Skip to content

Instantly share code, notes, and snippets.

@nick-botticelli
Last active March 17, 2023 10:38
Show Gist options
  • Save nick-botticelli/4e7714f2fb94deda1a3d52aa0ddcbb4b to your computer and use it in GitHub Desktop.
Save nick-botticelli/4e7714f2fb94deda1a3d52aa0ddcbb4b to your computer and use it in GitHub Desktop.
Virtualization.framework's builtin restore process when creating a VM (12.0.1); no patched bootchain
Virtualization.framework restore RE:
* Recorded with Wireshark after running `sudo ifconfig UserHC128 up` immediately after guest VM starts
* Some stuff like USB identifiers, iBoot USB info (SDOM...), and nonce stuff was excluded
> Send iBSS (ibss)
> `getenv build-version`
< iBoot-7429.41.5
> `getenv build-style`
< RELEASE
> `getenv ramdisk-size`
< 0x10000000
> `getenv ramdisk-size`
< 0x10000000
> Send localpolicy (lpol)
> `lpolrestore`
> `getenv boot-stage`
< 1
> `getenv ramdisk-size`
< 0x10000000
> Send iBEC (ibec)
> `go`
> `getenv build-version`
< iBoot-7429.41.5
> `getenv build-style`
< RELEASE
> `getenv ramdisk-size`
< 0x10000000
> `getenv boot-stage`
< 2
> `getenv ramdisk-size`
< 0x10000000
> Send restore logo (rlgo)
> `setpicture 4`
> `bgcolor 0 0 0`
> `setenv auto-boot false`
> `saveenv`
> `setenvnp boot-args rd=md0 nand-enable-reformat=1 -progress -restore`
> `getenv ramdisk-size`
> 0x10000000
> Send restore ramdisk trustcache (rtsc)
> `firmware`
> `getenv ramdisk-size`
< 0x10000000
> Send restore ramdisk (rdsk)
> `ramdisk`
> `getenv ramdisk-size`
< 0x10000000
> Send restore device tree (rdtr)
> `devicetree`
> `getenv ramdisk-size`
< 0x10000000
> Send restore kernel (rkrn)
> bootx
> ASR
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment