffff else b""
|
||||
|
||||
mode = _FileMode(int.from_bytes(d.read(2), "big"))
|
||||
#unknown2 = int.from_bytes(d.read(4), "big")
|
||||
#unknown3 = int.from_bytes(d.read(4), "big")
|
||||
inode = int.from_bytes(d.read(8), "big")
|
||||
user_id = int.from_bytes(d.read(4), "big")
|
||||
group_id = int.from_bytes(d.read(4), "big")
|
||||
mtime = int.from_bytes(d.read(4), "big")
|
||||
atime = int.from_bytes(d.read(4), "big")
|
||||
ctime = int.from_bytes(d.read(4), "big")
|
||||
size = int.from_bytes(d.read(8), "big")
|
||||
flags = int.from_bytes(d.read(1), "big")
|
||||
|
||||
properties_count = int.from_bytes(d.read(1), "big")
|
||||
properties = []
|
||||
|
||||
for _ in range(properties_count):
|
||||
name_len = int.from_bytes(d.read(2), "big")
|
||||
name = d.read(name_len).decode("utf-8") if name_len != 0xffff else ""
|
||||
|
||||
value_len = int.from_bytes(d.read(2), "big")
|
||||
value = d.read(value_len).decode("utf-8") if value_len != 0xffff else ""
|
||||
|
||||
properties.append((name, value))
|
||||
|
||||
return cls(domain, filename, link, hash, key, mode, inode, user_id, group_id, mtime, atime, ctime, size, flags, properties)
|
||||
|
||||
def to_bytes(self) -> bytes:
|
||||
d = BytesIO()
|
||||
|
||||
d.write(len(self.domain).to_bytes(2, "big"))
|
||||
d.write(self.domain.encode("utf-8"))
|
||||
|
||||
d.write(len(self.filename).to_bytes(2, "big"))
|
||||
d.write(self.filename.encode("utf-8"))
|
||||
|
||||
d.write(len(self.link).to_bytes(2, "big"))
|
||||
d.write(self.link.encode("utf-8"))
|
||||
|
||||
d.write(len(self.hash).to_bytes(2, "big"))
|
||||
d.write(self.hash)
|
||||
|
||||
d.write(len(self.key).to_bytes(2, "big"))
|
||||
d.write(self.key)
|
||||
|
||||
d.write(self.mode.to_bytes(2, "big"))
|
||||
#d.write(self.unknown2.to_bytes(4, "big"))
|
||||
#d.write(self.unknown3.to_bytes(4, "big"))
|
||||
d.write(self.inode.to_bytes(8, "big"))
|
||||
d.write(self.user_id.to_bytes(4, "big"))
|
||||
d.write(self.group_id.to_bytes(4, "big"))
|
||||
d.write(self.mtime.to_bytes(4, "big"))
|
||||
d.write(self.atime.to_bytes(4, "big"))
|
||||
d.write(self.ctime.to_bytes(4, "big"))
|
||||
d.write(self.size.to_bytes(8, "big"))
|
||||
d.write(self.flags.to_bytes(1, "big"))
|
||||
|
||||
d.write(len(self.properties).to_bytes(1, "big"))
|
||||
|
||||
for name, value in self.properties:
|
||||
d.write(len(name).to_bytes(2, "big"))
|
||||
d.write(name.encode("utf-8"))
|
||||
|
||||
d.write(len(value).to_bytes(2, "big"))
|
||||
d.write(value.encode("utf-8"))
|
||||
|
||||
return d.getvalue()
|
||||
|
||||
@dataclass
|
||||
class Mbdb:
|
||||
records: list[MbdbRecord]
|
||||
|
||||
@classmethod
|
||||
def from_bytes(cls, data: bytes):
|
||||
d = BytesIO(data)
|
||||
|
||||
if d.read(4) != b"mbdb":
|
||||
raise ValueError("Invalid MBDB file")
|
||||
|
||||
if d.read(2) != b"\x05\x00":
|
||||
raise ValueError("Invalid MBDB version")
|
||||
|
||||
records = []
|
||||
while d.tell() < len(data):
|
||||
records.append(MbdbRecord.from_stream(d))
|
||||
|
||||
return cls(records)
|
||||
|
||||
def to_bytes(self) -> bytes:
|
||||
d = BytesIO()
|
||||
|
||||
d.write(b"mbdb")
|
||||
d.write(b"\x05\x00")
|
||||
|
||||
for record in self.records:
|
||||
d.write(record.to_bytes())
|
||||
|
||||
return d.getvalue()
|
||||
31
exploit/restore.py
Normal file
31
exploit/restore.py
Normal file
@ -0,0 +1,31 @@
|
||||
from exploit import backup
|
||||
from pymobiledevice3.lockdown import create_using_usbmux
|
||||
from pymobiledevice3.services.mobilebackup2 import Mobilebackup2Service
|
||||
from tempfile import TemporaryDirectory
|
||||
from pathlib import Path
|
||||
|
||||
def restore_file(fp: str, restore_path: str, restore_name: str):
|
||||
# open the file and read the contents
|
||||
contents = open(fp, "rb").read()
|
||||
|
||||
# create the backup
|
||||
back = backup.Backup(files=[
|
||||
backup.Directory("", "RootDomain", owner=501, group=501),
|
||||
backup.Directory("Library", "RootDomain", owner=501, group=501),
|
||||
backup.Directory("Library/Preferences", "RootDomain", owner=501, group=501),
|
||||
backup.ConcreteFile("Library/Preferences/Hello", "RootDomain", owner=501, group=501, contents=contents, mode=backup.RWX | backup._FileMode.S_IFREG),
|
||||
backup.Directory("", f"SysContainerDomain-../../../../../../../../var/.backup.i{restore_path}", owner=501, group=501),
|
||||
backup.ConcreteFile("", f"SysContainerDomain-../../../../../../../../var/.backup.i{restore_path}{restore_name}", owner=501, group=501, contents=contents),
|
||||
backup.Directory("", "SysContainerDomain-../../../../../../../../var/.backup.i/var/root/Library/Preferences/Hello", owner=501, group=501),
|
||||
])
|
||||
|
||||
# get a temporary dir to store the backup
|
||||
with TemporaryDirectory() as backup_dir:
|
||||
backup_dir_path = Path(backup_dir)
|
||||
back.write_to_directory(backup_dir_path)
|
||||
print(f"Backup written to {backup_dir}")
|
||||
input("Press Enter to continue...")
|
||||
|
||||
lockdown = create_using_usbmux()
|
||||
with Mobilebackup2Service(lockdown) as mb:
|
||||
mb.restore(backup_dir, system=True, reboot=False, copy=False, source=".")
|
||||
106
main_app.py
Normal file
106
main_app.py
Normal file
@ -0,0 +1,106 @@
|
||||
from exploit.restore import restore_file
|
||||
from pathlib import Path
|
||||
import plistlib
|
||||
import traceback
|
||||
|
||||
running = True
|
||||
passed_check = False
|
||||
# tweaks
|
||||
dynamic_island_enabled = False
|
||||
current_model_name = ""
|
||||
boot_chime_enabled = False
|
||||
charge_limit_enabled = False
|
||||
stage_manager_enabled = False
|
||||
|
||||
gestalt_path = Path.joinpath(Path.cwd(), "com.apple.MobileGestalt.plist")
|
||||
|
||||
while running:
|
||||
print("""\n\n\n\n
|
||||
|
||||
,--.
|
||||
,--.'| ___
|
||||
,--,: : | ,--.'|_
|
||||
,`--.'`| ' : ,--, | | :,'
|
||||
| : : | | ,'_ /| ,----._,. ,----._,. : : ' :
|
||||
: | \\ | : .--. | | : / / ' / / / ' / ,---. .;__,' /
|
||||
| : ' '; |,'_ /| : . || : || : | / \\ | | |
|
||||
' ' ;. ;| ' | | . .| | .\\ .| | .\\ . / / |:__,'| :
|
||||
| | | \\ || | ' | | |. ; '; |. ; '; |. ' / | ' : |__
|
||||
' : | ; .': | : ; ; |' . . |' . . |' ; /| | | '.'|
|
||||
| | '`--' ' : `--' \\`---`-'| | `---`-'| |' | / | ; : ;
|
||||
' : | : , .-./.'__/\\_: | .'__/\\_: || : | | , /
|
||||
; |.' `--`----' | : : | : : \\ \\ / ---`-'
|
||||
'---' \\ \\ / \\ \\ / `----'
|
||||
`--`-' `--`-'
|
||||
""")
|
||||
print("1.0 ALPHA 2\n\n")
|
||||
|
||||
if not passed_check and Path.exists(gestalt_path) and Path.is_file(gestalt_path):
|
||||
passed_check = True
|
||||
|
||||
if passed_check:
|
||||
print(f"1. {"[Y] " if dynamic_island_enabled else ""}Toggle Dynamic Island")
|
||||
print(f"2. {"[Y] " if current_model_name != "" else ""}Set Device Model Name")
|
||||
print(f"3. {"[Y] " if boot_chime_enabled else ""}Toggle Boot Chime")
|
||||
print(f"4. {"[Y] " if charge_limit_enabled else ""}Toggle Charge Limit")
|
||||
print(f"5. {"[Y] " if stage_manager_enabled else ""}Toggle Stage Manager Supported")
|
||||
print("\n9. Apply")
|
||||
print("0. Exit\n")
|
||||
page = int(input("Enter a number: "))
|
||||
if page == 1:
|
||||
dynamic_island_enabled = not dynamic_island_enabled
|
||||
elif page == 2:
|
||||
print("\n\nSet Model Name")
|
||||
print("Leave blank to turn off custom name.\n")
|
||||
name = input("Enter Model Name: ")
|
||||
current_model_name = name
|
||||
elif page == 3:
|
||||
boot_chime_enabled = not boot_chime_enabled
|
||||
elif page == 4:
|
||||
charge_limit_enabled = not charge_limit_enabled
|
||||
elif page == 5:
|
||||
stage_manager_enabled = not stage_manager_enabled
|
||||
elif page == 9:
|
||||
print()
|
||||
# set the tweaks and apply
|
||||
# first open the file in read mode
|
||||
with open(gestalt_path, 'rb') as in_fp:
|
||||
plist = plistlib.load(in_fp)
|
||||
|
||||
# set the plist keys
|
||||
if dynamic_island_enabled:
|
||||
plist["CacheExtra"]["oPeik/9e8lQWMszEjbPzng"]["ArtworkDeviceSubType"] = 2556
|
||||
if current_model_name != "":
|
||||
plist["CacheExtra"]["oPeik/9e8lQWMszEjbPzng"]["ArtworkDeviceProductDescription"] = current_model_name
|
||||
if boot_chime_enabled:
|
||||
plist["CacheExtra"]["QHxt+hGLaBPbQJbXiUJX3w"] = True
|
||||
if charge_limit_enabled:
|
||||
plist["CacheExtra"]["37NVydb//GP/GrhuTN+exg"] = True
|
||||
if stage_manager_enabled:
|
||||
plist["CacheExtra"]["qeaj75wk3HF4DwQ8qbIi7g"] = 1
|
||||
|
||||
# write back to the file
|
||||
with open(gestalt_path, 'wb') as out_fp:
|
||||
plistlib.dump(plist, out_fp)
|
||||
# restore to the device
|
||||
try:
|
||||
restore_file(fp=gestalt_path, restore_path="/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/", restore_name="com.apple.MobileGestalt.plist")
|
||||
input("Success! Reboot your device to see the changes.")
|
||||
except Exception as e:
|
||||
print(traceback.format_exc())
|
||||
input("Press Enter to continue...")
|
||||
running = False
|
||||
elif page == 0:
|
||||
# exit the panel
|
||||
print("Goodbye!")
|
||||
running = False
|
||||
else:
|
||||
print("No MobileGestalt file found!")
|
||||
print(f"Please place the file in \'{Path.cwd()}\' with the name \'com.apple.MobileGestalt.plist\'")
|
||||
print("Remember to make a backup of the file!!\n")
|
||||
print("1. Retry")
|
||||
print("2. Enter path\n")
|
||||
choice = int(input("Enter number: "))
|
||||
if choice == 2:
|
||||
new_path = input("Enter new path to file: ")
|
||||
gestalt_path = Path(new_path)
|
||||
43
main_app.spec
Normal file
43
main_app.spec
Normal file
@ -0,0 +1,43 @@
|
||||
# -*- mode: python ; coding: utf-8 -*-
|
||||
|
||||
|
||||
a = Analysis(
|
||||
['main_app.py'],
|
||||
pathex=[],
|
||||
binaries=[],
|
||||
datas=[],
|
||||
hiddenimports=[],
|
||||
hookspath=[],
|
||||
hooksconfig={},
|
||||
runtime_hooks=[],
|
||||
excludes=[],
|
||||
noarchive=False,
|
||||
)
|
||||
pyz = PYZ(a.pure)
|
||||
|
||||
exe = EXE(
|
||||
pyz,
|
||||
a.scripts,
|
||||
[],
|
||||
exclude_binaries=True,
|
||||
name='main_app',
|
||||
debug=False,
|
||||
bootloader_ignore_signals=False,
|
||||
strip=False,
|
||||
upx=True,
|
||||
console=True,
|
||||
disable_windowed_traceback=False,
|
||||
argv_emulation=False,
|
||||
target_arch=None,
|
||||
codesign_identity=None,
|
||||
entitlements_file=None,
|
||||
)
|
||||
coll = COLLECT(
|
||||
exe,
|
||||
a.binaries,
|
||||
a.datas,
|
||||
strip=False,
|
||||
upx=True,
|
||||
upx_exclude=[],
|
||||
name='main_app',
|
||||
)
|
||||
1
requirements.txt
Normal file
1
requirements.txt
Normal file
@ -0,0 +1 @@
|
||||
pymobiledevice3
|
||||
Loading…
x
Reference in New Issue
Block a user