按照SysScan-Singapore-Targeting_The_IOS_Kernel.pdf里的说法,在PIN1和PIN21之间串接一个470K欧的电阻。为什么?
http://pinouts.ru/PortableDevices/ipod_pinout.shtml
里说:
PIN21 Accessory Indicator/Serial enable
6.8 kΩ - Serial port mode. Pin 11-13 are TTL level. Requires MAX232 chip to convert to RS232 levels.
500kOhm - related to serial communication / used to enable serial communications Used in Dension Ice Link Plus car interface
注:
参考IPHONE4的原理图,发现这个信号是接到dialog 电源管理芯片D1815A4的F3脚,这是一个ADC采样脚,外面串接不同的阻值,这里反应出不同的电压值。主芯片通过i2c接口将这个信息读走。
为了让串口可以显示出信息,可以用红雪将调试参数0x08传递给内核:
0x08 DB_KPRT Send kernel debugging kprintf output to serial port.
命令行运行: ./redsn0w.exe -i iPod4,1_6.0_10A403_Restore.ipsw -j -a "-v debug=0x08"
然后按照红雪的提示,让itouch进入DFU模式,一直点下一步就好了。
串口终端看到下面信息,说明串口tx信号(itouch侧)连接正常:
AppleS5L8930XIO::start: chip-revision: C0
AppleS5L8930XIO::start: PIO Errors Enabled
AppleARMPL192VIC::start: _vicBaseAddress = 0x86e7d000
AppleS5L8930XGPIOIC::start: gpioicBaseAddress: 0x85536000
AppleARMPerformanceController::traceBufferEnable: Trace is enabled
AppleS5L8930XPerformanceController::start: _pcBaseAddress: 0x86ec5000
AppleARMPerformanceController configured with 1 Performance Domains
...
注:
1. 这个信息和-v,在itouch lcd屏幕上显示的信息是不一样的。
2. 为什么是115200波特率?下面是逻辑分析仪捕获的信号,1bit的传送时间是8.750us
1*1000*1000/8.750=114285
后来我在SerialKDPProxy.c里也看到:
execlp("/bin/stty", "/bin/stty", "115200", "raw", "clocal", "crtscts", NULL);
3. 红雪命令参数说明:
$ ./redsn0w.exe -h
Usage: redsn0w [-i <str>] [-J] [-j] [-f] [-H] [-o] [-n] [-b <str>] [-k <str>] [-d <str>] [-r <str>] [-a <str>] [-K] [-S] [-U] [-D <str>] [-t <str>] [-x <str>] [-h]
-i, --ipsw=<str> use specified IPSW
-J, --justPwnDFU just enter pwned DFU mode
-j, --justBoot just do tethered boot
-f, --justFixRecovery just fix recovery loop
-H, --shshBlobs fetch the currently installed SHSH blobs
-o, --oldBootrom device has an old (not fixed) bootrom
-n, --noActivate don't activate an unactivated device
-b, --tetheredBootLogo=<str> boot logo PNG file for tethered boots
-k, --kernelcache=<str> use specified kernelcache (advanced)
-d, --devicetree=<str> use specified devicetree (advanced)
-r, --ramdisk=<str> use specified ramdisk (advanced)
-a, --bootArgs=<str> use specified kernel boot-args (advanced)
-K, --noKernelPatches don't pre-apply default set of kernel patches (advanced)
-S, --noStashing don't stash (implied when custom bundle is used) (advanced)
-U, --noUntetherHacks don't do normal untether hacks (implied when custom bundle is used) (advanced)
-D, --download=<str> download a file or directory via afc2
-t, --tempDir=<str> temporary directory to use for backups
-x, --extraFlags=<str> extra flags (advanced)
-h, --help show this help
下面编译KDP(Kernel Debugger Protocol)调试代理,使用zhuliang提供的Albert_liuwei修改版。
这个东西就是将gdb里kdp所需要使用的udp,端口41139上的信息通过串口透传给itouch
kdp-remote -- Connect to a remote KDP server. udp port 41139 is the default port number.
因运行在windows上,使用Cygwin编译。
编译提示错误:
SerialKDPProxy.c
找不到头文件:net/ethernet.h
-#include <net/ethernet.h>
+#include "ethernet.h"
然后下载份ethernet.h,放进来,编译通过。
$ ./SerialKDPProxy.exe /dev/ttyS3
Opening Serial
Waiting for packets, pid=4392
^@
这时将内核调试参数改为DB_KPRT | DB_HALT
0x01 DB_HALT Halt at boot-time and wait for debugger attach. ./redsn0w.exe -i iPod4,1_6.0_10A403_Restore.ipsw -j -a "-v debug=0x09"
内核开始运行时会被挂起(Itouch屏幕上停在被咬了一口的菠萝画面),SerialKDPProxy所在的终端继续显示(串口显示的信息也被定向到了这里):
-----------START----------
Debugger message: inline call to debugger(machine_startup)
OS version: Not set yet
Kernel version: Darwin Kernel Version 13.0.0: Sun Aug 19 00:27:34 PDT 2012; root:xnu-2107.2.33~4/RELEASE_ARM_S5L8930X
iBoot version: iBoot-1537.4.18
secure boot?: NO
Paniclog version: 1
Kernel slide: 0x0000000019400000
Kernel text base: 0x99401000
Epoch Time: sec usec
Boot : 0x00000000 0x00000000
Sleep : 0x00000000 0x00000000
Wake : 0x00000000 0x00000000
Calendar: 0x0000001c 0x0002d349
这时来到macbook,运行下面命令(其中192.168.1.234为SerialKDPProxy所运行机器的IP地址。):
$ gdb-arm-apple-darwin -arch armv7
GNU gdb 6.3.50-20050815 (Apple version gdb-1821) (Fri Jun 29 08:50:21 UTC 2012)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "--host=i386-apple-darwin --target=arm-apple-darwin".
(gdb) target remote-kdp
(gdb) attach 192.168.1.234
kdp_reply_wait: error from kdp_receive: receive timeout exceeded
kdp_transaction (kdp_attach): transaction timed out
kdp_transaction (kdp_attach): re-sending transaction
warning: Can't find dSYM for mach kernel (10CDDC0C-A9AC-3CC4-BD6D-9404074C194D)
Kernel is located in memory at 0x91601000 with uuid of 10CDDC0C-A9AC-3CC4-BD6D-9404074C194D
Connected.
(gdb) i r
r0 0x1 1
r1 0x1 1
r2 0x0 0
r3 0x0 0
r4 0x918da1c4 -1852988988
r5 0x91928f38 -1852666056
r6 0x0 0
r7 0x852a3edc -2060828964
r8 0x0 0
r9 0x9191e920 -1852708576
r10 0xfffffff9 -7
r11 0x0 0
r12 0x91928f38 -1852666056
sp 0x852a3eb8 -2060829000
lr 0x916898db -1855416101
pc 0x9168995c -1855415972
cpsr {
0x600000f3,
n = 0x0,
z = 0x1,
c = 0x1,
v = 0x0,
q = 0x0,
j = 0x0,
ge = 0x0,
e = 0x0,
a = 0x0,
i = 0x1,
f = 0x1,
t = 0x1,
mode = 0x13
} {
0x600000f3,
n = 0,
z = 1,
c = 1,
v = 0,
q = 0,
j = 0,
ge = 0,
e = 0,
a = 0,
i = 1,
f = 1,
t = 1,
mode = svc
}
(gdb) x /16xw $pc
0x9168995c: 0xe7ffdeff 0x4658e003 0xf0004641 0xf1baf8e3
0x9168996c: 0xd0f20f00 0xf89af1f1 0xbf1c2800 0xf1d92004
0x9168997c: 0xf1bafebf 0xd1420f00 0x0f90ee1d 0x04c0f8d0
0x9168998c: 0x1128f8d0 0xf8c03901 0xf8d01128 0xb9a91128
在attach、执行gdb命令时,SerialKDPProxy.exe终端可看到信息交互,例如:
Received 13 bytes from port 51335...and ouput over serial
Sent reply packet 12, 12, 12 to UDP 51335
Received 8 bytes from port 51335...and ouput over serial
Sent reply packet 24, 24, 24 to UDP 51335
3. 在我测试的过程中经常发现timed out
kdp_transaction (kdp_attach): transaction timed out
有时单步几下就会gdb端就会停止响应,SerialKDPProxy端无限看到信息交互的打印。
我觉得LAN的网络环境应该不用怀疑,所以感觉这个调试代理还是不稳定。