Post

ellie
:3
@ptrpa.ws

got bored and wrote a kexec implementation for armv7 iOS in 100% rust :3

3 reposts15 likes

ellie
:3
@ptrpa.ws

yes! I wrote a separate tool to patch out signature checks in iBoot, prevent iBoot from messing with nvram and inject boot args to set a different root disk node and enable verbose boot etc (newer iOS versions require a few more / different patches)

ellie
:3
@ptrpa.ws

it's not a "real" kexec, but imo close enough. all the code does is: load the /patched/ iBoot correctly into ram, overwrite the deep-sleep trampoline (reset vector) with shellcode that jumps to the new stage1, and then schedules a power event in the existing kernel to trigger a deep sleep/wake cycle