Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEP exploit unable to run on T8012, 'Registers are locked' error #93

Open
BogChanos opened this issue Sep 16, 2021 · 3 comments
Open

SEP exploit unable to run on T8012, 'Registers are locked' error #93

BogChanos opened this issue Sep 16, 2021 · 3 comments

Comments

@BogChanos
Copy link

I am having issues accessing SEP tools on the below versions/hardware:

#==================
#
# pongoOS 2.5.1-217eae6f
#
# https://checkra.in
#
#==================
Booted by: iBoot-6723.140.2
Built with: Clang 12.0.5 (clang-1205.0.22.11)
Running on: Apple T2 (T8012)
[modload_macho:i] Attempting to load a module
[modload_macho:+] Loaded module checkra1n-kpf2-12.0,14.5

#==================
#
# checkra1n kpf 0.12.4

When I try to run SEP exploits, I see

pongoOS> sep auto
pongoOS> sep peek
sep is not pwned!
pongoOS> sep pwn
Registers are locked
pongoOS>

Is anyone able to further identify the issue? My best guess is either the iBoot version has broken the blackbird exploit?
Or that there is no iBoot patch for this version (but then you'd have thought PongoOS wouldn't boot at all...)

I have tried manually patching the iBoot but I have no idea how to actually run the patched version as it seems existing tools are all built for other chip versions and checkra1n does not have an option for custom iBoot (I'm sure that would probably break checkra1n as well).

The exact revision of my board 'iBridge2,15' is listed as 'checkm8/blackbird confirmed' so I'm not sure if the latest iBoot has broken it or I'm just doing something wrong?

Any help greatly appreciated!

@0xallie
Copy link

0xallie commented Sep 16, 2021

I think it only works on T8010 and T8011 right now, the rest is theoretically possible but wasn't implemented yet.

@Siguza
Copy link
Member

Siguza commented Sep 16, 2021

T8012 is missing an iBoot patch - I shared a build on Discord a while ago that had such a patch, but officially, the TrustZone unlock for devices other than t8010 and t8011 is planned for a future release of checkra1n.

@BogChanos
Copy link
Author

T8012 is missing an iBoot patch - I shared a build on Discord a while ago that had such a patch, but officially, the TrustZone unlock for devices other than t8010 and t8011 is planned for a future release of checkra1n.

I see, thanks for the info! I guess it makes sense as other chips are more relevant to most people!

Do you have a link or channel name for that build you posted on Discord? I'd be interested in taking a look

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants