iPad 2 powdersn0w 7.x/DRA v6 issue tracker

[Pingzi610]

I just finished iPad2,1 7.x exploit(Both 7.0.x and 7.1.x). However, when trying to restore iPad 2 with powdersn0w, iOS4/5 doesn't work well. iOS 5 restore will stuck at "Waiting for device", and iOS 4 will crash when flashing nordata. ("Flashing firmware"). You can add the exploit to see whether this problem will emerge.

[LukeZGD]

I think iOS 5 one can be worked around by enabling gasgauge-patch/multipatch flag. I'll try finding a more permanent fix

edit: actually gasgauge-patch/multipatch is currently auto-enabled when restoring powdersn0w/dra v6 on a5 devices as workaround for the 4s, so maybe its the one that causes this issue if youre using the latest version

For iOS 4, I'm not sure on this yet unfortunately

[LukeZGD]

added the exploit ramdisks, hoping to receive reports from other users as well if any

i enabled it for not just the ipad2,1, but also 2,2 and 2,3 hoping that the same exploit ramdisks work for all of them

[Pingzi610]

Yes, iOS 5 works fine with multipatch enabled. But iOS 4.3.3 and below 💥
I‘m using an older version since the latest one have problem enabling simplified-chinese(简体中文) after restoring(This happens after iOS 5/6 restore).

[Pingzi610]

Do you think this could be the reason why iOS 4 fail?

[Log] Patch iBoot: --boot-partition --boot-ramdisk --logo4 --433 -b pio-error=0 -v
Archive: /Users/pingzi/Downloads/iPad2,1_4.3.3_8J2_Restore.ipsw
inflating: ./iBoot.k93ap.RELEASE.img3
/tmp/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 4d2879d717316a3717591c38773784be012b6180c238548867c69051d53f7a47405d10a5725d01836be7717fd3199549
main: Starting...
main: iBoot-1072 inputted.
patch_boot_args: Entering...
patch_boot_args: Default boot-args string is at 0x3018c
patch_boot_args: boot-args xref is at 0x14f98
patch_boot_args: Applying custom boot-args "pio-error=0 -v"
patch_boot_args: Found LDR R0, =boot_args at 0x147ee
patch_boot_args: Found IT instruction at 0x147f8
patch_boot_args: Found CMP Rx, #0 at 0x147f6
patch_logo4: Entering...
patch_logo4: Found main string: 0xeb4
patch_logo4: Patching logo -> log4 ...
patch_logo4: Leaving...
patch_433orlower_jumpiBoot: Entering...
patch_433orlower_jumpiBoot: Found main string: 0x2bcc4
patch_433orlower_jumpiBoot: Found the main_function string reference at 0xb8c
patch_433orlower_jumpiBoot: Failed to find patch_offset string
main: Error doing patch_jumptoiBoot()!
error: cannot open infile
error: cannot open infile
a iBoot

[Pingzi610]

4.3.3 and below will fail flashing firmware. but 4.3.4&4.3.5 can flash. However, reboot4 cannot work on iPad 2. Trying to use latest kit.

[Pingzi610]

Hmm.

log.rtf

Failed to create custom ipsw.

[LukeZGD]

i pushed an update that attempts to fix some things here.. the only concern is that i removed usage of iboot32patcher's --433 flag on a5 so 4.3.3 and lower might still not work, but 4.3.4/5 should work now, hopefully

[Pingzi610]

Exploit for iPad 2 10B329 is too low currently. It's not relevant to the payload.

[LukeZGD]

an ipad2,1 user tested dra v6 and got stuck on the apple logo, i have moved it to test branch for now and disabled it in main

unfortunately i also cant test it myself so that was just pretty much a test run.. ill repair my ipad 2 when i get the chance and check things, not sure on where i can help/test out for now

[Pingzi610]

5 of 10 exploit attempts can succeed. Maybe another offset or exploit method needed.
（事实上成功率没那么高）

[Pingzi610]

log.rtf
This is a log of restoring 4.3.5 using iOS 7 blob. Using enable exploit after restore works fine.
As for iOS 6, I don't think there're anything can be improved.