Xpwn Repo

[Cara Canellas]

ReanimatorXP: Small correction: I think it should be '/mnt1/Library/MobileSubstrate/DynamicLibraries'; otherwise you'll rename MobileSubstrate.dylib, and stuff will break because it's the main MobileSubstrate module and all processes are trying to load it when MobileSubstrate is installed.

You totally rock. I've been using your old method of an iphone 3G on and off for emergency fixes, but it's a long drawn out process, since iREB sometimes had issues if I didn't run it from sn0wbreeze. I tried to upgrade at one point, but it didn't work, and I had a solution that did the job. But a one click would be fantastic.

For whatever reason, when I tried to run your jar, I get the following error:

Could not load mux_redux.dll from C:\Documents and Settings\\Local Settings\Temp\ssh_rd\native\mux_redux.dll; ABORTING

though I see this file exists. I'm running on an XP machine. The popup is unhelpful with an "INIT FAILED (mux thread)!"

Past that, I'd be happy to help confirm/test it works on a 3G (still running 3.1.3).

On a slightly related note - my current issue is that it won't boot, even into Safe Mode, I can't ssh in normally. In the past, I've always been able to fix it, but this one has me stumped. If I move away all the dylibs, I get syslog errors about not being able to load particular dylibs (grr).

Otherwise, I seem to be getting mostly "Cannot Stack" errors, and ones about being unable connect to lockdown, though I'm not positive either of those is actually the culprit. Any tips, o wise ones?

@fcc14fe0: Confirmed an XP bug (I really need to test stuff before releasing, dammit!), will build a fixed version soon.

On a slightly related note - please email logs/excerpts.. If those dylibs are mobilesubstrate plugins, it's worth figuring out who loads them - or just disable mobilesubstrate completely and see if that helps?

On old versions, you needed to remove all references to mobilesubstrate from /system/library/launchdaemons/*plist, (EnvironmentVariables/DYLD_INSERT_LIBRARIES subkey); now it seems it's enough to rename /etc/launchd.conf

Gah. Is that really how my account showed up? Whatever.

The phone is actually riddled with problems - I mostly use it as a toy these days. Sometime around a year ago the WiFi stopped working, so most of the packages are admittedly rather outdated. Something made me want to try and revisit the perma-Safe-Mode issue it has, which is why I was trying again.

It's entirely possible that what caused the issue now was my attempting to update mobilesubstrate to the latest version (I scped over the deb to install). However, I can't reinstall the old one, since when I dpkg --root=/mnt1 -i , it dies on the postrm, because of this:

dyld: Library not loaded: /System/Library/Frameworks/Foundation.framework/Foundation

Referenced from: /mnt2/lib/dpkg/info/mobilesubstrate.postrm

Hilarity ensues.

The phone itself has too much junk on it, so it's probably a poorly written and old dylib, I think one of them was PwnTunes. But I can upload the syslog next time I power it up into the ramdisk. Is there anywhere in particular you'd like me to send it?

@fcc..: 1. Removing it in a legit way will be tricky, hence you only disable it via ssh, then remove/reinstall once the phone boots

2. It's needed for most tweaks, not the jailbreak. Since it injects dylibs to native Apple processes, without it, your phone will behave close to what Apple stock phone does - except you still will be able to run unsigned JB apps such as Cydia (so repairing MS should be pretty easy).

Yup, I can now confirm that your jar works on both Windows XP, and on a 3G. Much faster and simpler than my last method, too.

I tried your tip for removing MobileSubstrate, but the first time it just managed to recreate the /etc/launchd.conf, and the MobileSubstrate.dylib symlink. The next time I moved the entire Framework directory, but SpringBoard kept crashing, and it wouldn't boot.

Eventually I figured out that the problem was because a couple of symlinks (/Applications and /usr/share) had somehow disappeared. I have no idea how it happened, but recreating them managed to get the phone booting again, so I'm happy.

It makes me wonder, though, if any other links might be missing. Is there an authoritative list of ones that get created by the Jailbreak?

I did that earlier - I was trying to slowly re-enable the plugins to get some of them working. I'd been restarting SpringBoard along the way, but I hadn't realized one could crash it at startup. All these used to be around before the issues started a few days ago. But I can try removing the whole thing, again.

Is there any simple way to figure out, specifically, which one is crashing lockdownd, or do I have to enable them one-by-one, and restart each time?

Yeah, I know that one. Sadly, it doesn't take into account the vastly different costs of failure and success - in this case, failure means that you have to fail to reboot, boot into ramdisk, fsck, revert, reboot, repeat.

Hence why I was wondering if there was some better way to tell. Guess not, so I've got my work cut out for me. *sigh* Thanks anyway.

@fcc: you can weigh ratios proportionally to the costs involved: e.g. if failure is N times costlier than success, add 1/N of the remaining dylibs per try. Which, of course, might be close to 1 in your case ;)

the problem is when i access using winscp , folders mnt1 , mnt2 are empty

and i dont know how to use putty comands

please let me know the exact commands .

i just want to copy the pictures in dcim folder

plzzzzzz helppppppppp

I'm stuck on the command portion...

My iPod's battery drained and was stuck in the low battery/Apple logo loop and it was refusing to charge and etc.

Anyways, I ran everything as instructed and it finished. At the end it said to connect to localhost, which I'm assuming is normal. So I follow the instructions and connect using WinSCP. Now what I'm stumped on is where or how do I enter these commands?

I've even installed Putty to try and enter the command, but it says not found.

I'm not too familiar with commands via SSH. So if you guys could help me out with that part I'd be so grateful.

I'd hate to restore my iPod and lose everything because my old computer crashed with all my music and etc.

Thanks a lot if it works you guys are life savers!

Also, my iPod just has the reload wheel at the bottom of the screen.

And I think I just found out how to enter commands in WinSCP, Commands > Open Terminal - Now I entered the said command, but nothing is happening in WinSCP or my iPod...

Am I doing something wrong?

Also, could that my battery is low be playing a factor into this?

Alright...well I think my iPod charges now because it doesn't shut off like before.

But now it's still stuck on the Apple logo with the reloading wheel right beneath it, not sure what to do now...just wait it out and see if it'll boot?

Hello,

Firstly I would like to send out big thanks to msft.guy, reanimator and everybody who has worked on this. This is the very definition of giving back. Wanted to let you know there are ppl out there that appreciate what you guys are doing here.

Well I can now get access to MobileSubstrate directory, which is great. However I was not able to execute the command to disable the individual .dylib's (even from within the DynamicLibraries directory). I tried renaming the the whole DynamicLibraries directory as reanimator had suggested, no joy, when I reboot still stuck on apple logo. Is there other common problems that can cause "stuck on apple logo", other than the mobile substrate department? Any other thoughts as to what I could try, either regarding mobile substrate or other possible issues.

I would really appreciate any help or perceptive anybody can offer. My phone has been out since before Christmas, just this past weekend I was again considering wiping it all and starting from scratch, an unpleasant solution to say the least. That was before I discovered your new easier method which gave me new hope, I feel like I am so close.

Cheers,

TC of yourselves and thanks again.

Johann

@n0uzul

Unfortunately the problem I'm describing is probably different than what you're seeing. The problem I'm describing (the Springboard crashing dylib issue) is when you have just installed a new Cydia tweak, and upon respring, your phone just resprings in a loop endlessly (never reaches Safe Mode). MobileSubstrate is designed to kick you into Safe Mode in this circumstance, but in rare instances it does not, rendering your phone useless.

However, this problem usually means you will at least /see/ the lockscreen before the phone crashes, sending to you back to the lockscreen again. This indicates there's a bad .dylib installed that is crashing MobileSubstrate as soon as SpringBoard loads.

So.. is SpringBoard even loading? One of the first indications of SpringBoard loading is if you hear the 'charging' sound when booting your phone while it's hooked to the charger or a computer. If you never get a charging sound, SpringBoard isn't loading at all and .dylibs are /not/ the problem. I have seen this with one person's phone once, and unfortunately there's nothing I could do to correct it besides a restore. It would be hard to determine what was causing that issue without having a Verbose Boot option enabled.

However, using @msft.guy's awesome tool, you're still able to use some of my commands above to mount the data partition and then back up your files, provided you know where they're at. I recommend using my commands to mount using Putty, then using a visual tool like WinSCP to perform the rest.

With either tool, you'll be connecting to localhost, port 2022. @msft.guy was correct that my 4th command should be:

cd /mnt1/Library/MobileSubstrate/ DynamicLibraries

***Remember*** to paste all my commands into notepad so you can see which is on what line. The long "for" command word-wrapped to the next line as expected, and the directory correction above will too.

3a8082e126