Hello guys!
Im trying to get xnuspy running on iPhone 7 iOS 15.7.6 and this below is the result I get. Seems like some functions (like lck_rw_alloc_init, vm_deallocate, proc_rele etc ) cannot be found. If somebody already solved it can you please point me in the right direction.
#=====================
pongoOS 2.6.3-7ddd2752
#=====================
Booted by: iBoot-7459.140.15
Built with: Clang 15.0.0 Colang-1500.0.40.1)
Running on: Apple A10 (T8010)
Enabling USB
Done!
pongoOS> modload
[modload_macho:i] Attempting to load a module
[modload_macho:+] Loaded module xnuspy
xnuspy: loaded!
pongoOS> xargs rootdev=md@ use contiguous_hint=0 msgbuf=0x30000 atm diagnostic_config=0x2000 0000
Set xnu boot arg cmdline to: [rootdev=md0 use_contiguous_hint=0 msgbuf=0x3c000 atm_diagnosti
c_config=0x20000000]
pongoOS> xnuspy-getkernelv
xnuspy: iOS 15.x detected.
sep auto
pongoOS> successfully obtained SEPROM code execution
SEP payload ready to boot
pongoOS> xnuspy-prep
xnuspy: found memmove
xnuspy: found memset
xnuspy: found unused executable code
xnuspy: patched all occurrences of msr tcr_el1, x18
xnuspy: patched pinst_set_tcr
xnuspy: found thread_terminate
xnuspy: found strncmp
xnuspy: found kfree_ext
xnuspy: found vm_map_unwire nested
xnuspy: unset doprnt_hide_pointers
xnuspy: found mach_to_bsd_errno
xnuspy: found vm_map_wire_external
xnuspy: found offsetof(struct thread, map)
xnuspy: found mach_vm_map_external
xnuspy: found mach_make_memory_entry_64
xnuspy: disabled AMCC CTRR MMU lockdown
xnuspy: disabled KTRR MMU lockdown
xnuspy: found copyin
xnuspy: found copyinstr
xnuspy: found copyout
xnuspy: found phystokv
xnuspy: found bcopy_phys
xnuspy: found proc_list_mlook
xnuspy: found lck_mtx_lock
xnuspy: found lck_mtx_unlock
xnuspy: found allproc
xnuspy: found lck_rw_lock_shared
xnuspy: found name2oid
xnuspy: found lck_rw_done
xnuspy: found sysctl_geometry_lock
xnuspy: found sysctl_handle_long
xnuspy: found lck_rw_lock_shared_to_exclusive
xnuspy: found lck_rw_lock_exclusive
xnuspy: found sysent
xnuspy: found IOSleep
xnuspy: found snprintf
xnuspy: found strlen
xnuspy: found proc_name
xnuspy: found lck_rw_free
xnuspy: found IOLog
xnuspy: found kprintf
xnuspy: found panic
xnuspy: found kernel_map
xnuspy: found lck_grp_alloc_init
xnuspy: found sysctl_kern_children
xnuspy: found sysctl_register_oid
xnuspy: found h_s_c_sbn branch addr
xnuspy: found h_s_c_sbn epilogue
xnuspy: found proc_uniqueid
xnuspy: found proc_pid
xnuspy: found lck_grp_free
xnuspy: found kernel_thread_start
xnuspy: found thread_deallocate
pongoOS> bootx
Invoking preboot hook
xnuspy: error(s) before
we continue:
lck_rw_alloc_init not found
vm_deallocate not found
current_proc not found
vm_allocate_external not found
offsetof(vm_map_t, refcnt) not found
kalloc_external not found
ipc_object_lock not found
ipc_port_release_send_and_unlock not found
proc_ref not found
proc_rele not found
xnuspy: fatal error.
Please file an issue
on Github. Include
output up to this
point and device/iOS
version.
Spinning forever.
Hello guys!
Im trying to get xnuspy running on iPhone 7 iOS 15.7.6 and this below is the result I get. Seems like some functions (like lck_rw_alloc_init, vm_deallocate, proc_rele etc ) cannot be found. If somebody already solved it can you please point me in the right direction.
#=====================
pongoOS 2.6.3-7ddd2752
https://checkra.in
#=====================
Booted by: iBoot-7459.140.15
Built with: Clang 15.0.0 Colang-1500.0.40.1)
Running on: Apple A10 (T8010)
Enabling USB
Done!
pongoOS> modload
[modload_macho:i] Attempting to load a module
[modload_macho:+] Loaded module xnuspy
xnuspy: loaded!
pongoOS> xargs rootdev=md@ use contiguous_hint=0 msgbuf=0x30000 atm diagnostic_config=0x2000 0000
Set xnu boot arg cmdline to: [rootdev=md0 use_contiguous_hint=0 msgbuf=0x3c000 atm_diagnosti
c_config=0x20000000]
pongoOS> xnuspy-getkernelv
xnuspy: iOS 15.x detected.
sep auto
pongoOS> successfully obtained SEPROM code execution
SEP payload ready to boot
pongoOS> xnuspy-prep
xnuspy: found memmove
xnuspy: found memset
xnuspy: found unused executable code
xnuspy: patched all occurrences of msr tcr_el1, x18
xnuspy: patched pinst_set_tcr
xnuspy: found thread_terminate
xnuspy: found strncmp
xnuspy: found kfree_ext
xnuspy: found vm_map_unwire nested
xnuspy: unset doprnt_hide_pointers
xnuspy: found mach_to_bsd_errno
xnuspy: found vm_map_wire_external
xnuspy: found offsetof(struct thread, map)
xnuspy: found mach_vm_map_external
xnuspy: found mach_make_memory_entry_64
xnuspy: disabled AMCC CTRR MMU lockdown
xnuspy: disabled KTRR MMU lockdown
xnuspy: found copyin
xnuspy: found copyinstr
xnuspy: found copyout
xnuspy: found phystokv
xnuspy: found bcopy_phys
xnuspy: found proc_list_mlook
xnuspy: found lck_mtx_lock
xnuspy: found lck_mtx_unlock
xnuspy: found allproc
xnuspy: found lck_rw_lock_shared
xnuspy: found name2oid
xnuspy: found lck_rw_done
xnuspy: found sysctl_geometry_lock
xnuspy: found sysctl_handle_long
xnuspy: found lck_rw_lock_shared_to_exclusive
xnuspy: found lck_rw_lock_exclusive
xnuspy: found sysent
xnuspy: found IOSleep
xnuspy: found snprintf
xnuspy: found strlen
xnuspy: found proc_name
xnuspy: found lck_rw_free
xnuspy: found IOLog
xnuspy: found kprintf
xnuspy: found panic
xnuspy: found kernel_map
xnuspy: found lck_grp_alloc_init
xnuspy: found sysctl_kern_children
xnuspy: found sysctl_register_oid
xnuspy: found h_s_c_sbn branch addr
xnuspy: found h_s_c_sbn epilogue
xnuspy: found proc_uniqueid
xnuspy: found proc_pid
xnuspy: found lck_grp_free
xnuspy: found kernel_thread_start
xnuspy: found thread_deallocate
pongoOS> bootx
Invoking preboot hook
xnuspy: error(s) before
we continue:
lck_rw_alloc_init not found
vm_deallocate not found
current_proc not found
vm_allocate_external not found
offsetof(vm_map_t, refcnt) not found
kalloc_external not found
ipc_object_lock not found
ipc_port_release_send_and_unlock not found
proc_ref not found
proc_rele not found
xnuspy: fatal error.
Please file an issue
on Github. Include
output up to this
point and device/iOS
version.
Spinning forever.