├── include
    ├── Makefile.am
    └── libirecovery.h
├── Makefile.am
├── autogen.sh
├── libirecovery.pc.in
├── tools
    ├── Makefile.am
    └── irecovery.c
├── src
    ├── Makefile.am
    └── libirecovery.c
├── .gitignore
├── README
├── m4
    └── as-compiler-flag.m4
├── configure.ac
└── LICENCE


/include/Makefile.am:
--------------------------------------------------------------------------------
1 | nobase_dist_include_HEADERS = libirecovery.h


--------------------------------------------------------------------------------
/Makefile.am:
--------------------------------------------------------------------------------
1 | AUTOMAKE_OPTIONS = foreign
2 | ACLOCAL_AMFLAGS = -I m4
3 | SUBDIRS = src include tools
4 | 
5 | pkgconfigdir = $(libdir)/pkgconfig
6 | pkgconfig_DATA = libirecovery.pc


--------------------------------------------------------------------------------
/autogen.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | gprefix=`which glibtoolize 2>&1 >/dev/null`
 3 | if [ $? -eq 0 ]; then 
 4 |   glibtoolize --force
 5 | else
 6 |   libtoolize --force
 7 | fi
 8 | aclocal -I m4
 9 | autoheader
10 | automake --add-missing
11 | autoconf
12 | 
13 | if [ -z "$NOCONFIGURE" ]; then
14 |     ./configure "$@"
15 | fi
16 | 


--------------------------------------------------------------------------------
/libirecovery.pc.in:
--------------------------------------------------------------------------------
 1 | prefix=@prefix@
 2 | exec_prefix=@exec_prefix@
 3 | libdir=@libdir@
 4 | includedir=@includedir@
 5 | 
 6 | Name: libirecovery
 7 | Description: A library to communicate with iBoot/iBSS on iOS devices via USB
 8 | Version: @VERSION@
 9 | Libs: -L${libdir} -lirecovery
10 | Cflags: -I${includedir}
11 | 
12 | 


--------------------------------------------------------------------------------
/tools/Makefile.am:
--------------------------------------------------------------------------------
 1 | AM_CPPFLAGS = -I$(top_srcdir)/include
 2 | 
 3 | AM_CFLAGS = $(GLOBAL_CFLAGS) $(libusb_CFLAGS)
 4 | AM_LDFLAGS = $(libusb_LIBS) -lreadline
 5 | 
 6 | bin_PROGRAMS = irecovery
 7 | 
 8 | irecovery_SOURCES = irecovery.c
 9 | irecovery_CFLAGS = $(AM_CFLAGS)
10 | irecovery_LDFLAGS = $(AM_LDFLAGS)
11 | irecovery_LDADD = $(top_srcdir)/src/libirecovery.la


--------------------------------------------------------------------------------
/src/Makefile.am:
--------------------------------------------------------------------------------
 1 | AM_CPPFLAGS = -I$(top_srcdir)/include
 2 | 
 3 | AM_CFLAGS = $(GLOBAL_CFLAGS) $(libusb_CFLAGS)
 4 | AM_LDFLAGS = $(libusb_LIBS) $(LIBIRECOVERYLDFLAGS)
 5 | 
 6 | lib_LTLIBRARIES = libirecovery.la
 7 | libirecovery_la_CFLAGS = $(AM_CFLAGS)
 8 | libirecovery_la_LDFLAGS = $(AM_LDFLAGS) -version-info $(LIBIRECOVERY_SO_VERSION) -no-undefined
 9 | libirecovery_la_SOURCES = libirecovery.c
10 | 
11 | if WIN32
12 | libirecovery_la_LDFLAGS += -avoid-version
13 | endif


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
 1 | *.[oa]
 2 | *~
 3 | *.po
 4 | *.lo
 5 | *.la
 6 | autom4te.cache/*
 7 | *.in
 8 | */.deps/*
 9 | m4/*
10 | *.dll
11 | *.so
12 | *.dylib
13 | *.patch
14 | aclocal.m4
15 | config.h
16 | config.log
17 | config.sub
18 | config.guess
19 | config.status
20 | configure
21 | depcomp
22 | install-sh
23 | compile
24 | main
25 | ltmain.sh
26 | missing
27 | mkinstalldirs
28 | libtool
29 | *Makefile
30 | stamp-h1
31 | src/.libs
32 | *.pc
33 | tools/.libs/*
34 | tools/irecovery
35 | .irecovery


--------------------------------------------------------------------------------
/README:
--------------------------------------------------------------------------------
 1 | == What is libirecovery? ==
 2 | 
 3 | libirecovery is a cross-platform library which implements communication to
 4 | iBoot/iBSS found on Apple's iOS devices via USB. A command-line utility is also
 5 | provided.
 6 | 
 7 | The software is completely open-source, the source code is released under the
 8 | terms of the LGPL 2.1. The full license text can be found in the LICENSE file.
 9 | 
10 | Here's its usage:
11 | 
12 | irecovery [args]
13 | 	-v		Start irecovery in verbose mode.
14 | 	-c <cmd>	Send command to client.
15 | 	-f <file>	Send file to client.
16 | 	-k [payload]	Send usb exploit to client.
17 | 	-h		Show this help.
18 | 	-r		Reset client.
19 | 	-s		Start interactive shell.
20 | 	-e <script>	Executes recovery shell script.
21 | 
22 | You can get info on the shell commands here:
23 | http://code.google.com/p/chronicdev/wiki/iBootCommands
24 | 


--------------------------------------------------------------------------------
/m4/as-compiler-flag.m4:
--------------------------------------------------------------------------------
 1 | dnl as-compiler-flag.m4 0.1.0
 2 | 
 3 | dnl autostars m4 macro for detection of compiler flags
 4 | 
 5 | dnl David Schleef <ds@schleef.org>
 6 | 
 7 | dnl $Id: as-compiler-flag.m4,v 1.1 2005/12/15 23:35:19 ds Exp $
 8 | 
 9 | dnl AS_COMPILER_FLAG(CFLAGS, ACTION-IF-ACCEPTED, [ACTION-IF-NOT-ACCEPTED])
10 | dnl Tries to compile with the given CFLAGS.
11 | dnl Runs ACTION-IF-ACCEPTED if the compiler can compile with the flags,
12 | dnl and ACTION-IF-NOT-ACCEPTED otherwise.
13 | 
14 | AC_DEFUN([AS_COMPILER_FLAG],
15 | [
16 |   AC_MSG_CHECKING([to see if compiler understands $1])
17 | 
18 |   save_CFLAGS="$CFLAGS"
19 |   CFLAGS="$CFLAGS $1"
20 | 
21 |   AC_TRY_COMPILE([ ], [], [flag_ok=yes], [flag_ok=no])
22 |   CFLAGS="$save_CFLAGS"
23 | 
24 |   if test "X$flag_ok" = Xyes ; then
25 |     m4_ifvaln([$2],[$2])
26 |     true
27 |   else
28 |     m4_ifvaln([$3],[$3])
29 |     true
30 |   fi
31 |   AC_MSG_RESULT([$flag_ok])
32 | ])
33 | 
34 | dnl AS_COMPILER_FLAGS(VAR, FLAGS)
35 | dnl Tries to compile with the given CFLAGS.
36 | 
37 | AC_DEFUN([AS_COMPILER_FLAGS],
38 | [
39 |   list=$2
40 |   flags_supported=""
41 |   flags_unsupported=""
42 |   AC_MSG_CHECKING([for supported compiler flags])
43 |   for each in $list
44 |   do
45 |     save_CFLAGS="$CFLAGS"
46 |     CFLAGS="$CFLAGS $each"
47 |     AC_TRY_COMPILE([ ], [], [flag_ok=yes], [flag_ok=no])
48 |     CFLAGS="$save_CFLAGS"
49 | 
50 |     if test "X$flag_ok" = Xyes ; then
51 |       flags_supported="$flags_supported $each"
52 |     else
53 |       flags_unsupported="$flags_unsupported $each"
54 |     fi
55 |   done
56 |   AC_MSG_RESULT([$flags_supported])
57 |   if test "X$flags_unsupported" != X ; then
58 |     AC_MSG_WARN([unsupported compiler flags: $flags_unsupported])
59 |   fi
60 |   $1="$$1 $flags_supported"
61 | ])
62 | 
63 | 


--------------------------------------------------------------------------------
/configure.ac:
--------------------------------------------------------------------------------
  1 | #                                               -*- Autoconf -*-
  2 | # Process this file with autoconf to produce a configure script.
  3 | 
  4 | AC_PREREQ(2.61)
  5 | AC_INIT(libirecovery, 0.2.0, nospam@nowhere.com)
  6 | AM_INIT_AUTOMAKE([dist-bzip2 no-dist-gzip])
  7 | m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES])
  8 | AC_CONFIG_SRCDIR([src/])
  9 | AC_CONFIG_HEADERS([config.h])
 10 | AC_CONFIG_MACRO_DIR([m4])
 11 | 
 12 | dnl libtool versioning
 13 | # +1 : 0 : +1  == adds new functions to the interface
 14 | # +1 : 0 : 0   == changes or removes functions (changes include both
 15 | #                 changes to the signature and the semantic)
 16 | #  ? :+1 : ?   == just internal changes
 17 | # CURRENT : REVISION : AGE
 18 | LIBIRECOVERY_SO_VERSION=1:0:0
 19 | 
 20 | AC_SUBST(LIBIRECOVERY_SO_VERSION)
 21 | 
 22 | # Checks for programs.
 23 | AC_PROG_CC
 24 | AC_PROG_CXX
 25 | AM_PROG_CC_C_O
 26 | AC_PROG_LIBTOOL
 27 | 
 28 | # Checks for libraries.
 29 | PKG_CHECK_MODULES(libusb, libusb-1.0 >= 1.0.3)
 30 | 
 31 | # Check additional platform flags
 32 | case "$host_os" in
 33 | 	darwin*)
 34 | 		AC_CHECK_HEADER(CoreFoundation/CoreFoundation.h, [
 35 | 			AC_CHECK_HEADER(IOKit/IOKitLib.h, [
 36 | 				AC_DEFINE(HAVE_IOKIT, 1, [Define if we have IOKit])
 37 | 				LIBIRECOVERYLDFLAGS="-framework IOKit -framework CoreFoundation"
 38 | 			], [])
 39 | 		], [])
 40 | 	;;
 41 | 	mingw32*)
 42 | 		LDFLAGS+=" -static-libgcc"
 43 | 		LIBIRECOVERYLDFLAGS=" -lkernel32 -lmsvcrt -lsetupapi"
 44 | 	;;
 45 | 	cygwin*)
 46 | 		CC=gcc-3
 47 | 		CFLAGS+=" -mno-cygwin"
 48 | 		LDFLAGS+=" -static-libgcc"
 49 | 		LIBIRECOVERYLDFLAGS=" -lkernel32 -lmsvcrt -lsetupapi"
 50 | 	;;
 51 | 	*)
 52 | 		LIBIRECOVERYLDFLAGS=
 53 | 	;;
 54 | esac
 55 | AC_SUBST(LIBIRECOVERYLDFLAGS)
 56 | 
 57 | # Checks for header files.
 58 | AC_HEADER_STDC
 59 | AC_CHECK_HEADERS([stdint.h stdlib.h string.h])
 60 | 
 61 | # Checks for typedefs, structures, and compiler characteristics.
 62 | AC_C_CONST
 63 | AC_TYPE_SIZE_T
 64 | AC_TYPE_SSIZE_T
 65 | AC_TYPE_UINT16_T
 66 | AC_TYPE_UINT32_T
 67 | AC_TYPE_UINT8_T
 68 | 
 69 | # Checks for library functions.
 70 | AC_FUNC_MALLOC
 71 | AC_FUNC_REALLOC
 72 | AC_CHECK_FUNCS([strcasecmp strdup strerror strndup])
 73 | 
 74 | # Check for operating system
 75 | AC_MSG_CHECKING([whether to enable WIN32 build settings])
 76 | case ${host_os} in
 77 | 	*mingw32*|*cygwin*)
 78 | 		win32=true
 79 | 		AC_MSG_RESULT([yes])
 80 | 		AC_CHECK_TOOL([WINDRES], [windres], AC_MSG_ERROR([windres not found]))
 81 | 		AC_SUBST(WINDRES)
 82 | 	;;
 83 | 	*)
 84 | 		win32=false
 85 | 		AC_MSG_RESULT([no])
 86 | 	;;
 87 | esac
 88 | AM_CONDITIONAL(WIN32, test x$win32 = xtrue)
 89 | 
 90 | AS_COMPILER_FLAGS(GLOBAL_CFLAGS, "-Wall -Wextra -Wmissing-declarations -Wredundant-decls -Wshadow -Wpointer-arith -Wwrite-strings -Wswitch-default -Wno-unused-parameter")
 91 | AC_SUBST(GLOBAL_CFLAGS)
 92 | 
 93 | m4_ifdef([AM_SILENT_RULES],[AM_SILENT_RULES([yes])])
 94 | 
 95 | AC_OUTPUT([
 96 | Makefile
 97 | src/Makefile
 98 | include/Makefile
 99 | tools/Makefile
100 | libirecovery.pc
101 | ])
102 | 
103 | echo "
104 | Configuration for $PACKAGE $VERSION:
105 | -------------------------------------------
106 | 
107 |   Install prefix: .........: $prefix
108 | 
109 |   Now type 'make' to build $PACKAGE $VERSION,
110 |   and then 'make install' for installation.
111 | "
112 | 


--------------------------------------------------------------------------------
/include/libirecovery.h:
--------------------------------------------------------------------------------
  1 | /*
  2 |  * libirecovery.h
  3 |  * Communication to iBoot/iBSS on Apple iOS devices via USB
  4 |  *
  5 |  * Copyright (c) 2012-2013 Martin Szulecki <m.szulecki@libimobiledevice.org>
  6 |  * Copyright (c) 2010 Chronic-Dev Team
  7 |  * Copyright (c) 2010 Joshua Hill
  8 |  *
  9 |  * All rights reserved. This program and the accompanying materials
 10 |  * are made available under the terms of the GNU Lesser General Public License
 11 |  * (LGPL) version 2.1 which accompanies this distribution, and is available at
 12 |  * http://www.gnu.org/licenses/lgpl-2.1.html
 13 |  *
 14 |  * This library is distributed in the hope that it will be useful,
 15 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 16 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 17 |  * Lesser General Public License for more details.
 18 |  */
 19 | 
 20 | #ifndef LIBIRECOVERY_H
 21 | #define LIBIRECOVERY_H
 22 | 
 23 | #ifdef __cplusplus
 24 | extern "C" {
 25 | #endif
 26 | 
 27 | #include <stdint.h>
 28 | 
 29 | enum {
 30 | 	IRECV_K_RECOVERY_MODE_1   = 0x1280,
 31 | 	IRECV_K_RECOVERY_MODE_2   = 0x1281,
 32 | 	IRECV_K_RECOVERY_MODE_3   = 0x1282,
 33 | 	IRECV_K_RECOVERY_MODE_4   = 0x1283,
 34 | 	IRECV_K_WTF_MODE          = 0x1222,
 35 | 	IRECV_K_DFU_MODE          = 0x1227
 36 | };
 37 | 
 38 | typedef enum {
 39 | 	IRECV_E_SUCCESS           =  0,
 40 | 	IRECV_E_NO_DEVICE         = -1,
 41 | 	IRECV_E_OUT_OF_MEMORY     = -2,
 42 | 	IRECV_E_UNABLE_TO_CONNECT = -3,
 43 | 	IRECV_E_INVALID_INPUT     = -4,
 44 | 	IRECV_E_FILE_NOT_FOUND    = -5,
 45 | 	IRECV_E_USB_UPLOAD        = -6,
 46 | 	IRECV_E_USB_STATUS        = -7,
 47 | 	IRECV_E_USB_INTERFACE     = -8,
 48 | 	IRECV_E_USB_CONFIGURATION = -9,
 49 | 	IRECV_E_PIPE              = -10,
 50 | 	IRECV_E_TIMEOUT           = -11,
 51 | 	IRECV_E_UNKNOWN_ERROR     = -255
 52 | } irecv_error_t;
 53 | 
 54 | typedef enum {
 55 | 	IRECV_RECEIVED            = 1,
 56 | 	IRECV_PRECOMMAND          = 2,
 57 | 	IRECV_POSTCOMMAND         = 3,
 58 | 	IRECV_CONNECTED           = 4,
 59 | 	IRECV_DISCONNECTED        = 5,
 60 | 	IRECV_PROGRESS            = 6
 61 | } irecv_event_type;
 62 | 
 63 | typedef struct {
 64 | 	int size;
 65 | 	const char* data;
 66 | 	double progress;
 67 | 	irecv_event_type type;
 68 | } irecv_event_t;
 69 | 
 70 | struct irecv_device {
 71 | 	const char* product_type;
 72 | 	const char* hardware_model;
 73 | 	unsigned int board_id;
 74 | 	unsigned int chip_id;
 75 | };
 76 | typedef struct irecv_device* irecv_device_t;
 77 | 
 78 | typedef struct irecv_client_private irecv_client_private;
 79 | typedef irecv_client_private* irecv_client_t;
 80 | 
 81 | /* library */
 82 | void irecv_set_debug_level(int level);
 83 | const char* irecv_strerror(irecv_error_t error);
 84 | void irecv_init();
 85 | void irecv_exit();
 86 | 
 87 | /* device connectivity */
 88 | irecv_error_t irecv_open_with_ecid(irecv_client_t* client, unsigned long long ecid);
 89 | irecv_error_t irecv_open_with_ecid_and_attempts(irecv_client_t* pclient, unsigned long long ecid, int attempts);
 90 | irecv_error_t irecv_reset(irecv_client_t client);
 91 | irecv_error_t irecv_close(irecv_client_t client);
 92 | irecv_client_t irecv_reconnect(irecv_client_t client, int initial_pause);
 93 | 
 94 | /* misc */
 95 | irecv_error_t irecv_receive(irecv_client_t client);
 96 | irecv_error_t irecv_execute_script(irecv_client_t client, const char* script);
 97 | irecv_error_t irecv_reset_counters(irecv_client_t client);
 98 | irecv_error_t irecv_finish_transfer(irecv_client_t client);
 99 | irecv_error_t irecv_trigger_limera1n_exploit(irecv_client_t client);
100 | 
101 | /* usb helpers */
102 | irecv_error_t irecv_usb_set_configuration(irecv_client_t client, int configuration);
103 | irecv_error_t irecv_usb_set_interface(irecv_client_t client, int usb_interface, int usb_alt_interface);
104 | int irecv_usb_control_transfer(irecv_client_t client, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, unsigned char *data, uint16_t w_length, unsigned int timeout);
105 | int irecv_usb_bulk_transfer(irecv_client_t client, unsigned char endpoint, unsigned char *data, int length, int *transferred, unsigned int timeout);
106 | 
107 | /* events */
108 | typedef int(*irecv_event_cb_t)(irecv_client_t client, const irecv_event_t* event);
109 | irecv_error_t irecv_event_subscribe(irecv_client_t client, irecv_event_type type, irecv_event_cb_t callback, void *user_data);
110 | irecv_error_t irecv_event_unsubscribe(irecv_client_t client, irecv_event_type type);
111 | 
112 | /* I/O */
113 | irecv_error_t irecv_send_file(irecv_client_t client, const char* filename, int dfu_notify_finished);
114 | irecv_error_t irecv_send_command(irecv_client_t client, const char* command);
115 | irecv_error_t irecv_send_buffer(irecv_client_t client, unsigned char* buffer, unsigned long length, int dfu_notify_finished);
116 | irecv_error_t irecv_recv_buffer(irecv_client_t client, char* buffer, unsigned long length);
117 | 
118 | /* commands */
119 | irecv_error_t irecv_saveenv(irecv_client_t client);
120 | irecv_error_t irecv_getenv(irecv_client_t client, const char* variable, char** value);
121 | irecv_error_t irecv_setenv(irecv_client_t client, const char* variable, const char* value);
122 | irecv_error_t irecv_reboot(irecv_client_t client);
123 | irecv_error_t irecv_getret(irecv_client_t client, unsigned int* value);
124 | 
125 | /* device information */
126 | irecv_error_t irecv_get_mode(irecv_client_t client, int* mode);
127 | irecv_error_t irecv_get_cpid(irecv_client_t client, unsigned int* cpid);
128 | irecv_error_t irecv_get_bdid(irecv_client_t client, unsigned int* bdid);
129 | irecv_error_t irecv_get_ecid(irecv_client_t client, unsigned long long* ecid);
130 | irecv_error_t irecv_get_nonce(irecv_client_t client, unsigned char** nonce, int* nonce_size);
131 | irecv_error_t irecv_get_srnm(irecv_client_t client, char* srnm);
132 | irecv_error_t irecv_get_imei(irecv_client_t client, char* imei);
133 | 
134 | /* device database queries */
135 | irecv_device_t irecv_devices_get_all();
136 | irecv_error_t irecv_devices_get_device_by_client(irecv_client_t client, irecv_device_t* device);
137 | irecv_error_t irecv_devices_get_device_by_product_type(const char* product_type, irecv_device_t* device);
138 | irecv_error_t irecv_devices_get_device_by_hardware_model(const char* hardware_model, irecv_device_t* device);
139 | 
140 | #ifdef __cplusplus
141 | }
142 | #endif
143 | 
144 | #endif
145 | 


--------------------------------------------------------------------------------
/tools/irecovery.c:
--------------------------------------------------------------------------------
  1 | /*
  2 |  * irecovery.c
  3 |  * Software frontend for iBoot/iBSS communication with iOS devices
  4 |  *
  5 |  * Copyright (c) 2012-2013 Martin Szulecki <m.szulecki@libimobiledevice.org>
  6 |  * Copyright (c) 2010-2011 Chronic-Dev Team
  7 |  * Copyright (c) 2010-2011 Joshua Hill
  8 |  * Copyright (c) 2008-2011 Nicolas Haunold
  9 |  *
 10 |  * All rights reserved. This program and the accompanying materials
 11 |  * are made available under the terms of the GNU Lesser General Public License
 12 |  * (LGPL) version 2.1 which accompanies this distribution, and is available at
 13 |  * http://www.gnu.org/licenses/lgpl-2.1.html
 14 |  *
 15 |  * This library is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 18 |  * Lesser General Public License for more details.
 19 |  */
 20 | 
 21 | #include <stdio.h>
 22 | #include <stdlib.h>
 23 | #include <unistd.h>
 24 | #include <string.h>
 25 | #include <libirecovery.h>
 26 | #include <readline/readline.h>
 27 | #include <readline/history.h>
 28 | 
 29 | #ifdef WIN32
 30 | #include <windows.h>
 31 | #ifndef sleep
 32 | #define sleep(n) Sleep(1000 * n)
 33 | #endif
 34 | #define _FMT_lld "%I64d"
 35 | #else
 36 | #define _FMT_lld "%lld"
 37 | #endif
 38 | 
 39 | #define FILE_HISTORY_PATH ".irecovery"
 40 | #define debug(...) if(verbose) fprintf(stderr, __VA_ARGS__)
 41 | 
 42 | enum {
 43 | 	kResetDevice,
 44 | 	kStartShell,
 45 | 	kSendCommand,
 46 | 	kSendFile,
 47 | 	kSendExploit,
 48 | 	kSendScript,
 49 | 	kShowMode,
 50 | 	kRebootToNormalMode
 51 | };
 52 | 
 53 | static unsigned int quit = 0;
 54 | static unsigned int verbose = 0;
 55 | 
 56 | void print_progress_bar(double progress);
 57 | int received_cb(irecv_client_t client, const irecv_event_t* event);
 58 | int progress_cb(irecv_client_t client, const irecv_event_t* event);
 59 | int precommand_cb(irecv_client_t client, const irecv_event_t* event);
 60 | int postcommand_cb(irecv_client_t client, const irecv_event_t* event);
 61 | 
 62 | static void shell_usage() {
 63 | 	printf("Usage:\n");
 64 | 	printf("  /upload FILE\t\tsend FILE to device\n");
 65 | 	printf("  /limera1n [FILE]\trun limera1n exploit and send optional payload from FILE\n");
 66 | 	printf("  /deviceinfo\t\tprint device information (ECID, IMEI, etc.)\n");
 67 | 	printf("  /help\t\t\tshow this help\n");
 68 | 	printf("  /exit\t\t\texit interactive shell\n");
 69 | }
 70 | 
 71 | static const char* mode_to_str(int mode) {
 72 | 	switch (mode) {
 73 | 		case IRECV_K_RECOVERY_MODE_1:
 74 | 		case IRECV_K_RECOVERY_MODE_2:
 75 | 		case IRECV_K_RECOVERY_MODE_3:
 76 | 		case IRECV_K_RECOVERY_MODE_4:
 77 | 			return "Recovery";
 78 | 			break;
 79 | 		case IRECV_K_DFU_MODE:
 80 | 			return "DFU";
 81 | 			break;
 82 | 		case IRECV_K_WTF_MODE:
 83 | 			return "WTF";
 84 | 			break;
 85 | 		default:
 86 | 			return "Unknown";
 87 | 			break;
 88 | 	}
 89 | }
 90 | 
 91 | static void buffer_read_from_filename(const char *filename, char **buffer, uint64_t *length) {
 92 | 	FILE *f;
 93 | 	uint64_t size;
 94 | 
 95 | 	*length = 0;
 96 | 
 97 | 	f = fopen(filename, "rb");
 98 | 	if (!f) {
 99 | 		return;
100 | 	}
101 | 
102 | 	fseek(f, 0, SEEK_END);
103 | 	size = ftell(f);
104 | 	rewind(f);
105 | 
106 | 	if (size == 0) {
107 | 		fclose(f);
108 | 		return;
109 | 	}
110 | 
111 | 	*buffer = (char*)malloc(sizeof(char)*(size+1));
112 | 	fread(*buffer, sizeof(char), size, f);
113 | 	fclose(f);
114 | 
115 | 	*length = size;
116 | }
117 | 
118 | static void parse_command(irecv_client_t client, unsigned char* command, unsigned int size) {
119 | 	char* cmd = strdup((char*)command);
120 | 	char* action = strtok(cmd, " ");
121 | 
122 | 	if (!strcmp(cmd, "/exit")) {
123 | 		quit = 1;
124 | 	} else if (!strcmp(cmd, "/help")) {
125 | 		shell_usage();
126 | 	} else if (!strcmp(cmd, "/upload")) {
127 | 		char* filename = strtok(NULL, " ");
128 | 		debug("Uploading files %s\n", filename);
129 | 		if (filename != NULL) {
130 | 			irecv_send_file(client, filename, 0);
131 | 		}
132 | 	} else if (!strcmp(cmd, "/deviceinfo")) {
133 | 		int ret, mode;
134 | 		unsigned int cpid, bdid;
135 | 		unsigned long long ecid;
136 | 		char srnm[12], imei[15];
137 | 
138 | 		ret = irecv_get_cpid(client, &cpid);
139 | 		if(ret == IRECV_E_SUCCESS) {
140 | 			printf("CPID: %d\n", cpid);
141 | 		}
142 | 
143 | 		ret = irecv_get_bdid(client, &bdid);
144 | 		if(ret == IRECV_E_SUCCESS) {
145 | 			printf("BDID: %d\n", bdid);
146 | 		}
147 | 
148 | 		ret = irecv_get_ecid(client, &ecid);
149 | 		if(ret == IRECV_E_SUCCESS) {
150 | 			printf("ECID: " _FMT_lld "\n", ecid);
151 | 		}
152 | 
153 | 		ret = irecv_get_srnm(client, srnm);
154 | 		if(ret == IRECV_E_SUCCESS) {
155 | 			printf("SRNM: %s\n", srnm);
156 | 		}
157 | 
158 | 		ret = irecv_get_imei(client, imei);
159 | 		if(ret == IRECV_E_SUCCESS) {
160 | 			printf("IMEI: %s\n", imei);
161 | 		}
162 | 
163 | 		ret = irecv_get_mode(client, &mode);
164 | 		if (ret == IRECV_E_SUCCESS) {
165 | 			printf("MODE: %s\n", mode_to_str(mode));
166 | 		}
167 | 
168 | 	} else if (!strcmp(cmd, "/limera1n")) {
169 | 		char* filename = strtok(NULL, " ");
170 | 		debug("Sending limera1n payload %s\n", filename);
171 | 		if (filename != NULL) {
172 | 			irecv_send_file(client, filename, 0);
173 | 		}
174 | 		irecv_trigger_limera1n_exploit(client);
175 | 	} else if (!strcmp(cmd, "/execute")) {
176 | 		char* filename = strtok(NULL, " ");
177 | 		debug("Executing script %s\n", filename);
178 | 		if (filename != NULL) {
179 | 			char* buffer = NULL;
180 | 			uint64_t buffer_length = 0;
181 | 			buffer_read_from_filename(filename, &buffer, &buffer_length);
182 | 			if (buffer) {
183 | 				buffer[buffer_length] = '\0';
184 | 				irecv_execute_script(client, buffer);
185 | 				free(buffer);
186 | 			} else {
187 | 				printf("Could not read file '%s'\n", filename);
188 | 			}
189 | 		}
190 | 	}
191 | 
192 | 	free(action);
193 | }
194 | 
195 | static void load_command_history() {
196 | 	read_history(FILE_HISTORY_PATH);
197 | }
198 | 
199 | static void append_command_to_history(char* cmd) {
200 | 	add_history(cmd);
201 | 	write_history(FILE_HISTORY_PATH);
202 | }
203 | 
204 | static void init_shell(irecv_client_t client) {
205 | 	irecv_error_t error = 0;
206 | 	load_command_history();
207 | 	irecv_event_subscribe(client, IRECV_PROGRESS, &progress_cb, NULL);
208 | 	irecv_event_subscribe(client, IRECV_RECEIVED, &received_cb, NULL);
209 | 	irecv_event_subscribe(client, IRECV_PRECOMMAND, &precommand_cb, NULL);
210 | 	irecv_event_subscribe(client, IRECV_POSTCOMMAND, &postcommand_cb, NULL);
211 | 	while (!quit) {
212 | 		error = irecv_receive(client);
213 | 		if (error != IRECV_E_SUCCESS) {
214 | 			debug("%s\n", irecv_strerror(error));
215 | 			break;
216 | 		}
217 | 
218 | 		char* cmd = readline("> ");
219 | 		if (cmd && *cmd) {
220 | 			error = irecv_send_command(client, cmd);
221 | 			if (error != IRECV_E_SUCCESS) {
222 | 				quit = 1;
223 | 			}
224 | 
225 | 			append_command_to_history(cmd);
226 | 			free(cmd);
227 | 		}
228 | 	}
229 | }
230 | 
231 | int received_cb(irecv_client_t client, const irecv_event_t* event) {
232 | 	if (event->type == IRECV_RECEIVED) {
233 | 		int i = 0;
234 | 		int size = event->size;
235 | 		const char* data = event->data;
236 | 		for (i = 0; i < size; i++) {
237 | 			printf("%c", data[i]);
238 | 		}
239 | 	}
240 | 
241 | 	return 0;
242 | }
243 | 
244 | int precommand_cb(irecv_client_t client, const irecv_event_t* event) {
245 | 	if (event->type == IRECV_PRECOMMAND) {
246 | 		if (event->data[0] == '/') {
247 | 			parse_command(client, (unsigned char*)event->data, event->size);
248 | 			return -1;
249 | 		}
250 | 	}
251 | 
252 | 	return 0;
253 | }
254 | 
255 | int postcommand_cb(irecv_client_t client, const irecv_event_t* event) {
256 | 	char* value = NULL;
257 | 	char* action = NULL;
258 | 	char* command = NULL;
259 | 	char* argument = NULL;
260 | 	irecv_error_t error = IRECV_E_SUCCESS;
261 | 
262 | 	if (event->type == IRECV_POSTCOMMAND) {
263 | 		command = strdup(event->data);
264 | 		action = strtok(command, " ");
265 | 		if (!strcmp(action, "getenv")) {
266 | 			argument = strtok(NULL, " ");
267 | 			error = irecv_getenv(client, argument, &value);
268 | 			if (error != IRECV_E_SUCCESS) {
269 | 				debug("%s\n", irecv_strerror(error));
270 | 				free(command);
271 | 				return error;
272 | 			}
273 | 			printf("%s\n", value);
274 | 			free(value);
275 | 		}
276 | 
277 | 		if (!strcmp(action, "reboot")) {
278 | 			quit = 1;
279 | 		}
280 | 	}
281 | 
282 | 	if (command)
283 | 		free(command);
284 | 
285 | 	return 0;
286 | }
287 | 
288 | int progress_cb(irecv_client_t client, const irecv_event_t* event) {
289 | 	if (event->type == IRECV_PROGRESS) {
290 | 		print_progress_bar(event->progress);
291 | 	}
292 | 
293 | 	return 0;
294 | }
295 | 
296 | void print_progress_bar(double progress) {
297 | 	int i = 0;
298 | 
299 | 	if(progress < 0) {
300 | 		return;
301 | 	}
302 | 
303 | 	if(progress > 100) {
304 | 		progress = 100;
305 | 	}
306 | 
307 | 	printf("\r[");
308 | 
309 | 	for(i = 0; i < 50; i++) {
310 | 		if(i < progress / 2) {
311 | 			printf("=");
312 | 		} else {
313 | 			printf(" ");
314 | 		}
315 | 	}
316 | 
317 | 	printf("] %3.1f%%", progress);
318 | 
319 | 	fflush(stdout);
320 | 
321 | 	if(progress == 100) {
322 | 		printf("\n");
323 | 	}
324 | }
325 | 
326 | static void print_usage(int argc, char **argv) {
327 | 	char *name = NULL;
328 | 	name = strrchr(argv[0], '/');
329 | 	printf("Usage: %s [OPTIONS]\n", (name ? name + 1: argv[0]));
330 | 	printf("Interact with an iOS device in DFU or recovery mode.\n\n");
331 | 	printf("options:\n");
332 | 	printf("  -i ECID\tconnect to specific device by its hexadecimal ECID\n");
333 | 	printf("  -c CMD\trun CMD on device\n");
334 | 	printf("  -m\t\tprint current device mode\n");
335 | 	printf("  -f FILE\tsend file to device\n");
336 | 	printf("  -k FILE\tsend limera1n usb exploit payload from FILE\n");
337 | 	printf("  -r\t\treset client\n");
338 | 	printf("  -n\t\treboot device into normal mode (exit recovery loop)\n");
339 | 	printf("  -e FILE\texecutes recovery script from FILE\n");
340 | 	printf("  -s\t\tstart an interactive shell\n");
341 | 	printf("  -v\t\tenable verbose output, repeat for higher verbosity\n");
342 | 	printf("  -h\t\tprints this usage information\n");
343 | 	printf("\n");
344 | }
345 | 
346 | int main(int argc, char* argv[]) {
347 | 	int i = 0;
348 | 	int opt = 0;
349 | 	int action = 0;
350 | 	unsigned long long ecid = 0;
351 | 	int mode = -1;
352 | 	char* argument = NULL;
353 | 	irecv_error_t error = 0;
354 | 
355 | 	char* buffer = NULL;
356 | 	uint64_t buffer_length = 0;
357 | 
358 | 	if (argc == 1) {
359 | 		print_usage(argc, argv);
360 | 		return 0;
361 | 	}
362 | 
363 | 	while ((opt = getopt(argc, argv, "i:vhrsmnc:f:e:k::")) > 0) {
364 | 		switch (opt) {
365 | 			case 'i':
366 | 				if (optarg) {
367 | 					char* tail = NULL;
368 | 					ecid = strtoull(optarg, &tail, 16);
369 | 					if (tail && (tail[0] != '\0')) {
370 | 						ecid = 0;
371 | 					}
372 | 					if (ecid == 0) {
373 | 						fprintf(stderr, "ERROR: Could not parse ECID from argument '%s'\n", optarg);
374 | 						return -1;
375 | 					}
376 | 				}
377 | 				break;
378 | 
379 | 			case 'v':
380 | 				verbose += 1;
381 | 				break;
382 | 
383 | 			case 'h':
384 | 				print_usage(argc, argv);
385 | 				return 0;
386 | 
387 | 			case 'm':
388 | 				action = kShowMode;
389 | 				break;
390 | 
391 | 			case 'n':
392 | 				action = kRebootToNormalMode;
393 | 				break;
394 | 
395 | 			case 'r':
396 | 				action = kResetDevice;
397 | 				break;
398 | 
399 | 			case 's':
400 | 				action = kStartShell;
401 | 				break;
402 | 
403 | 			case 'f':
404 | 				action = kSendFile;
405 | 				argument = optarg;
406 | 				break;
407 | 
408 | 			case 'c':
409 | 				action = kSendCommand;
410 | 				argument = optarg;
411 | 				break;
412 | 
413 | 			case 'k':
414 | 				action = kSendExploit;
415 | 				argument = optarg;
416 | 				break;
417 | 
418 | 			case 'e':
419 | 				action = kSendScript;
420 | 				argument = optarg;
421 | 				break;
422 | 
423 | 			default:
424 | 				fprintf(stderr, "Unknown argument\n");
425 | 				return -1;
426 | 		}
427 | 	}
428 | 
429 | 	if (verbose)
430 | 		irecv_set_debug_level(verbose);
431 | 
432 | 	irecv_init();
433 | 	irecv_client_t client = NULL;
434 | 	for (i = 0; i <= 5; i++) {
435 | 		debug("Attempting to connect... \n");
436 | 
437 | 		if (irecv_open_with_ecid(&client, ecid) != IRECV_E_SUCCESS)
438 | 			sleep(1);
439 | 		else
440 | 			break;
441 | 
442 | 		if (i == 5) {
443 | 			return -1;
444 | 		}
445 | 	}
446 | 
447 | 	irecv_device_t device = NULL;
448 | 	irecv_devices_get_device_by_client(client, &device);
449 | 	if (device)
450 | 		debug("Connected to %s, model %s, cpid 0x%04x, bdid 0x%02x\n", device->product_type, device->hardware_model, device->chip_id, device->board_id);
451 | 
452 | 	switch (action) {
453 | 		case kResetDevice:
454 | 			irecv_reset(client);
455 | 			break;
456 | 
457 | 		case kSendFile:
458 | 			irecv_event_subscribe(client, IRECV_PROGRESS, &progress_cb, NULL);
459 | 			error = irecv_send_file(client, argument, 1);
460 | 			debug("%s\n", irecv_strerror(error));
461 | 			break;
462 | 
463 | 		case kSendCommand:
464 | 			error = irecv_send_command(client, argument);
465 | 			debug("%s\n", irecv_strerror(error));
466 | 			break;
467 | 
468 | 		case kSendExploit:
469 | 			if (argument != NULL) {
470 | 				irecv_event_subscribe(client, IRECV_PROGRESS, &progress_cb, NULL);
471 | 				error = irecv_send_file(client, argument, 0);
472 | 				if (error != IRECV_E_SUCCESS) {
473 | 					debug("%s\n", irecv_strerror(error));
474 | 					break;
475 | 				}
476 | 			}
477 | 			error = irecv_trigger_limera1n_exploit(client);
478 | 			debug("%s\n", irecv_strerror(error));
479 | 			break;
480 | 
481 | 		case kStartShell:
482 | 			init_shell(client);
483 | 			break;
484 | 
485 | 		case kSendScript:
486 | 			buffer_read_from_filename(argument, &buffer, &buffer_length);
487 | 			if (buffer) {
488 | 				buffer[buffer_length] = '\0';
489 | 
490 | 				error = irecv_execute_script(client, buffer);
491 | 				if(error != IRECV_E_SUCCESS) {
492 | 					debug("%s\n", irecv_strerror(error));
493 | 				}
494 | 
495 | 				free(buffer);
496 | 			} else {
497 | 				fprintf(stderr, "Could not read file '%s'\n", argument);
498 | 			}
499 | 			break;
500 | 
501 | 		case kShowMode:
502 | 			irecv_get_mode(client, &mode);
503 | 			printf("%s Mode\n", mode_to_str(mode));
504 | 			break;
505 | 
506 | 		case kRebootToNormalMode:
507 | 			error = irecv_setenv(client, "auto-boot", "true");
508 | 			if (error != IRECV_E_SUCCESS) {
509 | 				debug("%s\n", irecv_strerror(error));
510 | 				break;
511 | 			}
512 | 
513 | 			error = irecv_saveenv(client);
514 | 			if (error != IRECV_E_SUCCESS) {
515 | 				debug("%s\n", irecv_strerror(error));
516 | 				break;
517 | 			}
518 | 
519 | 			error = irecv_reboot(client);
520 | 			if (error != IRECV_E_SUCCESS) {
521 | 				debug("%s\n", irecv_strerror(error));
522 | 			} else {
523 | 				debug("%s\n", irecv_strerror(error));
524 | 			}
525 | 			break;
526 | 		default:
527 | 			fprintf(stderr, "Unknown action\n");
528 | 			break;
529 | 	}
530 | 
531 | 	irecv_close(client);
532 | 
533 | 	return 0;
534 | }
535 | 


--------------------------------------------------------------------------------
/LICENCE:
--------------------------------------------------------------------------------
  1 |                   GNU LESSER GENERAL PUBLIC LICENSE
  2 |                        Version 2.1, February 1999
  3 | 
  4 |  Copyright (C) 1991, 1999 Free Software Foundation, Inc.
  5 |  51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  6 |  Everyone is permitted to copy and distribute verbatim copies
  7 |  of this license document, but changing it is not allowed.
  8 | 
  9 | [This is the first released version of the Lesser GPL.  It also counts
 10 |  as the successor of the GNU Library Public License, version 2, hence
 11 |  the version number 2.1.]
 12 | 
 13 |                             Preamble
 14 | 
 15 |   The licenses for most software are designed to take away your
 16 | freedom to share and change it.  By contrast, the GNU General Public
 17 | Licenses are intended to guarantee your freedom to share and change
 18 | free software--to make sure the software is free for all its users.
 19 | 
 20 |   This license, the Lesser General Public License, applies to some
 21 | specially designated software packages--typically libraries--of the
 22 | Free Software Foundation and other authors who decide to use it.  You
 23 | can use it too, but we suggest you first think carefully about whether
 24 | this license or the ordinary General Public License is the better
 25 | strategy to use in any particular case, based on the explanations below.
 26 | 
 27 |   When we speak of free software, we are referring to freedom of use,
 28 | not price.  Our General Public Licenses are designed to make sure that
 29 | you have the freedom to distribute copies of free software (and charge
 30 | for this service if you wish); that you receive source code or can get
 31 | it if you want it; that you can change the software and use pieces of
 32 | it in new free programs; and that you are informed that you can do
 33 | these things.
 34 | 
 35 |   To protect your rights, we need to make restrictions that forbid
 36 | distributors to deny you these rights or to ask you to surrender these
 37 | rights.  These restrictions translate to certain responsibilities for
 38 | you if you distribute copies of the library or if you modify it.
 39 | 
 40 |   For example, if you distribute copies of the library, whether gratis
 41 | or for a fee, you must give the recipients all the rights that we gave
 42 | you.  You must make sure that they, too, receive or can get the source
 43 | code.  If you link other code with the library, you must provide
 44 | complete object files to the recipients, so that they can relink them
 45 | with the library after making changes to the library and recompiling
 46 | it.  And you must show them these terms so they know their rights.
 47 | 
 48 |   We protect your rights with a two-step method: (1) we copyright the
 49 | library, and (2) we offer you this license, which gives you legal
 50 | permission to copy, distribute and/or modify the library.
 51 | 
 52 |   To protect each distributor, we want to make it very clear that
 53 | there is no warranty for the free library.  Also, if the library is
 54 | modified by someone else and passed on, the recipients should know
 55 | that what they have is not the original version, so that the original
 56 | author's reputation will not be affected by problems that might be
 57 | introduced by others.
 58 | 
 59 |   Finally, software patents pose a constant threat to the existence of
 60 | any free program.  We wish to make sure that a company cannot
 61 | effectively restrict the users of a free program by obtaining a
 62 | restrictive license from a patent holder.  Therefore, we insist that
 63 | any patent license obtained for a version of the library must be
 64 | consistent with the full freedom of use specified in this license.
 65 | 
 66 |   Most GNU software, including some libraries, is covered by the
 67 | ordinary GNU General Public License.  This license, the GNU Lesser
 68 | General Public License, applies to certain designated libraries, and
 69 | is quite different from the ordinary General Public License.  We use
 70 | this license for certain libraries in order to permit linking those
 71 | libraries into non-free programs.
 72 | 
 73 |   When a program is linked with a library, whether statically or using
 74 | a shared library, the combination of the two is legally speaking a
 75 | combined work, a derivative of the original library.  The ordinary
 76 | General Public License therefore permits such linking only if the
 77 | entire combination fits its criteria of freedom.  The Lesser General
 78 | Public License permits more lax criteria for linking other code with
 79 | the library.
 80 | 
 81 |   We call this license the "Lesser" General Public License because it
 82 | does Less to protect the user's freedom than the ordinary General
 83 | Public License.  It also provides other free software developers Less
 84 | of an advantage over competing non-free programs.  These disadvantages
 85 | are the reason we use the ordinary General Public License for many
 86 | libraries.  However, the Lesser license provides advantages in certain
 87 | special circumstances.
 88 | 
 89 |   For example, on rare occasions, there may be a special need to
 90 | encourage the widest possible use of a certain library, so that it becomes
 91 | a de-facto standard.  To achieve this, non-free programs must be
 92 | allowed to use the library.  A more frequent case is that a free
 93 | library does the same job as widely used non-free libraries.  In this
 94 | case, there is little to gain by limiting the free library to free
 95 | software only, so we use the Lesser General Public License.
 96 | 
 97 |   In other cases, permission to use a particular library in non-free
 98 | programs enables a greater number of people to use a large body of
 99 | free software.  For example, permission to use the GNU C Library in
100 | non-free programs enables many more people to use the whole GNU
101 | operating system, as well as its variant, the GNU/Linux operating
102 | system.
103 | 
104 |   Although the Lesser General Public License is Less protective of the
105 | users' freedom, it does ensure that the user of a program that is
106 | linked with the Library has the freedom and the wherewithal to run
107 | that program using a modified version of the Library.
108 | 
109 |   The precise terms and conditions for copying, distribution and
110 | modification follow.  Pay close attention to the difference between a
111 | "work based on the library" and a "work that uses the library".  The
112 | former contains code derived from the library, whereas the latter must
113 | be combined with the library in order to run.
114 | 
115 |                   GNU LESSER GENERAL PUBLIC LICENSE
116 |    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
117 | 
118 |   0. This License Agreement applies to any software library or other
119 | program which contains a notice placed by the copyright holder or
120 | other authorized party saying it may be distributed under the terms of
121 | this Lesser General Public License (also called "this License").
122 | Each licensee is addressed as "you".
123 | 
124 |   A "library" means a collection of software functions and/or data
125 | prepared so as to be conveniently linked with application programs
126 | (which use some of those functions and data) to form executables.
127 | 
128 |   The "Library", below, refers to any such software library or work
129 | which has been distributed under these terms.  A "work based on the
130 | Library" means either the Library or any derivative work under
131 | copyright law: that is to say, a work containing the Library or a
132 | portion of it, either verbatim or with modifications and/or translated
133 | straightforwardly into another language.  (Hereinafter, translation is
134 | included without limitation in the term "modification".)
135 | 
136 |   "Source code" for a work means the preferred form of the work for
137 | making modifications to it.  For a library, complete source code means
138 | all the source code for all modules it contains, plus any associated
139 | interface definition files, plus the scripts used to control compilation
140 | and installation of the library.
141 | 
142 |   Activities other than copying, distribution and modification are not
143 | covered by this License; they are outside its scope.  The act of
144 | running a program using the Library is not restricted, and output from
145 | such a program is covered only if its contents constitute a work based
146 | on the Library (independent of the use of the Library in a tool for
147 | writing it).  Whether that is true depends on what the Library does
148 | and what the program that uses the Library does.
149 | 
150 |   1. You may copy and distribute verbatim copies of the Library's
151 | complete source code as you receive it, in any medium, provided that
152 | you conspicuously and appropriately publish on each copy an
153 | appropriate copyright notice and disclaimer of warranty; keep intact
154 | all the notices that refer to this License and to the absence of any
155 | warranty; and distribute a copy of this License along with the
156 | Library.
157 | 
158 |   You may charge a fee for the physical act of transferring a copy,
159 | and you may at your option offer warranty protection in exchange for a
160 | fee.
161 | 
162 |   2. You may modify your copy or copies of the Library or any portion
163 | of it, thus forming a work based on the Library, and copy and
164 | distribute such modifications or work under the terms of Section 1
165 | above, provided that you also meet all of these conditions:
166 | 
167 |     a) The modified work must itself be a software library.
168 | 
169 |     b) You must cause the files modified to carry prominent notices
170 |     stating that you changed the files and the date of any change.
171 | 
172 |     c) You must cause the whole of the work to be licensed at no
173 |     charge to all third parties under the terms of this License.
174 | 
175 |     d) If a facility in the modified Library refers to a function or a
176 |     table of data to be supplied by an application program that uses
177 |     the facility, other than as an argument passed when the facility
178 |     is invoked, then you must make a good faith effort to ensure that,
179 |     in the event an application does not supply such function or
180 |     table, the facility still operates, and performs whatever part of
181 |     its purpose remains meaningful.
182 | 
183 |     (For example, a function in a library to compute square roots has
184 |     a purpose that is entirely well-defined independent of the
185 |     application.  Therefore, Subsection 2d requires that any
186 |     application-supplied function or table used by this function must
187 |     be optional: if the application does not supply it, the square
188 |     root function must still compute square roots.)
189 | 
190 | These requirements apply to the modified work as a whole.  If
191 | identifiable sections of that work are not derived from the Library,
192 | and can be reasonably considered independent and separate works in
193 | themselves, then this License, and its terms, do not apply to those
194 | sections when you distribute them as separate works.  But when you
195 | distribute the same sections as part of a whole which is a work based
196 | on the Library, the distribution of the whole must be on the terms of
197 | this License, whose permissions for other licensees extend to the
198 | entire whole, and thus to each and every part regardless of who wrote
199 | it.
200 | 
201 | Thus, it is not the intent of this section to claim rights or contest
202 | your rights to work written entirely by you; rather, the intent is to
203 | exercise the right to control the distribution of derivative or
204 | collective works based on the Library.
205 | 
206 | In addition, mere aggregation of another work not based on the Library
207 | with the Library (or with a work based on the Library) on a volume of
208 | a storage or distribution medium does not bring the other work under
209 | the scope of this License.
210 | 
211 |   3. You may opt to apply the terms of the ordinary GNU General Public
212 | License instead of this License to a given copy of the Library.  To do
213 | this, you must alter all the notices that refer to this License, so
214 | that they refer to the ordinary GNU General Public License, version 2,
215 | instead of to this License.  (If a newer version than version 2 of the
216 | ordinary GNU General Public License has appeared, then you can specify
217 | that version instead if you wish.)  Do not make any other change in
218 | these notices.
219 | 
220 |   Once this change is made in a given copy, it is irreversible for
221 | that copy, so the ordinary GNU General Public License applies to all
222 | subsequent copies and derivative works made from that copy.
223 | 
224 |   This option is useful when you wish to copy part of the code of
225 | the Library into a program that is not a library.
226 | 
227 |   4. You may copy and distribute the Library (or a portion or
228 | derivative of it, under Section 2) in object code or executable form
229 | under the terms of Sections 1 and 2 above provided that you accompany
230 | it with the complete corresponding machine-readable source code, which
231 | must be distributed under the terms of Sections 1 and 2 above on a
232 | medium customarily used for software interchange.
233 | 
234 |   If distribution of object code is made by offering access to copy
235 | from a designated place, then offering equivalent access to copy the
236 | source code from the same place satisfies the requirement to
237 | distribute the source code, even though third parties are not
238 | compelled to copy the source along with the object code.
239 | 
240 |   5. A program that contains no derivative of any portion of the
241 | Library, but is designed to work with the Library by being compiled or
242 | linked with it, is called a "work that uses the Library".  Such a
243 | work, in isolation, is not a derivative work of the Library, and
244 | therefore falls outside the scope of this License.
245 | 
246 |   However, linking a "work that uses the Library" with the Library
247 | creates an executable that is a derivative of the Library (because it
248 | contains portions of the Library), rather than a "work that uses the
249 | library".  The executable is therefore covered by this License.
250 | Section 6 states terms for distribution of such executables.
251 | 
252 |   When a "work that uses the Library" uses material from a header file
253 | that is part of the Library, the object code for the work may be a
254 | derivative work of the Library even though the source code is not.
255 | Whether this is true is especially significant if the work can be
256 | linked without the Library, or if the work is itself a library.  The
257 | threshold for this to be true is not precisely defined by law.
258 | 
259 |   If such an object file uses only numerical parameters, data
260 | structure layouts and accessors, and small macros and small inline
261 | functions (ten lines or less in length), then the use of the object
262 | file is unrestricted, regardless of whether it is legally a derivative
263 | work.  (Executables containing this object code plus portions of the
264 | Library will still fall under Section 6.)
265 | 
266 |   Otherwise, if the work is a derivative of the Library, you may
267 | distribute the object code for the work under the terms of Section 6.
268 | Any executables containing that work also fall under Section 6,
269 | whether or not they are linked directly with the Library itself.
270 | 
271 |   6. As an exception to the Sections above, you may also combine or
272 | link a "work that uses the Library" with the Library to produce a
273 | work containing portions of the Library, and distribute that work
274 | under terms of your choice, provided that the terms permit
275 | modification of the work for the customer's own use and reverse
276 | engineering for debugging such modifications.
277 | 
278 |   You must give prominent notice with each copy of the work that the
279 | Library is used in it and that the Library and its use are covered by
280 | this License.  You must supply a copy of this License.  If the work
281 | during execution displays copyright notices, you must include the
282 | copyright notice for the Library among them, as well as a reference
283 | directing the user to the copy of this License.  Also, you must do one
284 | of these things:
285 | 
286 |     a) Accompany the work with the complete corresponding
287 |     machine-readable source code for the Library including whatever
288 |     changes were used in the work (which must be distributed under
289 |     Sections 1 and 2 above); and, if the work is an executable linked
290 |     with the Library, with the complete machine-readable "work that
291 |     uses the Library", as object code and/or source code, so that the
292 |     user can modify the Library and then relink to produce a modified
293 |     executable containing the modified Library.  (It is understood
294 |     that the user who changes the contents of definitions files in the
295 |     Library will not necessarily be able to recompile the application
296 |     to use the modified definitions.)
297 | 
298 |     b) Use a suitable shared library mechanism for linking with the
299 |     Library.  A suitable mechanism is one that (1) uses at run time a
300 |     copy of the library already present on the user's computer system,
301 |     rather than copying library functions into the executable, and (2)
302 |     will operate properly with a modified version of the library, if
303 |     the user installs one, as long as the modified version is
304 |     interface-compatible with the version that the work was made with.
305 | 
306 |     c) Accompany the work with a written offer, valid for at
307 |     least three years, to give the same user the materials
308 |     specified in Subsection 6a, above, for a charge no more
309 |     than the cost of performing this distribution.
310 | 
311 |     d) If distribution of the work is made by offering access to copy
312 |     from a designated place, offer equivalent access to copy the above
313 |     specified materials from the same place.
314 | 
315 |     e) Verify that the user has already received a copy of these
316 |     materials or that you have already sent this user a copy.
317 | 
318 |   For an executable, the required form of the "work that uses the
319 | Library" must include any data and utility programs needed for
320 | reproducing the executable from it.  However, as a special exception,
321 | the materials to be distributed need not include anything that is
322 | normally distributed (in either source or binary form) with the major
323 | components (compiler, kernel, and so on) of the operating system on
324 | which the executable runs, unless that component itself accompanies
325 | the executable.
326 | 
327 |   It may happen that this requirement contradicts the license
328 | restrictions of other proprietary libraries that do not normally
329 | accompany the operating system.  Such a contradiction means you cannot
330 | use both them and the Library together in an executable that you
331 | distribute.
332 | 
333 |   7. You may place library facilities that are a work based on the
334 | Library side-by-side in a single library together with other library
335 | facilities not covered by this License, and distribute such a combined
336 | library, provided that the separate distribution of the work based on
337 | the Library and of the other library facilities is otherwise
338 | permitted, and provided that you do these two things:
339 | 
340 |     a) Accompany the combined library with a copy of the same work
341 |     based on the Library, uncombined with any other library
342 |     facilities.  This must be distributed under the terms of the
343 |     Sections above.
344 | 
345 |     b) Give prominent notice with the combined library of the fact
346 |     that part of it is a work based on the Library, and explaining
347 |     where to find the accompanying uncombined form of the same work.
348 | 
349 |   8. You may not copy, modify, sublicense, link with, or distribute
350 | the Library except as expressly provided under this License.  Any
351 | attempt otherwise to copy, modify, sublicense, link with, or
352 | distribute the Library is void, and will automatically terminate your
353 | rights under this License.  However, parties who have received copies,
354 | or rights, from you under this License will not have their licenses
355 | terminated so long as such parties remain in full compliance.
356 | 
357 |   9. You are not required to accept this License, since you have not
358 | signed it.  However, nothing else grants you permission to modify or
359 | distribute the Library or its derivative works.  These actions are
360 | prohibited by law if you do not accept this License.  Therefore, by
361 | modifying or distributing the Library (or any work based on the
362 | Library), you indicate your acceptance of this License to do so, and
363 | all its terms and conditions for copying, distributing or modifying
364 | the Library or works based on it.
365 | 
366 |   10. Each time you redistribute the Library (or any work based on the
367 | Library), the recipient automatically receives a license from the
368 | original licensor to copy, distribute, link with or modify the Library
369 | subject to these terms and conditions.  You may not impose any further
370 | restrictions on the recipients' exercise of the rights granted herein.
371 | You are not responsible for enforcing compliance by third parties with
372 | this License.
373 | 
374 |   11. If, as a consequence of a court judgment or allegation of patent
375 | infringement or for any other reason (not limited to patent issues),
376 | conditions are imposed on you (whether by court order, agreement or
377 | otherwise) that contradict the conditions of this License, they do not
378 | excuse you from the conditions of this License.  If you cannot
379 | distribute so as to satisfy simultaneously your obligations under this
380 | License and any other pertinent obligations, then as a consequence you
381 | may not distribute the Library at all.  For example, if a patent
382 | license would not permit royalty-free redistribution of the Library by
383 | all those who receive copies directly or indirectly through you, then
384 | the only way you could satisfy both it and this License would be to
385 | refrain entirely from distribution of the Library.
386 | 
387 | If any portion of this section is held invalid or unenforceable under any
388 | particular circumstance, the balance of the section is intended to apply,
389 | and the section as a whole is intended to apply in other circumstances.
390 | 
391 | It is not the purpose of this section to induce you to infringe any
392 | patents or other property right claims or to contest validity of any
393 | such claims; this section has the sole purpose of protecting the
394 | integrity of the free software distribution system which is
395 | implemented by public license practices.  Many people have made
396 | generous contributions to the wide range of software distributed
397 | through that system in reliance on consistent application of that
398 | system; it is up to the author/donor to decide if he or she is willing
399 | to distribute software through any other system and a licensee cannot
400 | impose that choice.
401 | 
402 | This section is intended to make thoroughly clear what is believed to
403 | be a consequence of the rest of this License.
404 | 
405 |   12. If the distribution and/or use of the Library is restricted in
406 | certain countries either by patents or by copyrighted interfaces, the
407 | original copyright holder who places the Library under this License may add
408 | an explicit geographical distribution limitation excluding those countries,
409 | so that distribution is permitted only in or among countries not thus
410 | excluded.  In such case, this License incorporates the limitation as if
411 | written in the body of this License.
412 | 
413 |   13. The Free Software Foundation may publish revised and/or new
414 | versions of the Lesser General Public License from time to time.
415 | Such new versions will be similar in spirit to the present version,
416 | but may differ in detail to address new problems or concerns.
417 | 
418 | Each version is given a distinguishing version number.  If the Library
419 | specifies a version number of this License which applies to it and
420 | "any later version", you have the option of following the terms and
421 | conditions either of that version or of any later version published by
422 | the Free Software Foundation.  If the Library does not specify a
423 | license version number, you may choose any version ever published by
424 | the Free Software Foundation.
425 | 
426 |   14. If you wish to incorporate parts of the Library into other free
427 | programs whose distribution conditions are incompatible with these,
428 | write to the author to ask for permission.  For software which is
429 | copyrighted by the Free Software Foundation, write to the Free
430 | Software Foundation; we sometimes make exceptions for this.  Our
431 | decision will be guided by the two goals of preserving the free status
432 | of all derivatives of our free software and of promoting the sharing
433 | and reuse of software generally.
434 | 
435 |                             NO WARRANTY
436 | 
437 |   15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
438 | WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
439 | EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
440 | OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
441 | KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
442 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
443 | PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
444 | LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
445 | THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
446 | 
447 |   16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
448 | WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
449 | AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
450 | FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
451 | CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
452 | LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
453 | RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
454 | FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
455 | SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
456 | DAMAGES.
457 | 
458 |                      END OF TERMS AND CONDITIONS
459 | 
460 |            How to Apply These Terms to Your New Libraries
461 | 
462 |   If you develop a new library, and you want it to be of the greatest
463 | possible use to the public, we recommend making it free software that
464 | everyone can redistribute and change.  You can do so by permitting
465 | redistribution under these terms (or, alternatively, under the terms of the
466 | ordinary General Public License).
467 | 
468 |   To apply these terms, attach the following notices to the library.  It is
469 | safest to attach them to the start of each source file to most effectively
470 | convey the exclusion of warranty; and each file should have at least the
471 | "copyright" line and a pointer to where the full notice is found.
472 | 
473 |     <one line to give the library's name and a brief idea of what it does.>
474 |     Copyright (C) <year>  <name of author>
475 | 
476 |     This library is free software; you can redistribute it and/or
477 |     modify it under the terms of the GNU Lesser General Public
478 |     License as published by the Free Software Foundation; either
479 |     version 2.1 of the License, or (at your option) any later version.
480 | 
481 |     This library is distributed in the hope that it will be useful,
482 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
483 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
484 |     Lesser General Public License for more details.
485 | 
486 |     You should have received a copy of the GNU Lesser General Public
487 |     License along with this library; if not, write to the Free Software
488 |     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
489 | 
490 | Also add information on how to contact you by electronic and paper mail.
491 | 
492 | You should also get your employer (if you work as a programmer) or your
493 | school, if any, to sign a "copyright disclaimer" for the library, if
494 | necessary.  Here is a sample; alter the names:
495 | 
496 |   Yoyodyne, Inc., hereby disclaims all copyright interest in the
497 |   library `Frob' (a library for tweaking knobs) written by James Random Hacker.
498 | 
499 |   <signature of Ty Coon>, 1 April 1990
500 |   Ty Coon, President of Vice
501 | 
502 | That's all there is to it!


--------------------------------------------------------------------------------
/src/libirecovery.c:
--------------------------------------------------------------------------------
   1 | /*
   2 |  * libirecovery.c
   3 |  * Communication to iBoot/iBSS on Apple iOS devices via USB
   4 |  *
   5 |  * Copyright (c) 2012-2013 Martin Szulecki <m.szulecki@libimobiledevice.org>
   6 |  * Copyright (c) 2010 Chronic-Dev Team
   7 |  * Copyright (c) 2010 Joshua Hill
   8 |  * Copyright (c) 2008-2011 Nicolas Haunold
   9 |  *
  10 |  * All rights reserved. This program and the accompanying materials
  11 |  * are made available under the terms of the GNU Lesser General Public License
  12 |  * (LGPL) version 2.1 which accompanies this distribution, and is available at
  13 |  * http://www.gnu.org/licenses/lgpl-2.1.html
  14 |  *
  15 |  * This library is distributed in the hope that it will be useful,
  16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18 |  * Lesser General Public License for more details.
  19 |  */
  20 | 
  21 | #include <stdio.h>
  22 | #include <stdint.h>
  23 | #include <stdlib.h>
  24 | #include <string.h>
  25 | #include <ctype.h>
  26 | #include <unistd.h>
  27 | 
  28 | #ifndef WIN32
  29 | #include <libusb-1.0/libusb.h>
  30 | #define _FMT_qX "%qX"
  31 | #define _FMT_016llx "%016llx"
  32 | #else
  33 | #define WIN32_LEAN_AND_MEAN
  34 | #include <windows.h>
  35 | #undef interface
  36 | #include <setupapi.h>
  37 | #define _FMT_qX "%I64X"
  38 | #define _FMT_016llx "%016I64x"
  39 | #ifndef sleep
  40 | #define sleep(n) Sleep(1000 * n)
  41 | #endif
  42 | #endif
  43 | 
  44 | #include "libirecovery.h"
  45 | 
  46 | struct irecv_client_private {
  47 | 	int debug;
  48 | 	int config;
  49 | 	int interface;
  50 | 	int alt_interface;
  51 | 	unsigned int mode;
  52 | 	char serial[256];
  53 | #ifndef WIN32
  54 | 	libusb_device_handle* handle;
  55 | #else
  56 | 	HANDLE handle;
  57 | 	HANDLE hDFU;
  58 | 	HANDLE hIB;
  59 | 	LPSTR iBootPath;
  60 | 	LPSTR DfuPath;
  61 | #endif
  62 | 	irecv_event_cb_t progress_callback;
  63 | 	irecv_event_cb_t received_callback;
  64 | 	irecv_event_cb_t connected_callback;
  65 | 	irecv_event_cb_t precommand_callback;
  66 | 	irecv_event_cb_t postcommand_callback;
  67 | 	irecv_event_cb_t disconnected_callback;
  68 | };
  69 | 
  70 | #define USB_TIMEOUT 10000
  71 | #define APPLE_VENDOR_ID 0x05AC
  72 | 
  73 | #define BUFFER_SIZE 0x1000
  74 | #define debug(...) if(libirecovery_debug) fprintf(stderr, __VA_ARGS__)
  75 | 
  76 | static int libirecovery_debug = 0;
  77 | #ifndef WIN32
  78 | static libusb_context* libirecovery_context = NULL;
  79 | #endif
  80 | 
  81 | static struct irecv_device irecv_devices[] = {
  82 | 	{"iPhone1,1",  "m68ap", 0x00, 0x8900 },
  83 | 	{"iPhone1,2",  "n82ap", 0x04, 0x8900 },
  84 | 	{"iPhone2,1",  "n88ap", 0x00, 0x8920 },
  85 | 	{"iPhone3,1",  "n90ap", 0x00, 0x8930 },
  86 | 	{"iPhone3,2", "n90bap", 0x04, 0x8930 },
  87 | 	{"iPhone3,3",  "n92ap", 0x06, 0x8930 },
  88 | 	{"iPhone4,1",  "n94ap", 0x08, 0x8940 },
  89 | 	{"iPhone5,1",  "n41ap", 0x00, 0x8950 },
  90 | 	{"iPhone5,2",  "n42ap", 0x02, 0x8950 },
  91 | 	{"iPhone5,3",  "n48ap", 0x0a, 0x8950 },
  92 | 	{"iPhone5,4",  "n49ap", 0x0e, 0x8950 },
  93 | 	{"iPhone6,1",  "n51ap", 0x00, 0x8960 },
  94 | 	{"iPhone6,2",  "n53ap", 0x02, 0x8960 },
  95 | 	{"iPod1,1",    "n45ap", 0x02, 0x8900 },
  96 | 	{"iPod2,1",    "n72ap", 0x00, 0x8720 },
  97 | 	{"iPod3,1",    "n18ap", 0x02, 0x8922 },
  98 | 	{"iPod4,1",    "n81ap", 0x08, 0x8930 },
  99 | 	{"iPod5,1",    "n78ap", 0x00, 0x8942 },
 100 | 	{"iPad1,1",    "k48ap", 0x02, 0x8930 },
 101 | 	{"iPad2,1",    "k93ap", 0x04, 0x8940 },
 102 | 	{"iPad2,2",    "k94ap", 0x06, 0x8940 },
 103 | 	{"iPad2,3",    "k95ap", 0x02, 0x8940 },
 104 | 	{"iPad2,4",   "k93aap", 0x06, 0x8942 },
 105 | 	{"iPad2,5",   "p105ap", 0x0a, 0x8942 },
 106 | 	{"iPad2,6",   "p106ap", 0x0c, 0x8942 },
 107 | 	{"iPad2,7",   "p107ap", 0x0e, 0x8942 },
 108 | 	{"iPad3,1",     "j1ap", 0x00, 0x8945 },
 109 | 	{"iPad3,2",     "j2ap", 0x02, 0x8945 },
 110 | 	{"iPad3,3",    "j2aap", 0x04, 0x8945 },
 111 | 	{"iPad3,4",   "p101ap", 0x00, 0x8955 },
 112 | 	{"iPad3,5",   "p102ap", 0x02, 0x8955 },
 113 | 	{"iPad3,6",   "p103ap", 0x04, 0x8955 },
 114 | 	{"iPad4,1",    "j71ap", 0x10, 0x8960 },
 115 | 	{"iPad4,2",    "j72ap", 0x12, 0x8960 },
 116 | 	{"iPad4,4",    "j85ap", 0x0a, 0x8960 },
 117 | 	{"iPad4,5",    "j86ap", 0x0c, 0x8960 },
 118 | 	{"AppleTV2,1", "k66ap", 0x10, 0x8930 },
 119 | 	{"AppleTV3,1", "j33ap", 0x08, 0x8942 },
 120 | 	{"AppleTV3,2","j33iap", 0x00, 0x8947 },
 121 | 	{        NULL,    NULL,   -1,     -1 }
 122 | };
 123 | 
 124 | static unsigned int dfu_hash_t1[256] = {
 125 | 	0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
 126 | 	0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
 127 | 	0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
 128 | 	0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
 129 | 	0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
 130 | 	0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
 131 | 	0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
 132 | 	0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
 133 | 	0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
 134 | 	0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
 135 | 	0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
 136 | 	0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
 137 | 	0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
 138 | 	0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
 139 | 	0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
 140 | 	0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
 141 | 	0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
 142 | 	0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
 143 | 	0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
 144 | 	0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
 145 | 	0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
 146 | 	0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
 147 | 	0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
 148 | 	0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
 149 | 	0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
 150 | 	0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
 151 | 	0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
 152 | 	0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
 153 | 	0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
 154 | 	0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
 155 | 	0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
 156 | 	0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
 157 | 	0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
 158 | 	0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
 159 | 	0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
 160 | 	0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
 161 | 	0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
 162 | 	0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
 163 | 	0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
 164 | 	0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
 165 | 	0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
 166 | 	0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
 167 | 	0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
 168 | 	0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
 169 | 	0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
 170 | 	0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
 171 | 	0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
 172 | 	0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
 173 | 	0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
 174 | 	0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
 175 | 	0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
 176 | 	0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
 177 | 	0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
 178 | 	0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
 179 | 	0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
 180 | 	0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
 181 | 	0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
 182 | 	0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
 183 | 	0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
 184 | 	0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
 185 | 	0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
 186 | 	0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
 187 | 	0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
 188 | 	0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D,
 189 | };
 190 | 
 191 | #define dfu_hash_step(a,b) \
 192 | 	a = (dfu_hash_t1[(a & 0xFF) ^ ((unsigned char)b)] ^ (a >> 8))
 193 | 
 194 | #ifdef WIN32
 195 | static const GUID GUID_DEVINTERFACE_IBOOT = {0xED82A167L, 0xD61A, 0x4AF6, {0x9A, 0xB6, 0x11, 0xE5, 0x22, 0x36, 0xC5, 0x76}};
 196 | static const GUID GUID_DEVINTERFACE_DFU = {0xB8085869L, 0xFEB9, 0x404B, {0x8C, 0xB1, 0x1E, 0x5C, 0x14, 0xFA, 0x8C, 0x54}};
 197 | 
 198 | typedef struct usb_control_request {
 199 | 	uint8_t bmRequestType;
 200 | 	uint8_t bRequest;
 201 | 	uint16_t wValue;
 202 | 	uint16_t wIndex;
 203 | 	uint16_t wLength;
 204 | 
 205 | 	char data[];
 206 | } usb_control_request;
 207 | 
 208 | static int irecv_get_string_descriptor_ascii(irecv_client_t client, uint8_t desc_index, unsigned char * buffer, int size);
 209 | 
 210 | irecv_error_t mobiledevice_openpipes(irecv_client_t client);
 211 | void mobiledevice_closepipes(irecv_client_t client);
 212 | 
 213 | irecv_error_t mobiledevice_connect(irecv_client_t* client, unsigned long long ecid) {
 214 | 	int found = 0;
 215 | 	SP_DEVICE_INTERFACE_DATA currentInterface;
 216 | 	HDEVINFO usbDevices;
 217 | 	DWORD i;
 218 | 	irecv_client_t _client = (irecv_client_t) malloc(sizeof(struct irecv_client_private));
 219 | 	memset(_client, 0, sizeof(struct irecv_client_private));
 220 | 
 221 | 	/* get DFU paths */
 222 | 	usbDevices = SetupDiGetClassDevs(&GUID_DEVINTERFACE_DFU, NULL, NULL, DIGCF_PRESENT | DIGCF_DEVICEINTERFACE);
 223 | 	memset(&currentInterface, '\0', sizeof(SP_DEVICE_INTERFACE_DATA));
 224 | 	currentInterface.cbSize = sizeof(SP_DEVICE_INTERFACE_DATA);
 225 | 	for(i = 0; usbDevices && SetupDiEnumDeviceInterfaces(usbDevices, NULL, &GUID_DEVINTERFACE_DFU, i, &currentInterface); i++) {
 226 | 		if (_client->DfuPath) {
 227 | 			free(_client->DfuPath);
 228 | 			_client->DfuPath = NULL;
 229 | 		}
 230 | 		_client->handle = NULL;
 231 | 		DWORD requiredSize = 0;
 232 | 		PSP_DEVICE_INTERFACE_DETAIL_DATA details;
 233 | 		SetupDiGetDeviceInterfaceDetail(usbDevices, &currentInterface, NULL, 0, &requiredSize, NULL);
 234 | 		details = (PSP_DEVICE_INTERFACE_DETAIL_DATA) malloc(requiredSize);
 235 | 		details->cbSize = sizeof(SP_DEVICE_INTERFACE_DETAIL_DATA);
 236 | 		if(!SetupDiGetDeviceInterfaceDetail(usbDevices, &currentInterface, details, requiredSize, NULL, NULL)) {
 237 | 			free(details);
 238 | 			continue;
 239 | 		} else {
 240 | 			LPSTR result = (LPSTR) malloc(requiredSize - sizeof(DWORD));
 241 | 			memcpy((void*) result, details->DevicePath, requiredSize - sizeof(DWORD));
 242 | 			free(details);
 243 | 
 244 | 			_client->DfuPath = result;
 245 | 			if (mobiledevice_openpipes(_client) != IRECV_E_SUCCESS) {
 246 | 				mobiledevice_closepipes(_client);
 247 | 				continue;
 248 | 			}
 249 | 
 250 | 			if (ecid == IRECV_K_WTF_MODE) {
 251 | 				if (_client->mode != IRECV_K_WTF_MODE) {
 252 | 					/* special ecid case, ignore !IRECV_K_WTF_MODE */
 253 | 					continue;
 254 | 				} else {
 255 | 					ecid = 0;
 256 | 				}
 257 | 			}
 258 | 
 259 | 			if ((ecid != 0) && (_client->mode == IRECV_K_WTF_MODE)) {
 260 | 				/* we can't get ecid in WTF mode */
 261 | 				mobiledevice_closepipes(_client);
 262 | 				continue;
 263 | 			}
 264 | 
 265 | 			_client->serial[0] = '\0';
 266 | 			if ((sscanf(result, "\\\\?\\usb#vid_%*04x&pid_%*04x#%s#", _client->serial) != 1) || (_client->serial[0] == '\0')) {
 267 | 				mobiledevice_closepipes(_client);
 268 | 				continue;
 269 | 			}
 270 | 
 271 | 			char* p = strchr(_client->serial, '#');
 272 | 			if (p) {
 273 | 				*p = '\0';
 274 | 			}
 275 | 
 276 | 			int j;
 277 | 			for (j = 0; j < strlen(_client->serial); j++) {
 278 | 				if (_client->serial[j] == '_') {
 279 | 					_client->serial[j] = ' ';
 280 | 				} else {
 281 | 					_client->serial[j] = toupper(_client->serial[j]);	
 282 | 				}
 283 | 			}
 284 | 
 285 | 			if (ecid != 0) {
 286 | 				char* ecid_string = strstr(_client->serial, "ECID:");
 287 | 				if (ecid_string == NULL) {
 288 | 					debug("%s: could not get ECID for device\n", __func__);
 289 | 					mobiledevice_closepipes(_client);
 290 | 					continue;
 291 | 				}
 292 | 
 293 | 				unsigned long long this_ecid = 0;
 294 | 				sscanf(ecid_string, "ECID:" _FMT_qX, (unsigned long long*)&this_ecid);
 295 | 				if (this_ecid != ecid) {
 296 | 					mobiledevice_closepipes(_client);
 297 | 					continue;
 298 | 				}
 299 | 				debug("found device with ECID " _FMT_016llx "\n", (unsigned long long)ecid);
 300 | 			}
 301 | 			found = 1;
 302 | 			break;
 303 | 		}
 304 | 	}
 305 | 	SetupDiDestroyDeviceInfoList(usbDevices);
 306 | 
 307 | 	if (found) {
 308 | 		*client = _client;
 309 | 		return IRECV_E_SUCCESS;
 310 | 	}
 311 | 
 312 | 	/* get iBoot path */
 313 | 	usbDevices = SetupDiGetClassDevs(&GUID_DEVINTERFACE_IBOOT, NULL, NULL, DIGCF_PRESENT | DIGCF_DEVICEINTERFACE);
 314 | 	memset(&currentInterface, '\0', sizeof(SP_DEVICE_INTERFACE_DATA));
 315 | 	currentInterface.cbSize = sizeof(SP_DEVICE_INTERFACE_DATA);
 316 | 	for(i = 0; usbDevices && SetupDiEnumDeviceInterfaces(usbDevices, NULL, &GUID_DEVINTERFACE_IBOOT, i, &currentInterface); i++) {
 317 | 		if (_client->iBootPath) {
 318 | 			free(_client->iBootPath);
 319 | 			_client->iBootPath = NULL;
 320 | 		}
 321 | 		_client->handle = NULL;
 322 | 		DWORD requiredSize = 0;
 323 | 		PSP_DEVICE_INTERFACE_DETAIL_DATA details;
 324 | 		SetupDiGetDeviceInterfaceDetail(usbDevices, &currentInterface, NULL, 0, &requiredSize, NULL);
 325 | 		details = (PSP_DEVICE_INTERFACE_DETAIL_DATA) malloc(requiredSize);
 326 | 		details->cbSize = sizeof(SP_DEVICE_INTERFACE_DETAIL_DATA);
 327 | 		if(!SetupDiGetDeviceInterfaceDetail(usbDevices, &currentInterface, details, requiredSize, NULL, NULL)) {
 328 | 			free(details);
 329 | 			continue;
 330 | 		} else {
 331 | 			LPSTR result = (LPSTR) malloc(requiredSize - sizeof(DWORD));
 332 | 			memcpy((void*) result, details->DevicePath, requiredSize - sizeof(DWORD));
 333 | 			free(details);
 334 | 
 335 | 			_client->iBootPath = result;
 336 | 			if (mobiledevice_openpipes(_client) != IRECV_E_SUCCESS) {
 337 | 				mobiledevice_closepipes(_client);
 338 | 				continue;
 339 | 			}
 340 | 
 341 | 			if ((ecid != 0) && (_client->mode == IRECV_K_WTF_MODE)) {
 342 | 				/* we can't get ecid in WTF mode */
 343 | 				mobiledevice_closepipes(_client);
 344 | 				continue;
 345 | 			}
 346 | 
 347 | 			_client->serial[0] = '\0';
 348 | 			if ((sscanf(result, "\\\\?\\usb#vid_%*04x&pid_%*04x#%s#", _client->serial) != 1) || (_client->serial[0] == '\0')) {
 349 | 				mobiledevice_closepipes(_client);
 350 | 				continue;
 351 | 			}
 352 | 
 353 | 			char* p = strchr(_client->serial, '#');
 354 | 			if (p) {
 355 | 				*p = '\0';
 356 | 			}
 357 | 
 358 | 			int j;
 359 | 			for (j = 0; j < strlen(_client->serial); j++) {
 360 | 				if (_client->serial[j] == '_') {
 361 | 					_client->serial[j] = ' ';
 362 | 				} else {
 363 | 					_client->serial[j] = toupper(_client->serial[j]);	
 364 | 				}
 365 | 			}
 366 | 
 367 | 			if (ecid != 0) {
 368 | 				char* ecid_string = strstr(_client->serial, "ECID:");
 369 | 				if (ecid_string == NULL) {
 370 | 					debug("%s: could not get ECID for device\n", __func__);
 371 | 					mobiledevice_closepipes(_client);
 372 | 					continue;
 373 | 				}
 374 | 
 375 | 				unsigned long long this_ecid = 0;
 376 | 				sscanf(ecid_string, "ECID:" _FMT_qX, (unsigned long long*)&this_ecid);
 377 | 				if (this_ecid != ecid) {
 378 | 					mobiledevice_closepipes(_client);
 379 | 					continue;
 380 | 				}
 381 | 				debug("found device with ECID " _FMT_016llx" \n", (unsigned long long)ecid);
 382 | 			}
 383 | 			found = 1;
 384 | 			break;
 385 | 		}
 386 | 	}
 387 | 	SetupDiDestroyDeviceInfoList(usbDevices);
 388 | 
 389 | 	if (!found) {
 390 | 		irecv_close(_client);
 391 | 		return IRECV_E_UNABLE_TO_CONNECT;
 392 | 	}
 393 | 
 394 | 	*client = _client;
 395 | 
 396 | 	return IRECV_E_SUCCESS;
 397 | }
 398 | 
 399 | irecv_error_t mobiledevice_openpipes(irecv_client_t client) {
 400 | 	if (client->iBootPath && !(client->hIB = CreateFile(client->iBootPath, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL))) {
 401 | 		irecv_close(client);
 402 | 		return IRECV_E_UNABLE_TO_CONNECT;
 403 | 	}
 404 | 
 405 | 	if (client->DfuPath && !(client->hDFU = CreateFile(client->DfuPath, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL))) {
 406 | 		irecv_close(client);
 407 | 		return IRECV_E_UNABLE_TO_CONNECT;
 408 | 	}
 409 | 
 410 | 	client->mode = 0;
 411 | 	if (client->iBootPath == NULL) {
 412 | 		if (strncmp(client->DfuPath, "\\\\?\\usb#vid_05ac&pid_", 21) == 0) {
 413 | 			sscanf(client->DfuPath+21, "%x#", &client->mode);
 414 | 		}
 415 | 		client->handle = client->hDFU;
 416 | 	} else {
 417 | 		if (strncmp(client->iBootPath, "\\\\?\\usb#vid_05ac&pid_", 21) == 0) {
 418 | 			sscanf(client->iBootPath+21, "%x#", &client->mode);
 419 | 		}
 420 | 		client->handle = client->hIB;
 421 | 	}
 422 | 
 423 | 	if (client->mode == 0) {
 424 | 		irecv_close(client);
 425 | 		return IRECV_E_UNABLE_TO_CONNECT;
 426 | 	}
 427 | 
 428 | 	return IRECV_E_SUCCESS;
 429 | }
 430 | 
 431 | void mobiledevice_closepipes(irecv_client_t client) {
 432 | 	if (client->hDFU!=NULL) {
 433 | 		CloseHandle(client->hDFU);
 434 | 		client->hDFU = NULL;
 435 | 	}
 436 | 	if (client->hIB!=NULL) {
 437 | 		CloseHandle(client->hIB);
 438 | 		client->hIB = NULL;
 439 | 	}
 440 | }
 441 | #endif
 442 | 
 443 | static int check_context(irecv_client_t client) {
 444 | 	if (client == NULL || client->handle == NULL) {
 445 | 		return IRECV_E_NO_DEVICE;
 446 | 	}
 447 | 
 448 | 	return IRECV_E_SUCCESS;
 449 | }
 450 | 
 451 | void irecv_init() {
 452 | #ifndef WIN32
 453 | 	libusb_init(&libirecovery_context);
 454 | #endif
 455 | }
 456 | 
 457 | void irecv_exit() {
 458 | #ifndef WIN32
 459 | 	if (libirecovery_context != NULL) {
 460 | 		libusb_exit(libirecovery_context);
 461 | 		libirecovery_context = NULL;
 462 | 	}
 463 | #endif
 464 | }
 465 | 
 466 | #ifdef __APPLE__
 467 | 	void dummy_callback() { }
 468 | #endif
 469 | 
 470 | int irecv_usb_control_transfer(irecv_client_t client, uint8_t bm_request_type, uint8_t b_request, uint16_t w_value, uint16_t w_index, unsigned char *data, uint16_t w_length, unsigned int timeout) {
 471 | #ifndef WIN32
 472 | 	return libusb_control_transfer(client->handle, bm_request_type, b_request, w_value, w_index, data, w_length, timeout);
 473 | #else
 474 | 	DWORD count = 0;
 475 | 	BOOL bRet;
 476 | 	OVERLAPPED overlapped;
 477 | 
 478 | 	if (data == NULL)
 479 | 		w_length = 0;
 480 | 
 481 | 	usb_control_request* packet = (usb_control_request*) malloc(sizeof(usb_control_request) + w_length);
 482 | 	packet->bmRequestType = bm_request_type;
 483 | 	packet->bRequest = b_request;
 484 | 	packet->wValue = w_value;
 485 | 	packet->wIndex = w_index;
 486 | 	packet->wLength = w_length;
 487 | 	
 488 | 	if (bm_request_type < 0x80 && w_length > 0) {
 489 | 		memcpy(packet->data, data, w_length);
 490 | 	}
 491 | 
 492 | 	memset(&overlapped, 0, sizeof(overlapped));
 493 | 	overlapped.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
 494 | 	DeviceIoControl(client->handle, 0x2200A0, packet, sizeof(usb_control_request) + w_length, packet, sizeof(usb_control_request) + w_length, NULL, &overlapped);
 495 | 	WaitForSingleObject(overlapped.hEvent, timeout);
 496 | 	bRet = GetOverlappedResult(client->handle, &overlapped, &count, FALSE);
 497 | 	CloseHandle(overlapped.hEvent);
 498 | 	if (!bRet) {
 499 | 		CancelIo(client->handle);
 500 | 		free(packet);
 501 | 		return -1;
 502 | 	}
 503 | 
 504 | 	count -= sizeof(usb_control_request);
 505 | 	if (count > 0) {
 506 | 		if (bm_request_type >= 0x80) {
 507 | 			memcpy(data, packet->data, count);
 508 | 		}
 509 | 	}
 510 | 	free(packet);
 511 | 
 512 | 	return count;
 513 | #endif
 514 | }
 515 | 
 516 | int irecv_usb_bulk_transfer(irecv_client_t client,
 517 | 							unsigned char endpoint,
 518 | 							unsigned char *data,
 519 | 							int length,
 520 | 							int *transferred,
 521 | 							unsigned int timeout) {
 522 | 	int ret;
 523 | 
 524 | #ifndef WIN32
 525 | 	ret = libusb_bulk_transfer(client->handle, endpoint, data, length, transferred, timeout);
 526 | 	if (ret < 0) {
 527 | 		libusb_clear_halt(client->handle, endpoint);
 528 | 	}
 529 | #else
 530 | 	if (endpoint==0x4) {
 531 | 		ret = DeviceIoControl(client->handle, 0x220195, data, length, data, length, (PDWORD) transferred, NULL);
 532 | 	} else {
 533 | 		ret = 0;
 534 | 	}
 535 | 	ret = (ret==0) ? -1 : 0;
 536 | #endif
 537 | 
 538 | 	return ret;
 539 | }
 540 | 
 541 | static int irecv_get_string_descriptor_ascii(irecv_client_t client, uint8_t desc_index, unsigned char * buffer, int size) {
 542 | #ifndef WIN32
 543 | 	return libusb_get_string_descriptor_ascii(client->handle, desc_index, buffer, size);
 544 | #else
 545 | 	irecv_error_t ret;
 546 | 	unsigned short langid = 0;
 547 | 	unsigned char data[255];
 548 | 	int di, si;
 549 | 	memset(data, 0, sizeof(data));
 550 | 	memset(buffer, 0, size);
 551 | 
 552 | 	ret = irecv_usb_control_transfer(client, 0x80, 0x06, (0x03 << 8) | desc_index, langid, data, sizeof(data), USB_TIMEOUT);
 553 | 
 554 | 	if (ret < 0) return ret;
 555 | 	if (data[1] != 0x03) return IRECV_E_UNKNOWN_ERROR;
 556 | 	if (data[0] > ret) return IRECV_E_UNKNOWN_ERROR; 
 557 | 
 558 | 	for (di = 0, si = 2; si < data[0]; si += 2) {
 559 | 		if (di >= (size - 1)) break;
 560 | 		if (data[si + 1]) {
 561 | 			/* high byte */
 562 | 			buffer[di++] = '?';
 563 | 		} else {
 564 | 			buffer[di++] = data[si];
 565 | 		}
 566 | 	}
 567 | 	buffer[di] = 0;
 568 | 
 569 | 	return di;
 570 | #endif
 571 | }
 572 | 
 573 | irecv_error_t irecv_open_with_ecid(irecv_client_t* pclient, unsigned long long ecid) {
 574 | 	if(libirecovery_debug) {
 575 | 		irecv_set_debug_level(libirecovery_debug);
 576 | 	}
 577 | #ifndef WIN32
 578 | 	int i = 0;
 579 | 	struct libusb_device* usb_device = NULL;
 580 | 	struct libusb_device** usb_device_list = NULL;
 581 | 	struct libusb_device_handle* usb_handle = NULL;
 582 | 	struct libusb_device_descriptor usb_descriptor;
 583 | 
 584 | 	*pclient = NULL;
 585 | 	irecv_error_t error = IRECV_E_SUCCESS;
 586 | 	int usb_device_count = libusb_get_device_list(libirecovery_context, &usb_device_list);
 587 | 	for (i = 0; i < usb_device_count; i++) {
 588 | 		usb_device = usb_device_list[i];
 589 | 		libusb_get_device_descriptor(usb_device, &usb_descriptor);
 590 | 		if (usb_descriptor.idVendor == APPLE_VENDOR_ID) {
 591 | 			/* verify this device is in a mode we understand */
 592 | 			if (usb_descriptor.idProduct == IRECV_K_RECOVERY_MODE_1 ||
 593 | 				usb_descriptor.idProduct == IRECV_K_RECOVERY_MODE_2 ||
 594 | 				usb_descriptor.idProduct == IRECV_K_RECOVERY_MODE_3 ||
 595 | 				usb_descriptor.idProduct == IRECV_K_RECOVERY_MODE_4 ||
 596 | 				usb_descriptor.idProduct == IRECV_K_WTF_MODE ||
 597 | 				usb_descriptor.idProduct == IRECV_K_DFU_MODE) {
 598 | 
 599 | 				if (ecid == IRECV_K_WTF_MODE) {
 600 | 					if (usb_descriptor.idProduct != IRECV_K_WTF_MODE) {
 601 | 						/* special ecid case, ignore !IRECV_K_WTF_MODE */
 602 | 						continue;
 603 | 					} else {
 604 | 						ecid = 0;
 605 | 					}
 606 | 				}
 607 | 
 608 | 				if ((ecid != 0) && (usb_descriptor.idProduct == IRECV_K_WTF_MODE)) {
 609 | 					/* we can't get ecid in WTF mode */
 610 | 					continue;
 611 | 				}
 612 | 
 613 | 				debug("opening device %04x:%04x...\n", usb_descriptor.idVendor, usb_descriptor.idProduct);
 614 | 
 615 | 				libusb_open(usb_device, &usb_handle);
 616 | 				if (usb_handle == NULL) {
 617 | 					debug("%s: can't connect to device...\n", __func__);
 618 | 					libusb_close(usb_handle);
 619 | 					if (ecid != 0) {
 620 | 						continue;
 621 | 					}
 622 | 					libusb_free_device_list(usb_device_list, 1);
 623 | 					libusb_exit(libirecovery_context);
 624 | 					return IRECV_E_UNABLE_TO_CONNECT;
 625 | 				}
 626 | 
 627 | 				irecv_client_t client = (irecv_client_t) malloc(sizeof(struct irecv_client_private));
 628 | 				if (client == NULL) {
 629 | 					libusb_free_device_list(usb_device_list, 1);
 630 | 					libusb_close(usb_handle);
 631 | 					libusb_exit(libirecovery_context);
 632 | 					return IRECV_E_OUT_OF_MEMORY;
 633 | 				}
 634 | 
 635 | 				memset(client, '\0', sizeof(struct irecv_client_private));
 636 | 				client->interface = 0;
 637 | 				client->handle = usb_handle;
 638 | 				client->mode = usb_descriptor.idProduct;
 639 | 
 640 | 				/* cache usb serial */
 641 | 				irecv_get_string_descriptor_ascii(client, usb_descriptor.iSerialNumber, (unsigned char*) client->serial, 255);
 642 | 
 643 | 				if (ecid != 0) {
 644 | 					char* ecid_string = strstr(client->serial, "ECID:");
 645 | 					if (ecid_string == NULL) {
 646 | 						debug("%s: could not get ECID for device\n", __func__);
 647 | 						irecv_close(client);
 648 | 						continue;
 649 | 					}
 650 | 
 651 | 					unsigned long long this_ecid = 0;
 652 | 					sscanf(ecid_string, "ECID:" _FMT_qX, (unsigned long long*)&this_ecid);
 653 | 					if (this_ecid != ecid) {
 654 | 						irecv_close(client);
 655 | 						continue;
 656 | 					}
 657 | 					debug("found device with ECID " _FMT_016llx "\n", (unsigned long long)ecid);
 658 | 				}
 659 | 
 660 | 				error = irecv_usb_set_configuration(client, 1);
 661 | 				if (error != IRECV_E_SUCCESS) {
 662 | 					return error;
 663 | 				}
 664 | 
 665 | 				if ((client->mode != IRECV_K_DFU_MODE) && (client->mode != IRECV_K_WTF_MODE)) {
 666 | 					error = irecv_usb_set_interface(client, 0, 0);
 667 | 					error = irecv_usb_set_interface(client, 1, 1);
 668 | 				} else {
 669 | 					error = irecv_usb_set_interface(client, 0, 0);
 670 | 				}
 671 | 
 672 | 				if (error != IRECV_E_SUCCESS) {
 673 | 					return error;
 674 | 				}
 675 | 
 676 | 				*pclient = client;
 677 | 
 678 | 				return IRECV_E_SUCCESS;
 679 | 			}
 680 | 		}
 681 | 	}
 682 | 
 683 | 	return IRECV_E_UNABLE_TO_CONNECT;
 684 | #else
 685 | 	int ret = mobiledevice_connect(pclient, ecid);
 686 | 	if (ret == IRECV_E_SUCCESS) {
 687 | 		irecv_client_t client = *pclient;
 688 | 		int error = IRECV_E_SUCCESS;
 689 | 		if ((client->mode != IRECV_K_DFU_MODE) && (client->mode != IRECV_K_WTF_MODE)) {
 690 | 			error = irecv_usb_set_interface(client, 0, 0);
 691 | 			if (client->mode > IRECV_K_RECOVERY_MODE_2) {
 692 | 				error = irecv_usb_set_interface(client, 1, 1);
 693 | 			}
 694 | 		} else {
 695 | 			error = irecv_usb_set_interface(client, 0, 0);
 696 | 		}
 697 | 		if (error != IRECV_E_SUCCESS) {
 698 | 			debug("WARNING: set interface failed, error %d\n", error);
 699 | 		}
 700 | 	}
 701 | 
 702 | 	return ret;
 703 | #endif
 704 | }
 705 | 
 706 | irecv_error_t irecv_usb_set_configuration(irecv_client_t client, int configuration) {
 707 | 	if (check_context(client) != IRECV_E_SUCCESS)
 708 | 		return IRECV_E_NO_DEVICE;
 709 | 
 710 | #ifndef WIN32
 711 | 	debug("Setting to configuration %d\n", configuration);
 712 | 
 713 | 	int current = 0;
 714 | 	libusb_get_configuration(client->handle, &current);
 715 | 	if (current != configuration) {
 716 | 		if (libusb_set_configuration(client->handle, configuration) < 0) {
 717 | 			return IRECV_E_USB_CONFIGURATION;
 718 | 		}
 719 | 	}
 720 | 
 721 | 	client->config = configuration;
 722 | #endif
 723 | 
 724 | 	return IRECV_E_SUCCESS;
 725 | }
 726 | 
 727 | irecv_error_t irecv_usb_set_interface(irecv_client_t client, int usb_interface, int usb_alt_interface) {
 728 | 	if (check_context(client) != IRECV_E_SUCCESS)
 729 | 		return IRECV_E_NO_DEVICE;
 730 | 
 731 | 	debug("Setting to interface %d:%d\n", usb_interface, usb_alt_interface);
 732 | #ifndef WIN32
 733 | 	if (libusb_claim_interface(client->handle, usb_interface) < 0) {
 734 | 		return IRECV_E_USB_INTERFACE;
 735 | 	}
 736 | 
 737 | 	if (libusb_set_interface_alt_setting(client->handle, usb_interface, usb_alt_interface) < 0) {
 738 | 		return IRECV_E_USB_INTERFACE;
 739 | 	}
 740 | #else
 741 | 	if (irecv_usb_control_transfer(client, 0, 0x0B, usb_alt_interface, usb_interface, NULL, 0, USB_TIMEOUT) < 0) {
 742 | 		return IRECV_E_USB_INTERFACE;
 743 | 	}
 744 | #endif
 745 | 	client->interface = usb_interface;
 746 | 	client->alt_interface = usb_alt_interface;
 747 | 
 748 | 	return IRECV_E_SUCCESS;
 749 | }
 750 | 
 751 | irecv_error_t irecv_reset(irecv_client_t client) {
 752 | 	if (check_context(client) != IRECV_E_SUCCESS)
 753 | 		return IRECV_E_NO_DEVICE;
 754 | 
 755 | #ifndef WIN32
 756 | 	libusb_reset_device(client->handle);
 757 | #else
 758 | 	DWORD count;
 759 | 	DeviceIoControl(client->handle, 0x22000C, NULL, 0, NULL, 0, &count, NULL);
 760 | #endif
 761 | 
 762 | 	return IRECV_E_SUCCESS;
 763 | }
 764 | 
 765 | irecv_error_t irecv_open_with_ecid_and_attempts(irecv_client_t* pclient, unsigned long long ecid, int attempts) {
 766 | 	int i;
 767 | 
 768 | 	for (i = 0; i < attempts; i++) {
 769 | 		if(*pclient) {
 770 | 			irecv_close(*pclient);
 771 | 			*pclient = NULL;
 772 | 		}
 773 | 		if (irecv_open_with_ecid(pclient, ecid) != IRECV_E_SUCCESS) {
 774 | 			debug("Connection failed. Waiting 1 sec before retry.\n");
 775 | 			sleep(1);
 776 | 		} else {
 777 | 			return IRECV_E_SUCCESS;
 778 | 		}
 779 | 	}
 780 | 
 781 | 	return IRECV_E_UNABLE_TO_CONNECT;
 782 | }
 783 | 
 784 | irecv_error_t irecv_event_subscribe(irecv_client_t client, irecv_event_type type, irecv_event_cb_t callback, void* user_data) {
 785 | 	switch(type) {
 786 | 	case IRECV_RECEIVED:
 787 | 		client->received_callback = callback;
 788 | 		break;
 789 | 
 790 | 	case IRECV_PROGRESS:
 791 | 		client->progress_callback = callback;
 792 | 
 793 | 	case IRECV_CONNECTED:
 794 | 		client->connected_callback = callback;
 795 | 
 796 | 	case IRECV_PRECOMMAND:
 797 | 		client->precommand_callback = callback;
 798 | 		break;
 799 | 
 800 | 	case IRECV_POSTCOMMAND:
 801 | 		client->postcommand_callback = callback;
 802 | 		break;
 803 | 
 804 | 	case IRECV_DISCONNECTED:
 805 | 		client->disconnected_callback = callback;
 806 | 
 807 | 	default:
 808 | 		return IRECV_E_UNKNOWN_ERROR;
 809 | 	}
 810 | 
 811 | 	return IRECV_E_SUCCESS;
 812 | }
 813 | 
 814 | irecv_error_t irecv_event_unsubscribe(irecv_client_t client, irecv_event_type type) {
 815 | 	switch(type) {
 816 | 	case IRECV_RECEIVED:
 817 | 		client->received_callback = NULL;
 818 | 		break;
 819 | 
 820 | 	case IRECV_PROGRESS:
 821 | 		client->progress_callback = NULL;
 822 | 
 823 | 	case IRECV_CONNECTED:
 824 | 		client->connected_callback = NULL;
 825 | 
 826 | 	case IRECV_PRECOMMAND:
 827 | 		client->precommand_callback = NULL;
 828 | 		break;
 829 | 
 830 | 	case IRECV_POSTCOMMAND:
 831 | 		client->postcommand_callback = NULL;
 832 | 		break;
 833 | 
 834 | 	case IRECV_DISCONNECTED:
 835 | 		client->disconnected_callback = NULL;
 836 | 
 837 | 	default:
 838 | 		return IRECV_E_UNKNOWN_ERROR;
 839 | 	}
 840 | 
 841 | 	return IRECV_E_SUCCESS;
 842 | }
 843 | 
 844 | irecv_error_t irecv_close(irecv_client_t client) {
 845 | 	if (client != NULL) {
 846 | 		if(client->disconnected_callback != NULL) {
 847 | 			irecv_event_t event;
 848 | 			event.size = 0;
 849 | 			event.data = NULL;
 850 | 			event.progress = 0;
 851 | 			event.type = IRECV_DISCONNECTED;
 852 | 			client->disconnected_callback(client, &event);
 853 | 		}
 854 | #ifndef WIN32
 855 | 		if (client->handle != NULL) {
 856 | 			if ((client->mode != IRECV_K_DFU_MODE) && (client->mode != IRECV_K_WTF_MODE)) {
 857 | 				libusb_release_interface(client->handle, client->interface);
 858 | 			}
 859 | 			libusb_close(client->handle);
 860 | 			client->handle = NULL;
 861 | 		}
 862 | #else
 863 | 		if (client->iBootPath!=NULL) {
 864 | 			free(client->iBootPath);
 865 | 			client->iBootPath = NULL;
 866 | 		}
 867 | 		if (client->DfuPath!=NULL) {
 868 | 			free(client->DfuPath);
 869 | 			client->DfuPath = NULL;
 870 | 		}
 871 | 		mobiledevice_closepipes(client);
 872 | #endif
 873 | 		free(client);
 874 | 		client = NULL;
 875 | 	}
 876 | 
 877 | 	return IRECV_E_SUCCESS;
 878 | }
 879 | 
 880 | void irecv_set_debug_level(int level) {
 881 | 	libirecovery_debug = level;
 882 | #ifndef WIN32
 883 | 	if(libirecovery_context) {
 884 | 		libusb_set_debug(libirecovery_context, libirecovery_debug > 2 ? 1: 0);
 885 | 	}
 886 | #endif
 887 | }
 888 | 
 889 | static irecv_error_t irecv_send_command_raw(irecv_client_t client, const char* command) {
 890 | 	unsigned int length = strlen(command);
 891 | 	if (length >= 0x100) {
 892 | 		length = 0xFF;
 893 | 	}
 894 | 
 895 | 	if (length > 0) {
 896 | 		irecv_usb_control_transfer(client, 0x40, 0, 0, 0, (unsigned char*) command, length + 1, USB_TIMEOUT);
 897 | 	}
 898 | 
 899 | 	return IRECV_E_SUCCESS;
 900 | }
 901 | 
 902 | irecv_error_t irecv_send_command(irecv_client_t client, const char* command) {
 903 | 	irecv_error_t error = 0;
 904 | 
 905 | 	if (check_context(client) != IRECV_E_SUCCESS)
 906 | 		return IRECV_E_NO_DEVICE;
 907 | 
 908 | 	unsigned int length = strlen(command);
 909 | 	if (length >= 0x100) {
 910 | 		length = 0xFF;
 911 | 	}
 912 | 
 913 | 	irecv_event_t event;
 914 | 	if(client->precommand_callback != NULL) {
 915 | 		event.size = length;
 916 | 		event.data = command;
 917 | 		event.type = IRECV_PRECOMMAND;
 918 | 		if(client->precommand_callback(client, &event)) {
 919 | 			return IRECV_E_SUCCESS;
 920 | 		}
 921 | 	}
 922 | 
 923 | 	error = irecv_send_command_raw(client, command);
 924 | 	if (error != IRECV_E_SUCCESS) {
 925 | 		debug("Failed to send command %s\n", command);
 926 | 		if (error != IRECV_E_PIPE)
 927 | 			return error;
 928 | 	}
 929 | 
 930 | 	if(client->postcommand_callback != NULL) {
 931 | 		event.size = length;
 932 | 		event.data = command;
 933 | 		event.type = IRECV_POSTCOMMAND;
 934 | 		if(client->postcommand_callback(client, &event)) {
 935 | 			return IRECV_E_SUCCESS;
 936 | 		}
 937 | 	}
 938 | 
 939 | 	return IRECV_E_SUCCESS;
 940 | }
 941 | 
 942 | irecv_error_t irecv_send_file(irecv_client_t client, const char* filename, int dfu_notify_finished) {
 943 | 	if (check_context(client) != IRECV_E_SUCCESS)
 944 | 		return IRECV_E_NO_DEVICE;
 945 | 
 946 | 	FILE* file = fopen(filename, "rb");
 947 | 	if (file == NULL) {
 948 | 		return IRECV_E_FILE_NOT_FOUND;
 949 | 	}
 950 | 
 951 | 	fseek(file, 0, SEEK_END);
 952 | 	long length = ftell(file);
 953 | 	fseek(file, 0, SEEK_SET);
 954 | 
 955 | 	char* buffer = (char*) malloc(length);
 956 | 	if (buffer == NULL) {
 957 | 		fclose(file);
 958 | 		return IRECV_E_OUT_OF_MEMORY;
 959 | 	}
 960 | 
 961 | 	long bytes = fread(buffer, 1, length, file);
 962 | 	fclose(file);
 963 | 
 964 | 	if (bytes != length) {
 965 | 		free(buffer);
 966 | 		return IRECV_E_UNKNOWN_ERROR;
 967 | 	}
 968 | 
 969 | 	irecv_error_t error = irecv_send_buffer(client, (unsigned char*)buffer, length, dfu_notify_finished);
 970 | 	free(buffer);
 971 | 
 972 | 	return error;
 973 | }
 974 | 
 975 | static irecv_error_t irecv_get_status(irecv_client_t client, unsigned int* status) {
 976 | 	if (check_context(client) != IRECV_E_SUCCESS) {
 977 | 		*status = 0;
 978 | 		return IRECV_E_NO_DEVICE;
 979 | 	}
 980 | 
 981 | 	unsigned char buffer[6];
 982 | 	memset(buffer, '\0', 6);
 983 | 	if (irecv_usb_control_transfer(client, 0xA1, 3, 0, 0, buffer, 6, USB_TIMEOUT) != 6) {
 984 | 		*status = 0;
 985 | 		return IRECV_E_USB_STATUS;
 986 | 	}
 987 | 
 988 | 	*status = (unsigned int) buffer[4];
 989 | 
 990 | 	return IRECV_E_SUCCESS;
 991 | }
 992 | 
 993 | irecv_error_t irecv_send_buffer(irecv_client_t client, unsigned char* buffer, unsigned long length, int dfu_notify_finished) {
 994 | 	irecv_error_t error = 0;
 995 | 	int recovery_mode = ((client->mode != IRECV_K_DFU_MODE) && (client->mode != IRECV_K_WTF_MODE));
 996 | 
 997 | 	if (check_context(client) != IRECV_E_SUCCESS)
 998 | 		return IRECV_E_NO_DEVICE;
 999 | 
1000 | 	unsigned int h1 = 0xFFFFFFFF;
1001 | 	unsigned char dfu_xbuf[12] = {0xff, 0xff, 0xff, 0xff, 0xac, 0x05, 0x00, 0x01, 0x55, 0x46, 0x44, 0x10};
1002 | 	int packet_size = recovery_mode ? 0x8000 : 0x800;
1003 | 	int last = length % packet_size;
1004 | 	int packets = length / packet_size;
1005 | 
1006 | 	if (last != 0) {
1007 | 		packets++;
1008 | 	} else {
1009 | 		last = packet_size;
1010 | 	}
1011 | 
1012 | 	/* initiate transfer */
1013 | 	if (recovery_mode) {
1014 | 		error = irecv_usb_control_transfer(client, 0x41, 0, 0, 0, NULL, 0, USB_TIMEOUT);
1015 | 	} else {
1016 | 		unsigned char dump[4];
1017 | 		if (irecv_usb_control_transfer(client, 0xa1, 5, 0, 0, dump, 1, USB_TIMEOUT) == 1) {
1018 | 			error = IRECV_E_SUCCESS;
1019 | 		} else {
1020 | 			error = IRECV_E_USB_UPLOAD;
1021 | 		}
1022 | 	}
1023 | 
1024 | 	if (error != IRECV_E_SUCCESS) {
1025 | 		return error;
1026 | 	}
1027 | 
1028 | 	int i = 0;
1029 | 	unsigned long count = 0;
1030 | 	unsigned int status = 0;
1031 | 	int bytes = 0;
1032 | 	for (i = 0; i < packets; i++) {
1033 | 		int size = (i + 1) < packets ? packet_size : last;
1034 | 
1035 | 		/* Use bulk transfer for recovery mode and control transfer for DFU and WTF mode */
1036 | 		if (recovery_mode) {
1037 | 			error = irecv_usb_bulk_transfer(client, 0x04, &buffer[i * packet_size], size, &bytes, USB_TIMEOUT);
1038 | 		} else {
1039 | 			int j;
1040 | 			for (j = 0; j < size; j++) {
1041 | 				dfu_hash_step(h1, buffer[i*packet_size + j]);
1042 | 			}
1043 | 			if (i+1 == packets) {
1044 | 				for (j = 0; j < 2; j++) {
1045 | 					dfu_hash_step(h1, dfu_xbuf[j*6 + 0]);
1046 | 					dfu_hash_step(h1, dfu_xbuf[j*6 + 1]);
1047 | 					dfu_hash_step(h1, dfu_xbuf[j*6 + 2]);
1048 | 					dfu_hash_step(h1, dfu_xbuf[j*6 + 3]);
1049 | 					dfu_hash_step(h1, dfu_xbuf[j*6 + 4]);
1050 | 					dfu_hash_step(h1, dfu_xbuf[j*6 + 5]);
1051 | 				}
1052 | 
1053 | 				char* newbuf = (char*)malloc(size + 16);
1054 | 				memcpy(newbuf, &buffer[i * packet_size], size);
1055 | 				memcpy(newbuf+size, dfu_xbuf, 12);
1056 | 				newbuf[size+12] = h1 & 0xFF;
1057 | 				newbuf[size+13] = (h1 >> 8) & 0xFF;
1058 | 				newbuf[size+14] = (h1 >> 16) & 0xFF;
1059 | 				newbuf[size+15] = (h1 >> 24) & 0xFF;
1060 | 				size += 16;
1061 | 				bytes = irecv_usb_control_transfer(client, 0x21, 1, i, 0, (unsigned char*)newbuf, size, USB_TIMEOUT);
1062 | 				free(newbuf);
1063 | 			} else {
1064 | 				bytes = irecv_usb_control_transfer(client, 0x21, 1, i, 0, &buffer[i * packet_size], size, USB_TIMEOUT);
1065 | 			}
1066 | 		}
1067 | 
1068 | 		if (bytes != size) {
1069 | 			return IRECV_E_USB_UPLOAD;
1070 | 		}
1071 | 
1072 | 		if (!recovery_mode) {
1073 | 			error = irecv_get_status(client, &status);
1074 | 		}
1075 | 
1076 | 		if (error != IRECV_E_SUCCESS) {
1077 | 			return error;
1078 | 		}
1079 | 
1080 | 		if (!recovery_mode && status != 5) {
1081 | 			int retry = 0;
1082 | 
1083 | 			while (retry < 20) {
1084 | 				irecv_get_status(client, &status);
1085 | 				if (status == 5) {
1086 | 					break;
1087 | 				}
1088 | 				sleep(1);
1089 | 			}
1090 | 
1091 | 			if (status != 5) {
1092 | 				return IRECV_E_USB_UPLOAD;
1093 | 			}
1094 | 		}
1095 | 
1096 | 		count += size;
1097 | 		if(client->progress_callback != NULL) {
1098 | 			irecv_event_t event;
1099 | 			event.progress = ((double) count/ (double) length) * 100.0;
1100 | 			event.type = IRECV_PROGRESS;
1101 | 			event.data = (char*)"Uploading";
1102 | 			event.size = count;
1103 | 			client->progress_callback(client, &event);
1104 | 		} else {
1105 | 			debug("Sent: %d bytes - %lu of %lu\n", bytes, count, length);
1106 | 		}
1107 | 	}
1108 | 
1109 | 	if (dfu_notify_finished && !recovery_mode) {
1110 | 		irecv_usb_control_transfer(client, 0x21, 1, packets, 0, (unsigned char*) buffer, 0, USB_TIMEOUT);
1111 | 
1112 | 		for (i = 0; i < 2; i++) {
1113 | 			error = irecv_get_status(client, &status);
1114 | 			if (error != IRECV_E_SUCCESS) {
1115 | 				return error;
1116 | 			}
1117 | 		}
1118 | 
1119 | 		if (dfu_notify_finished == 2) {
1120 | 			/* we send a pseudo ZLP here just in case */
1121 | 			irecv_usb_control_transfer(client, 0x21, 1, 0, 0, 0, 0, USB_TIMEOUT);
1122 | 		}
1123 | 
1124 | 		irecv_reset(client);
1125 | 	}
1126 | 
1127 | 	return IRECV_E_SUCCESS;
1128 | }
1129 | 
1130 | irecv_error_t irecv_receive(irecv_client_t client) {
1131 | 	char buffer[BUFFER_SIZE];
1132 | 	memset(buffer, '\0', BUFFER_SIZE);
1133 | 
1134 | 	if (check_context(client) != IRECV_E_SUCCESS)
1135 | 		return IRECV_E_NO_DEVICE;
1136 | 
1137 | 	int bytes = 0;
1138 | 	while (irecv_usb_bulk_transfer(client, 0x81, (unsigned char*) buffer, BUFFER_SIZE, &bytes, 500) == 0) {
1139 | 		if (bytes > 0) {
1140 | 			if (client->received_callback != NULL) {
1141 | 				irecv_event_t event;
1142 | 				event.size = bytes;
1143 | 				event.data = buffer;
1144 | 				event.type = IRECV_RECEIVED;
1145 | 				if (client->received_callback(client, &event) != 0) {
1146 | 					return IRECV_E_SUCCESS;
1147 | 				}
1148 | 			}
1149 | 		} else break;
1150 | 	}
1151 | 
1152 | 	return IRECV_E_SUCCESS;
1153 | }
1154 | 
1155 | irecv_error_t irecv_getenv(irecv_client_t client, const char* variable, char** value) {
1156 | 	char command[256];
1157 | 
1158 | 	if (check_context(client) != IRECV_E_SUCCESS)
1159 | 		return IRECV_E_NO_DEVICE;
1160 | 
1161 | 	*value = NULL;
1162 | 
1163 | 	if(variable == NULL) {
1164 | 		return IRECV_E_INVALID_INPUT;
1165 | 	}
1166 | 
1167 | 	memset(command, '\0', sizeof(command));
1168 | 	snprintf(command, sizeof(command)-1, "getenv %s", variable);
1169 | 	irecv_error_t error = irecv_send_command_raw(client, command);
1170 | 	if(error == IRECV_E_PIPE) {
1171 | 		return IRECV_E_SUCCESS;
1172 | 	}
1173 | 
1174 | 	if(error != IRECV_E_SUCCESS) {
1175 | 		return error;
1176 | 	}
1177 | 
1178 | 	char* response = (char*) malloc(256);
1179 | 	if (response == NULL) {
1180 | 		return IRECV_E_OUT_OF_MEMORY;
1181 | 	}
1182 | 
1183 | 	memset(response, '\0', 256);
1184 | 	irecv_usb_control_transfer(client, 0xC0, 0, 0, 0, (unsigned char*) response, 255, USB_TIMEOUT);
1185 | 
1186 | 	*value = response;
1187 | 
1188 | 	return IRECV_E_SUCCESS;
1189 | }
1190 | 
1191 | irecv_error_t irecv_getret(irecv_client_t client, unsigned int* value) {
1192 | 	if (check_context(client) != IRECV_E_SUCCESS)
1193 | 		return IRECV_E_NO_DEVICE;
1194 | 
1195 | 	*value = 0;
1196 | 
1197 | 	char* response = (char*) malloc(256);
1198 | 	if (response == NULL) {
1199 | 		return IRECV_E_OUT_OF_MEMORY;
1200 | 	}
1201 | 
1202 | 	memset(response, '\0', 256);
1203 | 	irecv_usb_control_transfer(client, 0xC0, 0, 0, 0, (unsigned char*) response, 255, USB_TIMEOUT);
1204 | 
1205 | 	*value = (unsigned int) *response;
1206 | 
1207 | 	return IRECV_E_SUCCESS;
1208 | }
1209 | 
1210 | irecv_error_t irecv_get_mode(irecv_client_t client, int* mode) {
1211 | 	if (check_context(client) != IRECV_E_SUCCESS)
1212 | 		return IRECV_E_NO_DEVICE;
1213 | 
1214 | 	*mode = client->mode;
1215 | 
1216 | 	return IRECV_E_SUCCESS;
1217 | }
1218 | 
1219 | irecv_error_t irecv_get_cpid(irecv_client_t client, unsigned int* cpid) {
1220 | 	if (check_context(client) != IRECV_E_SUCCESS)
1221 | 		return IRECV_E_NO_DEVICE;
1222 | 
1223 | 	if (client->mode == IRECV_K_WTF_MODE) {
1224 | 		char s_cpid[8] = {0,};
1225 | 		strncpy(s_cpid, client->serial, 4);
1226 | 		if (sscanf(s_cpid, "%x", cpid) != 1) {
1227 | 			*cpid = 0;
1228 | 			return IRECV_E_UNKNOWN_ERROR;
1229 | 		}
1230 | 
1231 | 		return IRECV_E_SUCCESS;
1232 | 	}
1233 | 
1234 | 	char* cpid_string = strstr(client->serial, "CPID:");
1235 | 	if (cpid_string == NULL) {
1236 | 		*cpid = 0;
1237 | 		return IRECV_E_UNKNOWN_ERROR;
1238 | 	}
1239 | 	sscanf(cpid_string, "CPID:%x", cpid);
1240 | 
1241 | 	return IRECV_E_SUCCESS;
1242 | }
1243 | 
1244 | irecv_error_t irecv_get_bdid(irecv_client_t client, unsigned int* bdid) {
1245 | 	if (check_context(client) != IRECV_E_SUCCESS)
1246 | 		return IRECV_E_NO_DEVICE;
1247 | 
1248 | 	char* bdid_string = strstr(client->serial, "BDID:");
1249 | 	if (bdid_string == NULL) {
1250 | 		*bdid = 0;
1251 | 		return IRECV_E_UNKNOWN_ERROR;
1252 | 	}
1253 | 	sscanf(bdid_string, "BDID:%x", bdid);
1254 | 
1255 | 	return IRECV_E_SUCCESS;
1256 | }
1257 | 
1258 | irecv_error_t irecv_get_ecid(irecv_client_t client, unsigned long long* ecid) {
1259 | 	if (check_context(client) != IRECV_E_SUCCESS)
1260 | 		return IRECV_E_NO_DEVICE;
1261 | 
1262 | 	char* ecid_string = strstr(client->serial, "ECID:");
1263 | 	if (ecid_string == NULL) {
1264 | 		*ecid = 0;
1265 | 		return IRECV_E_UNKNOWN_ERROR;
1266 | 	}
1267 | 	sscanf(ecid_string, "ECID:" _FMT_qX, ecid);
1268 | 
1269 | 	return IRECV_E_SUCCESS;
1270 | }
1271 | 
1272 | irecv_error_t irecv_get_srnm(irecv_client_t client, char* srnm) {
1273 | 	if (check_context(client) != IRECV_E_SUCCESS)
1274 | 		return IRECV_E_NO_DEVICE;
1275 | 
1276 | 	char* srnmp;
1277 | 	char* srnm_string = strstr(client->serial, "SRNM:[");
1278 | 	if(srnm_string == NULL) {
1279 | 		*srnm = 0;
1280 | 		return IRECV_E_UNKNOWN_ERROR;
1281 | 	}
1282 | 
1283 | 	sscanf(srnm_string, "SRNM:[%s]", srnm);
1284 | 	srnmp = strrchr(srnm, ']');
1285 | 	if(srnmp != NULL) {
1286 | 		*srnmp = '\0';
1287 | 	}
1288 | 
1289 | 	return IRECV_E_SUCCESS;
1290 | }
1291 | 
1292 | irecv_error_t irecv_get_imei(irecv_client_t client, char* imei) {
1293 | 	if (check_context(client) != IRECV_E_SUCCESS)
1294 | 		return IRECV_E_NO_DEVICE;
1295 | 
1296 | 	char* imeip;
1297 | 	char* imei_string = strstr(client->serial, "IMEI:[");
1298 | 	if (imei_string == NULL) {
1299 | 		*imei = 0;
1300 | 		return IRECV_E_UNKNOWN_ERROR;
1301 | 	}
1302 | 
1303 | 
1304 | 	sscanf(imei_string, "IMEI:[%s]", imei);
1305 | 	imeip = strrchr(imei, ']');
1306 | 	if(imeip != NULL) {
1307 | 		*imeip = '\0';
1308 | 	}
1309 | 
1310 | 	return IRECV_E_SUCCESS;
1311 | }
1312 | 
1313 | irecv_error_t irecv_get_nonce(irecv_client_t client, unsigned char** nonce, int* nonce_size) {
1314 | 	if (check_context(client) != IRECV_E_SUCCESS)
1315 | 		return IRECV_E_NO_DEVICE;
1316 | 
1317 | 	unsigned char buf[255];
1318 | 	int len;
1319 | 
1320 | 	*nonce = NULL;
1321 | 	*nonce_size = 0;
1322 | 
1323 | 	len = irecv_get_string_descriptor_ascii(client, 1, (unsigned char*) buf, 255);
1324 | 	debug("%s: got length: %d\n", __func__, len);
1325 | 	if (len < 0) {
1326 | 		return len;
1327 | 	}
1328 | 
1329 | 	buf[len] = 0;
1330 | 	debug("%s: buf='%s'\n", __func__, buf);
1331 | 
1332 | 	char* nonce_string = strstr((char*)buf, "NONC:");
1333 | 	if (nonce_string == NULL) {
1334 | 		return IRECV_E_UNKNOWN_ERROR;
1335 | 	}
1336 | 	nonce_string+=5;
1337 | 
1338 | 	int nlen = (len - ((unsigned char*)nonce_string - &buf[0])) / 2;
1339 | 	unsigned char *nn = malloc(nlen);
1340 | 	if (!nn) {
1341 | 		return IRECV_E_OUT_OF_MEMORY;
1342 | 	}
1343 | 
1344 | 	int i = 0;
1345 | 	for (i = 0; i < nlen; i++) {
1346 | 		int val = 0;
1347 | 		if (sscanf(nonce_string+(i*2), "%02X", &val) == 1) {
1348 | 			nn[i] = (unsigned char)val;
1349 | 		} else {
1350 | 			debug("%s: ERROR: unexpected data in nonce result (%2s)\n", __func__, nonce_string+(i*2));
1351 | 			break;
1352 | 		}
1353 | 	}
1354 | 
1355 | 	if (i != nlen) {
1356 | 		debug("%s: ERROR: unable to parse nonce\n", __func__);
1357 | 		free(nn);
1358 | 		return IRECV_E_UNKNOWN_ERROR;
1359 | 	}
1360 | 
1361 | 	*nonce = nn;
1362 | 	*nonce_size = nlen;
1363 | 
1364 | 	return IRECV_E_SUCCESS;
1365 | }
1366 | 
1367 | irecv_error_t irecv_trigger_limera1n_exploit(irecv_client_t client) {
1368 | 	if (check_context(client) != IRECV_E_SUCCESS)
1369 | 		return IRECV_E_NO_DEVICE;
1370 | 
1371 | 	irecv_usb_control_transfer(client, 0x21, 2, 0, 0, NULL, 0, USB_TIMEOUT);
1372 | 
1373 | 	return IRECV_E_SUCCESS;
1374 | }
1375 | 
1376 | irecv_error_t irecv_execute_script(irecv_client_t client, const char* script) {
1377 | 	irecv_error_t error = IRECV_E_SUCCESS;
1378 | 	if (check_context(client) != IRECV_E_SUCCESS)
1379 | 		return IRECV_E_NO_DEVICE;
1380 | 
1381 | 	char* body = strdup(script);
1382 | 	char* line = strtok(body, "\n");
1383 | 
1384 | 	while(line != NULL) {
1385 | 		if(line[0] != '#') {
1386 | 			error = irecv_send_command(client, line);
1387 | 			if(error != IRECV_E_SUCCESS) {
1388 | 				break;
1389 | 			}
1390 | 
1391 | 			error = irecv_receive(client);
1392 | 			if(error != IRECV_E_SUCCESS) {
1393 | 				break;
1394 | 			}
1395 | 		}
1396 | 		line = strtok(NULL, "\n");
1397 | 	}
1398 | 
1399 | 	if (body)
1400 | 		free(body);
1401 | 
1402 | 	return error;
1403 | }
1404 | 
1405 | irecv_error_t irecv_saveenv(irecv_client_t client) {
1406 | 	irecv_error_t error = irecv_send_command_raw(client, "saveenv");
1407 | 	if(error != IRECV_E_SUCCESS) {
1408 | 		return error;
1409 | 	}
1410 | 
1411 | 	return IRECV_E_SUCCESS;
1412 | }
1413 | 
1414 | irecv_error_t irecv_setenv(irecv_client_t client, const char* variable, const char* value) {
1415 | 	char command[256];
1416 | 
1417 | 	if (check_context(client) != IRECV_E_SUCCESS)
1418 | 		return IRECV_E_NO_DEVICE;
1419 | 
1420 | 	if(variable == NULL || value == NULL) {
1421 | 		return IRECV_E_UNKNOWN_ERROR;
1422 | 	}
1423 | 
1424 | 	memset(command, '\0', sizeof(command));
1425 | 	snprintf(command, sizeof(command)-1, "setenv %s %s", variable, value);
1426 | 	irecv_error_t error = irecv_send_command_raw(client, command);
1427 | 	if(error != IRECV_E_SUCCESS) {
1428 | 		return error;
1429 | 	}
1430 | 
1431 | 	return IRECV_E_SUCCESS;
1432 | }
1433 | 
1434 | irecv_error_t irecv_reboot(irecv_client_t client) {
1435 | 	irecv_error_t error = irecv_send_command_raw(client, "reboot");
1436 | 	if(error != IRECV_E_SUCCESS) {
1437 | 		return error;
1438 | 	}
1439 | 
1440 | 	return IRECV_E_SUCCESS;
1441 | }
1442 | 
1443 | const char* irecv_strerror(irecv_error_t error) {
1444 | 	switch (error) {
1445 | 	case IRECV_E_SUCCESS:
1446 | 		return "Command completed successfully";
1447 | 
1448 | 	case IRECV_E_NO_DEVICE:
1449 | 		return "Unable to find device";
1450 | 
1451 | 	case IRECV_E_OUT_OF_MEMORY:
1452 | 		return "Out of memory";
1453 | 
1454 | 	case IRECV_E_UNABLE_TO_CONNECT:
1455 | 		return "Unable to connect to device";
1456 | 
1457 | 	case IRECV_E_INVALID_INPUT:
1458 | 		return "Invalid input";
1459 | 
1460 | 	case IRECV_E_FILE_NOT_FOUND:
1461 | 		return "File not found";
1462 | 
1463 | 	case IRECV_E_USB_UPLOAD:
1464 | 		return "Unable to upload data to device";
1465 | 
1466 | 	case IRECV_E_USB_STATUS:
1467 | 		return "Unable to get device status";
1468 | 
1469 | 	case IRECV_E_USB_INTERFACE:
1470 | 		return "Unable to set device interface";
1471 | 
1472 | 	case IRECV_E_USB_CONFIGURATION:
1473 | 		return "Unable to set device configuration";
1474 | 
1475 | 	case IRECV_E_PIPE:
1476 | 		return "Broken pipe";
1477 | 
1478 | 	case IRECV_E_TIMEOUT:
1479 | 		return "Timeout talking to device";
1480 | 
1481 | 	default:
1482 | 		return "Unknown error";
1483 | 	}
1484 | 
1485 | 	return NULL;
1486 | }
1487 | 
1488 | irecv_error_t irecv_reset_counters(irecv_client_t client) {
1489 | 	if (check_context(client) != IRECV_E_SUCCESS)
1490 | 		return IRECV_E_NO_DEVICE;
1491 | 
1492 | 	if ((client->mode == IRECV_K_DFU_MODE) || (client->mode == IRECV_K_WTF_MODE)) {
1493 | 		irecv_usb_control_transfer(client, 0x21, 4, 0, 0, 0, 0, USB_TIMEOUT);
1494 | 	}
1495 | 
1496 | 	return IRECV_E_SUCCESS;
1497 | }
1498 | 
1499 | irecv_error_t irecv_recv_buffer(irecv_client_t client, char* buffer, unsigned long length) {
1500 | 	int recovery_mode = ((client->mode != IRECV_K_DFU_MODE) && (client->mode != IRECV_K_WTF_MODE));
1501 | 
1502 | 	if (check_context(client) != IRECV_E_SUCCESS)
1503 | 		return IRECV_E_NO_DEVICE;
1504 | 
1505 | 	int packet_size = recovery_mode ? 0x2000: 0x800;
1506 | 	int last = length % packet_size;
1507 | 	int packets = length / packet_size;
1508 | 	if (last != 0) {
1509 | 		packets++;
1510 | 	} else {
1511 | 		last = packet_size;
1512 | 	}
1513 | 
1514 | 	int i = 0;
1515 | 	int bytes = 0;
1516 | 	unsigned long count = 0;
1517 | 	for (i = 0; i < packets; i++) {
1518 | 		unsigned short size = (i+1) < packets ? packet_size : last;
1519 | 		bytes = irecv_usb_control_transfer(client, 0xA1, 2, 0, 0, (unsigned char*)&buffer[i * packet_size], size, USB_TIMEOUT);
1520 | 
1521 | 		if (bytes != size) {
1522 | 			return IRECV_E_USB_UPLOAD;
1523 | 		}
1524 | 
1525 | 		count += size;
1526 | 		if(client->progress_callback != NULL) {
1527 | 			irecv_event_t event;
1528 | 			event.progress = ((double) count/ (double) length) * 100.0;
1529 | 			event.type = IRECV_PROGRESS;
1530 | 			event.data = (char*)"Downloading";
1531 | 			event.size = count;
1532 | 			client->progress_callback(client, &event);
1533 | 		} else {
1534 | 			debug("Sent: %d bytes - %lu of %lu\n", bytes, count, length);
1535 | 		}
1536 | 	}
1537 | 
1538 | 	return IRECV_E_SUCCESS;
1539 | }
1540 | 
1541 | irecv_error_t irecv_finish_transfer(irecv_client_t client) {
1542 | 	int i = 0;
1543 | 	unsigned int status = 0;
1544 | 
1545 | 	if (check_context(client) != IRECV_E_SUCCESS)
1546 | 		return IRECV_E_NO_DEVICE;
1547 | 
1548 | 	irecv_usb_control_transfer(client, 0x21, 1, 0, 0, 0, 0, USB_TIMEOUT);
1549 | 
1550 | 	for(i = 0; i < 3; i++){
1551 | 		irecv_get_status(client, &status);
1552 | 	}
1553 | 
1554 | 	irecv_reset(client);
1555 | 
1556 | 	return IRECV_E_SUCCESS;
1557 | }
1558 | 
1559 | irecv_device_t irecv_devices_get_all() {
1560 | 	return irecv_devices;
1561 | }
1562 | 
1563 | irecv_error_t irecv_devices_get_device_by_client(irecv_client_t client, irecv_device_t* device) {
1564 | 	uint32_t bdid = 0;
1565 | 	uint32_t cpid = 0;
1566 | 	int i = 0;
1567 | 
1568 | 	*device = NULL;
1569 | 
1570 | 	if (irecv_get_cpid(client, &cpid) < 0) {
1571 | 		return IRECV_E_UNKNOWN_ERROR;
1572 | 	}
1573 | 
1574 | 	if (irecv_get_bdid(client, &bdid) < 0) {
1575 | 		return IRECV_E_UNKNOWN_ERROR;
1576 | 	}
1577 | 
1578 | 	for (i = 0; irecv_devices[i].hardware_model != NULL; i++) {
1579 | 		if (irecv_devices[i].chip_id == cpid && irecv_devices[i].board_id == bdid) {
1580 | 			*device = &irecv_devices[i];
1581 | 			return IRECV_E_SUCCESS;
1582 | 		}
1583 | 	}
1584 | 
1585 | 	return IRECV_E_NO_DEVICE;
1586 | }
1587 | 
1588 | irecv_error_t irecv_devices_get_device_by_product_type(const char* product_type, irecv_device_t* device) {
1589 | 	int i = 0;
1590 | 
1591 | 	*device = NULL;
1592 | 
1593 | 	for (i = 0; irecv_devices[i].product_type != NULL; i++) {
1594 | 		if (!strcmp(product_type, irecv_devices[i].product_type)) {
1595 | 			*device = &irecv_devices[i];
1596 | 			return IRECV_E_SUCCESS;
1597 | 		}
1598 | 	}
1599 | 
1600 | 	return IRECV_E_NO_DEVICE;
1601 | }
1602 | 
1603 | irecv_error_t irecv_devices_get_device_by_hardware_model(const char* hardware_model, irecv_device_t* device) {
1604 | 	int i = 0;
1605 | 
1606 | 	*device = NULL;
1607 | 
1608 | 	/* lowercase hardware_model string for proper lookup */
1609 | 	char model[8];
1610 | 	strcpy(model, hardware_model);
1611 | 	char *p = model;
1612 | 	for (; *p; ++p) *p = tolower(*p);
1613 | 
1614 | 	for (i = 0; irecv_devices[i].hardware_model != NULL; i++) {
1615 | 		if (!strcmp(model, irecv_devices[i].hardware_model)) {
1616 | 			*device = &irecv_devices[i];
1617 | 			return IRECV_E_SUCCESS;
1618 | 		}
1619 | 	}
1620 | 
1621 | 	return IRECV_E_NO_DEVICE;
1622 | }
1623 | 
1624 | irecv_client_t irecv_reconnect(irecv_client_t client, int initial_pause) {
1625 | 	irecv_error_t error = 0;
1626 | 	irecv_client_t new_client = NULL;
1627 | 	irecv_event_cb_t progress_callback = client->progress_callback;
1628 | 
1629 | 	unsigned long long ecid = 0;
1630 | 	irecv_get_ecid(client, &ecid);
1631 | 
1632 | 	if (check_context(client) == IRECV_E_SUCCESS) {
1633 | 		irecv_close(client);
1634 | 	}
1635 | 
1636 | 	if (initial_pause > 0) {
1637 | 		debug("Waiting %d seconds for the device to pop up...\n", initial_pause);
1638 | 		sleep(initial_pause);
1639 | 	}
1640 | 	
1641 | 	error = irecv_open_with_ecid_and_attempts(&new_client, ecid, 10);
1642 | 	if(error != IRECV_E_SUCCESS) {
1643 | 		return NULL;
1644 | 	}
1645 | 
1646 | 	new_client->progress_callback = progress_callback;
1647 | 
1648 | 	return new_client;
1649 | }
1650 | 


--------------------------------------------------------------------------------