Skip to content

Instantly share code, notes, and snippets.

@zhuowei
Created July 21, 2018 04:48
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save zhuowei/7111cd6b9ba3b9c3bd430b8caa30235c to your computer and use it in GitHub Desktop.
Save zhuowei/7111cd6b9ba3b9c3bd430b8caa30235c to your computer and use it in GitHub Desktop.
iOS 12b4 kernel in QEMU. It works!
iBoot version:
corecrypto_kext_start called
FIPSPOST_KEXT [64144875] fipspost_post:156: PASSED: (4 ms) - fipspost_post_integrity
FIPSPOST_KEXT [64366750] fipspost_post:162: PASSED: (1 ms) - fipspost_post_hmac
FIPSPOST_KEXT [64504187] fipspost_post:163: PASSED: (0 ms) - fipspost_post_aes_ecb
FIPSPOST_KEXT [64659750] fipspost_post:164: PASSED: (0 ms) - fipspost_post_aes_cbc
FIPSPOST_KEXT [72129500] fipspost_post:165: PASSED: (117 ms) - fipspost_post_rsa_sig
FIPSPOST_KEXT [76481625] fipspost_post:166: PASSED: (67 ms) - fipspost_post_ecdsa
FIPSPOST_KEXT [77264187] fipspost_post:167: PASSED: (11 ms) - fipspost_post_ecdh
FIPSPOST_KEXT [77397875] fipspost_post:168: PASSED: (0 ms) - fipspost_post_drbg_ctr
FIPSPOST_KEXT [77595812] fipspost_post:169: PASSED: (1 ms) - fipspost_post_aes_ccm
FIPSPOST_KEXT [77765500] fipspost_post:171: PASSED: (1 ms) - fipspost_post_aes_gcm
FIPSPOST_KEXT [77941875] fipspost_post:172: PASSED: (1 ms) - fipspost_post_aes_xts
FIPSPOST_KEXT [78176875] fipspost_post:173: PASSED: (1 ms) - fipspost_post_tdes_cbc
FIPSPOST_KEXT [78338625] fipspost_post:174: PASSED: (1 ms) - fipspost_post_drbg_hmac
FIPSPOST_KEXT [78460125] fipspost_post:197: all tests PASSED (233 ms)
AUC[<ptr>]::init(<ptr>)
AUC[<ptr>]::probe(<ptr>, <ptr>)
Darwin Image4 Validation Extension Version 1.0.0: Mon Jul 9 21:36:59 PDT 2018; root:AppleImage4-1.200.16~357/AppleImage4/RELEASE_ARM64
AppleCredentialManager: init: called, instance = <ptr>.
ACMRM: init: called, ACMDRM_ENABLED=YES, ACMDRM_STATE_PUBLISHING_ENABLED=YES, ACMDRM_KEYBAG_OBSERVING_ENABLED=YES.
ACMRM: _loadRestrictedModeForceEnable: restricted mode force-enabled = 0 .
ACMRM-A: init: called, .
ACMRM-A: _loadAnalyticsCollectionPeriod: analytics collection period = 86400 .
ACMRM: _getDefaultStandardModeTimeout: default standard mode timeout = 604800 .
ACMRM: _loadStandardModeTimeout: standard mode timeout = 604800 .
ACMRM-A: notifyStandardModeTimeoutChanged: called, value = 604800 (modified = YES).
ACMRM: _loadGracePeriodTimeout: device lock timeout = 3600 .
ACMRM-A: notifyGracePeriodTimeoutChanged: called, value = 3600 (modified = YES).
AppleCredentialManager: init: returning, result = true, instance = <ptr>.
AUC[<ptr>]::start(<ptr>)
AppleKeyStore starting (BUILT: Jul 9 2018 21:51:06)
AppleSEPKeyStore::start: _sep_enabled = 1
AppleCredentialManager: start: called, instance = <ptr>.
AppleCredentialManager: start: initializing power management, instance = <ptr>.
AppleCredentialManager: start: started, instance = <ptr>.
AppleCredentialManager: start: returning, result = true, instance = <ptr>.
AppleARMPE::getGMTTimeOfDay can not provide time of day: RTC did not show up
: apfs_module_start:1277: load: com.apple.filesystems.apfs, v748.200.53, 748.200.53.0.1, 2018/07/09
com.apple.AppleFSCompressionTypeZlib kmod start
IOSurfaceRoot::installMemoryRegions()
IOSurface disallowing global lookups
apfs_sysctl_register:818: done registering sysctls.
com.apple.AppleFSCompressionTypeZlib load succeeded
L2TP domain init
L2TP domain init complete
PPTP domain init
BSD root: md0, major 2, minor 0
apfs_vfsop_mountroot:1468: apfs: mountroot called!
apfs_vfsop_mount:1231: unable to root from devvp <ptr> (root_device): 2
apfs_vfsop_mountroot:1472: apfs: mountroot failed, error: 2
hfs: mounted PeaceSeed16A5327f.arm64UpdateRamDisk on device b(2, 0)
: : Darwin Bootstrapper Version 6.0.0: Mon Jul 9 00:39:56 PDT 2018; root:libxpc_executables-1336.200.86~25/launchd/RELEASE_ARM64
boot-args = debug=0x8 kextlog=0xfff cpus=1 rd=md0
Thu Jan 1 00:00:05 1970 localhost com.apple.xpc.launchd[1] <Notice>: Restore environment starting.
Thu Jan 1 00:00:05 1970 localhost com.apple.xpc.launchd[1] <Notice>: Early boot complete. Continuing system boot.
Thu Jan 1 00:00:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.syslogd) <Error>: The HopefullyExitsLast key is no longer respected. Please remove it.
Thu Jan 1 00:00:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.syslogd) <Notice>: Please switch away from OnDemand to KeepAlive.
Thu Jan 1 00:00:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.ReportCrash.restored) <Warning>: Unknown key for string: EfficiencyMode
Thu Jan 1 00:00:06 1970 localhost com.apple.xpc.launchd[1] <Error>: assertion failed: 16A5327f: launchd + 186300 [E19492D0-CC83-3216-9F52-65302345049F]: 0x9
Thu Jan 1 00:00:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Could not read path: path = /AppleInternal/Library/LaunchDaemons, error = 2: No such file or directory
Thu Jan 1 00:00:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Could not read path: path = /System/Library/NanoLaunchDaemons, error = 2: No such file or directory
Thu Jan 1 00:00:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemons, error = 2: No such file or directory
Thu Jan 1 00:00:06 1970 localhost com.apple.xpc.launchd[1] <Error>: assertion failed: 16A5327f: launchd + 186192 [E19492D0-CC83-3216-9F52-65302345049F]: 0x9
waiting for matching IOKit service: <CFBasicHash 0x145d08e80 [0x105863e00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x105b04150 [0x105863e00]>{contents = "IOProviderClass"} = <CFString 0x145d08ec0 [0x105863e00]>{contents = "IOResources"}
2 : <CFString 0x104936bf8 [0x105863e00]>{contents = "IOResourceMatch"} = <CFString 0x145d08f20 [0x105863e00]>{contents = "IONVRAM"}
}
SYSLOG: Jan 1 00:00:04 localhost bootlog[0] <Notice>: BOOT_TIME 4 173594
[00:00:10.0569-GMT]{1>3} CHECKPOINT NOTICE: NVRAM access is not currently available
[00:00:10.0661-GMT]{1>3} CHECKPOINT PROGRESS: START (unknown) -> (presumed_initial_monitor_no_return)
entering set_boot_stage
Thu Jan 1 00:00:10 1970 localhost com.apple.xpc.launchd[1] <Error>: assertion failed: 16A5327f: launchd + 64908 [E19492D0-CC83-3216-9F52-65302345049F]: 0x9
Thu Jan 1 00:00:10 1970 localhost com.apple.xpc.launchd[1] (com.apple.syslogd.4) <Warning>: Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.system.logger
unable to find registry entry for boot stage, skipping
[00:00:10.0787-GMT]{1>3} CHECKPOINT MONITOR: [0x0204] boot_stage
[00:00:10.0807-GMT]{1>3} CHECKPOINT MONITOR: [0x0206] monitoring_child
SYSLOG: Jan 1 00:00:04 localhost bootlog[0] <Notice>: BOOT_TIME 4 173594
[00:00:12.0110-GMT]{3>5} CHECKPOINT NOTICE: Image4 device: AP nonce clearable
entering ramrod_clear_ap_nonce
[00:00:12.0239-GMT]{3>5} CHECKPOINT NOTICE: AP nonce consumed
waiting for matching IOKit service: <CFBasicHash 0x1089098e0 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x108909030 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x108909920 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:12.0289-GMT]{3>5} CHECKPOINT NOTICE: NVRAM access is not currently available
[00:00:12.0304-GMT]{3>5} CHECKPOINT PROGRESS: START (unknown) -> (presumed_initial_engine_no_return)
[00:00:12.0319-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x0400] umask
[00:00:12.0332-GMT]{3>5} CHECKPOINT END: MAIN:[0x0400] umask
waiting for matching IOKit service: <CFBasicHash 0x108909a20 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x108902a90 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x108909b80 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:12.0379-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x0402] setvbuf
[00:00:12.0400-GMT]{3>5} CHECKPOINT END: MAIN:[0x0402] setvbuf
waiting for matching IOKit service: <CFBasicHash 0x108909760 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x108908f70 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x108909f60 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:12.0462-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x0403] kernel_logger_thread
unable to open /dev/klog: Resource busy
[00:00:12.0501-GMT]{3>5} CHECKPOINT END: MAIN:[0x0403] kernel_logger_thread
waiting for matching IOKit service: <CFBasicHash 0x10890a360 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x108908f80 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890a060 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:12.0540-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x0406] set_progress_0
unable to get display list
unable to get framebuffer
No framebuffer but an internal display. Ok on bridge but weird anywhere else.
ramrod_display_set_granular_progress_forced: 0.000000
[00:00:12.0685-GMT]{3>5} CHECKPOINT END: MAIN:[0x0406] set_progress_0
waiting for matching IOKit service: <CFBasicHash 0x10890aa30 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890aa70 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890a480 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:12.0729-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x0407] start_gasgauge_thread
[00:00:12.0760-GMT]{3>5} CHECKPOINT WARNING: MAIN:[0x0407] gasgauge_start_update_thread failed: -1
restored_update: gasgauge_start_update_thread failed: -1
[00:00:12.0777-GMT]{3>5} CHECKPOINT END: MAIN:[0x0407] start_gasgauge_thread
waiting for matching IOKit service: <CFBasicHash 0x10890ab30 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890aa80 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890b030 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:12.0820-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x0408] listen_for_log_client
[00:00:12.0865-GMT]{3>5} CHECKPOINT END: MAIN:[0x0408] listen_for_log_client
waiting for matching IOKit service: <CFBasicHash 0x10890b890 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890b8d0 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890af70 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:12.0908-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x040D] create_listen_socket
[00:00:12.0922-GMT]{3>5} CHECKPOINT END: MAIN:[0x040D] create_listen_socket
waiting for matching IOKit service: <CFBasicHash 0x10890b950 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890b790 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890b7f0 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:12.0968-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x0404] update_root_mount
[00:00:13.0051-GMT]{3>5} CHECKPOINT END: MAIN:[0x0404] update_root_mount
waiting for matching IOKit service: <CFBasicHash 0x10890bb90 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890bbd0 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890c3d0 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:13.0091-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x0405] disable_watchdog
No watchdog timer found
[00:00:13.0120-GMT]{3>5} CHECKPOINT END: MAIN:[0x0405] disable_watchdog
waiting for matching IOKit service: <CFBasicHash 0x10890c670 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890bbf0 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890c5c0 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:13.0160-GMT]{3>5} CHECKPOINT BEGIN: MAIN:[0x040E] enable_usb
unable to find valid configuration for this device
waiting for matching IOKit service: <CFBasicHash 0x10890c9f0 [0x1055abe00]>{type = mutable dict, count = 1,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890ca30 [0x1055abe00]>{contents = "AppleUSBDeviceMux"}
}
waiting for matching IOKit service: <CFBasicHash 0x10890c9f0 [0x1055abe00]>{type = mutable dict, count = 1,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890ca30 [0x1055abe00]>{contents = "AppleUSBDeviceMux"}
}
waiting for matching IOKit service: <CFBasicHash 0x10890c9f0 [0x1055abe00]>{type = mutable dict, count = 1,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890ca30 [0x1055abe00]>{contents = "AppleUSBDeviceMux"}
}
waiting for matching IOKit service: <CFBasicHash 0x10890c9f0 [0x1055abe00]>{type = mutable dict, count = 1,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890ca30 [0x1055abe00]>{contents = "AppleUSBDeviceMux"}
}
unable to find AppleUSBDeviceMux service
[00:00:53.0787-GMT]{3>5} CHECKPOINT WARNING: MAIN:[0x040E] unable to enable usbmux debug logging
restored_update: unable to enable usbmux debug logging
[00:00:53.0807-GMT]{3>5} CHECKPOINT FAILURE:(FAILURE:1) MAIN:[0x040E] enable_usb
waiting for matching IOKit service: <CFBasicHash 0x10890ca70 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890c9c0 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890cde0 [0x1055abe00]>{contents = "IONVRAM"}
}
[00:00:53.0862-GMT]{3>5} CHECKPOINT NOTICE: NVRAM access is not currently available
waiting for matching IOKit service: <CFBasicHash 0x10890ca70 [0x1055abe00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x10584c150 [0x1055abe00]>{contents = "IOProviderClass"} = <CFString 0x10890c9d0 [0x1055abe00]>{contents = "IOResources"}
2 : <CFString 0x10465ebf8 [0x1055abe00]>{contents = "IOResourceMatch"} = <CFString 0x10890c960 [0x1055abe00]>{contents = "IONVRAM"}
}
restored_update: enable_usb_connections failed
waiting for matching IOKit service: <CFBasicHash 0x145d08e80 [0x105863e00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x105b04150 [0x105863e00]>{contents = "IOProviderClass"} = <CFString 0x145d08f40 [0x105863e00]>{contents = "IOResources"}
2 : <CFString 0x104936bf8 [0x105863e00]>{contents = "IOResourceMatch"} = <CFString 0x145d094c0 [0x105863e00]>{contents = "IONVRAM"}
}
[00:00:53.0985-GMT]{1>3} CHECKPOINT NOTICE: NVRAM access is not currently available
restored exited normally with status 1 - rebooting
[00:00:54.0024-GMT]{1>3} CHECKPOINT MONITOR:(FAILURE:256) [0x020A] set_exit_status
restored-exit-status = 0x100
waiting for matching IOKit service: <CFBasicHash 0x145d09e60 [0x105863e00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x105b04150 [0x105863e00]>{contents = "IOProviderClass"} = <CFString 0x145d09b80 [0x105863e00]>{contents = "IOResources"}
2 : <CFString 0x104936bf8 [0x105863e00]>{contents = "IOResourceMatch"} = IONVRAM
}
waiting for matching IOKit service: <CFBasicHash 0x145d09e60 [0x105863e00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x105b04150 [0x105863e00]>{contents = "IOProviderClass"} = <CFString 0x145d09b80 [0x105863e00]>{contents = "IOResources"}
2 : <CFString 0x104936bf8 [0x105863e00]>{contents = "IOResourceMatch"} = IONVRAM
}
waiting for matching IOKit service: <CFBasicHash 0x145d09e60 [0x105863e00]>{type = mutable dict, count = 2,
entries =>
0 : <CFString 0x105b04150 [0x105863e00]>{contents = "IOProviderClass"} = <CFString 0x145d09b80 [0x105863e00]>{contents = "IOResources"}
2 : <CFString 0x104936bf8 [0x105863e00]>{contents = "IOResourceMatch"} = IONVRAM
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment