awake_rootfs.c

// unset MNT_ROOTFS flag, remount, set it back
// based on xerub's extra_recipe code
// 
int mountroot(void) {
    int ret;

    uint64_t kaslr_shift = find_kernel_base() - 0xFFFFFFF007004000;

    // iPod7,1 iOS 11.1.2
    uint64_t _rootvnode = 0xfffffff007622088 + kaslr_shift;
    uint64_t rootfs_vnode = rk64(_rootvnode);

    // We read and write v_flag one byte shifted into v_kernel_flag
    // because lower byte is not needed to unset ROOTFS flag
    // and because it contains RDONLY and we don't want to write back
    // old value of RDONLY :)

    // read original flags
    uint64_t v_mount = rk64(rootfs_vnode + koffset(KSTRUCT_OFFSET_VNODE_V_UN));
    uint32_t v_flag = rk32(v_mount + koffset(KSTRUCT_OFFSET_MOUNT_MNT_FLAG) + 1);

    // unset rootfs flag
    wk32(v_mount + koffset(KSTRUCT_OFFSET_MOUNT_MNT_FLAG) + 1, v_flag & ~(MNT_ROOTFS >> 8));

    // remount
    char *nmz = strdup("/dev/disk0s1s1");
    ret = mount("msdos", "/", MNT_UPDATE, (void *)&nmz);

    // set original flags back
    v_mount = rk64(rootfs_vnode + koffset(KSTRUCT_OFFSET_VNODE_V_UN));
    wk32(v_mount + koffset(KSTRUCT_OFFSET_MOUNT_MNT_FLAG) + 1, v_flag);

    return ret;
}