iphonetool 0.1.0__py3-none-any.whl

iphonetool/__main__.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=3.13"
+# dependencies = [
+#     "pymobiledevice3>=10.1.0",
+#     "pyusb>=1.3.1",
+# ]
+# ///
+
+try:
+    import usb.core
+except ImportError:
+    print("pyusb not installed and is needed for all operations. Please install pyusb")
+    raise
+import argparse
+import asyncio
+import sys
+from enum import IntEnum
+
+import dfu
+import helpers
+import normal
+import recovery
+
+
+async def main() -> int:
+    if "-w" in sys.argv or "--wait" in sys.argv:
+        print("Waiting for device...")
+        dev = await helpers.wait_device()
+        print("Found device")
+    else:
+        dev = helpers.get_device()
+
+    # If this fails, it will fall through to a "normal" device below
+    if dev is None and ("-h" not in sys.argv and "--help" not in sys.argv):
+        print("No idevice found :(")
+        return 1
+
+    parser = argparse.ArgumentParser()
+    # This is only for showing up in help
+    parser.add_argument(
+        "-w", "--wait", help="Wait for a device to appear", action="store_true"
+    )
+    subparsers = parser.add_subparsers(dest="action")
+    # List is supported in all modes
+    subparsers.add_parser("info")
+
+    if dev is None:
+        return await normal.main(None, parser, subparsers)
+
+    # Figure out what mode the device is in
+    match helpers.classify_mode(dev):
+        case helpers.DeviceMode.NORMAL:
+            return await normal.main(dev, parser, subparsers)
+        case helpers.DeviceMode.RECOVERY:
+            return await recovery.main(dev, parser, subparsers)
+        case helpers.DeviceMode.DFU:
+            return await dfu.main(dev, parser, subparsers)
+
+
+if __name__ == "__main__":
+    exit(asyncio.run(main()))

iphonetool/config.py

@@ -0,0 +1,11 @@
+from enum import IntEnum
+
+APPLE_VENDORID = 0x05AC
+
+
+class AppleProductId(IntEnum):
+    RECOVERY = 0x1281
+    DFU = 0x1227
+
+
+USBLITER8_TRANSFER_SIZE = 0x800

iphonetool/dfu.py

@@ -0,0 +1,243 @@
+import argparse
+import asyncio
+import glob
+import os
+import pathlib
+import shutil
+import subprocess
+import sys
+import tempfile
+from enum import IntEnum
+from typing import Any, Optional
+
+import usb.core
+
+import config
+import helpers
+
+
+async def main(
+    dev: usb.core.Device,
+    parser: argparse.ArgumentParser,
+    subparsers: argparse._SubParsersAction,
+):
+    subparsers.add_parser("exit_dfu_helper", help="Help exiting DFU mode")
+
+    try:
+        serial = dev.serial_number
+    except ValueError as e:
+        raise ValueError(
+            "This script must be run as root for iPhones in recovery or dfu mode."
+        ) from e
+
+    if helpers.serial_info_get(serial, "PWND") == "[usbliter8]":
+        pwned_device = True
+    else:
+        pwned_device = False
+
+    if pwned_device:
+        subparsers.add_parser(
+            "demote", help="Demote this device to a development device"
+        )
+
+        boot_parser = subparsers.add_parser(
+            "boot", help='Low-level device exploit booting. You probably want "linux"'
+        )
+        boot_subparsers = boot_parser.add_subparsers(dest="boot_action")
+
+        boot_raw_parser = boot_subparsers.add_parser(
+            "raw", help="Boot a raw iBoot file"
+        )
+        boot_raw_parser.add_argument(
+            "iBoot", type=pathlib.Path, help="The raw iBoot to boot"
+        )
+
+        boot_remote_parser = boot_subparsers.add_parser(
+            "remote", help="Remote boot m1n1, linux, etc."
+        )
+        boot_remote_parser.add_argument(
+            "-1",
+            "--m1n1",
+            type=pathlib.Path,
+            help="m1n1-idevice.macho + any addons (linux, dtbs, etc)",
+            required=True,
+        )
+        boot_remote_parser.add_argument(
+            "-m", "--monitor", type=pathlib.Path, help="m1n1 monitor stub"
+        )
+
+        # High-level linux booter
+        linux_parser = subparsers.add_parser("linux", help="Boot linux on device")
+        linux_parser.add_argument(
+            "-1",
+            "--m1n1",
+            type=pathlib.Path,
+            help="Path to m1n1-idevice.macho",
+            required=True,
+        )
+        linux_parser_dtb_group = linux_parser.add_mutually_exclusive_group(
+            required=True
+        )
+        linux_parser_dtb_group.add_argument(
+            "-d", "--dtb", type=pathlib.Path, help="Path to devicetree for device"
+        )
+        linux_parser_dtb_group.add_argument(
+            "-D", "--dtbs", type=pathlib.Path, help="Path to directory of devicetrees"
+        )
+        linux_parser.add_argument(
+            "-k", "--kernel", type=pathlib.Path, help="Path to kernel", required=True
+        )
+        linux_parser.add_argument(
+            "-c", "--commandline", help="Linux commandline to boot"
+        )
+        linux_parser.add_argument(
+            "-i", "--initramfs", type=pathlib.Path, help="Linux initramfs to boot"
+        )
+        linux_parser.add_argument(
+            "-m", "--monitor", type=pathlib.Path, help="m1n1 monitor stub"
+        )
+
+    args = parser.parse_args()
+
+    return await main_real(dev, pwned_device, serial, args.action, vars(args))
+
+
+class Usbliter8Command(IntEnum):
+    DFU_DNLOAD = 1
+    DFU_ABORT = 4
+    CUSTOM_DEMOTE = 7
+    CUSTOM_BOOT = 8
+
+
+def send_usbliter8_command(
+    dev: usb.core.Device, command: Usbliter8Command, data: Any, timeout: int
+) -> None:
+    dev.ctrl_transfer(0x21, command, 0, 0, data, timeout)
+
+
+def usbliter8_download(dev: usb.core.Device, data: bytes) -> True:
+    offset = 0
+    left = len(data)
+
+    while left:
+        current_block_length = min(config.USBLITER8_TRANSFER_SIZE, left)
+
+        send_usbliter8_command(
+            dev,
+            Usbliter8Command.DFU_DNLOAD,
+            data[offset : offset + current_block_length],
+            1000,
+        )
+
+        offset += current_block_length
+        left -= current_block_length
+
+        print(f"\rUploaded: 0x{offset:x}/0x{len(data):x} bytes.", end="")
+
+    print()
+
+    send_usbliter8_command(dev, Usbliter8Command.DFU_DNLOAD, None, 100)
+
+
+def linux_remote_boot(m1n1_blob: pathlib.Path, monitor_stub: Optional[pathlib.Path]):
+    subprocess.check_call(["./remote_boot/remoteboot.sh", "build"])
+    if monitor_stub is not None:
+        subprocess.check_call(
+            [
+                helpers.base_directory() / "./remote_boot/remoteboot.sh",
+                "boot",
+                m1n1_blob,
+                monitor_stub,
+            ],
+            env={
+                "USBLITER8CTL": helpers.base_directory() / "usbliter8ctl.py",
+                "PYTHON": sys.executable,
+                "HOME": os.getenv("HOME"),
+            },
+        )
+    else:
+        subprocess.check_call(
+            ["./remote_boot/remoteboot.sh", "boot", m1n1_blob],
+            env={
+                "USBLITER8CTL": helpers.base_directory() / "usbliter8ctl.py",
+                "PYTHON": sys.executable,
+                "HOME": os.getenv("HOME"),
+            },
+        )
+
+
+async def main_real(
+    dev: usb.core.Device, pwned: bool, serial: str, action: str, args: dict
+) -> int:
+    ecid = int(helpers.serial_info(serial, "ECID"), 16)
+
+    irecovery = subprocess.check_output(["irecovery", "-q", "-i", hex(ecid)]).decode()
+
+    print(args)
+
+    match action:
+        case "info":
+            if pwned:
+                print(
+                    f"Detected PWNED DFU mode {helpers.irecovery_info(irecovery, "NAME")}:"
+                )
+            else:
+                print(f"Detected DFU mode {helpers.irecovery_info(irecovery, "NAME")}:")
+            print("iPhone ID:", ecid)
+            print(
+                "iPhone internal version:", helpers.irecovery_info(irecovery, "PRODUCT")
+            )
+            print("Codename:", helpers.irecovery_info(irecovery, "MODEL"))
+            print("CPU:", helpers.serial_info(serial, "CPID"))
+        case "exit_dfu_helper":
+            # TODO: This
+            print("Idk. You figure it out")
+        case "demote":
+            print(f"Telling device {ecid} to demote to development.")
+            send_usbliter8_command(dev, Usbliter8Command.CUSTOM_DEMOTE, None, 100)
+            print(f"Device {ecid} has demoted to development.")
+        case "boot":
+            match args["boot_action"]:
+                case "raw":
+                    iboot_file = args["iBoot"]
+                    print(f"Uploading {iboot_file} to device...")
+                    usbliter8_download(dev, iboot_file.read_bytes())
+
+                    send_usbliter8_command(dev, Usbliter8Command.CUSTOM_BOOT, None, 100)
+                    send_usbliter8_command(dev, Usbliter8Command.DFU_ABORT, None, 100)
+                case "remote":
+                    linux_remote_boot(args["m1n1"], args.get("monitor"))
+        case "linux":
+            print("Preapring iboot...")
+            with tempfile.NamedTemporaryFile(mode="wb") as m1n1_blob_file:
+                print("adding m1n1")
+                with args["m1n1"].open("rb") as f:
+                    shutil.copyfileobj(f, m1n1_blob_file)
+                if args["commandline"] is not None:
+                    print("adding commandline")
+                    m1n1_blob_file.write(
+                        f'chosen.bootargs={args["commandline"]}\n'.encode()
+                    )
+                if args["dtb"] is not None:
+                    if not args["dtb"].is_file():
+                        raise ValueError("Specified DTB is not a file.")
+                    print("adding dtb")
+                    with args["dtb"].open("rb") as f:
+                        shutil.copyfileobj(f, m1n1_blob_file)
+                else:
+                    if not args["dtbs"].is_dir():
+                        raise ValueError("Specified DTB directory is not a dir.")
+                    print("adding dtbs")
+                    for dtb in glob.iglob("./*.dtb", root_dir=args["dtbs"]):
+                        with (args["dtbs"] / dtb).open("rb") as f:
+                            shutil.copyfileobj(f, m1n1_blob_file)
+                print("adding kernel")
+                with args["kernel"].open("rb") as f:
+                    shutil.copyfileobj(f, m1n1_blob_file)
+                if args["initramfs"] is not None:
+                    print("adding initramfs")
+                    with args["initramfs"].open("rb") as f:
+                        shutil.copyfileobj(f, m1n1_blob_file)
+                linux_remote_boot(
+                    pathlib.Path(m1n1_blob_file.name), args.get("monitor")
+                )

iphonetool/helpers.py

@@ -0,0 +1,87 @@
+import asyncio
+import functools
+import pathlib
+import subprocess
+from enum import Enum, auto
+from typing import Optional
+
+import usb.core
+
+from config import APPLE_VENDORID, AppleProductId
+
+
+class DeviceMode(Enum):
+    NORMAL = auto()
+    RECOVERY = auto()
+    DFU = auto()
+
+
+def get_device():
+    return usb.core.find(idVendor=APPLE_VENDORID)
+
+
+async def wait_device():
+    while True:
+        dev = get_device()
+        if dev is not None:
+            return dev
+
+        await asyncio.sleep(0.1)
+
+
+async def wait_disconnect(dev: usb.core.Device):
+    while True:
+        try:
+            device = usb.core.find(idVendor=dev.idVendor, idProduct=dev.idProduct)
+            if device is not None and device.serial_number == dev.serial_number:
+                await asyncio.sleep(0.1)
+                continue
+        except ValueError:
+            continue
+        break
+
+
+def classify_mode(dev: usb.core.Device) -> DeviceMode:
+    match dev.idProduct:
+        case AppleProductId.RECOVERY:
+            return DeviceMode.RECOVERY
+        case AppleProductId.DFU:
+            return DeviceMode.DFU
+        case _:
+            return DeviceMode.NORMAL
+
+
+def serial_info_get(serial, key) -> Optional[str]:
+    value = dict(
+        list(map(functools.partial(str.split, sep=":", maxsplit=1), serial.split(" ")))
+    ).get(key.upper())
+    if value is None:
+        return value
+    return value.strip()
+
+
+def serial_info(serial, key) -> str:
+    value = serial_info_get(serial, key)
+    if value is None:
+        raise ValueError(f"Could not find key {key} in recovery serial {serial}")
+    return value
+
+
+def irecovery_info(irecovery, key) -> str:
+    try:
+        return dict(list(map(functools.partial(str.split, sep=":", maxsplit=1), irecovery.splitlines())))[key.upper()].strip()  # type: ignore
+    except IndexError as e:
+        raise ValueError(
+            f"Could not find key {key} in irecovery data {irecovery}"
+        ) from e
+
+
+def irecovery_command(cmd: str, ecid: Optional[int] = None) -> None:
+    if ecid is not None:
+        subprocess.run(["irecovery", "-i", hex(ecid), "-c", cmd], check=True)
+    else:
+        subprocess.run(["irecovery", "-c", cmd], check=True)
+
+
+def base_directory() -> pathlib.Path:
+    return pathlib.Path(__file__).parent

iphonetool/normal.py

@@ -0,0 +1,89 @@
+import argparse
+import asyncio
+
+import usb.core
+
+import helpers
+import recovery
+
+try:
+    import pymobiledevice3.exceptions
+    import pymobiledevice3.lockdown
+except ImportError:
+    print(
+        "pymobiledevice3 not installed and is needed for normal/recovery mode operation. Please install pymobiledevice3"
+    )
+    raise
+
+
+async def main(
+    dev: usb.core.Device,
+    parser: argparse.ArgumentParser,
+    subparsers: argparse._SubParsersAction,
+) -> int:
+    subparsers.add_parser("dfu_helper", help="Help put device into DFU mode")
+    subparsers.add_parser("enter_recovery", help="Enter recovery mode")
+
+    args = parser.parse_args()
+
+    return await main_real(dev, args.action)
+
+
+# This can be called easily from other python files
+async def main_real(dev: usb.core.Device, action: str) -> int:
+    serial = dev.serial_number.rstrip("\x00")
+
+    while True:
+        try:
+            connector = await pymobiledevice3.lockdown.create_using_usbmux(
+                connection_type="USB", serial=serial
+            )
+            break
+        except (
+            pymobiledevice3.exceptions.DeviceNotFoundError,
+            pymobiledevice3.exceptions.ConnectionFailedToUsbmuxdError,
+        ):
+            # usbmuxd needs a little time sometimes
+            print("Failed to connect. Retrying...")
+            await asyncio.sleep(0.3)
+            continue
+        except pymobiledevice3.exceptions.MissingValueError as e:
+            # THis can occur if the attempt to connect is made while the device is shutting down
+            raise ValueError("Failed to connect to device") from e
+
+    async with connector as lockdown:
+        match action:
+            case "info":
+                print(f"Detected normal mode {lockdown.display_name}:")
+                print("iPhone ID:", lockdown.udid)
+                print("iPhone internal version:", lockdown.product_type)
+                print("Device name:", lockdown.all_values["DeviceName"])
+                print("iOS Version:", lockdown.product_version)
+                print("Codename:", lockdown.hardware_model.upper())
+                print("CPU:", lockdown.all_values["HardwarePlatform"].upper())
+            case "enter_recovery":
+                print(f"Telling device {lockdown.udid} to enter recovery.")
+                await lockdown.enter_recovery()
+                print(f"Device {lockdown.udid} has entered recovery.")
+            case "dfu_helper":
+                # Put device into recovery
+                print(f"Telling device {lockdown.udid} to enter recovery.")
+                await lockdown.enter_recovery()
+                print(f"Device {lockdown.udid} has entered recovery.")
+
+                # Wait for the device to disconnect
+                print("Waiting for device disconnect.")
+                await helpers.wait_disconnect(dev)
+                print(f"Device {lockdown.udid} disconnected")
+
+                # Release the old device
+                del dev
+
+                # Get a new device
+                print("Waiting for device to reconnect...")
+                dev = await helpers.wait_device()
+
+                # Continue dfu helper there
+                return await recovery.main_real(dev, "dfu_helper")
+
+    return 0

iphonetool/recovery.py

@@ -0,0 +1,112 @@
+import argparse
+import asyncio
+import subprocess
+from collections.abc import Callable
+from typing import Optional
+
+import usb.core
+
+import helpers
+import normal
+
+try:
+    import pymobiledevice3
+except ImportError:
+    print(
+        "pymobiledevice3 not installed and is needed for normal/recovery mode operation. Please install pymobiledevice3"
+    )
+    raise
+
+
+async def print_in(secs: float, message: str) -> None:
+    try:
+        await asyncio.sleep(secs)
+        print(message)
+    except asyncio.CancelledError:
+        pass
+
+
+async def main(
+    dev: usb.core.Device,
+    parser: argparse.ArgumentParser,
+    subparsers: argparse._SubParsersAction,
+):
+    subparsers.add_parser("dfu_helper", help="Help put device into DFU mode")
+    subparsers.add_parser("exit_recovery", help="Exit recovery mode")
+
+    args = parser.parse_args()
+
+    return await main_real(dev, args.action)
+
+
+# This can be called easily from other python files
+async def main_real(dev: usb.core.Device, action: str) -> int:
+    try:
+        serial = dev.serial_number
+    except ValueError as e:
+        raise ValueError(
+            "This script must be run as root for iPhones in recovery or dfu mode."
+        ) from e
+    ecid = int(helpers.serial_info(serial, "ECID"), 16)
+
+    irecovery = subprocess.check_output(["irecovery", "-q", "-i", hex(ecid)]).decode()
+
+    match action:
+        case "info":
+            print(
+                f"Detected recovery mode {helpers.irecovery_info(irecovery, "NAME")}:"
+            )
+            print("iPhone ID:", ecid)
+            print(
+                "iPhone internal version:", helpers.irecovery_info(irecovery, "PRODUCT")
+            )
+            print("Codename:", helpers.irecovery_info(irecovery, "MODEL"))
+            print("CPU:", helpers.serial_info(serial, "CPID"))
+        case "exit_recovery":
+            print(f"Telling device {ecid} to exit recovery.", flush=True)
+            helpers.irecovery_command("setenv auto-boot true", ecid)
+            helpers.irecovery_command("saveenv", ecid)
+            helpers.irecovery_command("reboot", ecid)
+            print(f"Device {ecid} has exited recovery", flush=True)
+        case "dfu_helper":
+            helpers.irecovery_command("setenv auto-boot true", ecid)
+            helpers.irecovery_command("saveenv", ecid)
+
+            input(
+                "Hold down buttons 1 & 2 on the device (and keep holding until this program says stop) and press enter."
+            )
+
+            helpers.irecovery_command("reset", ecid)
+
+            await asyncio.sleep(2.5)
+
+            print("Release button 1. Keep holding button 2")
+
+            info_task = asyncio.create_task(
+                print_in(
+                    8, "Whoops. Device did not enter DFU mode. Waiting for re-connect."
+                )
+            )
+            dev = await helpers.wait_device()
+            canceled = info_task.cancel()
+
+            # Now actually check if the device entered DFU
+            mode = helpers.classify_mode(dev)
+
+            match mode:
+                case helpers.DeviceMode.NORMAL:
+                    if not canceled:
+                        # Print the message now if it wasn't printed before
+                        print("Whoops. Device did not enter DFU mode.")
+                    print("Device re-connected in normal mode.")
+                    return await normal.main_real(dev, "dfu_helper")
+                case helpers.DeviceMode.RECOVERY:
+                    if not canceled:
+                        # Print the message now if it wasn't printed before
+                        print("Whoops. Device did not enter DFU mode.")
+                    print("Device re-connected in recovery mode.")
+                    return await main_real(dev, "dfu_helper")
+                case helpers.DeviceMode.DFU:
+                    print("Device entered DFU mode successfully!")
+
+    return 0

iphonetool/usbliter8ctl.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=3.13"
+# dependencies = [
+#     "pyusb>=1.3.1",
+# ]
+# ///
+
+# This is a clone of usbliter8ctl using the helpers in this module.
+# Used for remote_boot
+
+import argparse
+import pathlib
+
+import usb
+
+from dfu import Usbliter8Command, send_usbliter8_command, usbliter8_download
+from helpers import get_device
+
+
+def do_boot(args, dev):
+    usbliter8_download(dev, args.iboot.read_bytes())
+
+    send_usbliter8_command(dev, Usbliter8Command.CUSTOM_BOOT, None, 100)
+    send_usbliter8_command(dev, Usbliter8Command.DFU_ABORT, None, 100)
+
+
+def do_demote(args, dev):
+    send_usbliter8_command(dev, Usbliter8Command.CUSTOM_DEMOTE, None, 100)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Love is Control")
+
+    subparsers = parser.add_subparsers()
+
+    boot_parser = subparsers.add_parser("boot", help="boot raw iBoot")
+    boot_parser.set_defaults(func=do_boot)
+    boot_parser.add_argument("iboot", type=pathlib.Path)
+
+    demote_parser = subparsers.add_parser("demote", help="demote production mode")
+    demote_parser.set_defaults(func=do_demote)
+
+    args = parser.parse_args()
+    if not hasattr(args, "func"):
+        parser.print_help()
+        exit(-1)
+
+    dev = get_device()
+
+    srnm = dev.serial_number
+
+    if "PWND:[" not in srnm:
+        raise RuntimeError("this is not Pwned DFU device")
+
+    args.func(args, dev)
+
+
+if __name__ == "__main__":
+    main()

iphonetool-0.1.0.dist-info/METADATA

@@ -0,0 +1,26 @@
+Metadata-Version: 2.4
+Name: iphonetool
+Version: 0.1.0
+Summary: All of the modern iOS tools. Unified
+Author: Jacob Freeman
+Author-email: Jacob Freeman <t00niyf5@duck.com>
+License-Expression: GPL-3.0-or-later
+License-File: LICENSE
+Requires-Dist: pymobiledevice3>=10.1.0
+Requires-Dist: pyusb>=1.3.1
+Requires-Python: >=3.13
+Description-Content-Type: text/markdown
+
+# iphonetool
+
+All of the modern iOS tools. Unified.
+
+
+# Usage
+
+- Run `iphonetool.py info` to give info on connected devices
+- Run `iphonetool.py -h` to show help for the current device (this help changes per-device)
+
+# License
+
+`iphonetool` is currently licensed under the GPLv3.