In today's video, we're discussing yet another release from Google Project Zero, an iMessage exploit powerful enough that once can get unsandboxed remote code execution with it, so much so that Min (Spark) Zheng managed to extract files from an iPhone with it, and Samuel Groß managed to remotely open the "Calculator" application just by sending an iMessage to the target device which was an iPhone XS (A12). In his demo, Samuel first breaks ASLR by leaking the dyld_shared_cache base address, then proceeds to open the calculator app using the exploit.
Security researcher Natalie Silvanovich of Google Project Zero has posted a full writeup on the Project Zero blog detailing the vulnerability and how the exploit works. While this is not tfp0, it's still very impressive, and can potentially be used for a Jailbreak since it is unsandboxed. One of the uses could be as a vector to initialize the jailbreak itself, though I believe that is less practic than a standard #iOS application. The exploit works on iOS 12.3, iOS 12.3.1 and iOS 12.4.

As always, do not forget to SUBSCRIBE to stay updated with the latest iOS and Jailbreak news!

So you wanna build a Jailbreak and there is a tfp0 kernel exploit released (probably by either Sparkey or by Google Project Zero if I know this community well). The tfp0 is basically task_for_pid(0) so the task port for PID 0, which is the kernel_task or the XNU kernel itself. Once you've got tfp0, things are pretty simple because if you possess the Kernel Task Port, you have access to vm_read and vm_write to the Kernel Virtual Memory which means that you can apply various patches to yourself (your process representation in the kernel), or to other processes.

Of course, Apple thought about this and starting with iOS 9 things have changed quite a bit with the advent of KPP or Kernel Patch Protection. With A10 (iPhone 7, 7 Plus), Apple took it one step further after KPP was bypassed in iOS 9 and 10. They introduced KTRR (Kernel Text Read-Only Region), a hardware solution which to this date was only bypassed once, back in the iOS 10 days. KPP and KTRR are very different in the implementation. One is software, another is hardware, and they work in different ways. Siguza has very well writ explanations on how these work in his blog, but it suffices to know that both KTRR and KPP prevent you from patching the Kernel (well, Apple tried... in reality, they only protect the __TEXT region (the code itself) and the constants). Since variable data cannot be protected, it has since been abused to heck and beyond in all post iOS 10 Jailbreaks, the so-called KPPLess paradigm which is not really a KPP bypass, but a KPP compliance. KPP/KTRR don't want us to mess with the constants and the code, and we don't because we don't even have to, at least for now.

iOS is basically a mobile fork of macOS which grew to have its own particularities. macOS is basically FreeBSD + Unix + Apple's own shenanigans, so you will see many similarities with other Unix-based systems. One of these is the fact that each process that runs on the device has a PID (process ID) and a representation somewhere in the kernel. That representation holds everything from your permissions (or lack of thereof) to your PID, your Entitlements (to make AMFI happy) and other bits and pieces which make up the process structure.

So the plan is simple: If you have Kernel Read / Write privileges, you can poke around the kernel to find basically yourself (your app's representation in the Kernel). Once you find that, given the right offsets, you can modify the data to grant yourself new entitlements (they govern what you can and what you can't as an App on iOS), escape yourself from the SandBox, get to be owned by root (root:wheel) rather than mobile which is far more limited, etc.
(Or you can just say freak it and get the kernel credentials and replace yours with the kernel's, but not only that can result in weird bugs due to increased reference counters and other weird glitches, but it's also a bit dangerous).

So, the first thing we wanna do after we've integrated the tfp0 exploit with our Jailbreak Xcode project is to add the proper offsets. These offsets basically represent how far from a specific base address we should expect to find an object in the memory.
The following analogy should clear what offsets are once and for all:
Imagine a street. The street has a number, let's say street 0xFFFFFFFFFFa14eba. Now, there are multiple houses on that street, but we want to find Joe's house. We know that Joe lives at the house 401 so 401 is the offset because from the base address (the start of the street) we need to go 401 positions up (houses) before we find what we need. The same way in the memory we can find things by knowing their offsets relative to a base address.

Problem with these offsets is that they change from a version to another and even from a device to another, so iOS 11's offsets will not work on iOS 12. They may, however, in some cases work from a minor version to another, for example from 12.0 to 12.1.2.

The following structure contains the offsets for iOS 12.x firmware:
 

As you are probably aware, Cydia Impactor is a closed source multi-platform program developed by saurik (Jay Freeman), the same developer behind Cydia and Cydia Substrate. We rely on this piece of tool to be able to sideload iOS Applications from outside the iOS AppStore to the device using Free or Paid Apple Developer accounts. An Apple Developer Account can be absolutely any normal Apple ID used for downloading AppStore apps. You just have to enroll it into the Developer Portal which is Free if you need limited features (the free one cannot publish new apps into the AppStore). 

Cydia Impactor uses your Apple ID to be able to sign and deploy to the device your iOS applications that come in the .IPA format. This is useful if you wanna install modified / third-party iOS Apps that would not be available in the AppStore, but it's much more useful if you wanna deploy a Jailbreak application such as Unc0ver, Electra, Chimera, Osiris, Yalu, or other such Jailbreak tools, depending on the iOS version you are on.

From time to time, Cydia Impactor gets updated by Saurik (mostly to fix bugs or to add compatibility with newer major iOS version releases such as iOS 12.0, iOS 13.0, etc.).
If you do not update your Cydia Impactor, but you update your iOS, you may experience weird errors when you try to deploy an app. To update your Cydia Impactor you'll need to follow the steps below:

Method 1: 
1) Open your current Cydia Impactor
2) Navigate to Impactor -> Check For Update
3) A window will pop-up. If there's a new update, it will be downloaded and installed. Otherwise, you will be told the version you have is up to date.

Method 2:
1) Remove the Cydia Impactor you currently have.
2) Head to Cydia Impactor Website
3) Download the appropriate package for your OS (Windows, macOS or Linux)
4) Open the file. It is the latest available Cydia Impactor.

Keeping Cydia Impactor up to date is important to avoid multiple and severe errors during iOS App deployment.

In today's video, we have massive news to discuss some very valuable research released by the Pangu Jailbreak Team and security researcher Siguza in the past couple of days. Pangu Team was at BlackHat 2019 and they had two different talks, one about Remote Code Execution in FaceTime, and another one about exploiting the iPhone XS MAX (Basically A12 devices) in which they also covered very important aspects of PAC, XNU, and other security mechanisms. Also, at the same time, security researcher Siguza has published a very detailed article about APRR, KTRR and other hardware-based security mechanisms Apple uses in their devices, previously unknown details and vulnerabilities, all of which help the Jailbreak community enormously.

Of course, these may not be very useful right away for the end-user, but for the Jailbreak developers who build these tools, these research slides are extremely valuable because they were produced after long hours of independent research, trial and error and a lot of reverse engineering. This is not random info you get from the internet, it takes literally days of digging and poking around to understand these mechanisms Apple would like you to not even know they exist. Of course, for the jailbreak community, the better we understand these mechanisms, the better we can keep up with Apple's new mitigations and we can continue to build reliable jailbreak tools.

Hi I don’t know if anyone else’s is working or if I’ve messed something up but in flex I’m unable to process any apps at all. Does anyone know how to fix this? Thanks

In today's video, we're discussing the latest Sileo (Cydia alternative) update that was released just a few hours ago by the Chimera / Electra Team lead by Coolstar. The update brings important features to the table so I advise every Sileo user to update to the latest available version, which at the time I am making this video happens to be 1.3.0. In this video we're also discussing Pwn20wnd's plans for A12 support for his Unc0ver Jailbreak, plans that are quite big and if they come to fruition, they may change how A12 devices are jailbroken and how fast.

Currently, the majority of the users run the Unc0ver Jailbreak, so it only seems normal that Pwn20wnd is doing his best to implement A12 support, but not any sort of A12 support. He wants a stable bulletproof framework so that A12 devices can be jailbroken as reliably as any other iPhone below iPhone XS, XR or XS MAX. For that, he's been working a lot on a new framework that should be as powerful as the mighty Substrate by saurik. Unc0ver comes with #Cydia and Chimera / Electra come with #Sileo by default. Both quite powerful package managers.

In today's video, we're debunking yet another iOS 12.3.1, iOS 12.3 and iOS 12.4 Jailbreak, this time called "iElectraJB", basically a supposed Electra Jailbreak but from within safari and with compatibility with the aforementioned versions. As you probably are aware, the Electra Jailbreak is indeed a real jailbreak created by Coolstar and his team which works for iOS 11 to iOS 11.4.1. The iOS 12 equivalent of Electra is Chimera Jailbreak made by the same team but under a different name. Both Chimera and Electra are real jailbreaks that work for their intended iOS version range, but none of them are compatible at the time I am making this video with iOS 12.3 and newer.

So, the iElectraJB is a website that is only accessible from your iOS device in Safari that simulates almost perfectly the User Interface of the Electra Jailbreak and claims compatibility with iOS 11 all the way up to iOS 12.4. While iOS 11.0 to iOS 12.2 support is provided by the Electra Team in the real Electra Jailbreak, this website provides none. It's just a fake jailbreak website made for ads by the looks of it with no connection whatsoever to the real Electra Jailbreak or the real Electra Team.

Their strategy was to basically piggyback on #Electra Team's well-known name for some hits. Please do not use that, it's not a real jailbreak. As always, subscribe to stay informed when real jailbreaks are released and with the latest #iOS / #Jailbreak news!

I am having real issue with the Developer Acct.  Looks like Ignition signing down again.

So I tried to side load using impactor but getting the provision.cpp:81 error message and then stated I need an Apple developer acct.. I created a new acct, signed into Apple Developer and all looked ok.

So why do I still get the error message, can't get passed it to load JB.

Any help would be greatly appreciated.

In today's video, we're discussing what is currently going on in the jailbreak community in terms of Jailbreak for iOS 12.4, iOS 12.3 and iOS 12.3.1. We're talking Apple's recent changes in the signing status, a new iMessage exploit released by Google Project Zero for iOS 12.3.1 and demoed by Min (Spark) Zheng, we're also discussing how you can save your SHSH2 blobs for iOS 12.4 for future downgrades, upgrades, and restores, and also about the currently available tfp0 kernel exploits usable for a jailbreak and what to expect.

As always, it is pretty crucial to save your SHSH2 blobs for the latest signed versions. While the latest signed version is usually a no-no for jailbreak purposes, it won't stay "the latest" for so long, and once new versions are out, a jailbreak may come for what we currently call "the latest version". When that happens, it's best to have your SHSH2 blob saved for downgrade and restore purposes, otherwise, you may not be able to recover from a bootloop, and saving them at that point is probably no longer possible.

So i recently bypassed icloud on my iphone 4s using Apple Tech 752 method and upgraded it to 8.4.1. The phone does have service and i can receive message and dial *101#,.. thing like that, but i cant connect to 3g nor making any call and it does not show the carrier name on the status bar. So i was wondering if i replace the carrier bundles on my 4s with the one on my 5s will it work? Sorry about my bad english, i'm still learning