iPhone 6 on iOS 12.3.1 - checkra1n jailbreak - getting past error -31 (timeout error)

Thursday, January 28, 2021

I was having some fun trying to jailbreak an old iPhone 6 on iOS 12.3.1. I tried checkra1n 0.12.2 (https://checkra.in/) and some previous versions in GUI mode and was getting an error -31. 
It recommends the CLI. I tried that too but it didn't work as I only got the GUI in a text format. Then I used -h and found the CLI is actually enabled with the -c flag. I added -v to be verbose. 
I got then some more details about my error -31. It is a timeout issue. I also read online that it will re-attempt the jailbreak once you connect and in DFU mode.  (N.B: this is not the case when it is in GUI mode.) 
$ cd /Applications/checkra1n.app/Contents/MacOS
$ ./checkra1n -v -c
#
#
# Checkra1n beta 0.12.2
#
# Proudly written in nano
# (c) 2019-2020 Kim Jong Cracks
#
#======== Made by =======
# argp, axi0mx, danyl931, jaywalker, kirb, littlelailo, nitoTV
# never_released, nullpixel, pimskeks, qwertyoruiop, sbingner, siguza
#======== Thanks to =======
# haifisch, jndok, jonseals, xerub, lilstevie, psychotea, sferrini
# Cellebrite (ih8sn0w, cjori, ronyrus et al.)
#==========================


- [01/21/21 21:03:42] <Info>: Waiting for DFU devices
- [01/21/21 21:04:51] <Verbose>: DFU mode device found
- [01/21/21 21:04:52] <Info>: Exploiting
- [01/21/21 21:04:52] <Verbose>: Attempting to perform checkm8 on xxx xx...
- [01/21/21 21:04:52] <Info>: Checking if device is ready
- [01/21/21 21:04:52] <Verbose>: == Checkm8 Preparation stage ==
- [01/21/21 21:04:52] <Verbose>: DFU device disconnected
- [01/21/21 21:04:52] <Verbose>: DFU mode device found
- [01/21/21 21:05:17] <Error>: Timed out in state 1, assuming we are back to square one with this device. (error code: -31)

So I removed the USB from the iPhone and reconnected. I had to kill iTunes, hence the extra disconnect attempts. But once iTunes was closed it continued the jailbreak process. In the end use CTRL+C to exit. 
$ ./checkra1n -v -c
#
# Checkra1n beta 0.12.2
#
# Proudly written in nano
# (c) 2019-2020 Kim Jong Cracks
#
#======== Made by =======
# argp, axi0mx, danyl931, jaywalker, kirb, littlelailo, nitoTV
# never_released, nullpixel, pimskeks, qwertyoruiop, sbingner, siguza
#======== Thanks to =======
# haifisch, jndok, jonseals, xerub, lilstevie, psychotea, sferrini
# Cellebrite (ih8sn0w, cjori, ronyrus et al.)
#==========================

- [01/21/21 21:06:14] <Info>: Waiting for DFU devices
- [01/21/21 21:06:14] <Verbose>: DFU mode device found
- [01/21/21 21:06:14] <Info>: Exploiting
- [01/21/21 21:06:14] <Verbose>: Attempting to perform checkm8 on xxxx xx...
- [01/21/21 21:06:14] <Info>: Checking if device is ready
- [01/21/21 21:06:14] <Verbose>: == Checkm8 Preparation stage ==
- [01/21/21 21:06:14] <Verbose>: DFU mode device found
- [01/21/21 21:06:16] <Info>: Setting up the exploit (this is the heap spray)
- [01/21/21 21:06:16] <Verbose>: == Checkm8 Setup stage ==
- [01/21/21 21:06:16] <Info>: Right before trigger (this is the real bug setup)
- [01/21/21 21:06:16] <Verbose>: Entered initial checkm8 state after 0 steps, issuing DFU abort..
- [01/21/21 21:06:17] <Verbose>: DFU device disconnected
- [01/21/21 21:06:17] <Verbose>: DFU mode device found
- [01/21/21 21:06:17] <Verbose>: == Checkm8 Trigger stage ==
- [01/21/21 21:06:17] <Verbose>: Checkmate!
- [01/21/21 21:06:18] <Verbose>: DFU device disconnected
- [01/21/21 21:06:18] <Verbose>: DFU mode device found
- [01/21/21 21:06:20] <Verbose>: == Checkm8 Trying to run payload... ==
- [01/21/21 21:06:20] <Verbose>: If everything went correctly, you should now have code execution.
- [01/21/21 21:06:20] <Verbose>: DFU device disconnected
- [01/21/21 21:06:21] <Info>: Entered download mode
- [01/21/21 21:06:21] <Verbose>: Download mode device found
- [01/21/21 21:06:23] <Info>: Booting...
- [01/21/21 21:06:23] <Verbose>: Setting bootargs to: rootdev=md0
- [01/21/21 21:06:24] <Verbose>: Download mode device disconnected
- [01/21/21 21:06:48] <Info>: Uploading bootstrap...
- [01/21/21 21:06:48] <Verbose>: Uploading bootstrap... 6
- [01/21/21 21:06:49] <Info>: All Done
- [01/21/21 21:06:49] <Verbose>: Bootstrap upload done

Finally, you will need to connect to a network (check in General-Software Update-Automatic Updates-OFF). Within checkra1n, install Cydia. From Cydia install OpenSSH (if that is the aim). 

Enjoy ! 

Labels: , , ,

Receive, store and read SMS messages on Jailbroken iPad

Monday, August 13, 2012

I have managed to find the secret combination of AT commands [1] that will allow you to save an incoming message to the SIM card and then you can read it on the iPad. 

You will need the following commands in order to receive SMS to the SIM card.

at
at+cmgf=1
at+cnmi=0,1,0,0,0
at+cpms="SM","SM","SM"
at+cmgl="ALL"

You can make use of the sendmodem [2] code to make life easier. You can use minicom too!

Example: 
./sendmodem at
./sendmodem at+cmgf=1
./sendmodem at+cnmi=0,1,0,0,0
./sendmodem at+cpms=\"SM\",\"SM\",\"SM\"
./sendmodem at+cmgl=\"ALL\"

Known problems:
There is an awful time out issue. To start this process you will need to './sendmodem at' until you get OK and then quickly send the rest of the commands.


Enjoy!

Refs:

[1] - GSM AT Commands example (good ref really) -http://www.arcelect.com/GSM%20Developer%20Guide%20-%20GSM%20AT%20Commands%20-%20Rev%20%20A.pdf

[2] - sendmodem - http://code.google.com/p/iphone-elite/wiki/sendmodem

Labels: , , , , ,