/Undecimus

unc0ver jailbreak for iOS 11.0 - 11.4b3

Primary LanguageCMIT LicenseMIT

unc0ver

The most advanced jailbreak tool

unc0ver logo

unc0ver jailbreak for iOS 11.0 - 11.4b3
by @pwn20wnd & @sbingner
UI by @DennisBednarz & Samg_is_a_Ninja

The most outstanding changes over the other jailbreaks

  • All exploits in same app
  • Detailed error messages
  • Faster patches
  • More stable patches
  • No extra battery drain
  • No random freezes
  • No random slow downs
  • No data is logged or shared
  • No malware
  • Proper jailbreak state detection
  • Proper bootstrap extraction to fix issues such as Cydia not appearing after jailbreak
  • Native build of Cydia for iOS 11
  • Telesphoreo port for ARM64
  • Much faster Cydia
  • Much more stable Cydia
  • Much more modern looking and acting Cydia
  • Cydia skips uicache when not needed
  • Cydia supports iPhone X screen size
  • Cydia Substrate for tweak injection
  • Much faster ldrestart
  • Much more stable ldrestart
  • Changes to Cydia were made with permission from Saurik
  • Option to skip loading daemons
  • Option to dump APTicket
  • Option to refresh icon cache
  • Option to disable auto updates
  • Option to block app revokes
  • Option to restore RootFS
  • Button to restart device
  • Button to open Cydia in case it doesn't appear on the Home Screen
  • Label to show the days left till the application expires
  • Working debugserver
  • An awesome UI

The technical side

  • Exploit kernel_task
  • Get kernel base
  • Find offsets
  • Get root
  • Escape sandbox
  • Get entitlements
  • Dump APTicket
  • Unlock nvram
  • Set boot-nonce
  • Lock nvram
  • Allow double mount
  • Remount RootFS
  • Prepare resources
  • Inject to trust cache
  • Log slide
  • Set HSP4
  • Patch amfid
  • Spawn jailbreakd
  • Patch launchd
  • Update version string
  • Extract bootstrap
  • Disable stashing
  • Disable app revokes
  • Allow SpringBoard to show non-default system apps
  • Disable Auto Updates
  • Load Daemons
  • Run uicache
  • Load Tweaks

Switching from the other jailbreaks

  • The RootFS will automatically be restored

Getting support

  • Use the built-in diagnostics tool
  • Get technical support on the r/Jailbreak Discord Server
  • Tweet @pwn20wnd

Best practices

  • Perform a full restore with Rollectra before switching from the other jailbreaks
  • Turn on the AirPlane Mode before starting the jailbreak
  • Turn off Siri before starting the jailbreak

Source code

  • This project is completely open source and it will be kept like it in the future
  • Any kind of contribution is welcome
  • The source code can be found on pwn20wndstuff's GitHub account

Video tutorial

To Do List

  • Contact @saurik to enable the Cydia Store purchases on iOS 11 and remove the empty front page ads in Cydia: Partially done
  • Completely switch to Cydia Substrate and ditch Substitute: Done, testing...
  • Make switching from other jailbreaks without wiping the device possible: Almost done
  • Fix a kernel panic that's triggered by a kernel data abort which is caused by a UaF bug in jailbreakd: Almost done
  • Chain @_bazad's blanket to bypass the developer certificate requirement for multi_path: Almost done
  • Enable the on-fly entitlement patching on iOS 11: Work in progress
  • WebKit Port with @_niklasb's WebKit Exploit: Work in progress

Screenshots

Changelog

  • rc1: Initial release
  • rc2: Add the dynastic repo by default and fix a bug in firmware checker
  • rc3: Add a switch to manually enable restoring RootFS, stop erasing user preferences when restoring RootFS and fix bugs
  • rc4: Add a label to display the uptime, a label to display the app's version number, spawn to the PATH and stop bundling system fonts
  • rc5: Run videosubscriptionsd in the jailed state, fix a bug in firmware and update checker
  • rc6: Start logging again, improve update checker and fix multi_path
  • rc7: Fix a bug in RootFS Restore and multi_path
  • rc8: Fix a bug in RootFS Remount and add a work in progress warning for some firmwares
  • rc9: Fix a bug in RootFS Remount, add even more detailed error messages and add a switch to increase the memory limit to improve the stability and improve the compatibility layer to work correctly with some tweaks that were specifically made for the other jailbreaks
  • v1.0.0: Fix a bug in RootFS Restore and Remount, make the settings tab match with the rest of the UI and fix bugs
  • v1.0.1: Disable the RootFS Restore for the unstable versions
  • v1.0.2: Enable and fix the RootFS Restore for all versions
  • v1.0.3: Fix the beta firmwares
  • v1.1.0: Automatically select the best exploit, rewrite the versions checker, improve assertion, show the code which has failed in the error messages, improve memory management, optimize and clean up the code, fix the Storage settings, switch to a new technique to disable auto updates, remove so much useless logging, only set the boot-nonce if the switch is on without checking if it exists or not, log offsets, remove static sleeps to improve the speed, fix series of bugs and leave no known bug
  • v1.1.1: Add a label to show the ECID and a button to open the source code, improve auto layout and fix various bugs in RootFS remount, RootFS restore, RootFS resource copier, Icon cache refresher, Version checker, Exploit selector, jailbreak state detector and others
  • v1.1.2: Improve auto layout and code and Significantly improve Empty_List (VFS) exploit and slightly improve Multi_Path (MPTCP)
  • v1.1.3: Fix a bug in starting jailbreakd
  • v1.1.4: Fix a bug in finding offsets: Download (IPA)
  • Releases are now available at https://github.com/pwn20wndstuff/Undecimus/releases

Special Thanks