Making PwnageTool Bundles

Creating the template Info.plist
Remove all AES keys/IVs and hashes, replace with TODO Also replace all .dmg filenames, SHA1 hash value and the rootfs volume name.

Getting the AES keys
Put the keys into the Info.plist, replacing TODO entries

Decrypting IMG3 files
Use xpwntool to decrypt all img3 files: NOR, kernelcache and the restore ramdisk

Decrypting the RootFS

 * 1) Use GenPass with decrypted Ramdisk to get the rootfs vfdecrypt key.
 * 2) Decrypt the rootfs using VFDecrypt, put the key and rootfs volume name into Info.plist

Patches
In most cases you can reuse the patches from a previous firmware version. You can use the fuzzy_patcher tool for that. To extract differences from the previous version of files: fuzzy_patcher --diff --delta delta_file.json \ --orig original_decrypted_file_vPrev \ --patched patched_decrypted_file_vPrev --verbose To apply the difference file to the current version: fuzzy_patcher --patch --delta delta_file.json \ --orig original_decrypted_file \ --patched patched_decrypted_file --fuzz 80 --verbose You can lower the 'fuzzyness' level to apply lower confidence patches, but it's not a very good idea; you would usually want to inspect the file with IDA in such cases.

ASR
ASR can be patched by finding a xref to a string "Image failed signature verification" and patching the first instruction at the preceding label to branch to the previous label, which is the success case "Image passed signature verification". On ARMv7 this branch is usually 'F3 E7' (Thumb mode, instruction B (branch) to address -0x16 relative to opcode address).
 * 1) Patch ASR from the Restore Ramdisk
 * 2) Fix its page hashes using codesign or ldid (see Bypassing iPhone Code Signatures).

iBSS patches
For noawadays limera1n- based jailbreaks there are quite a bit patches: kernelcache file is not patched in those bundles to allow untethered boot with intact NOR. Instead, kernelcache patches required to run the ramdisk are located in iBSS - an iBSS kernelcache_load function is patched to call a proc at ibss_base+0xFC that patches the decrypted and unpacked kernel in memory. You can use iBSS KPatch to add kernel patches to iBSS. This applies to all the recent jailbreaks (excluding old-bootrom N88AP).
 * 1) You need to patch the iBSS from every signature check or integrity check that is in it (Ramdisk signature, APTicket- see below, iBEC signatures etc.)
 * 2) APTicket- on 5.x.x+, the iBSS patches are slightly different. If you are using a stitched ipsw, where the img3 files are embded with the SHSH of the restored device and APTicket is included as "APTicket.img3" or "SCAB.img3" or old bootrom 3GS the iBSS needs to be patched out of its nonce creation. If you're patching a stock firmware the iBSS needs to still generate nonce but not check for APTicket's validity or its match for the nonce created.
 * 3) iBSS patch for bundles using user-mode untether exploit (or for tethered bundles)

Creating BSDiffs
Use BSDiff to create diffs by diffing unpacked original versus patched files. Example: bsdiff iBSS.k48ap.RELEASE.dfu.dec iBSS.k48ap.RELEASE.dfu.dec.patched iBSS.k48ap.RELEASE.patch

LLB 24k exploit
iPod touch (2nd generation) and iPhone 3GS utilize a different bootrom exploit, so the encrypted LLB and iBoot for these devices need patching. This requires ARM assembler knowledge and a software named IDA Pro. To extract the bootloader and disassemble using IDA, follow the following steps for IDA dissasembly (portarited on iBoot) "iBoot for ...., Copyright 2012, Apple Inc." if you cat (i.e. type) the file.
 * 1) obtain the bootloader from the iPSW. This file is in the  subdir, e.g. , where the "n81ap", "k90", etc.. are for the i-Device type
 * 2) run xpwntool with the proper key (from elsewhere in this Wiki)
 * 3) Make sure the decryption was successful - if it is, you should see:
 * 1) remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool
 * 2) Load in IDA. Set processor to ARM. Rebase program (Edit&#8594;Segments&#8594;Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:

ROM:5FF00000 loc_5FF00000                           ; CODE XREF: ROM:5FF00078�j ROM:5FF00000                B       loc_5FF00040        ; Used for Reset - This is where we start ROM:5FF00004 ; --- ROM:5FF00004                LDR     PC, =sub_5FF16FB4   ; Used for Undef ROM:5FF00008 ; --- ROM:5FF00008                LDR     PC, =sub_5FF16FEC   ; Used for SWI ROM:5FF0000C ; --- ROM:5FF0000C                LDR     PC, =sub_5FF17024   ; Used for Prefabt ROM:5FF00010 ; --- ROM:5FF00010                LDR     PC, =sub_5FF17060   ; Used for DataAbt ROM:5FF00014 ; --- ROM:5FF00014                LDR     PC, =loc_5FF17098   ; Used for AddrExc ROM:5FF00018 ; --- ROM:5FF00018                LDR     PC, =loc_5FF16F24   ; Used for IRQ ROM:5FF0001C ; --- ROM:5FF0001C                LDR     PC, =sub_5FF16F6C   ; Probably FIQ, need to verify this ROM:5FF00020 ; --- ROM:5FF00020                SVCPL   0xF00040 ROM:5FF00020 ; --- ROM:5FF00024 off_5FF00024   DCD sub_5FF16FB4        ; DATA XREF: ROM:5FF00004�r ROM:5FF00028 off_5FF00028   DCD sub_5FF16FEC        ; DATA XREF: ROM:5FF00008�r ROM:5FF0002C off_5FF0002C   DCD sub_5FF17024        ; DATA XREF: ROM:5FF0000C�r ROM:5FF00030 off_5FF00030   DCD sub_5FF17060        ; DATA XREF: ROM:5FF00010�r ROM:5FF00034 off_5FF00034   DCD loc_5FF17098        ; DATA XREF: ROM:5FF00014�r ROM:5FF00038 off_5FF00038   DCD loc_5FF16F24        ; DATA XREF: ROM:5FF00018�r ROM:5FF0003C off_5FF0003C   DCD sub_5FF16F6C        ; DATA XREF: ROM:5FF0001C�r ROM:5FF00040 ; --- ROM:5FF00040 ROM:5FF00040 loc_5FF00040                           ; CODE XREF: ROM:loc_5FF00000�j ROM:5FF00040                ADR     R0, loc_5FF00000   <-- The address we rebased to ROM:5FF00044                 LDR     R1, =loc_5FF00000 ROM:5FF00048                CMP     R0, R1 ROM:5FF0004C                 CMP     R0, R1 ROM:5FF00050                 BEQ     loc_5FF0007C ... ... ROM:5FF000E8 loc_5FF000E8                           ; CODE XREF: ROM:5FF000F0�j ROM:5FF000E8                CMP     R0, R1 ROM:5FF000EC                 STRLT   R2, [R0],#4 ROM:5FF000F0                BLT     loc_5FF000E8 ROM:5FF000F4                LDR     R0, =(_ibootStart+1) ROM:5FF000F8                MOV     LR, PC ROM:5FF000FC                 BX      R0 ; _ibootStart ROM:5FF00100 ROM:5FF00100 loc_5FF00100                           ; CODE XREF: ROM:loc_5FF00100�j ROM:5FF00100                B       loc_5FF00100

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

ROM:5FF00BA4 _ibootStart                            ; CODE XREF: ROM:5FF000FC�p ROM:5FF00BA4                                        ; DATA XREF: ROM:5FF000F4�o ... ROM:5FF00BA4                PUSH    {R7,LR} ROM:5FF00BA6                MOV     R7, SP ROM:5FF00BA8                 LDR     R0, =aIbootStart ; "\niBoot start\n" ROM:5FF00BAA                BL      loc_5FF233C4 ROM:5FF00BAE                MOVS    R0, #0 ROM:5FF00BB0                BL      loc_5FF16E54 ROM:5FF00BB4                BL      loc_5FF1570C ROM:5FF00BB8                BL      loc_5FF143A8 ROM:5FF00BBC                BL      unk_5FF15264 ROM:5FF00BC0                LDR     R0, =aMain      ; "main" ..

You need to patch the LLB and iBoot out of every signature check, APTicket check and the match of each other.

To put the file back in the ipsw you need to recontain the file in the img3 container (returning the img3 header) and puting back the file in it's original place in the ipsw.

you need to load the exploit using the xpwntool option "-x24k" (for iPod touch (2nd generation)) or "-xn8824k" (for iPhone 3GS) on the LLB. Example: xpwntool LLB.n88ap.RELEASE.img3.dec LLB.n88ap.RELEASE.img3.dec.patched \ -t LLB.n88ap.RELEASE.img3 -xn8824k -iv replace_with_iv \ -k replace_with_key Then bsdiff the encrypted files.

Fixing the ipsw file hash
Run shasum on the original ipsw, paste the result to the 'SHA1' field.