QEMU port for t8030

Overview

QEMU README

QEMU is a generic and open source machine & userspace emulator and virtualizer.

QEMU is capable of emulating a complete machine in software without any need for hardware virtualization support. By using dynamic translation, it achieves very good performance. QEMU can also integrate with the Xen and KVM hypervisors to provide emulated hardware while allowing the hypervisor to manage the CPU. With hypervisor support, QEMU can achieve near native performance for CPUs. When QEMU emulates CPUs directly it is capable of running operating systems made for one machine (e.g. an ARMv7 board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux and BSD kernel interfaces. This allows binaries compiled against one architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a different architecture ABI (e.g. the Linux x86_64 ABI). This does not involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly by users wishing to have full control over its behaviour and settings. It also aims to facilitate integration into higher level management layers, by providing a stable command line interface and monitor API. It is commonly invoked indirectly via the libvirt library when using open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License, version 2. For full licensing details, consult the LICENSE file.

Building

QEMU is multi-platform software intended to be buildable on all modern Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety of other UNIX targets. The simple steps to build QEMU are:

mkdir build
cd build
../configure
make

Additional information can also be found online via the QEMU website:

Submitting patches

The QEMU source code is maintained under the GIT version control system.

git clone https://git.qemu.org/git/qemu.git

When submitting patches, one common approach is to use 'git format-patch' and/or 'git send-email' to format & send the mail to the [email protected] mailing list. All patches submitted must contain a 'Signed-off-by' line from the author. Patches should follow the guidelines set out in the CODING_STYLE.rst file.

Additional information on submitting patches can be found online via the QEMU website

The QEMU website is also maintained under source control.

git clone https://git.qemu.org/git/qemu-web.git

A 'git-publish' utility was created to make above process less cumbersome, and is highly recommended for making regular contributions, or even just for sending consecutive patch series revisions. It also requires a working 'git send-email' setup, and by default doesn't automate everything, so you may want to go through the above steps manually for once.

For installation instructions, please go to

The workflow with 'git-publish' is:

$ git checkout master -b my-feature
$ # work on new commits, add your 'Signed-off-by' lines to each
$ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer back to it in the future.

Sending v2:

$ git checkout my-feature # same topic branch
$ # making changes to the commits (using 'git rebase', for example)
$ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip will be tagged as my-feature-v2.

Bug reporting

The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs found when running code built from QEMU git or upstream released sources should be reported via:

If using QEMU via an operating system vendor pre-built binary package, it is preferable to report bugs to the vendor's own bug tracker first. If the bug is also known to affect latest upstream code, it can also be reported via launchpad.

For additional information on bug reporting consult:

ChangeLog

For version history and release notes, please visit https://wiki.qemu.org/ChangeLog/ or look at the git history for more detailed information.

Contact

The QEMU community can be contacted in a number of ways, with the two main methods being email and IRC

Information on additional methods of contacting the community can be found online via the QEMU website:

Issues
  • Process 1 exec of /sbin/launchd failed, errno 86

    Process 1 exec of /sbin/launchd failed, errno 86

    I am trying to boot iOS 14.0 (18A188 InternalUI) in the emulator. Error log:

    `Loading iOS 14.0... kernel_low: 0xfffffff004000000 kernel_high: 0xfffffff00a4cd4f0 KPF: found apfs_vfsop_mount KPF: found handle_eval_rootauth KPF: Found AMFI hashtype check kpf_amfi_callback: Found AMFI (Leaf) kpf_amfi_callback: start @ 0xfffffff007b5d718 kpf_amfi_callback: Found lookup_in_static_trust_cache KPF: Found mac_mount KPF: Found mac_mount kpf_amfi_callback: Found AMFI (Routine) kpf_amfi_callback: start @ 0xfffffff0097edcb8 kpf_amfi_callback: Found lookup_in_trust_cache_module KPF: Found AppleKeyStoreUserClient::handleUserClientCommandGated Qemu FB realize g_virt_base: 0xfffffff004000000 g_phys_base: 0x0000000802000000 entry: 0x00000008061204e8 boot_mode: 0 auto-boot=true cmdline: [debug=0x14e kextlog=0xffff serial=3 -v wdt=-1 launchd_unsecure_cache=1] iBoot version: qemu-t8030 Darwin Image4 Validator Version 3.0.0: Wed Aug 12 22:19:21 PDT 2020; root:AppleImage4-106.0.4.0.1~129/AppleImage4/RELEASE_ARM64E AMFI is running in RESEARCH mode! AUC:[0xffffffe19b9f47e0]::init(0xffffffe19ba323c8)

    AUC:[0xffffffe19b9f47e0]::probe(0xffffffe19b7c1ea0, 0xffffffe80e3abdac)

    AppleCredentialManager: init: called, instance = . ACMFirstResponderKernelService: init: called, . ACMRM-S: init: called, starting PersistentStore service. ACMRM-C: init: called, starting AccessoryCache service. ACMKernelService: initValueFromBootArgAliasesUInt32: acc-cache size = 16 (default). ACMKernelService: initValueFromBootArgAliasesUInt32: acc-cache expiration = 2592000 (default). ACMRM: init: called, starting TRM service. ACMRM-A: init: called, starting TRM Analytics service. ACMKernelService: initValueFromBootArgAliasesUInt32: analytics collection period = 86400 (default). ACMKernelService: initValueFromBootArgAliasesUInt32: policy mode timeout = 259200 (default). ACMRM-A: notifyStandardModeTimeoutChanged: called, value = 259200 (modified = YES). ACMKernelService: initValueFromBootArgAliasesUInt32: (bounded) grace period timeout = 3600 (default). ACMRM-A: notifyGracePeriodTimeoutChanged: called, value = 3600 (modified = YES). ACMKernelService: initValueFromBootArgAliasesUInt32: enabled = 1 (default). ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO* BtArg=NO LegHW=NO OSEnv=NO | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO). ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO BtArg=NO* LegHW=NO OSEnv=NO | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO). ACMRM: _loadDisabledByOSEnvironment: disabled by OSEnvironment: NO. ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO BtArg=NO LegHW=NO OSEnv=NO* | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO). ACMRM: _mapAndPublishTRM: set TRM_PolicyTimeout = 259200. ACMRM: _mapAndPublishTRM: sending kIOMessageServicePropertyChange(n=1) while DISABLED, TRM: 259200 -/ff 4294967295 -/ff miss=ff (CUR: 259200 -/ff 4294967295 -/ff). AppleCredentialManager: init: returning, result = true, instance = . AppleARMBootPerf: Error: profile region not found (2) AppleARMBootPerf: Error: failed to publish profile data (2) virtual bool CoreAnalyticsHub::start(IOService *)::105:CoreAnalyticsHub start AppleSSE::start called AppleSSE::start returning, result = 1 AUC:[0xffffffe19b9f47e0]::start(0xffffffe19b7c1ea0)

    AppleSEPKeyStore:321:0: starting (BUILT: Aug 12 2020 22:51:30) AppleSEPKeyStore:545:0: _sep_enabled = 1 AppleCredentialManager: start: called, instance = . ACMRM: _publishIOResource: AppleUSBRestrictedModeTimeout = 259200. AppleCredentialManager: start: initializing power management, instance = . AppleCredentialManager: start: started, instance = . AppleCredentialManager: start: returning, result = true, instance = . AppleInterruptController::start: Num Shared Timestamps == 0 AppleGPIOICController::start: this: , _gpioicBaseAddress: AppleS8000AES::start: registers at phys:0x0x235008000/0x0x23d2d0000 virt:0x/0x0x4000 / 0x/0x0x4000 AppleGPIOICController::start: this: , _gpioicBaseAddress: AppleGPIOICController::start: this: , _gpioicBaseAddress: virtual bool AppleARMLightEmUp::start(IOService *): starting... AppleS5L8960XUSBPhy::start: hsic disabled 000001.085722 wlan0.A[1] [email protected]:Default options property found with value 4 Creating an object of AppleBCMWLANPlatformFunctionEmbeddedAMFM class 000001.121777 wlan0.A[2] [email protected]: Raised adjustBusy(+1), getBusyState() -> 1 000001.121898 wlan0.A[3] [email protected]:Setting up notifier for CoreAnalyticsHub 000001.138758 [email protected]: IOUSBDeviceController::prepareDefaults: model iPhone version 12.1 Identified Serial Port uart7 at 0x23521c000() AppleA7IOPNub: withRegistryEntry, 47: allocated nub

    Identified Serial Port uart0 at 0x235200000() AppleA7IOPNub: withRegistryEntry, 47: allocated nub

    RTBuddy(SMC): start() - (Aug 12 [email protected]:50:37) RTBuddy(ANS2): start() - (Aug 12 [email protected]:50:37) RTBuddy(SMC): Boot args override: wdt = -1 RTBuddy(ANS2): Boot args override: wdt = -1 RTBuddy(ANS2): Resuming...

    RTBuddy(SMC): Resuming...

    Starting AppleSMC kext() - (Aug 12 [email protected]:51:44) 000001.210077 [email protected]: IOUSBDeviceController::gated_handleUSBCableConnect: cable connected, but don't have device configuration yet AppleSMCEmbedded::setPowerState(): ENTER powerStateOrdinal=1, _activeKeyCommand=0 newState=1 AppleA7IOPNub: withRegistryEntry, 47: allocated nub

    virtual IOService AppleANS2NVMeController::probe(IOService , SInt32 )::194:Found (ANS2) provider, returning score 100000 000001.217358 [email protected]: IOUSBDeviceController::gated_handleUSBCableConnect: cable connected, but don't have device configuration yet RTBuddy(SIO): start() - (Aug 12 [email protected]:50:37) RTBuddy(SIO): Boot args override: wdt = -1 virtual bool AppleANS2NVMeController::start(IOService )::394:Found the ANS2Endpoint1 bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT virtual IOFilterInterruptEventSource AppleANS2NVMeController::CreateDeviceInterrupt(IOInterruptEventSource::Action, IOFilterInterruptEventSource::Filter, IOService )::2719:ANS2 NVMe interrupt index - 0x4 LPM: Log data is NOT valid. 0x0 0x0 AppleDialogSPMIPMU::start: Primary PMU detected AppleARMRTC started!##### AppleDialogSPMIPMURTC started! Failed to read info-leg_scrpad/Library/Caches/com.apple.xbs/Sources/AppleSMC/AppleSMC-589.0.5/AppleSMCEmbeddedCharger/AppleSMCCharger.cpp:408 _setPowerStateGated() ENTER powerStateOrdinal=1, _powerState=1 AppleDialogSPMIPMURTC tick read!&&&&&&& AppleDialogSPMIPMURTC ending!%%% AppleARMRTC registering [email protected]@@@@@ AppleARMRTC service registered!$$$$$ AppleARMRTC publishing service!^^^^^^ apfs_module_start:2411: load: com.apple.filesystems.apfs, v1677.0.5, apfs-1677.0.5, 2020/08/12 com.apple.AppleFSCompressionTypeZlib kmod start apfs_sysctl_register:1253: done registering sysctls. com.apple.AppleFSCompressionTypeZlib load succeeded L2TP domain init L2TP domain init complete Load request for com.apple.nke.pptp failed: -603946998 Waiting on IOProviderClassIOMediaIOPropertyMatchPartition ID0x1 virtual IOReturn IONVMeController::CreateSubmissionQueue(uint16_t, uint8_t)::2886:SQ index=0 entrysize=64 virtual IOReturn IONVMeController::CreateSubmissionQueue(uint16_t, uint8_t)::2886:SQ index=1 entrysize=128 ANS2: MMIO write to unknown vendor register, offset=0x1210 value=0x240024, returning ANS2: MMIO write to unknown vendor register, offset=0x24004 value=0x1000, returning ANS2: MMIO write to unknown vendor register, offset=0x24008 value=0x0, returning ANS2: MMIO write to unknown vendor register, offset=0x24118 value=0x102, returning ANS2: MMIO write to unknown vendor register, offset=0x24108 value=0x102, returning ANS2: MMIO write to unknown vendor register, offset=0x24420 value=0x102, returning ANS2: MMIO write to unknown vendor register, offset=0x24414 value=0x102, returning ANS2: MMIO write to unknown vendor register, offset=0x2441c value=0x10002, returning ANS2: MMIO write to unknown vendor register, offset=0x24418 value=0x10002, returning ANS2: MMIO write to unknown vendor register, offset=0x24144 value=0x10002, returning ANS2: MMIO write to unknown vendor register, offset=0x24524 value=0x10002, returning ANS2: MMIO write to unknown vendor register, offset=0x24508 value=0x102, returning ANS2: MMIO write to unknown vendor register, offset=0x24504 value=0x10002, returning virtual void AppleANS2NVMeController::SetModeselRegister(uint32_t)::1186:Setting modesel to 0 ANS2: MMIO write to unknown vendor register, offset=0x1304 value=0x0, returning bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1964:nvme: Vendor ID : 0x1b36 bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1965:nvme: Model Number : QEMU NVMe Ctrl
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1966:nvme: Serial Number : QEMUT8030ANS
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1967:nvme: Firmware Rev : 1.0
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2000:nvme: S3E A0 Invalid 1x slc 1D 0 plane 128GB NAND bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2009:ECCVersion : 0 bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2010:FTL Rev : 0.0 bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2011:DM_Version : 0 bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2012:======================= bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2019:Found 16 namespaces in current NAND bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[1] as nstype[1] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[2] as nstype[2] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[3] as nstype[3] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[4] as nstype[4] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[5] as nstype[5] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[6] as nstype[6] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[7] as nstype[8] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[8] as nstype[0] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[9] as nstype[0] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[10] as nstype[0] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[11] as nstype[0] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[12] as nstype[0] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[13] as nstype[0] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[14] as nstype[0] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[15] as nstype[0] bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[16] as nstype[0] bool AppleEmbeddedNVMeController::SetSwapWriteLimit(uint32_t)::2192: Swap limit set to 2147483648bytes, 2GB uint32_t AppleEmbeddedNVMeNVRAM::GetNVRAMSize()::745:NVRAM size is 8192 bytes virtual bool AppleEmbeddedNVMeController::AllocateNodes(bool)::1578:allocateAll 1 dev_init:297: disk0 device accelerated crypto: 0 (compiled @ Aug 12 2020 22:19:57) dev_init:300: disk0 device_handle block size 512 block count 67108864 features 0 internal nx_kernel_mount:1134: disk0 initializing cache w/hash_size 4096 and cache size 10064 nx_kernel_mount:1402: disk0 checkpoint search: largest xid 355, best xid 355 @ 33 import_iboot_forwarded_roothash:2577: importing root hash ... apfs_extract_root_hash_arm:10001: could not retrieve system-volume-auth-blob from device tree import_iboot_forwarded_roothash:2580: apfs_extract_root_hash_and_manifest failed with error: No such file or directory (2) Got boot device = IOService:/AppleARMPE/[email protected]/AppleT803xIO/[email protected]/AppleASCWrapV2/iop-ans-nub/RTBuddyV2/RTBuddyService/AppleANS2NVMeController/[email protected]/IOBlockStorageDriver/QEMU NVMe Ctrl Media/IOGUIDPartitionScheme/Untitled [email protected] BSD root: disk0s1, major 1, minor 1 virtual bool AppleEmbeddedNVMeController::AllocateNodes(bool)::1605:Creating blockdevice with NSID - 2, NSTYPE - 2 apfs_vfsop_mountroot:2188: apfs: mountroot called! dev_init:297: disk0s1 device accelerated crypto: 3 (compiled @ Aug 12 2020 22:19:57) dev_init:300: disk0s1 device_handle block size 512 block count 67108864 features 22 internal solidstate nx_kernel_mount:1134: disk0s1 initializing cache w/hash_size 4096 and cache size 10064 virtual bool AppleEmbeddedNVMeController::AllocateNodes(bool)::1605:Creating blockdevice with NSID - 3, NSTYPE - 3 virtual bool AppleEmbeddedNVMeController::AllocateNodes(bool)::1605:Creating blockdevice with NSID - 6, NSTYPE - 6 [effaceable:ERR ] unable to find content [effaceable:INIT] started virtual bool AppleEmbeddedNVMeController::AllocateNodes(bool)::1605:Creating blockdevice with NSID - 7, NSTYPE - 8 virtual IOReturn AppleNVMeNamespaceDevice::GetDeviceProperties()::269: Logical Blocks Size = 512 virtual IOReturn AppleNVMeNamespaceDevice::GetDeviceProperties()::272: Block Count = 2048 virtual bool AppleNVMeNamespaceDevice::start(IOService *)::111:NVMe Namespace Device registration done for NSID: 7, NSTYPE: 8 virtual bool AppleEmbeddedNVMeController::StartController()::1547:Setting NAND status to Ready nx_kernel_mount:1402: disk0s1 checkpoint search: largest xid 355, best xid 355 @ 33 apfs_vfsop_mount:1848: Promoter has been locked for disk0s1 failed to find root-snapshot-name snapshot handle_mount:627: vol-uuid: 5133F48D-5D9E-499B-A8BA-45E692E36FD9 block size: 4096 block count: 8388608 (unencrypted; flags: 0x1; features: 8.0.12) handle_mount:640: setting dev block size to 4096 from 512 nx_volume_group_update:6634: Volume System is not in a volume group apfs_vfsop_mount:2171: disk0s1s1:0 mounted volume: System IOPlatformPanicAction -> AppleANS2NVMeController IOPlatformPanicAction -> AppleNubSynopsysOTG3Device IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> AppleSMC IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> AppleT8030PMGR panic(cpu 0 caller 0xfffffff007e63dfc): "Process 1 exec of /sbin/launchd failed, errno 86" Debugger message: panic Memory ID: 0x0 OS release type: Not set yet OS version: Not set yet Kernel version: Darwin Kernel Version 20.0.0: Wed Aug 12 22:56:55 PDT 2020; root:xnu-7195.0.33~64/RELEASE_ARM64_T8030 Kernel UUID: FDDAF386-4EA2-35FC-8235-1F167AEFD6F3 iBoot version: qemu-t8030 secure boot?: YES Paniclog version: 13 Kernel text base: 0xfffffff007004000 mach_absolute_time: 0x3a68cda Epoch Time: sec usec Boot : 0x62471b68 0x00092c8a Sleep : 0x00000000 0x00000000 Wake : 0x00000000 0x00000000 Calendar: 0x62471b69 0x000da7c4

    Panicked task 0xffffffe19b795f40: 1 pages, 1 threads: pid 1: init Panicked thread: 0xffffffe19ba185d0, backtrace: 0xffffffe8139e37f0, tid: 358 lr: 0xfffffff007a2af48 fp: 0xffffffe8139e3830 lr: 0xfffffff007a2ad48 fp: 0xffffffe8139e38a0 lr: 0xfffffff007b64940 fp: 0xffffffe8139e38c0 lr: 0xfffffff007b56e1c fp: 0xffffffe8139e3980 lr: 0xfffffff00811c5f4 fp: 0xffffffe8139e3990 lr: 0xfffffff007a2aa30 fp: 0xffffffe8139e3d10 lr: 0xfffffff007a2aa30 fp: 0xffffffe8139e3d70 lr: 0xfffffff0097db97c fp: 0xffffffe8139e3d90 lr: 0xfffffff007e63dfc fp: 0xffffffe8139e3e40 lr: 0xfffffff007e2fea0 fp: 0xffffffe8139e3e60 lr: 0xfffffff007a21b7c fp: 0xffffffe8139e3e90 lr: 0xfffffff00811caec fp: 0xffffffe8139e3ea0 lr: 0xfffffff007a61fd0 fp: 0xffffffe8139e3f00 lr: 0xfffffff00812495c fp: 0x0000000000000000

    ** Stackshot Succeeded ** Bytes Traced 10867 (Uncompressed 36160) ** IOPlatformPanicAction -> AppleANS2NVMeController IOPlatformPanicAction -> AppleNubSynopsysOTG3Device IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> AppleSMC IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> AppleT8030PMGR IOPlatformPanicAction -> AppleANS2NVMeController IOPlatformPanicAction -> AppleNubSynopsysOTG3Device IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> AppleSMC IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> AppleT8030PMGR IOPlatformPanicAction -> AppleANS2NVMeController IOPlatformPanicAction -> AppleNubSynopsysOTG3Device IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> AppleSMC IOPlatformPanicAction -> RTBuddyV2 IOPlatformPanicAction -> AppleT8030PMGR wdog panic (attempt 1) ` Boot command:

    ../qemu-system-aarch64 -accel tcg,tb-size=8192 -s -M t8030,trustcache-filename=static_tc,ticket-filename=root_ticket.der \ -kernel kernelcache.research.iphone12b \ -dtb Firmware/all_flash/DeviceTree.n104ap.im4p \ -append "debug=0x14e kextlog=0xffff serial=3 -v wdt=-1 launchd_unsecure_cache=1" \ -initrd 038-44135-124.dmg \ -cpu max -smp 4 \ -m 4G -serial mon:stdio \ -drive file=disk.1,format=raw,if=none,id=drive.1 \ -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1 \ -drive file=nvme.2,format=raw,if=none,id=drive.2 \ -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2 \ -drive file=nvme.3,format=raw,if=none,id=drive.3 \ -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3 \ -drive file=nvme.4,format=raw,if=none,id=drive.4 \ -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4 \ -drive file=nvram,if=none,format=raw,id=nvram \ -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram \ -drive file=nvme.6,format=raw,if=none,id=drive.6 \ -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6 \ -drive file=nvme.7,format=raw,if=none,id=drive.7 \ -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8 \ -monitor telnet:127.0.0.1:1235,server,nowait

    With blocksize set to 4096, I get mount errors.

    opened by iarchiveml 38
  • How to create an iOS VM

    How to create an iOS VM

    UPDATE: Check out the latest guide

    I'd be grateful if you could provide some instructions on how we can create a VM which can use the xnu kernel using this project.

    Do we need to follow the instructions from https://github.com/alephsecurity/xnu-qemu-arm64/wiki/Build-iOS-on-QEMU? Which ipsw / iOS version did you use?

    It looks like you're on iOS 14, so I guess that would make iPhone11,8,iPhone12,1_14.4_18D52_Restore.ipsw then, right? Did you use the kernelcache.release.iphone11b kernel image and the DeviceTree.n104ap.im4p device tree?

    PS - I had issues using the Python tools to extract the kernel image & device tree, but https://github.com/blacktop/ipsw seemed to work fine.


    Build dependencies

    sudo apt-get install -y git libglib2.0-dev libfdt-dev libpixman-1-dev zlib1g-dev ninja-build build-essential cmake gdb
    

    Build script

    git clone https://github.com/TrungNguyen1909/qemu-t8030
    cd qemu-t8030
    mkdir build
    cd build
    ../configure --enable-debug --target-list=aarch64-softmmu --disable-capstone --disable-slirp
    make -j$(nproc)
    

    Install lzfse

    git clone https://github.com/lzfse/lzfse
    cd lzfse
    mkdir build
    cmake ..
    make
    sudo make install
    

    Extract disks from IPSW file

    wget https://github.com/blacktop/ipsw/releases/download/v20.08.87/ipsw_20.08.87_Linux_x86_64.tar.gz
    tar xvzf ipsw_20.08.87_Linux_x86_64.tar.gz
    
    wget -nv -nc http://updates-http.cdn-apple.com/2021WinterFCS/fullrestores/001-98427/9C42F04F-C1B3-41C5-8E0D-0EDCB5087BB5/iPhone11,8,iPhone12,1_14.4_18D52_Restore.ipsw
    unzip iPhone11,8,iPhone12,1_14.4_18D52_Restore.ipsw
    
    ./ipsw img4 extract kernelcache.research.iphone12b
    lzfse -decode -i kernelcache.research.iphone12b.payload -o kernelcache.research.iphone12b.out
    
    ./ipsw img4 extract Firmware/all_flash/DeviceTree.n104ap.im4p
    lzfse -decode -i Firmware/all_flash/DeviceTree.n104ap.im4p.payload -o Firmware/all_flash/DeviceTree.n104ap.im4p.out
    
    ./ipsw img4 extract 038-96262-062.dmg
    ./ipsw img4 extract Firmware/038-96262-062.dmg.trustcache
    

    Launch script

    ~/git/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,kernel-filename=kernelcache.research.iphone12b,dtb-filename=DeviceTree.n104ap,kern-cmd-args="debug=0x8 kextlog=0xffff io=0xfff rd=md0 serial=2 -v nvme=0xffff pmgr-debug=0xff",ramdisk-filename=038-96262-062.dmg,xnu-ramfb=on,trustcache-filename=038-96262-062.dmg.trustcache -cpu max -m 4G -serial mon:stdio -monitor telnet:127.0.0.1:1235,server,nowait -smp 6
    
    ~/git/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,kernel-filename=kernelcache.research.iphone12b.out,dtb-filename=Firmware/all_flash/DeviceTree.n104ap.im4p.out,kern-cmd-args="debug=0x8 kextlog=0xffff io=0xfff rd=md0 serial=2 -v nvme=0xffff pmgr-debug=0xff",ramdisk-filename=038-96262-062.dmg.payload,xnu-ramfb=on,trustcache-filename=Firmware/038-96262-062.dmg.trustcache.payload -cpu max -m 4G -serial mon:stdio -monitor telnet:127.0.0.1:1235,server,nowait -smp 6
    
    good first issue 
    opened by qmfrederik 24
  • RootTicket verification error

    RootTicket verification error

    I cannot seem to restore the device:

    ┌──(nick㉿kali)-[~]
    └─$ idevicerestore -P -d --erase --restore-mode -i 0x1122334455667788 iPhone11,8,iPhone12,1_14.0_18A5351d_Restore.ipsw -T root_ticket.der
    Using ApTicket found at root_ticket.der length 8931
    progress: 0 0.000000
    idevice_event_cb: device 1122334455667788 (udid: 00008030-1122334455667788) connected in restore mode
    progress: 0 0.100000
    Found device in Restore mode
    INFO: device serial number is C39ZRMDEN72J
    restore_get_irecv_device: Found model N104DEV
    progress: 0 0.200000
    Identified device as n104ap, iPhone12,1
    progress: 0 0.600000
    Extracting BuildManifest from IPSW
    progress: 0 0.800000
    Product Version: 14.0
    Product Build: 18A5351d Major: 18
    Device supports Image4: true
    ERROR: Unable to find any build identities
    

    idevicerestore commit 38595f0b7dac3d53033f93e9893d9be49996ba95 with patch applied iOS version: 14.0 VM is kali linux rolling (minimal) root_ticket.der made from ticket.shsh2 in xnu-qemu-arm64-tools Device appears to enter restore mode successfully

    Additionally, the patch does not apply for configure.ac I ended up adding AC_SEARCH_LIBS([pthread_create], [pthread]) to configure.ac myself and then remove that hunk of the patch.

    Linux boot command:

    ${HOME}/qemu-t8030/build/qemu-system-x86_64 -smp 1 -m 768 \
    -machine q35 \
    -device virtio-vga,xres=640,yres=480 \
    -enable-kvm \
    -cpu qemu64 \
    -usb \
    -device usb-ehci,id=ehci \
    -device usb-tcp-remote,bus=ehci.0 \
    -drive file=${HOME}/vm_images/kali.qcow2 \
    -net user,hostfwd=tcp::8122-:22 \
    -net nic \
    -monitor telnet:127.0.0.1:1236,server,nowait
    

    iOS boot command:

    ${HOME}/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,trustcache-filename=038-44135-124.dmg.trustcache.out \
    -kernel kernelcache.research.iphone12b \
    -dtb DeviceTree.n104ap.im4p \
    -append "debug=0x14e kextlog=0xffff serial=3 -v" \
    -initrd 038-44135-124.dmg \
    -cpu max -smp 4 \
    -m 2G -serial mon:stdio \
    -drive file=nvme.1,format=raw,if=none,id=drive.1 \
    -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.2,format=raw,if=none,id=drive.2 \
    -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.3,format=raw,if=none,id=drive.3 \
    -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.4,format=raw,if=none,id=drive.4 \
    -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvram,if=none,format=raw,id=nvram \
    -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.6,format=raw,if=none,id=drive.6 \
    -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.7,format=raw,if=none,id=drive.7 \
    -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
    -monitor telnet:127.0.0.1:1235,server,nowait
    

    Nick Chan

    opened by asdfugil 12
  • Linux VM couldn't find the emulated device

    Linux VM couldn't find the emulated device

    I followed the instructions in the wiki, build QEMU from this repo, launch a Linux VM using it (I use Slax). I also generated root_ticket.der and put it in both host Linux and guess Linux VM, start the Linux VM then start the iOS VM.

    The iOS VM boot to the line waiting for host to trigger start of restore [timeout of 120 seconds] image

    But Linux VM can't find the device, although it found something using lsusb: image

    /tmp/usbqemu is available in the host: image

    When the iOS VM run out of time and reboot, it shows something like RTBuddy(SMC): WARNING: failed to send ping. image

    Any ideas? Thanks!

    opened by raspiduino 11
  • Support J327AP devices

    Support J327AP devices

    J327AP is AppleDisplay2,1 aka Studio Display Currently, the kernel can boot to restored (not restored_external), and such a restore could be attempted. There is a failed kernel patch: qemu-system-aarch64: Missing patch: AKSUC_handle, which is probably related to the problem below. Anyways, the system successfully boots to ramdisk with bash running. The firmware can be obtained from here, which is DarwinOS 15.4, although sw_vers still outputs iPhone OS. Now, this is an OTA update, but the AssetData/ directory in it is the structure of an IPSW. The problem Stuck trying to create protecteted filesystems To reproduce

    1. Extract the OTA update
    2. cd to the AssetData directory in the OTA update, we want to edit BuildManifest.plist such that idevicerestore will restored it.
    3. Create display.der with create_apticket.py, the board config should be j327ap
    4. In BuildManifest.plist, under SupportedProductTypes, change AppleDisplay12,1 to iPhone12,1
    5. ...under DeviceClass, change J327AP to N104AP
    6. Zips up every file in the AssetData directory to create a display.ipsw file
    7. create the qemu boot command, use the 018-26834-343.dmg file, which is a FactoryRamDisk as the other FactorySupportRamDisk does not seem to have restored. The following is my boot command:
    ${HOME}/qemu-t8030/build/qemu-system-x86_64 -smp 4 -m 768 \
    -machine q35 \
    -device virtio-vga,xres=640,yres=480 \
    -enable-kvm \
    -cpu qemu64 \
    -usb \
    -device usb-ehci,id=ehci \
    -device usb-tcp-remote,bus=ehci.0 \
    -drive file=${HOME}/vm_images/kali.qcow2 \
    -net user,hostfwd=tcp::8122-:22 \
    -net nic \
    -monitor telnet:127.0.0.1:1236,server,nowait &
    sleep 1
    ${HOME}/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,trustcache-filename=018-26834-343.dmg.trustcache.out,ticket-filename=root_ticket.der \
    -kernel kernelcache.release.j327.out \
    -dtb DeviceTree.j327ap.im4p \
    -append "kextlog=0xffff debug=0x14e -v launchd_missing_exec_no_panic=1 serial=3 wdt=-1 keepsyms=1 launchd_unsecure_cache=1 wdt=-1" \
    -initrd '018-26834-343.dmg.out'   \
    -cpu max -smp 4 \
    -m 2G -serial mon:stdio \
    -drive file=nvme.1,format=raw,if=none,id=drive.1 \
    -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvram,if=none,format=raw,id=nvram \
    -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.2,format=raw,if=none,id=drive.2 \
    -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.3,format=raw,if=none,id=drive.3 \
    -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.4,format=raw,if=none,id=drive.4 \
    -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.6,format=raw,if=none,id=drive.6 \
    -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.7,format=raw,if=none,id=drive.7 \
    -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
    -monitor telnet:127.0.0.1:1235,server,nowait
    
    1. (Optional) modify the ramdisk and add a shell and stuff
    2. In the Linux VM, the device should show up as Apple Inc.,
    3. Try to restore the device: idevicerestore -P -d --erase --restore-mode -i 0x1122334455667788 display.ipsw -T display.der
    4. Wait until it reaches 97%
    5. Stuck trying to create protected filesystem Related restored log:
    [08:19:36.0505-GMT]{4>9} CHECKPOINT BEGIN: (null):[0x0674] create_protected_filesystems
    restore-step-ids = {0x1103067B:77;0x11030674:135}
    restore-step-names = {0x1103067B:perform_restore_installing;0x11030674:create_protected_
    filesystems}
    restore-step-uptime = 217
    restore-step-user-progress = 97
    entering create_protected_filesystems
    ramrod_display_set_granular_progress_forced: 97.000000
    content-protect property not found
    encryptable property not found
    creating class d key for /mnt2
    

    idevicerestore log:

    Requesting EAN Data (74)
    Creating Protected Volume (67)
    FDR 0x5586d0a342c0 timeout waiting for command
    FDR 0x5586d0a342c0 waiting for message...
    FDR 0x5586d0a342c0 timeout waiting for command
    FDR 0x5586d0a342c0 waiting for message...
    No data to read (timeout)
    FDR 0x5586d0a342c0 timeout waiting for command
    FDR 0x5586d0a342c0 waiting for message...
    No data to read (timeout)
    FDR 0x5586d0a342c0 timeout waiting for command
    FDR 0x5586d0a342c0 waiting for message...
    FDR 0x5586d0a342c0 timeout waiting for command
    FDR 0x5586d0a342c0 waiting for message...
    No data to read (timeout)
    

    Full serial output Full idevicerestore log

    wontfix 
    opened by asdfugil 11
  • Cannot mount root from NAND after successful restore

    Cannot mount root from NAND after successful restore

    After a successful restore, rootfs cannot be mounted for some reason. The rootfs is already modified, and have its snapshot renamed to orig-fs

    rootfs binaries (not the one in the wiki as I wanted a newer bash) bash.plist and launchd.plist from setup-ios Although I do not these details mattered when the rootfs is not even mounted.

    A filesystem check on the APFS container reported no problem, and it can be mounted on macOS.

    This appears to be the log related the the problem:

    Got boot device = IOService:/AppleARMPE/[email protected]/AppleT803xIO/[email protected]/AppleASCWrapV2/iop-ans-nub/RTBuddyV2/RTBuddyService/AppleANS2NVMeController/[email protected]/IOBlockStorageDriver/QEMU NVMe Ctrl Media/IOFDiskPartitionScheme/Untitled [email protected]
    BSD root: disk0s1, major 1, minor 1
    apfs_vfsop_mountroot:2188: apfs: mountroot called!
    dev_init:297: disk0s1 device accelerated crypto: 3 (compiled @ Aug 12 2020 22:19:57)
    dev_init:300: disk0s1 device_handle block size 4096 block count 8388607 features 22 internal solidstate
    apfs_vfsop_mount:1745: unable to root from devvp <ptr> (root_device): 79
    apfs_vfsop_mountroot:2192: apfs: mountroot failed, error: 79
    virtual bool AppleEmbeddedNVMeController::StartController()::1547:Setting NAND status to Ready
    hfs_ValidateHFSPlusVolumeHeader: unknown Volume Signature : 0
    hfs_mount: hfs_mountfs returned error=22 for device unknown-dev
    mount(2) failed
    

    Host is Debian bullseye Full log:

    Loading iOS 14.0...
    kernel_low: 0xfffffff004000000
    kernel_high: 0xfffffff00a4cd4f0
    KPF: found apfs_vfsop_mount
    KPF: found handle_eval_rootauth
    KPF: Found AMFI hashtype check
    kpf_amfi_callback: Found AMFI (Leaf)
    kpf_amfi_callback: start @ 0xfffffff007b5d718
    kpf_amfi_callback: Found lookup_in_static_trust_cache
    KPF: Found mac_mount
    KPF: Found mac_mount
    kpf_amfi_callback: Found AMFI (Routine)
    kpf_amfi_callback: start @ 0xfffffff0097edcb8
    kpf_amfi_callback: Found lookup_in_trust_cache_module
    KPF: Found AppleKeyStoreUserClient::handleUserClientCommandGated
    Qemu FB realize
    g_virt_base: 0xfffffff004000000
    g_phys_base: 0x0000000800000000
    entry: 0x00000008041204e8
    boot_mode: 0
    auto-boot=true
    cmdline: [debug=0x14e kextlog=0xffff rd=disk0s1 serial=3 -v wdt=-1]
    iBoot version: qemu-t8030
    Darwin Image4 Validator Version 3.0.0: Wed Aug 12 22:19:21 PDT 2020; root:AppleImage4-106.0.4.0.1~129/AppleImage4/RELEASE_ARM64E
    AMFI is running in RESEARCH mode!
    AUC:[0xffffffe19b677dd0]::init(0xffffffe19b5cc1b8)
    
    AUC:[0xffffffe19b677dd0]::probe(0xffffffe19b445fe0, 0xffffffe80a31bdac)
    
    AppleCredentialManager: init: called, instance = <ptr>.
    ACMFirstResponderKernelService: init: called, .
    ACMRM-S: init: called, starting PersistentStore service.
    ACMRM-C: init: called, starting AccessoryCache service.
    ACMKernelService: initValueFromBootArgAliasesUInt32: acc-cache size = 16 (default).
    ACMKernelService: initValueFromBootArgAliasesUInt32: acc-cache expiration = 2592000 (default).
    ACMRM: init: called, starting TRM service.
    ACMRM-A: init: called, starting TRM Analytics service.
    ACMKernelService: initValueFromBootArgAliasesUInt32: analytics collection period = 86400 (default).
    ACMKernelService: initValueFromBootArgAliasesUInt32: policy mode timeout = 259200 (default).
    ACMRM-A: notifyStandardModeTimeoutChanged: called, value = 259200 (modified = YES).
    ACMKernelService: initValueFromBootArgAliasesUInt32: (bounded) grace period timeout = 3600 (default).
    ACMRM-A: notifyGracePeriodTimeoutChanged: called, value = 3600 (modified = YES).
    ACMKernelService: initValueFromBootArgAliasesUInt32: enabled = 1 (default).
    ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO* BtArg=NO LegHW=NO OSEnv=NO | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO).
    ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO BtArg=NO* LegHW=NO OSEnv=NO | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO).
    ACMRM: _loadDisabledByOSEnvironment: disabled by OSEnvironment: NO.
    ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO BtArg=NO LegHW=NO OSEnv=NO* | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO).
    ACMRM: _mapAndPublishTRM: set TRM_PolicyTimeout = 259200.
    ACMRM: _mapAndPublishTRM: sending kIOMessageServicePropertyChange(n=1) while DISABLED, TRM: 259200 -/ff 4294967295 -/ff miss=ff (CUR: 259200 -/ff 4294967295 -/ff).
    AppleCredentialManager: init: returning, result = true, instance = <ptr>.
    AppleARMBootPerf: Error: profile region not found (2)
    AppleARMBootPerf: Error: failed to publish profile data (2)
    virtual bool CoreAnalyticsHub::start(IOService *)::105:CoreAnalyticsHub start
    AppleInterruptController::start: Num Shared Timestamps == 0
    AppleSSE::start called
    AppleSSE::start returning, result = 1
    AUC:[0xffffffe19b677dd0]::start(0xffffffe19b445fe0)
    
    AppleSEPKeyStore:321:0: starting (BUILT: Aug 12 2020 22:51:30)
    AppleSEPKeyStore:545:0: _sep_enabled = 1
    AppleCredentialManager: start: called, instance = <ptr>.
    ACMRM: _publishIOResource: AppleUSBRestrictedModeTimeout = 259200.
    AppleGPIOICController::start: this: <ptr>, _gpioicBaseAddress: <ptr>
    AppleS8000AES::start: registers at phys:0x0x235008000/0x0x23d2d0000 virt:0x<ptr>/0x0x4000 / 0x<ptr>/0x0x4000
    AppleCredentialManager: start: initializing power management, instance = <ptr>.
    AppleCredentialManager: start: started, instance = <ptr>.
    AppleCredentialManager: start: returning, result = true, instance = <ptr>.
    virtual bool AppleARMLightEmUp::start(IOService *): starting...
    000001.935910 wlan0.A[1] [email protected]:Default options property found with value 4
    Creating an object of AppleBCMWLANPlatformFunctionEmbeddedAMFM class
    000001.948877 wlan0.A[2] [email protected]: Raised adjustBusy(+1), getBusyState() -> 1
    000001.949319 wlan0.A[3] [email protected]:Setting up notifier for CoreAnalyticsHub
    AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>
    
    RTBuddy(ANS2): start(<ptr>) - (Aug 12 [email protected]:50:37)
    RTBuddy(ANS2): Boot args override: wdt = -1
    RTBuddy(ANS2): Resuming...
    
    AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>
    
    RTBuddy(SMC): start(<ptr>) - (Aug 12 [email protected]:50:37)
    RTBuddy(SMC): Boot args override: wdt = -1
    RTBuddy(SMC): Resuming...
    
    Starting AppleSMC kext(<ptr>) - (Aug 12 [email protected]:51:44)
    AppleSMCEmbedded::setPowerState(): ENTER powerStateOrdinal=1, _activeKeyCommand=0 newState=1
    virtual IOService *AppleANS2NVMeController::probe(IOService *, SInt32 *)::194:Found (ANS2) provider, returning score 100000
    virtual bool AppleANS2NVMeController::start(IOService *)::394:Found the ANS2Endpoint1
    bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT
    virtual IOFilterInterruptEventSource *AppleANS2NVMeController::CreateDeviceInterrupt(IOInterruptEventSource::Action, IOFilterInterruptEventSource::Filter, IOService *)::2719:ANS2 NVMe interrupt index - 0x4
    AppleGPIOICController::start: this: <ptr>, _gpioicBaseAddress: <ptr>
    AppleGPIOICController::start: this: <ptr>, _gpioicBaseAddress: <ptr>
    AppleS5L8960XUSBPhy::start: hsic disabled
    Identified Serial Port uart7 at 0x23521c000(<ptr>)
    Identified Serial Port uart0 at 0x235200000(<ptr>)
    AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>
    
    RTBuddy(SIO): start(<ptr>) - (Aug 12 [email protected]:50:37)
    RTBuddy(SIO): Boot args override: wdt = -1
    000002.252741 [email protected]: IOUSBDeviceController::prepareDefaults: model iPhone version 12.1
    000002.282571 [email protected]: IOUSBDeviceController::gated_handleUSBCableConnect: cable connected, but don't have device configuration yet
    000002.287644 [email protected]: IOUSBDeviceController::gated_handleUSBCableConnect: cable connected, but don't have device configuration yet
    LPM: Log data is NOT valid. 0x0 0x0
    AppleDialogSPMIPMU::start: Primary PMU detected
    /Library/Caches/com.apple.xbs/Sources/AppleSMC/AppleSMC-589.0.5/AppleSMCEmbeddedCharger/AppleSMCCharger.cpp:408 _setPowerStateGated() ENTER powerStateOrdinal=1, _powerState=1
    AppleARMRTC started!#####
    AppleDialogSPMIPMURTC started!******
    Failed to read info-leg_scrpadAppleDialogSPMIPMURTC tick read!&&&&&&&
    AppleDialogSPMIPMURTC ending!%%%
    AppleARMRTC registering [email protected]@@@@@
    AppleARMRTC service registered!$$$$$
    AppleARMRTC publishing service!^^^^^^
    apfs_module_start:2411: load: com.apple.filesystems.apfs, v1677.0.5, apfs-1677.0.5, 2020/08/12
    com.apple.AppleFSCompressionTypeZlib kmod start
    apfs_sysctl_register:1253: done registering sysctls.
    com.apple.AppleFSCompressionTypeZlib load succeeded
    L2TP domain init
    L2TP domain init complete
    Load request for com.apple.nke.pptp failed: -603946998
    Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOService</string><key>BSD Name</key><string ID="2">disk0s1</string></dict>
    virtual IOReturn IONVMeController::CreateSubmissionQueue(uint16_t, uint8_t)::2886:SQ index=0 entrysize=64
    virtual IOReturn IONVMeController::CreateSubmissionQueue(uint16_t, uint8_t)::2886:SQ index=1 entrysize=128
    ANS2: MMIO write to unknown vendor register, offset=0x1210 value=0x240024, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24004 value=0x1000, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24008 value=0x0, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24118 value=0x102, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24108 value=0x102, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24420 value=0x102, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24414 value=0x102, returning
    ANS2: MMIO write to unknown vendor register, offset=0x2441c value=0x10002, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24418 value=0x10002, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24144 value=0x10002, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24524 value=0x10002, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24508 value=0x102, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24504 value=0x10002, returning
    virtual void AppleANS2NVMeController::SetModeselRegister(uint32_t)::1186:Setting modesel to 0
    ANS2: MMIO write to unknown vendor register, offset=0x1304 value=0x0, returning
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1964:nvme: Vendor ID     : 0x1b36
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1965:nvme: Model Number  : QEMU NVMe Ctrl                          
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1966:nvme: Serial Number : QEMUT8030ANS        
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1967:nvme: Firmware Rev  : 1.0     
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2000:nvme: S3E A0 Invalid 1x slc 1D 0 plane 128GB NAND
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2009:ECCVersion   : 0
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2010:FTL Rev      : 0.0
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2011:DM_Version   : 0
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2012:=======================
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2019:Found 16 namespaces in current NAND
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[1] as nstype[1]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[2] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[3] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[4] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[5] as nstype[5]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[6] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[7] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[8] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[9] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[10] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[11] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[12] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[13] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[14] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[15] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[16] as nstype[0]
    bool AppleEmbeddedNVMeController::SetSwapWriteLimit(uint32_t)::2192: Swap limit set to 2147483648bytes, 2GB
    uint32_t AppleEmbeddedNVMeNVRAM::GetNVRAMSize()::745:NVRAM size is 8192 bytes
    virtual bool AppleEmbeddedNVMeController::AllocateNodes(bool)::1578:allocateAll 1
    Got boot device = IOService:/AppleARMPE/[email protected]/AppleT803xIO/[email protected]/AppleASCWrapV2/iop-ans-nub/RTBuddyV2/RTBuddyService/AppleANS2NVMeController/[email protected]/IOBlockStorageDriver/QEMU NVMe Ctrl Media/IOFDiskPartitionScheme/Untitled [email protected]
    BSD root: disk0s1, major 1, minor 1
    apfs_vfsop_mountroot:2188: apfs: mountroot called!
    dev_init:297: disk0s1 device accelerated crypto: 3 (compiled @ Aug 12 2020 22:19:57)
    dev_init:300: disk0s1 device_handle block size 4096 block count 8388607 features 22 internal solidstate
    apfs_vfsop_mount:1745: unable to root from devvp <ptr> (root_device): 79
    apfs_vfsop_mountroot:2192: apfs: mountroot failed, error: 79
    virtual bool AppleEmbeddedNVMeController::StartController()::1547:Setting NAND status to Ready
    hfs_ValidateHFSPlusVolumeHeader: unknown Volume Signature : 0
    hfs_mount: hfs_mountfs returned error=22 for device unknown-dev
    mount(2) failed
    Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOService</string><key>BSD Name</key><string ID="2">disk0s1</string></dict>
    Got boot device = IOService:/AppleARMPE/[email protected]/AppleT803xIO/[email protected]/AppleASCWrapV2/iop-ans-nub/RTBuddyV2/RTBuddyService/AppleANS2NVMeController/[email protected]/IOBlockStorageDriver/QEMU NVMe Ctrl Media/IOFDiskPartitionScheme/Untitled [email protected]
    BSD root: disk0s1, major 1, minor 1
    apfs_vfsop_mountroot:2188: apfs: mountroot called!
    dev_init:297: disk0s1 device accelerated crypto: 3 (compiled @ Aug 12 2020 22:19:57)
    dev_init:300: disk0s1 device_handle block size 4096 block count 8388607 features 22 internal solidstate
    apfs_vfsop_mount:1745: unable to root from devvp <ptr> (root_device): 79
    apfs_vfsop_mountroot:2192: apfs: mountroot failed, error: 79
    hfs_ValidateHFSPlusVolumeHeader: unknown Volume Signature : 0
    hfs_mount: hfs_mountfs returned error=22 for device unknown-dev
    mount(3) failed
    

    Nick Chan

    opened by asdfugil 10
  • Panic when restoring (Creating 7 namespaces on NAND)

    Panic when restoring (Creating 7 namespaces on NAND)

    I was following the Wiki guide and was restoring the emulator, but shortly after starting the restore process, it hangs and then panics at Creating 7 namespaces on NAND.

    Here is the full log from start to panic. File modification dates show that nvme.1 and nvram storage files were modified, but there still look zeroed out (except the header in nvram). My environment is macOS 12.4 on M1 MacBook Air, and I compiled the tools and code as of today. Below is my launch command.

    qemu-t8030/build/qemu-system-aarch64 -s -M t8030,trustcache-filename=firmware/Firmware/038-44135-124.dmg.trustcache,ticket-filename=root_ticket.der \
    -kernel firmware/kernelcache.research.iphone12b \
    -dtb firmware/Firmware/all_flash/DeviceTree.n104ap.im4p \
    -append "debug=0x14e kextlog=0xffff serial=3 -v -wdt=-1" \
    -initrd firmware/038-44135-124.dmg \
    -cpu max -smp 6 \
    -m 4G -serial mon:stdio \
    -drive file=nvme.1,format=raw,if=none,id=drive.1 \
    -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.2,format=raw,if=none,id=drive.2 \
    -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.3,format=raw,if=none,id=drive.3 \
    -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.4,format=raw,if=none,id=drive.4 \
    -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvram,if=none,format=raw,id=nvram \
    -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.6,format=raw,if=none,id=drive.6 \
    -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.7,format=raw,if=none,id=drive.7 \
    -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
    -monitor telnet:127.0.0.1:1235,server,nowait
    
    opened by nick-botticelli 9
  • Cannot boot emulator, kernel panic, thermalmonitord

    Cannot boot emulator, kernel panic, thermalmonitord

    Im having this issue while booting a recently restored system

    apfs_is_valid_class:2253: rejecting class open (class 2) because we're not content protected
    handle_mount:627: vol-uuid: 3D9B78CD-479A-4DC6-ACE3-B6D84DC5166E block size: 4096 block count: 8388597 (unencrypted; flags: 0x1; features: 8.0.12)
    handle_mount:640: setting dev block size to 4096 from 512
    nx_volume_group_update:6634: Volume System is not in a volume group
    apfs_vfsop_mount:2171: disk0s1s1:0 mounted volume: System
    handle_revert_to_snapshot:5195: On next mount, volume will revert to snapshot 'com.apple.os.update-5118EA8F39FF61D152BA7E1F92591910CDE7A2B09B867D8D58DC37E2CDC0B7C98DD296D4BF57862D143413DD17012D70' w/snap xid 54
    apfs_vfsop_unmount:2375: disk0s1: unmounting volume 'System'
    apfs_vfsop_unmount:2406: waiting for cleaners to finish: purgatory 
    apfs_stop_bg_work:1028: disk0s1s1:0 Volume System is unmounting, stop any bg work
    tx_flush:1075: disk0s1 xid 323 tx stats: # 20 finish 22 enter 599 wait 2 209518us close 32us flush 315223us
    apfs: total mem allocated: 12501875 (11 mb);
    apfs_vfsop_unmount:2682: all done.  going home.  (numMountedAPFSVolumes 5)
    revert_to_snapshot:1260: Reverting to snapshot w/xid 54 and old sblock oid 8259450.
    revert_extents_to_snapshot:1093: free'ing extents in main extentref tree 8257872
    free_allocated_snapshot_extents:1008: processed 0 extents and free'd 0 blocks
    obj_cache_remove_reverted_fs_objects:1547: disk0s1s1:0 removing reverted fs objects for fs 1026: 55 - 326
    revert_to_snapshot:1336: DONE reverting to snapshot w/xid 54
    handle_mount:627: vol-uuid: 3D9B78CD-479A-4DC6-ACE3-B6D84DC5166E block size: 4096 block count: 8388597 (unencrypted; flags: 0x1; features: 8.0.12)
    handle_mount:640: setting dev block size to 4096 from 512
    nx_volume_group_update:6634: Volume System is not in a volume group
    apfs_vfsop_mount:2171: disk0s1s1:0 mounted volume: System
    apfs_vfsop_unmount:2375: disk0s1: unmounting volume 'System'
    apfs: total mem allocated: 13116575 (12 mb);
    apfs_vfsop_unmount:2682: all done.  going home.  (numMountedAPFSVolumes 5)
    static IOReturn AppleMobileFileIntegrityUserClient::isCdhashInTrustCache(OSObject *, void *, IOExternalMethodArguments *): Process 170 is checking if a cdhash is in the trust cache
    static IOReturn AppleMobileFileIntegrityUserClient::isCdhashInTrustCache(OSObject *, void *, IOExternalMethodArguments *): Returning IOReturn 0x0 to process 170
    tx_flush:1075: disk0s1 xid 343 tx stats: # 40 finish 42 enter 3116 wait 6 281119us close 18us flush 354580us
    tx_flush:1033: disk0s1 tx xid 344 took 1046026 us to sync and write superblock
    IOPlatformPanicAction -> AppleANS2NVMeController
    IOPlatformPanicAction -> AppleNubSynopsysOTG3Device
    IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> AppleSMC
    IOPlatformPanicAction -> AppleT8030PMGR
    panic(cpu 3 caller 0xfffffff009169144): userspace watchdog timeout: no successful checkins from com.apple.thermalmonitord since load
    service returned not alive with context : is_alive_func returned unhealthy : current 400000000000, mask 7fffffffffff, expected 7fffffffffff.  SD: 1 Missing sensor(s): TG0B TG0V TP1A TP2C TP3R TP4H TP5d TP0Z Th0a Th0f Th0x Th1a Th1f Th1x Th2a Th2f Th2x Tc0a Tc0f Tc0x Tc1a Tc1f Tc1x Tc2a Tc2f Tc2x 
    service: com.apple.backboardd, total successful checkins since load (180 seconds ago): 19, last successful checkin: 0 seconds ago
    service: com.apple.mediaserverd, total successful checkins since load (180 seconds ago): 17, last successful checkin: 0 seconds ago
    service: com.apple.logd, total successful checkins since load (180 seconds ago): 19, last successful checkin: 0 seconds ago
    service: com.apple.thermalmonitord, no successful checkins since load (180 seconds ago)
    service: com.apple.runningboardd, total successful checkins since load (180 seconds ago): 19, last successful checkin: 0 seconds ago
    service: com.apple.wifid, total successful checkins s
    Debugger message: panic
    Memory ID: 0x0
    OS release type: Beta
    OS version: 18A5351d
    Kernel version: Darwin Kernel Version 20.0.0: Wed Aug 12 22:56:55 PDT 2020; root:xnu-7195.0.33~64/RELEASE_ARM64_T8030
    Kernel UUID: FDDAF386-4EA2-35FC-8235-1F167AEFD6F3
    iBoot version: qemu-t8030
    secure boot?: YES
    Paniclog version: 13
    Kernel text base:  0xfffffff007004000
    mach_absolute_time: 0x11ab03024
    Epoch Time:        sec       usec
      Boot    : 0x62376f1f 0x000825ce
      Sleep   : 0x00000000 0x00000000
      Wake    : 0x00000000 0x00000000
      Calendar: 0x62376fe3 0x0008cccd
    
    Total cpu_usage: 118819282
    Thread task pri cpu_usage
    0xffffffe19c0cd170 watchdogd 97 0
    0xffffffe19c868000 backboardd 63 0
    0xffffffe19c0cc5d0 thermalmonitord 37 0
    0xffffffe19cb84000 watchdogd 31 105505
    0xffffffe19cae68b0 lsd 31 4488402
    
    Panicked task 0xffffffe19be98640: 242 pages, 5 threads: pid 52: watchdogd
    Panicked thread: 0xffffffe19c0cd170, backtrace: 0xffffffe9c237b1e0, tid: 549
    		  lr: 0xfffffff007a2af48  fp: 0xffffffe9c237b220
    		  lr: 0xfffffff007a2ad48  fp: 0xffffffe9c237b290
    		  lr: 0xfffffff007b64940  fp: 0xffffffe9c237b2b0
    		  lr: 0xfffffff007b56e1c  fp: 0xffffffe9c237b370
    		  lr: 0xfffffff00811c5f4  fp: 0xffffffe9c237b380
    		  lr: 0xfffffff007a2aa30  fp: 0xffffffe9c237b700
    		  lr: 0xfffffff007a2aa30  fp: 0xffffffe9c237b760
    		  lr: 0xfffffff0097db9c0  fp: 0xffffffe9c237b780
    		  lr: 0xfffffff009169144  fp: 0xffffffe9c237b7a0
    		  lr: 0xfffffff009168e38  fp: 0xffffffe9c237b7c0
    		  lr: 0xfffffff00808cb78  fp: 0xffffffe9c237b820
    		  lr: 0xfffffff009168130  fp: 0xffffffe9c237b900
    		  lr: 0xfffffff00809a98c  fp: 0xffffffe9c237baa0
    		  lr: 0xfffffff007b25190  fp: 0xffffffe9c237bbc0
    		  lr: 0xfffffff007a30e9c  fp: 0xffffffe9c237bc20
    		  lr: 0xfffffff007a021d8  fp: 0xffffffe9c237bca0
    		  lr: 0xfffffff007a1d810  fp: 0xffffffe9c237bd60
    		  lr: 0xfffffff007b4a434  fp: 0xffffffe9c237be30
    		  lr: 0xfffffff007b57094  fp: 0xffffffe9c237bef0
    		  lr: 0xfffffff00811c5f4  fp: 0xffffffe9c237bf00
    
    
    ** Stackshot Succeeded ** Bytes Traced 115555 (Uncompressed 294176) **
    IOPlatformPanicAction -> AppleANS2NVMeController
    IOPlatformPanicAction -> AppleNubSynopsysOTG3Device
    IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> AppleSMC
    IOPlatformPanicAction -> AppleT8030PMGR
    IOPlatformPanicAction -> AppleANS2NVMeController
    IOPlatformPanicAction -> AppleNubSynopsysOTG3Device
    IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> AppleSMC
    IOPlatformPanicAction -> AppleT8030PMGR
    IOPlatformPanicAction -> AppleANS2NVMeController
    IOPlatformPanicAction -> AppleNubSynopsysOTG3Device
    IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> RTBuddyV2
    IOPlatformPanicAction -> AppleSMC
    IOPlatformPanicAction -> AppleT8030PMGR
    wdog panic (attempt 1)
    wdt_update: wdog reset chip
    

    this is my startup script, which is the same which is found at Bringing Up The Emulator - Auto Boot section only added -noconsole -vnc :1 -k es

    qemu-t8030/build/qemu-system-aarch64 -s -M t8030,trustcache-filename=Firmware/038-44135-124.dmg.trustcache,ticket-filename=root_ticket.der \
    -kernel kernelcache.research.iphone12b \
    -dtb Firmware/all_flash/DeviceTree.n104ap.im4p \
    -append "debug=0x14e kextlog=0xffff serial=3 -v" \
    -initrd 038-44135-124.dmg \
    -cpu max -smp 4 \
    -m 4G -serial mon:stdio \
    -drive file=nvme.1,format=raw,if=none,id=drive.1 \
    -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.2,format=raw,if=none,id=drive.2 \
    -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.3,format=raw,if=none,id=drive.3 \
    -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.4,format=raw,if=none,id=drive.4 \
    -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvram,if=none,format=raw,id=nvram \
    -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.6,format=raw,if=none,id=drive.6 \
    -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.7,format=raw,if=none,id=drive.7 \
    -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
    -monitor telnet:127.0.0.1:1235,server,nowait \
    -nographic \
    -vnc :1 -k es \
    
    opened by PabloGirol 9
  • Support loading kernel, device tree, trust cache from im4p files

    Support loading kernel, device tree, trust cache from im4p files

    This adds support for extracting the kernel, device tree and trust cache from im4p files.

    It turns out qemu doesn't link with OpenSSL after all, but does use GnuTLS which uses libtasn1, which supports parsing ASN.1 files as well.

    It does require you to define a schema for the ASN.1 structure which you're parsing (hence the img4.asn1 file), which is then converted into a "definitions array" using asn1Parser -o img4.c -n img4_definitions_array img4.asn1.

    The code assumes:

    • The file is an IM4P file if asn1_der_decoding can successfully parse the file.
    • The payload is LZFSE-compressed if it starts with the string bvx.
    opened by qmfrederik 8
  • ERROR: Dependency

    ERROR: Dependency "appleframeworks" not found

    When running the below command as per the Wiki, I'm receiving the following error:

    $ ../configure --target-list=aarch64-softmmu,x86_64-softmmu --disable-capstone --enable-lzfse --disable-werror
    […]
    ../meson.build:192:2: ERROR: Dependency "appleframeworks" not found, tried framework
    

    My system is a 2021 16" MacBook Pro w/ M1 Max:

    $ uname -a
    Darwin Jacobs-MBP.lan 21.3.0 Darwin Kernel Version 21.3.0: Wed Jan  5 21:37:58 PST 2022; root:xnu-8019.80.24~20/RELEASE_ARM64_T6000 x86_64
    
    opened by jacobcxdev 7
  • Failed to read nvram property

    Failed to read nvram property

    I followed the bringing the emulator, from what I could understand from the error is there could be some issue with nvram or missing plist files.

    Following is the directory strucuture

    iphone:
    total 5304212
    -rw-r--r--  1 zoro zoro   107767835 Jan  9  2007 038-44087-125.dmg
    -rw-r--r--  1 zoro zoro   104685595 Jan  9  2007 038-44135-124.dmg
    -rw-r--r--  1 zoro zoro  5155389281 Jan  9  2007 038-44337-083.dmg
    -r--r--r--  1 zoro zoro      729171 Jan  9  2007 BuildManifest.plist
    drwxr-xr-x 18 zoro zoro        4096 Jan  9  2007 Firmware
    -rw-r--r--  1 zoro zoro    15278127 Jan  9  2007 kernelcache.release.iphone11b
    -rw-r--r--  1 zoro zoro    15704952 Jan  9  2007 kernelcache.release.iphone12b
    -rw-r--r--  1 zoro zoro    17429507 Jan  9  2007 kernelcache.research.iphone12b
    -rw-r--r--  1 zoro zoro 34359738368 May 26 17:49 nvme.1
    -rw-r--r--  1 zoro zoro     8388608 May 26 17:49 nvme.2
    -rw-r--r--  1 zoro zoro      131072 May 26 17:49 nvme.3
    -rw-r--r--  1 zoro zoro        8192 May 26 17:49 nvme.4
    -rw-r--r--  1 zoro zoro        4096 May 26 17:49 nvme.6
    -rw-r--r--  1 zoro zoro     1048576 May 26 17:49 nvme.7
    -rw-r--r--  1 zoro zoro        8192 May 26 18:09 nvram
    -r--r--r--  1 zoro zoro        1420 Jan  9  2007 Restore.plist
    drwxr-xr-x 13 zoro zoro        4096 May 26 20:17 strap
    -rw-r--r--  1 zoro zoro    14458876 May 26 20:17 strap.tar.lzma
    
    lzfse:
    total 40
    -rw-r--r-- 1 zoro zoro  458 May 16 17:25 appveyor.yml
    drwxr-xr-x 6 zoro zoro 4096 May 16 17:25 build
    -rw-r--r-- 1 zoro zoro 4231 May 16 17:25 CMakeLists.txt
    -rw-r--r-- 1 zoro zoro 1514 May 16 17:25 LICENSE
    drwxr-xr-x 2 zoro zoro 4096 May 16 17:25 lzfse.xcodeproj
    -rw-r--r-- 1 zoro zoro 3022 May 16 17:25 Makefile
    -rw-r--r-- 1 zoro zoro 2582 May 16 17:25 README.md
    drwxr-xr-x 2 zoro zoro 4096 May 16 17:25 src
    drwxr-xr-x 2 zoro zoro 4096 May 16 17:25 tests
    
    qemu-t8030:
    total 1924
    drwxr-xr-x  8 zoro zoro   4096 May 16 17:26 accel
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 audio
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 authz
    drwxr-xr-x  3 zoro zoro   4096 May 16 17:26 backends
    drwxr-xr-x  4 zoro zoro   4096 May 16 17:26 block
    -rw-r--r--  1 zoro zoro 247543 May 16 17:26 block.c
    -rw-r--r--  1 zoro zoro 119968 May 16 17:26 blockdev.c
    -rw-r--r--  1 zoro zoro   7497 May 16 17:26 blockdev-nbd.c
    -rw-r--r--  1 zoro zoro  16520 May 16 17:26 blockjob.c
    drwxr-xr-x 10 zoro zoro   4096 May 16 17:26 bsd-user
    drwxr-xr-x 77 zoro zoro   4096 May 26 12:49 build
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 capstone
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 chardev
    drwxr-xr-x  3 zoro zoro   4096 May 16 17:26 common-user
    drwxr-xr-x  4 zoro zoro   4096 May 16 17:26 configs
    -rwxr-xr-x  1 zoro zoro  91796 May 16 17:26 configure
    drwxr-xr-x 13 zoro zoro   4096 May 16 17:26 contrib
    -rw-r--r--  1 zoro zoro  17992 May 16 17:26 COPYING
    -rw-r--r--  1 zoro zoro  26530 May 16 17:26 COPYING.LIB
    -rw-r--r--  1 zoro zoro  12950 May 16 17:26 cpu.c
    -rw-r--r--  1 zoro zoro  10318 May 16 17:26 cpus-common.c
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 crypto
    drwxr-xr-x  3 zoro zoro   4096 May 16 17:26 disas
    -rw-r--r--  1 zoro zoro  10982 May 16 17:26 disas.c
    drwxr-xr-x 14 zoro zoro   4096 May 16 17:26 docs
    drwxr-xr-x  7 zoro zoro   4096 May 16 17:27 dtc
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 dump
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 ebpf
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 fpu
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 fsdev
    -rw-r--r--  1 zoro zoro  93984 May 16 17:26 gdbstub.c
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 gdb-xml
    -rw-r--r--  1 zoro zoro   1835 May 16 17:26 gitdm.config
    -rw-r--r--  1 zoro zoro  52286 May 16 17:26 hmp-commands.hx
    -rw-r--r--  1 zoro zoro  19607 May 16 17:26 hmp-commands-info.hx
    drwxr-xr-x 68 zoro zoro   4096 May 16 17:26 hw
    drwxr-xr-x 25 zoro zoro   4096 May 16 17:26 include
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 io
    -rw-r--r--  1 zoro zoro  12640 May 16 17:26 iothread.c
    -rw-r--r--  1 zoro zoro  27882 May 16 17:26 job.c
    -rw-r--r--  1 zoro zoro   4997 May 16 17:26 job-qmp.c
    -rw-r--r--  1 zoro zoro    132 May 16 17:26 Kconfig
    -rw-r--r--  1 zoro zoro    598 May 16 17:26 Kconfig.host
    drwxr-xr-x  3 zoro zoro   4096 May 16 17:26 libdecnumber
    -rw-r--r--  1 zoro zoro   1177 May 16 17:26 LICENSE
    drwxr-xr-x 12 zoro zoro   4096 May 16 17:26 linux-headers
    drwxr-xr-x 24 zoro zoro   4096 May 16 17:26 linux-user
    -rw-r--r--  1 zoro zoro  86163 May 16 17:26 MAINTAINERS
    -rw-r--r--  1 zoro zoro  11567 May 16 17:26 Makefile
    -rw-r--r--  1 zoro zoro  16093 May 16 17:26 memory_ldst.c.inc
    drwxr-xr-x 14 zoro zoro   4096 May 16 17:27 meson
    -rw-r--r--  1 zoro zoro 138523 May 16 17:26 meson.build
    -rw-r--r--  1 zoro zoro  13676 May 16 17:26 meson_options.txt
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 migration
    -rw-r--r--  1 zoro zoro    113 May 16 17:26 module-common.c
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 monitor
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 nbd
    drwxr-xr-x  3 zoro zoro   4096 May 16 17:26 net
    -rw-r--r--  1 zoro zoro   8495 May 16 17:26 os-posix.c
    -rw-r--r--  1 zoro zoro   2249 May 16 17:26 os-win32.c
    -rw-r--r--  1 zoro zoro   1223 May 16 17:26 page-vary.c
    -rw-r--r--  1 zoro zoro   1668 May 16 17:26 page-vary-common.c
    drwxr-xr-x  7 zoro zoro   4096 May 16 17:26 pc-bios
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 plugins
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 po
    drwxr-xr-x  4 zoro zoro   4096 May 16 17:26 python
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 qapi
    -rw-r--r--  1 zoro zoro  12152 May 16 17:26 qemu-bridge-helper.c
    -rw-r--r--  1 zoro zoro   3681 May 16 17:26 qemu-edid.c
    -rw-r--r--  1 zoro zoro 163649 May 16 17:26 qemu-img.c
    -rw-r--r--  1 zoro zoro   5654 May 16 17:26 qemu-img-cmds.hx
    -rw-r--r--  1 zoro zoro  18269 May 16 17:26 qemu-io.c
    -rw-r--r--  1 zoro zoro  66195 May 16 17:26 qemu-io-cmds.c
    -rw-r--r--  1 zoro zoro   7588 May 16 17:26 qemu-keymap.c
    -rw-r--r--  1 zoro zoro  38211 May 16 17:26 qemu-nbd.c
    -rw-r--r--  1 zoro zoro   6916 May 16 17:26 qemu.nsi
    -rw-r--r--  1 zoro zoro 235167 May 16 17:26 qemu-options.hx
    -rw-r--r--  1 zoro zoro   1694 May 16 17:26 qemu.sasl
    drwxr-xr-x  4 zoro zoro   4096 May 16 17:26 qga
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 qobject
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 qom
    -rw-r--r--  1 zoro zoro   5575 May 16 17:26 README.rst
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 replay
    -rw-r--r--  1 zoro zoro   2530 May 16 17:26 replication.c
    drwxr-xr-x 17 zoro zoro   4096 May 16 17:26 roms
    drwxr-xr-x 16 zoro zoro   4096 May 16 17:26 scripts
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 scsi
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 semihosting
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 setup-ios
    drwxr-xr-x  4 zoro zoro   4096 May 16 17:27 slirp
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 softmmu
    drwxr-xr-x  3 zoro zoro   4096 May 16 17:26 storage-daemon
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 stubs
    drwxr-xr-x  3 zoro zoro   4096 May 16 17:26 subprojects
    drwxr-xr-x 22 zoro zoro   4096 May 16 17:26 target
    drwxr-xr-x 12 zoro zoro   4096 May 16 17:26 tcg
    drwxr-xr-x 27 zoro zoro   4096 May 16 17:26 tests
    drwxr-xr-x  4 zoro zoro   4096 May 16 17:26 tools
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 trace
    -rw-r--r--  1 zoro zoro   5582 May 16 17:26 trace-events
    drwxr-xr-x  5 zoro zoro   4096 May 16 17:26 ui
    drwxr-xr-x  2 zoro zoro   4096 May 16 17:26 util
    -rw-r--r--  1 zoro zoro      6 May 16 17:26 VERSION.QEMU
    -rw-r--r--  1 zoro zoro    867 May 16 17:26 version.rc
    
    qemu-t8030-tools:
    total 12
    drwxr-xr-x 2 zoro zoro 4096 May 16 17:19 bootstrap_scripts
    drwxr-xr-x 2 zoro zoro 4096 May 16 17:19 libimobiledevice_patches
    -rw-r--r-- 1 zoro zoro  327 May 16 17:19 README.md
    
    

    Following is the qemu logs

    ../qemu-t8030/build/qemu-system-aarch64 -snapshot -s -M t8030,trustcache-filename=Firmware/038-44135-124.dmg.trustcache \ 
    -kernel kernelcache.research.iphone12b \
    -dtb Firmware/all_flash/DeviceTree.n104ap.im4p \
    -append "debug=0x14e kextlog=0xffff serial=3 -v" \
    -initrd 038-44135-124.dmg \
    -cpu max -smp 4 \
    -m 4G -serial mon:stdio \
    -drive file=nvme.1,format=raw,if=none,id=drive.1 \
    -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.2,format=raw,if=none,id=drive.2 \
    -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.3,format=raw,if=none,id=drive.3 \
    -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.4,format=raw,if=none,id=drive.4 \
    -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvram,if=none,format=raw,id=nvram \
    -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.6,format=raw,if=none,id=drive.6 \
    -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.7,format=raw,if=none,id=drive.7 \
    -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
    -monitor telnet:127.0.0.1:1235,server,nowait
    Loading iOS 14.0...
    kernel_low: 0xfffffff004000000
    kernel_high: 0xfffffff00a4cd4f0
    KPF: found apfs_vfsop_mount
    KPF: found handle_eval_rootauth
    KPF: Found AMFI hashtype check
    kpf_amfi_callback: Found AMFI (Leaf)
    kpf_amfi_callback: Found lookup_in_trust_cache_module @ 0xfffffff007b5d71c
    KPF: Found mac_mount
    KPF: Found mac_mount
    kpf_amfi_callback: Found AMFI (Routine)
    kpf_amfi_callback: Found lookup_in_static_trust_cache @ 0xfffffff0097edcb8
    KPF: Found AppleKeyStoreUserClient::handleUserClientCommandGated
    Qemu FB realize
    g_virt_base: 0xfffffff00a000000
    g_phys_base: 0x0000000802000000
    slide_virt: 0x0000000007000000
    slide_phys: 0x0000000001000000
    entry: 0x00000008071204e8
    boot_mode: 0
    auto-boot=false
    cmdline: [-restore rd=md0 nand-enable-reformat=1 -progress debug=0x14e kextlog=0xffff serial=3 -v]
    iBoot version: qemu-t8030
    Darwin Image4 Validator Version 3.0.0: Wed Aug 12 22:19:21 PDT 2020; root:AppleImage4-106.0.4.0.1 ~ 129/AppleImage4/RELEASE_ARM64E
    AppleImage4: failed to read nvram property: nonce-seeds: 2
    AppleImage4: error reading seeds: 2
    AMFI is running in RESEARCH mode!
    AUC:[0xffffffe19bb18950]::init(0xffffffe19bb4a0a8)
    AUC:[0xffffffe19bb18950]::probe(0xffffffe19b8e2300, 0xffffffe8080abdac)
    AppleCredentialManager: init: called, instance = <ptr>.
    ACMFirstResponderKernelService: init: called, .
    ACMRM-S: init: called, starting PersistentStore service.
    ACMRM-C: init: called, starting AccessoryCache service.
    ACMKernelService: initValueFromBootArgAliasesUInt32: acc-cache size = 16 (default).
    ACMKernelService: initValueFromBootArgAliasesUInt32: acc-cache expiration = 2592000 (default).
    ACMRM: init: called, starting TRM service.
    ACMRM-A: init: called, starting TRM Analytics service.
    ACMKernelService: initValueFromBootArgAliasesUInt32: analytics collection period = 86400 (default).
    ACMKernelService: initValueFromBootArgAliasesUInt32: policy mode timeout = 259200 (default).
    ACMRM-A: notifyStandardModeTimeoutChanged: called, value = 259200 (modified = YES).
    ACMKernelService: initValueFromBootArgAliasesUInt32: (bounded) grace period timeout = 3600 (default).
    ACMRM-A: notifyGracePeriodTimeoutChanged: called, value = 3600 (modified = YES).
    ACMKernelService: initValueFromBootArgAliasesUInt32: enabled = 1 (default).
    ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO* BtArg=NO LegHW=NO OSEnv=NO | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO).
    ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO BtArg=NO* LegHW=NO OSEnv=NO | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO).
    ACMRM: _loadDisabledByOSEnvironment: disabled by OSEnvironment: NO.
    ACMRM: _disableBy: [TRM ENABLED=YES] (mask=0, DISABLED BY: Def=NO BtArg=NO LegHW=NO OSEnv=NO* | MngCo=NO DwnOS=NO ChkBd=NO coGSw=NO).
    ACMRM: _mapAndPublishTRM: set TRM_PolicyTimeout = 259200.
    ACMRM: _mapAndPublishTRM: sending kIOMessageServicePropertyChange(n=1) while DISABLED, TRM: 259200 -/ff 4294967295 -/ff miss=ff (CUR: 259200 -/ff 4294967295 -/ff).
    AppleCredentialManager: init: returning, result = true, instance = <ptr>.
    AppleARMBootPerf: Error: profile region not found (2)
    AppleARMBootPerf: Error: failed to publish profile data (2)
    virtual bool CoreAnalyticsHub::start(IOService *)::105:CoreAnalyticsHub start
    virtual bool AppleARMLightEmUp::start(IOService *): starting...
    AppleSSE::start called
    AppleSSE::start returning, result = 1
    AUC:[0xffffffe19bb18950]::start(0xffffffe19b8e2300)
    AppleS5L8940XI2CController::start: smc-i2c1 this: <ptr> _i2cBaseAddress: <ptr>
    AppleGPIOICController::start: this: <ptr>, _gpioicBaseAddress: <ptr>
    AppleGPIOICController::start: this: <ptr>, _gpioicBaseAddress: <ptr>
    AppleS5L8940XI2CController::start: i2c1 this: <ptr> _i2cBaseAddress: <ptr>
    AppleInterruptController::start: Num Shared Timestamps == 0
    AppleSEPKeyStore:321:0: starting (BUILT: Aug 12 2020 22:51:30)
    AppleSEPKeyStore:545:0: _sep_enabled = 1
    AppleCredentialManager: start: called, instance = <ptr>.
    ACMRM: _publishIOResource: AppleUSBRestrictedModeTimeout = 259200.
    AppleCredentialManager: start: initializing power management, instance = <ptr>.
    AppleCredentialManager: start: started, instance = <ptr>.
    AppleCredentialManager: start: returning, result = true, instance = <ptr>.
    AppleS5L8940XI2CController::start: i2c0 this: <ptr> _i2cBaseAddress: <ptr>
    AppleS5L8940XI2CController::start: i2c2 this: <ptr> _i2cBaseAddress: <ptr>
    AppleS5L8940XI2CController::start: smc-i2c0 this: <ptr> _i2cBaseAddress: <ptr>
    AppleGPIOICController::start: this: <ptr>, _gpioicBaseAddress: <ptr>
    000002.788268 wlan0.A[1] [email protected]:Default options property found with value 4
    AppleS5L8940XI2CController::start: i2c3 this: <ptr> _i2cBaseAddress: <ptr>
    AppleS5L8960XUSBPhy::start: hsic disabled
    AppleS8000AES::start: registers at phys:0x0x235008000/0x0x23d2d0000 virt:0x<ptr>/0x0x4000 / 0x<ptr>/0x0x4000
    Creating an object of AppleBCMWLANPlatformFunctionEmbeddedAMFM class
    000002.898100 wlan0.A[2] [email protected]: Raised adjustBusy(+1), getBusyState() -> 1
    000002.898560 wlan0.A[3] [email protected]:Setting up notifier for CoreAnalyticsHub
    000002.939384 [email protected]: IOUSBDeviceController::prepareDefaults: model iPhone version 12.1
    AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>
    Identified Serial Port uart7 at 0x23521c000(<ptr>)
    Identified Serial Port uart0 at 0x235200000(<ptr>)
    AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>
    RTBuddy(SMC): start(<ptr>) - (Aug 12 [email protected]:50:37)
    RTBuddy(ANS2): start(<ptr>) - (Aug 12 [email protected]:50:37)
    LPM state clear
    LPM: Log data is NOT valid. 0x0 0x0
    AppleDialogSPMIPMU::start: Primary PMU detected
    AppleARMRTC started!#####
    AppleDialogSPMIPMURTC started!******
    Failed to read info-leg_scrpadAppleDialogSPMIPMURTC tick read!&&&&&&&
    AppleDialogSPMIPMURTC ending!%%%
    AppleARMRTC registering [email protected]@@@@@
    RTBuddy(SMC): Resuming...
    RTBuddy(ANS2): Resuming...
    AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>
    AppleARMRTC service registered!$$$$$
    AppleARMRTC publishing service!^^^^^^
    virtual IOService *AppleANS2NVMeController::probe(IOService *, SInt32 *)::194:Found (ANS2) provider, returning score 100000
    void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
    RTBuddy(SIO): start(<ptr>) - (Aug 12 [email protected]:50:37)
    000003.144880 [email protected]: IOUSBDeviceController::gated_handleUSBCableConnect: cable connected, but don't have device configuration yet
    Starting AppleSMC kext(<ptr>) - (Aug 12 [email protected]:51:44)
    AppleSMCEmbedded::setPowerState(): ENTER powerStateOrdinal=1, _activeKeyCommand=17 newState=1
    virtual bool AppleANS2NVMeController::start(IOService *)::394:Found the ANS2Endpoint1
    000003.164450 [email protected]: IOUSBDeviceController::gated_handleUSBCableConnect: cable connected, but don't have device configuration yet
    void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
    bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT
    virtual IOFilterInterruptEventSource *AppleANS2NVMeController::CreateDeviceInterrupt(IOInterruptEventSource::Action, IOFilterInterruptEventSource::Filter, IOService *)::2719:ANS2 NVMe interrupt index - 0x4
    /Library/Caches/com.apple.xbs/Sources/AppleSMC/AppleSMC-589.0.5/AppleSMCEmbeddedCharger/AppleSMCCharger.cpp:408 _setPowerStateGated() ENTER powerStateOrdinal=1, _powerState=1
    apfs_module_start:2411: load: com.apple.filesystems.apfs, v1677.0.5, apfs-1677.0.5, 2020/08/12
    com.apple.AppleFSCompressionTypeZlib kmod start
    apfs_sysctl_register:1253: done registering sysctls.
    com.apple.AppleFSCompressionTypeZlib load succeeded
    L2TP domain init
    L2TP domain init complete
    Load request for com.apple.nke.pptp failed: -603946998
    BSD root: md0, major 3, minor 0
    virtual IOReturn IONVMeController::CreateSubmissionQueue(uint16_t, uint8_t)::2886:SQ index=0 entrysize=64
    apfs_vfsop_mountroot:2188: apfs: mountroot called!
    virtual IOReturn IONVMeController::CreateSubmissionQueue(uint16_t, uint8_t)::2886:SQ index=1 entrysize=128
    ANS2: MMIO write to unknown vendor register, offset=0x1210 value=0x240024, returning
    apfs_vfsop_mANS2: MMIO write to unknown vendor register, offset=0x24004 value=0x1000, returning
    ount:1745: unable to root from devvpANS2: MMIO write to unknown vendor register, offset=0x24008 value=0x0, returning
     <ptr> (ANS2: MMIO write to unknown vendor register, offset=0x24118 value=0x102, returning
    roANS2: MMIO write to unknown vendor register, offset=0x24108 value=0x102, returning
    otANS2: MMIO write to unknown vendor register, offset=0x24420 value=0x102, returning
    _dANS2: MMIO write to unknown vendor register, offset=0x24414 value=0x102, returning
    evice): 2
    ANS2: MMIO write to unknown vendor register, offset=0x2441c value=0x10002, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24418 value=0x10002, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24144 value=0x10002, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24524 value=0x10002, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24508 value=0x102, returning
    ANS2: MMIO write to unknown vendor register, offset=0x24504 value=0x10002, returning
    apfs_vfsop_mountroot:2192: apfs: mountroot failed, error: 2
    virtual void AppleANS2NVMeController::SetModeselRegister(uint32_t)::1186:Setting modesel to 4
    ANS2: MMIO write to unknown vendor register, offset=0x1304 value=0x4, returning
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1964:nvme: Vendor ID     : 0x1b36
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1965:nvme: Model Number  : QEMU NVMe Ctrl                          
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1966:nvme: Serial Number : QEMUT8030ANS        
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::1967:nvme: Firmware Rev  : 1.0     
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2000:nvme: S3E A0 Invalid 1x slc 1D 0 plane 128GB NAND
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2009:ECCVersion   : 0
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2010:FTL Rev      : 0.0
    hfs: mounted AzulSeed18A5351d.arm64eCustomerRamDisk on device b(3, 0)
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2011:DM_Version   : 0
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2012:=======================
    bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2019:Found 16 namespaces in current NAND
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[1] as nstype[1]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[2] as nstype[2]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[3] as nstype[3]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[4] as nstype[4]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[5] as nstype[5]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[6] as nstype[6]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[7] as nstype[8]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[8] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[9] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[10] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[11] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[12] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[13] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[14] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[15] as nstype[0]
    bool AppleEmbeddedNVMeController::DetermineNamespaces()::2435:Identified nsid[16] as nstype[0]
    bool AppleEmbeddedNVMeController::SetSwapWriteLimit(uint32_t)::2192: Swap limit set to 2147483648bytes, 2GB
    virtual bool AppleEmbeddedNVMeController::InitializeController()::507:FW update not complete, create dummy block device
    uint32_t AppleEmbeddedNVMeNVRAM::GetNVRAMSize()::745:NVRAM size is 8192 bytes
    virtual bool AppleEmbeddedNVMeController::AllocateNodes(bool)::1578:allocateAll 1
    virtual bool AppleEmbeddedNVMeController::StartController()::1547:Setting NAND status to Ready
    dyld: setting comm page to 0x0
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: hello
    Darwin Bootstrapper Version 7.0.0: Mon Aug 10 04:09:14 PDT 2020; root:libxpc_executables-2038.0.13~13/launchd/RELEASE_ARM64E
    boot-args = -restore rd=md0 nand-enable-reformat=1 -progress debug=0x14e kextlog=0xffff serial=3 -v
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Restore environment starting.
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: entering ondemand mode
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fsck
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: mount-phase-1
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: data-protection
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-obliteration
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: commit-boot-mode
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: boot-mode committed: (null)
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: restore-datapartition
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: restore-datapartition: optional boot task not present
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: mount-phase-2
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: init-with-data-volume
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: MSUEarlyBootTask
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fips
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: keybag
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: usermanagerd
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: init_featureflags
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fud
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: tzinit
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-restore
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-demo-restore
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: sysstatuscheck
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: prng_seedctl
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Error>: Unable to open /System/Library/xpc/launchd.plist [2:No such file or directory]
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: launchd_cache_loader
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Error>: No MRM cache found
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Warning>: Unable to load cache
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: launchd UUID: 4C2464F5-9F87-31DE-B252-584E3391D4FA
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] <Notice>: Early boot complete. Continuing system boot.
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: entering bootstrap mode
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker) <Warning>: Unknown key for Boolean: EnablePressureExit
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.KeyMaker (lint): Unable to find persona with type 6: kpersona_find returned -1
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.PurpleReverseProxy.ramdisk (lint): Unable to find persona with type 6: kpersona_find returned -1
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.diskimagesiod.ram (lint): Unable to find persona with type 6: kpersona_find returned -1
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.restored_external (lint): Unable to find persona with type 6: kpersona_find returned -1
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemonsAltAccount, error = 2: No such file or directory
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemons, error = 2: No such file or directory
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /AppleInternal/Library/LaunchDaemons, error = 2: No such file or directory
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: exiting bootstrap mode
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: exiting ondemand mode
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker.3) <Warning>: Could not find and/or execute program specified by service: 2: No such file or directory: /usr/local/bin/KeyMaker
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker.3) <Notice>: Service setup event to handle failure and will not launch until it fires.
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker.3) <Error>: Missing executable detected. Job: 'com.apple.KeyMaker' Executable: '/usr/local/bin/KeyMaker'
    Thu May 26 14:48:05 2022 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker.3) <Warning>: Service exited with abnormal code: 78
    objc[4]: Class AMSupportURLConnectionDelegate is implemented in both ?? (0x1014a0000) and ?? (0x101eb0028). One of the two will be used. Which one is undefined.
    objc[4]: Class AMSupportURLSession is implemented in both ?? (0x1014a0050) and ?? (0x101eb0078). One of the two will be used. Which one is undefined.
    [14:48:08.0929-GMT]{1>4} CHECKPOINT ANOMALY: [check_collection]auto-boot(does_not_exist)
    [14:48:08.0955-GMT]{1>4} CHECKPOINT PROGRESS: START (unknown) -> (initial_monitor_no_return)
    [14:48:08.0958-GMT]{1>4} CHECKPOINT NOTICE: NVRAM access available on initial check
    restore-anomalies = {0x00000000:[check_collection]auto-boot(does_not_exist)}
    restore-outcome = initial_monitor_no_return
    executing /usr/sbin/nvram -s restore-outcome=initial_monitor_no_return
    [14:48:09.0589-GMT]{1>4} CHECKPOINT NOTICE: (NVRAM set) restore-outcome=initial_monitor_no_return [sync=true] (initial entry)
    entering set_boot_stage
    [14:48:09.0684-GMT]{1>4} CHECKPOINT MONITOR: [0x0204] boot_stage
    restore-step-monitor = {0x11010204:"boot_stage"}
    executing /sbin/mount_tmpfs /mnt5
    entering show_service_nodes
    disk0
    IOBlockStorageDriver RegistryID : 0x10000021e Busy State : 0x0 Service State : 0x1e
    NS_01 RegistryID : 0x10000021d Busy State : 0x0 Service State : 0x1e
    AppleANS2NVMeController RegistryID : 0x1000001fb Busy State : 0x0 Service State : 0x1e
    RTBuddyService RegistryID : 0x1000001f3 Busy State : 0x0 Service State : 0x1e
    RTBuddyV2 RegistryID : 0x1000001ea Busy State : 0x0 Service State : 0x1e
    iop-ans-nub RegistryID : 0x100000132 Busy State : 0x0 Service State : 0x1e
    AppleASCWrapV2 RegistryID : 0x1000001d8 Busy State : 0x0 Service State : 0x0
    ans RegistryID : 0x100000131 Busy State : 0x0 Service State : 0x1e
    AppleT803xIO RegistryID : 0x1000001a6 Busy State : 0x5 Service State : 0x1e
    arm-io RegistryID : 0x100000116 Busy State : 0x1 Service State : 0x1e
    AppleARMPE RegistryID : 0x100000186 Busy State : 0x2 Service State : 0x1e
    N104DEV RegistryID : 0x100000185 Busy State : 0x1 Service State : 0x1e
    Root RegistryID : 0x100000100 Busy State : 0x0 Service State : 0x0
    [14:48:10.0034-GMT]{1>4} CHECKPOINT MONITOR: [0x1180] create_ramdisk
    restore-step-monitor = {0x11011180:"create_ramdisk"}
    [14:48:10.0036-GMT]{1>4} CHECKPOINT MONITOR: [0x0206] monitoring_child
    restore-step-monitor = {0x11010206:"monitoring_child"}
    objc[7]: Class AMSupportURLConnectionDelegate is implemented in both ?? (0x1017f0000) and ?? (0x102200028). One of the two will be used. Which one is undefined.
    objc[7]: Class AMSupportURLSession is implemented in both ?? (0x1017f0050) and ?? (0x102200078). One of the two will be used. Which one is undefined.
    libMobileGestalt MobileGestalt.c:711: RestoreLog: Client Query: Image4Supported
    2022-05-26 14:48:11.678882+0000 restored_external[7:370] RestoreLog: Client Query: Image4Supported
    libMobileGestalt utility.c:64: Could not open /private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist: No such file or directory
    2022-05-26 14:48:11.698142+0000 restored_external[7:370] Could not open /private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist: No such file or directory
    libMobileGestalt MobileGestalt.c:743: RestoreLog: Client Response: Image4Supported : true
    2022-05-26 14:48:11.717470+0000 restored_external[7:370] RestoreLog: Client Response: Image4Supported : 1
    [14:48:11.0719-GMT]{4>7} CHECKPOINT NOTICE: Image4 device: AP nonce clearable
    entering ramrod_clear_ap_nonce
    [14:48:11.0772-GMT]{4>7} CHECKPOINT NOTICE: AP nonce consumed
    [14:48:11.0791-GMT]{4>7} CHECKPOINT NOTICE: Pre-existing NVRAM variable: restore-outcome=initial_monitor_no_return
    [14:48:11.0822-GMT]{4>7} CHECKPOINT ANOMALY: [check_collection]auto-boot(does_not_exist)
    [14:48:11.0825-GMT]{4>7} CHECKPOINT PROGRESS: START (unknown) -> (initial_engine_no_return)
    [14:48:11.0826-GMT]{4>7} CHECKPOINT NOTICE: NVRAM access available on initial check
    restore-anomalies = {0x00000000:[check_collection]auto-boot(does_not_exist)}
    restore-outcome = initial_engine_no_return
    executing /usr/sbin/nvram restore-outcome=initial_engine_no_return
    [14:48:12.0325-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0400] umask
    restore-step-ids = {0x11030400:1}
    restore-step-names = {0x11030400:umask}
    restore-step-uptime = 9
    restore-step-user-progress = -1
    [14:48:12.0332-GMT]{4>7} CHECKPOINT END: MAIN:[0x0400] umask
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 9
    restore-step-user-progress = -1
    [14:48:12.0337-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0402] setvbuf
    restore-step-ids = {0x11030402:2}
    restore-step-names = {0x11030402:setvbuf}
    restore-step-uptime = 9
    restore-step-user-progress = -1
    [14:48:12.0342-GMT]{4>7} CHECKPOINT END: MAIN:[0x0402] setvbuf
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 9
    restore-step-user-progress = -1
    [14:48:12.0347-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0403] kernel_logger_thread
    restore-step-ids = {0x11030403:3}
    restore-step-names = {0x11030403:kernel_logger_thread}
    restore-step-uptime = 9
    restore-step-user-progress = -1
    [14:48:12.0352-GMT]{4>7} CHECKPOINT END: MAIN:[0x0403] kernel_logger_thread
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 9
    restore-step-user-progress = -1
    [14:48:12.0359-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0406] set_progress_0
    restore-step-ids = {0x11030406:4}
    restore-step-names = {0x11030406:set_progress_0}
    restore-step-uptime = 9
    restore-step-user-progress = -1
    libMobileGestalt MobileGestalt.c:711: RestoreLog: Client Query: DeviceClass
    2022-05-26 14:48:12.367467+0000 restored_external[7:370] RestoreLog: Client Query: DeviceClass
    libMobileGestalt MobileGestalt.c:743: RestoreLog: Client Response: DeviceClass : iPhone
    2022-05-26 14:48:12.370310+0000 restored_external[7:370] RestoreLog: Client Response: DeviceClass : iPhone
    libMobileGestalt MobileGestalt.c:711: RestoreLog: Client Query: DeviceColorMapPolicy
    2022-05-26 14:48:12.372004+0000 restored_external[7:370] RestoreLog: Client Query: DeviceColorMapPolicy
    libMobileGestalt MobileGestalt.c:743: RestoreLog: Client Response: DeviceColorMapPolicy : 0
    2022-05-26 14:48:12.382616+0000 restored_external[7:370] RestoreLog: Client Response: DeviceColorMapPolicy : 0
    2022-05-26 14:48:12.393758+0000 restored_external[7:370] IOMFB: /System/Library/Frameworks/MediaToolbox.framework/MediaToolbox not found
    2022-05-26 14:48:12.397712+0000 restored_external[7:370] IOMFB: /System/Library/PrivateFrameworks/MediaToolbox.framework/MediaToolbox not found
    2022-05-26 14:48:12.400924+0000 restored_external[7:370] IOMFB: /System/Library/PrivateFrameworks/Celestial.framework/Celestial not found
    2022-05-26 14:48:12.402334+0000 restored_external[7:370] IOMFB: FigInstallVirtualDisplay not found
    unable to get display list
    unable to get framebuffer
    No framebuffer but an internal display. Ok on bridge but weird anywhere else.
    ramrod_display_set_granular_progress_forced: 0.000000
    [14:48:18.0016-GMT]{4>7} CHECKPOINT END: MAIN:[0x0406] set_progress_0
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0027-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0407] start_gasgauge_thread
    restore-step-ids = {0x11030407:5}
    restore-step-names = {0x11030407:start_gasgauge_thread}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0052-GMT]{4>7} CHECKPOINT WARNING: MAIN:[0x0407] gasgauge_start_update_thread failed: -1
    restored_external: gasgauge_start_update_thread failed: -1
    [14:48:18.0057-GMT]{4>7} CHECKPOINT END: MAIN:[0x0407] start_gasgauge_thread
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-warnings = {0x11060407:{0:"gasgauge_start_update_thread failed: -1"}}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0074-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0408] listen_for_log_client
    restore-step-ids = {0x11030408:6}
    restore-step-names = {0x11030408:listen_for_log_client}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0097-GMT]{4>7} CHECKPOINT END: MAIN:[0x0408] listen_for_log_client
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0103-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x040D] create_listen_socket
    restore-step-ids = {0x1103040D:7}
    restore-step-names = {0x1103040D:create_listen_socket}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0111-GMT]{4>7} CHECKPOINT END: MAIN:[0x040D] create_listen_socket
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0117-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0404] update_root_mount
    restore-step-ids = {0x11030404:8}
    restore-step-names = {0x11030404:update_root_mount}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0158-GMT]{4>7} CHECKPOINT END: MAIN:[0x0404] update_root_mount
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0163-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0405] disable_watchdog
    restore-step-ids = {0x11030405:9}
    restore-step-names = {0x11030405:disable_watchdog}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0177-GMT]{4>7} CHECKPOINT END: MAIN:[0x0405] disable_watchdog
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    [14:48:18.0190-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x040E] enable_usb
    restore-step-ids = {0x1103040E:10}
    restore-step-names = {0x1103040E:enable_usb}
    restore-step-uptime = 15
    restore-step-user-progress = 0
    libMobileGestalt MobileGestalt.c:711: RestoreLog: Client Query: UniqueDeviceID
    2022-05-26 14:48:18.259105+0000 restored_external[7:370] RestoreLog: Client Query: UniqueDeviceID
    2022-05-26 14:48:18.261258+0000 restored_external[7:370] [fast-path] taking platform fast path for key: re6Zb+zwFKJNlkQTUeT+/w
    libMobileGestalt MobileGestalt.c:711: RestoreLog: Client Query: nFRqKto/RuQAV1P+0/qkBA
    2022-05-26 14:48:18.263541+0000 restored_external[7:370] RestoreLog: Client Query: nFRqKto/RuQAV1P+0/qkBA
    2022-05-26 14:48:18.264773+0000 restored_external[7:370] [fast-path] taking platform fast path for key: nFRqKto/RuQAV1P+0/qkBA
    libMobileGestalt MobileGestalt.c:711: RestoreLog: Client Query: TF31PAB6aO8KAbPyNKSxKA
    2022-05-26 14:48:18.268898+0000 restored_external[7:370] RestoreLog: Client Query: TF31PAB6aO8KAbPyNKSxKA
    libMobileGestalt MobileGestalt.c:743: RestoreLog: Client Response: TF31PAB6aO8KAbPyNKSxKA : 1234605616436508552
    2022-05-26 14:48:18.275121+0000 restored_external[7:370] RestoreLog: Client Response: TF31PAB6aO8KAbPyNKSxKA : 1234605616436508552
    libMobileGestalt MobileGestalt.c:711: RestoreLog: Client Query: 566JrJVMlDfnslGpwUzNlQ
    2022-05-26 14:48:18.277011+0000 restored_external[7:370] RestoreLog: Client Query: 566JrJVMlDfnslGpwUzNlQ
    libMobileGestalt MobileGestalt.c:743: RestoreLog: Client Response: 566JrJVMlDfnslGpwUzNlQ : 32816
    2022-05-26 14:48:18.283882+0000 restored_external[7:370] RestoreLog: Client Response: 566JrJVMlDfnslGpwUzNlQ : 32816
    libMobileGestalt MobileGestalt.c:743: RestoreLog: Client Response: nFRqKto/RuQAV1P+0/qkBA : <CFData 0x13880e540 [0x101ee41b8]>{length = 25, capacity = 25, bytes = 0x30303030383033302d31313232333334 ... 3535363637373838}
    2022-05-26 14:48:18.304635+0000 restored_external[7:370] RestoreLog: Client Response: nFRqKto/RuQAV1P+0/qkBA : {length = 25, bytes = 0x30303030 38303330 2d313132 32333334 ... 35353636 37373838 }
    libMobileGestalt MobileGestalt.c:743: RestoreLog: Client Response: UniqueDeviceID : 00008030-1122334455667788
    2022-05-26 14:48:18.307444+0000 restored_external[7:370] RestoreLog: Client Response: UniqueDeviceID : 00008030-1122334455667788
    000017.727052 [email protected]: IOUSBDeviceController::createUSBDevice: configuration: Apple Mobile Device
    000017.727788 [email protected]: IOUSBDeviceController::createUSBDevice:    interface: AppleUSBMux
    000017.728893 [email protected]: IOUSBDeviceController::createUSBDevice: configuration: Reserved 1 + Apple Mobile Device
    000017.729475 [email protected]: IOUSBDeviceController::createUSBDevice:    interface: Reserved
    000017.730027 [email protected]: IOUSBDeviceController::createUSBDevice:    interface: AppleUSBMux
    000017.730562 [email protected]: IOUSBDeviceController::createUSBDevice: configuration: Reserved 2 + Apple Mobile Device
    000017.731165 [email protected]: IOUSBDeviceController::createUSBDevice:    interface: Reserved
    000017.731708 [email protected]: IOUSBDeviceController::createUSBDevice:    interface: AppleUSBMux
    000017.732254 [email protected]: IOUSBDeviceController::createUSBDevice: configuration: Reserved 3 + Apple Mobile Device
    000017.732852 [email protected]: IOUSBDeviceController::createUSBDevice:    interface: Reserved
    000017.733326 [email protected]: IOUSBDeviceController::createUSBDevice:    interface: AppleUSBMux
    waiting for matching IOKit service: {
        IOProviderClass = AppleUSBDeviceMux;
    }
    000017.752422 [email protected]: IOUSBDeviceController::gated_registerFunction: register function Reserved
    AppleUSBDeviceMux build: Aug 12 2020 22:50:42
    000017.769377 [email protected]: IOUSBDeviceController::gated_registerFunction: register function AppleUSBMux
    000017.770859 [email protected]: IOUSBDeviceController::startUSBStack: starting usb stack
    qemu: usb_tcp_host_attach: failed to connect to server: -1
    IOReturn AppleUSBDeviceMux::setPropertiesGated(OSObject *) setting debug level to 7
    [14:48:21.0340-GMT]{4>7} CHECKPOINT END: MAIN:[0x040E] enable_usb
    restore-step-ids = {}
    restore-step-names = {}
    restore-step-uptime = 18
    restore-step-user-progress = 0
    waiting for host to trigger start of restore [timeout of 120 seconds]
    000022.894390 wlan0.A[4] [email protected]:amfm not matched
    000022.900667 wlan0.A[5] [email protected]: Lowered adjustBusy(-1), getBusyState() -> 4
    ```
    
    opened by 4bh1 6
  • Watchdog Kernel Panic during iOS restore

    Watchdog Kernel Panic during iOS restore

    When attempting a restore (in this case with fresh NAND files), the iOS device kernel panics shortly after creating NAND namespaces. Full log (too long to send as text):

    ios.log

    opened by NinjaCheetah 3
  • stuck at auto boot

    stuck at auto boot

    I'm using Macbook Pro (Intel), follow side bar guide compile codes is fine, but auto boot stuck at apfs: mountroot , how can I fix it ? -------logs------- L2TP domain init L2TP domain init complete Load request for com.apple.nke.pptp failed: -603946998 BSD root: md0, major 3, minor 0 apfs_vfsop_mountroot:2188: apfs: mountroot called! apfs_vfsop_mount:1745: unable to root from devvp (root_device): 2 apfs_vfsop_mountroot:2192: apfs: mountroot failed, error: 2 hfs: mounted AzulSeed18A5351d.arm64eCustomerRamDisk on device b(3, 0)

    opened by neohob 7
  • Cannot get Bash on iOS 15.0

    Cannot get Bash on iOS 15.0

    I've restored iOS 15.0, edited launchd.plist and added bash.plist to /System/Library/LaunchDaemons however bash is not starting. There are no APFS Snapshots to rename. Boot command: ../qemu-system-aarch64 -s -M t8030,trustcache-filename=15.0/static_tc,ticket-filename=15.0/root_ticket.der -kernel 15.0/kernelcache.research.iphone12b -dtb 15.0/Firmware/all_flash/DeviceTree.n104ap.im4p -append "debug=0x14e kextlog=0xffff serial=3 -v wdt=-1 launchd_unsecure_cache=1" -initrd 15.0/038-42528-639.dmg -cpu max -smp 4 -m 4G -serial mon:stdio -drive file=nvme.1,format=raw,if=none,id=drive.1 -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 -drive file=nvme.2,format=raw,if=none,id=drive.2 -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 -drive file=nvme.3,format=raw,if=none,id=drive.3 -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 -drive file=nvme.4,format=raw,if=none,id=drive.4 -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 -drive file=nvram,if=none,format=raw,id=nvram -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 -drive file=nvme.6,format=raw,if=none,id=drive.6 -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 -drive file=nvme.7,format=raw,if=none,id=drive.7 -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 -monitor telnet:127.0.0.1:1235,server,nowait Log: fastsim_is_enabled:9457: ================ fastsim is enabled ================ apfs_vfsop_mount:2354: mounted volume: Preboot /dev/disk0s1s4 on /private/preboot (apfs, local, nodev, nosuid, read-only, journaled, noatime, nobrowse) com.apple.xpc.launchd|2022-04-17 08:16:14.555550 : Doing boot task: data-protection init_data_protection: No SEP present on this device com.apple.xpc.launchd|2022-04-17 08:16:14.814353 : Doing boot task: finish-obliteration Obliterator: In INIT check IORegistryEntryGetProperty failed, may be does not exist Obliterator: No obliteration needed, continue booting, returning 0 com.apple.xpc.launchd|2022-04-17 08:16:15.028039 : Doing boot task: commit-boot-mode com.apple.xpc.launchd|2022-04-17 08:16:15.029260 : boot-mode committed: (null) com.apple.xpc.launchd|2022-04-17 08:16:15.030008 : Doing boot task: restore-datapartition com.apple.xpc.launchd|2022-04-17 08:16:15.033256 : restore-datapartition: optional boot task not present com.apple.xpc.launchd|2022-04-17 08:16:15.046458 : Doing boot task: mount-phase-2 mount: found boot container: /dev/disk0s1, data volume: /dev/disk0s1s2 env: 1 spaceman_metazone_init:191: disk0s1 metazone for device 0 of size 262143 blocks (encrypted: 8126454-8257525 unencrypted: 8257525-8388597) spaceman_datazone_init:625: disk0s1 allocation zone on dev 0 for allocations of 1 blocks starting at paddr 4096000 spaceman_datazone_init:625: disk0s1 allocation zone on dev 0 for allocations of 2 blocks starting at paddr 32768 spaceman_datazone_init:625: disk0s1 allocation zone on dev 0 for allocations of 3 blocks starting at paddr 65536 spaceman_datazone_init:625: disk0s1 allocation zone on dev 0 for allocations of 4 blocks starting at paddr 98304 dev_dump:256: Aggregate constructed: dev= di=0 dv_num_slice=15 dv_num_slice_blk=589824 dv_num_lslice_blk=131061 migrate_media_keys_if_needed:1254: disk0s1 no media keys to migrate spaceman_scan_free_blocks:3171: disk0s1 scan took 0.015712 s (no trims) mount: failed to migrate Media Keys, error = c002 handle_mount:654: disk0s1s2 vol-uuid: 61706673-7575-6964-0040-766F6C756D01 block size: 4096 block count: 8388597 (unencrypted; flags: 0x1; features: 8.0.2) handle_mount:667: disk0s1s2 setting dev block size to 4096 from 512 nx_volume_group_update:7713: disk0s1s2 Volume Data is not in a volume group fastsim_is_enabled:9457: ================ fastsim is enabled ================ apfs_vfsop_mount:2354: mounted volume: Data /dev/disk0s1s2 on /private/var (apfs, local, nodev, nosuid, journaled, noatime) handle_mount:654: disk0s1s5 vol-uuid: E3918FE6-47D6-43AD-9A10-058CDC596EB4 block size: 4096 block count: 8388597 (unencrypted; flags: 0x1; features: 8.0.2) handle_mount:667: disk0s1s5 setting dev block size to 4096 from 512 nx_volume_group_update:7707: disk0s1s5 Volume Update role c0 Not a System or data volume fastsim_is_enabled:9457: ================ fastsim is enabled ================ apfs_vfsop_mount:2354: mounted volume: Update /dev/disk0s1s5 on /private/var/MobileSoftwareUpdate (apfs, local, nodev, nosuid, journaled, noatime, nobrowse) handle_mount:654: disk0s1s3 vol-uuid: 61706673-7575-6964-0140-766F6C756D02 block size: 4096 block count: 8388597 (unencrypted; flags: 0x1; features: 8.0.2) handle_mount:667: disk0s1s3 setting dev block size to 4096 from 512 nx_volume_group_update:7707: disk0s1s3 Volume Hardware role 140 Not a System or data volume fastsim_is_enabled:9457: ================ fastsim is enabled ================ apfs_vfsop_mount:2354: mounted volume: Hardware /dev/disk0s1s3 on /private/var/hardware (apfs, local, nodev, nosuid, journaled, noatime, nobrowse) com.apple.xpc.launchd|2022-04-17 01:16:16.033083 : Doing boot task: init-with-data-volume com.apple.xpc.launchd|2022-04-17 01:16:16.095901 : Doing boot task: MSUEarlyBootTask spaceman_scan_free_blocks:3153: disk0s1 scan took 1.025618 s, trims took 0.983285 s spaceman_scan_free_blocks:3155: disk0s1 6089571 blocks free in 17906 extents spaceman_scan_free_blocks:3163: disk0s1 6089571 blocks trimmed in 17906 extents (54 us/trim, 18210 trims/s) spaceman_scan_free_blocks:3166: disk0s1 trim distribution 1:12171 2+:1962 4+:2516 16+:796 64+:310 256+:151 MSUEarlyBootTask: MSUEarlyBootTask running main: Content from the ramdisk will be present at /private/var/MobileSoftwareUpdate//2b906ac48e7b89aa76bdc77cf2eb46a52a5cfc4d863d676f515d4c2a3fcd87c5203e5dc133c771fde7038ea4513d4dd6-MSUData if it exists MSUEarlyBootTask: I have nothing to do. Goodbye!! com.apple.xpc.launchd|2022-04-17 01:16:16.328821 : Doing boot task: fips Tracing: disabled FIPSPOST_USER [270726780] fipspost_post:155: [FIPSPOST][Module-ID] Apple corecrypto Module v12.0 [Apple ARM, User, Software, SL1] FIPSPOST_USER [270839121] fipspost_post:165: PASSED: (4 ms) - fipspost_post_hmac FIPSPOST_USER [271036682] fipspost_post:166: PASSED: (12 ms) - fipspost_post_integrity FIPSPOST_USER [271068000] fipspost_post:172: PASSED: (14 ms) - fipspost_post_indicator FIPSPOST_USER [271078926] fipspost_post:173: PASSED: (14 ms) - fipspost_post_aes_ecb FIPSPOST_USER [271088853] fipspost_post:174: PASSED: (15 ms) - fipspost_post_aes_cbc FIPSPOST_USER [271452097] fipspost_post:175: PASSED: (30 ms) - fipspost_post_rsa_sig FIPSPOST_USER [272340780] fipspost_post:176: PASSED: (67 ms) - fipspost_post_ecdsa FIPSPOST_USER [272388121] fipspost_post:177: PASSED: (69 ms) - fipspost_post_ecdh FIPSPOST_USER [272413658] fipspost_post:178: PASSED: (70 ms) - fipspost_post_aes_ccm FIPSPOST_USER [272428439] fipspost_post:179: PASSED: (70 ms) - fipspost_post_aes_cmac FIPSPOST_USER [272438097] fipspost_post:180: PASSED: (71 ms) - fipspost_post_hkdf FIPSPOST_USER [272933219] fipspost_post:182: PASSED: (91 ms) - fipspost_post_pbkdf FIPSPOST_USER [272942512] fipspost_post:183: PASSED: (92 ms) - fipspost_post_kdf_ctr FIPSPOST_USER [272960731] fipspost_post:184: PASSED: (93 ms) - fipspost_post_aes_gcm FIPSPOST_USER [272973585] fipspost_post:185: PASSED: (93 ms) - fipspost_post_aes_xts FIPSPOST_USER [273002609] fipspost_post:186: PASSED: (94 ms) - fipspost_post_tdes_ecb FIPSPOST_USER [273011609] fipspost_post:187: PASSED: (95 ms) - fipspost_post_drbg_ctr FIPSPOST_USER [273026219] fipspost_post:188: PASSED: (95 ms) - fipspost_post_drbg_hmac FIPSPOST_USER [282071512] fipspost_post:190: PASSED: (472 ms) - fipspost_post_ffdh FIPSPOST_USER [282638439] fipspost_post:191: PASSED: (496 ms) - fipspost_post_rsa_enc_dec FIPSPOST_USER [282641804] fipspost_post:210: all tests PASSED (496 ms) com.apple.xpc.launchd|2022-04-17 01:16:16.953443 : Doing boot task: keybag ****** DIAGNOSTICS MODE ENABLED, SKIP INIT **** com.apple.xpc.launchd|2022-04-17 01:16:17.201197 : Doing boot task: usermanagerd com.apple.xpc.launchd|2022-04-17 01:16:17.203375 : usermanagerd: optional boot task not present com.apple.xpc.launchd|2022-04-17 01:16:17.228387 : launchd logging initialized. name: com.apple.xpc.launchd pid: 1 com.apple.xpc.launchd|2022-04-17 01:16:17.248288 : Doing boot task: xpcroleaccountd com.apple.xpc.launchd|2022-04-17 01:16:17.385264 : Doing boot task: init_featureflags com.apple.xpc.launchd|2022-04-17 01:16:17.902870 : Doing boot task: fud fud: Early Boot fud: -FudEarlyBoot doFUDEarlyBoot:: Starting Early Boot fud: No Early Boot Accessories fud: -FudEarlyBoot doFUDEarlyBoot:: End Early Boot fud: Exitng Early Boot com.apple.xpc.launchd|2022-04-17 01:16:18.438675 : Doing boot task: tzinit com.apple.xpc.launchd|2022-04-17 01:16:18.574303 : Doing boot task: finish-restore com.apple.xpc.launchd|2022-04-17 01:16:18.697320 : Doing boot task: finish-demo-restore com.apple.xpc.launchd|2022-04-17 01:16:18.821920 : Doing boot task: sysstatuscheck com.apple.xpc.launchd|2022-04-17 01:16:18.947177 : Doing boot task: prng_seedctl kern.prng.user_reseed_count: (-1) (2) No such file or directory failed to load virtual random: (-147) (-536870212) com.apple.xpc.launchd|2022-04-17 01:16:19.088041 : Doing boot task: launchd_cache_loader 0 Found valid port: 2307 Valid: 1 1 Found valid port: 0 Valid: 0 2 Found valid port: 0 Valid: 0 Using default cache paths Code: /System/Library/xpc/launchd.plist Sig: /System/Library/xpc/launchd.plist.sig Using unsecure cache: /System/Library/xpc/launchd.plist Trying to send bytes to launchd: 2307 16384 Sending validated cache to launchd Cache sent to launchd successfully com.apple.xpc.launchd|2022-04-17 01:16:19.388631 : launchd UUID: D1C385F5-82FE-32CD-9F8F-2C4A3A640895 com.apple.xpc.launchd|2022-04-17 01:16:19.388733 : Early boot complete. Continuing system boot. 000021.115717 AppleOLYHAL_log.A[1] AppleOLYHALPortInterfacePCIeAMFM::initWithProvider: amfm not matched 000021.122704 wlan0.A[4] [email protected]: Lowered adjustBusy(-1), getBusyState() -> 4

    opened by iarchiveml 4
  • libiosexec does not work

    libiosexec does not work

    libiosexec - an execve shim to allow executing shell scripts on ios libiosexec does not work here - it is almost like it isn't there iOS version: 14.3 with RELEASE kernel - so it definitely works on a real device (can also be reproduced with research kernels though) In fact this could also be reproduced on an iOS 15.3.1 arm64eCustomerRamDisk with research kernels

    bootstrap tarball To reproduce From a bash linked with libiosexec (/bin/bash will do), execute /usr/bin/apt-key (or any other script)

    shell output: bash: /usr/bin/apt-key: /bin/sh: bad interpreter: No such file or directory

    dmesg output [ 286.963467]: System Policy: bash(231) deny(1) process-exec-interpreter /usr/bin/dash for some reason the shebang exec ended up passed to the kernel, even with libiosexec.

    Note: I am not asking for a shebang exec kernel patch here - libiosexec is supposed to work around that. There is something else that prevent it from working. (although a shebang exec kernel patch will still fix my apparent issue)

    boot command:

    ${HOME}/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,trustcache-filename=038-83075-083.dmg.trustcache.out,ticket-filename=root_ticket.der \
    -kernel kernelcache.research.iphone12b \
    -dtb DeviceTree.n104ap.im4p \
    -append "-v launchd_missing_exec_no_panic=1 serial=3 keepsyms=1 launchd_unsecure_cache=1" \
    -initrd '038-83075-083.dmg.out' \
    -cpu max -smp 4 \
    -m 2G -serial mon:stdio \
    -drive file=nvme.1,format=raw,if=none,id=drive.1 \
    -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvram,if=none,format=raw,id=nvram \
    -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.2,format=raw,if=none,id=drive.2 \
    -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.3,format=raw,if=none,id=drive.3 \
    -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.4,format=raw,if=none,id=drive.4 \
    -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.6,format=raw,if=none,id=drive.6 \
    -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.7,format=raw,if=none,id=drive.7 \
    -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
    -monitor telnet:127.0.0.1:1235,server,nowait
    
    opened by asdfugil 3
  • unencrypted data volume is not allowed - iOS 15.3.1 restore

    unencrypted data volume is not allowed - iOS 15.3.1 restore

    iOS 15.3.1 cannot be restored - unencrypted data volume is not allowed panic Kernel is a research kernel xnu cmdline: -restore kextlog=0xffff debug=0x14e -v rd=md0 launchd_missing_exec_no_panic=1 serial=3 wdt=-1 keepsyms=1 launchd_unsecure_cache=1 IPSW download root_ticket.der generated with BuildManifest in ipsw and the ticket.shsh2 in qemu-t8030-tools Host is Debian bullseye Linux 5.15.0-0.bpo.3-amd64 #1 SMP Debian 5.15.15-2~bpo11+1 (2022-02-03) x86_64 qemu-t8030 commit: 42fedc70b97c8071f587b7748e323b897249548a boot command:

    ${HOME}/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,trustcache-filename=018-92126-069.dmg.trustcache.out,ticket-filename=${HOME}/vm_images/t8030/root_ticket.der \
    -kernel kernelcache.research.iphone12b \
    -dtb DeviceTree.n104ap.im4p \
    -append "-restore kextlog=0xffff debug=0x14e -v rd=md0 launchd_missing_exec_no_panic=1 serial=3 wdt=-1 keepsyms=1 launchd_unsecure_cache=1" \
    -initrd '018-92126-069.dmg.out'   \
    -cpu max -smp 4 \
    -m 2G -serial mon:stdio \
    -drive file=nvme.1,format=raw,if=none,id=drive.1 \
    -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvram,if=none,format=raw,id=nvram \
    -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.2,format=raw,if=none,id=drive.2 \
    -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.3,format=raw,if=none,id=drive.3 \
    -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.4,format=raw,if=none,id=drive.4 \
    -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.6,format=raw,if=none,id=drive.6 \
    -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
    -drive file=nvme.7,format=raw,if=none,id=drive.7 \
    -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
    -monitor telnet:127.0.0.1:1235,server,nowait
    

    Serial port output right before panic

    entering mount_partition                          
    executing /sbin/mount_apfs -R /dev/disk0s1s2 /mnt2                                                  
    apfs_mount:26376: disk0s1s2 mount for ramdisk                                                       
    set_cloneinfo_id_epoch:25743: disk0s1s2 set cloneinfo_id_epoch to 16                                
    apfs_log_mount_unmount:1828: disk0s1s2 mounting volume Data, requested by: mount_apfs (pid 37); parent: restored_externa (pid 6)                                                                         
    handle_mount:654: disk0s1s2 vol-uuid: 61706673-7575-6964-0040-766F6C756D01 block size: 4096 block count: 8388597 (unencrypted; flags: 0x1; features: 8.0.2)
    handle_mount:667: disk0s1s2 setting dev block size to 4096 from 512                                 
    nx_volume_group_update:7715: disk0s1s2 Volume Data is not in a volume group                         
    IOPlatformPanicAction -> AppleANS2NVMeController                                                    
    IOPlatformPanicAction -> AppleT8030PMGR                                                             
    IOPlatformPanicAction -> AppleARMWatchdogTimer                                                      
    IOPlatformPanicAction -> AppleNubSynopsysOTG3Device                                                 
    IOPlatformPanicAction -> RTBuddyV2                
    IOPlatformPanicAction -> RTBuddyV2                
    IOPlatformPanicAction -> RTBuddyV2                
    panic(cpu 2 caller 0xfffffff0093c31c8): "unencrypted data volume is not allowed" @apfs_vfsops.c:2357                                                                                                     
    Debugger message: panic                           
    Memory ID: 0x0                                    
    OS release type: Restore                          
    OS version: 19D52                                 
    Kernel version: Darwin Kernel Version 21.3.0: Wed Jan  5 21:44:45 PST 2022; root:xnu-8019.80.24~23/RELEASE_ARM64_T8030                                                                                   
    Kernel UUID: 5703F07F-AEE8-3207-8205-203C7B11B3C2                                                   
    iBoot version: qemu-t8030                         
    secure boot?: YES                                 
    Paniclog version: 13                              
    Kernel text base:  0xfffffff007004000             
    mach_absolute_time: 0x8fcb69550                   
    Epoch Time:        sec       usec                 
      Boot    : 0x6228c86d 0x000d892c                 
      Sleep   : 0x00000000 0x00000000                 
      Wake    : 0x00000000 0x00000000                 
      Calendar: 0x6228ceb3 0x0000edac
      
      Zone info:                                        
    Foreign   : 0xfffffff0b83dc000 - 0xfffffff0b83ec000                                                 
    Native    : 0xffffffe000588000 - 0xffffffe600588000                                                 
    Readonly  : 0xffffffe0e6bec000 - 0xffffffe1338b0000                                                 
    Metadata  : 0xffffffeb018cc000 - 0xffffffeb05bac000                                                 
    Bitmaps   : 0xffffffeb030cc000 - 0xffffffeb03b28000                                                 
    CORE 0: PC=0xfffffff007d4dadc, LR=0xfffffff007c77134, FP=0xffffffeb057bbd60                         
    CORE 1: PC=0xfffffff007d4e650, LR=0xfffffff007d4e64c, FP=0xffffffeb0578be80                         
    CORE 2 is the one that panicked. Check the full backtrace for details.                              
    CORE 3: PC=0xfffffff007d4e650, LR=0xfffffff007d4e64c, FP=0xffffffeb10693e80                         
    Panicked task 0xffffffe3006cece8: 658 pages, 1 threads: pid 37: mount_apfs                          
    Panicked thread: 0xffffffe3e6cbb020, backtrace: 0xffffffeb0583a990, tid: 551                                                                                                                             
                      lr: 0xfffffff007c08c18  fp: 0xffffffeb0583a9d0                                    
                      lr: 0xfffffff007c08938  fp: 0xffffffeb0583aa40                                    
                      lr: 0xfffffff007d5a2cc  fp: 0xffffffeb0583aa60                                    
                      lr: 0xfffffff007d4bae0  fp: 0xffffffeb0583aae0                                    
                      lr: 0xfffffff007d4a894  fp: 0xffffffeb0583aba0                                    
                      lr: 0xfffffff00835a610  fp: 0xffffffeb0583abb0                                    
                      lr: 0xfffffff007c08604  fp: 0xffffffeb0583af40                                    
                      lr: 0xfffffff007c08604  fp: 0xffffffeb0583afa0                                    
                      lr: 0xfffffff009cf01a8  fp: 0xffffffeb0583afc0                                    
                      lr: 0xfffffff0093c31c8  fp: 0xffffffeb0583b890                                    
                      lr: 0xfffffff007de7ee0  fp: 0xffffffeb0583bb40                                    
                      lr: 0xfffffff007de9974  fp: 0xffffffeb0583bd70                                    
                      lr: 0xfffffff007de96bc  fp: 0xffffffeb0583bdb0                                    
                      lr: 0xfffffff0081a8a98  fp: 0xffffffeb0583be50                                    
                      lr: 0xfffffff007d4a960  fp: 0xffffffeb0583bf10                                    
                      lr: 0xfffffff00835a610  fp: 0xffffffeb0583bf20                                    
    
    
    ** Stackshot Succeeded ** Bytes Traced 18741 (Uncompressed 50480) **                                
    IOPlatformPanicAction -> AppleANS2NVMeController                                                    
    IOPlatformPanicAction -> AppleT8030PMGR                                                             
    IOPlatformPanicAction -> AppleARMWatchdogTimer                                                      
    IOPlatformPanicAction -> AppleNubSynopsysOTG3Device                                                 
    IOPlatformPanicAction -> RTBuddyV2                
    IOPlatformPanicAction -> RTBuddyV2                
    IOPlatformPanicAction -> RTBuddyV2                
    IOPlatformPanicAction -> AppleANS2NVMeController                                                    
    IOPlatformPanicAction -> AppleT8030PMGR                                                             
    IOPlatformPanicAction -> AppleARMWatchdogTimer                                                      
    IOPlatformPanicAction -> AppleNubSynopsysOTG3Device                                                 
    IOPlatformPanicAction -> RTBuddyV2                
    IOPlatformPanicAction -> RTBuddyV2                
    IOPlatformPanicAction -> RTBuddyV2                
    
    Please go to https://panic.apple.com to report this panic
    

    idevicerestore log

    ┌──(nick㉿kali)-[~]
    └─$ idevicerestore -P -d --erase --restore-mode -i 0x1122334455667788 *.ipsw -T root_ticket.der
    Using ApTicket found at root_ticket.der length 8931
    progress: 0 0.000000
    idevice_event_cb: device 1122334455667788 (udid: 00008030-1122334455667788) connected in restore mode
    progress: 0 0.100000
    Found device in Restore mode
    INFO: device serial number is C39ZRMDEN72J
    restore_get_irecv_device: Found model N104DEV
    progress: 0 0.200000
    Identified device as n104ap, iPhone12,1
    progress: 0 0.600000
    Extracting BuildManifest from IPSW
    progress: 0 0.800000
    Product Version: 15.3.1
    Product Build: 19D52 Major: 19
    Device supports Image4: true
    Variant: Customer Erase Install (IPSW)
    This restore will erase your device data.
    ################################ [ WARNING ] #################################
    # You are about to perform an *ERASE* restore. ALL DATA on the target device #
    # will be IRREVERSIBLY DESTROYED. If you want to update your device without  #
    # erasing the user data, hit CTRL+C now and restart without -e or --erase    #
    # command line switch.                                                       #
    # If you want to continue with the ERASE, please type YES and press ENTER.   #
    ##############################################################################
    > YES  
    progress: 1 0.000000
    Checking IPSW for required components...
    All required components found in IPSW
    Using cached filesystem from 'iPhone11,8,iPhone12,1_15.3.1_19D52_Restore/018-91937-063.dmg'
    progress: 1 0.200000
    progress: 1 0.250000
    progress: 1 0.300000
    progress: 1 0.500000
    progress: 1 0.700000
    progress: 1 0.900000
    About to restore device... 
    restore_is_current_device: Connected to com.apple.mobile.restored, version 15
    Connecting now...
    Connected to com.apple.mobile.restored, version 15
    Device 00008030-1122334455667788 has successfully entered restore mode
    Hardware Information:
    BoardID: 4
    ChipID: 32816
    UniqueChipID: 1234605616436508552
    ProductionMode: false
    Starting FDR listener thread
    Connecting to FDR client at port 1082
    About to do ctrl handshake
    FDR sending 89 bytes:
    common.c:printing 287 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>BeginCtrl</string>
            <key>CtrlProtoVersion</key>
            <integer>2</integer>
    </dict>
    </plist>
    FDR Sent 89 bytes
    FDR Received 105 bytes
    common.c:printing 334 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>BeginCtrl</string>
            <key>CtrlProtoVersion</key>
            <integer>2</integer>
            <key>ConnPort</key>
            <integer>49161</integer>
    </dict>
    </plist>
    Ctrl handshake done (ConnPort = 49161)
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 1 1.000000
    About to send RootTicket...
    Sending RootTicket now...
    Done sending RootTicket
    Waiting for NAND (28)
    Updating NAND Firmware (58)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    About to send FDR Trust data...
    Sending FDR Trust data now...
    Done sending FDR Trust Data
    Checking for uncollected logs (44)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Creating partition map (11)
    Creating filesystem (12)
    About to send filesystem...
    Connecting to ASR
    Retrying connection...
    Received 272 bytes:
    common.c:printing 272 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Checksum Chunks</key>
            <true/>
            <key>Command</key>
            <string>Initiate</string>
    </dict>
    </plist>
    Connected to ASR
    Validating the filesystem
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    Received 336 bytes:
    common.c:printing 336 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>1276</integer>
            <key>OOB Offset</key>
            <integer>6562671111</integer>
    </dict>
    </plist>
    Received 325 bytes:
    common.c:printing 325 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>72</integer>
            <key>OOB Offset</key>
            <integer>0</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 325 bytes:
    common.c:printing 325 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>64</integer>
            <key>OOB Offset</key>
            <integer>0</integer>
    </dict>
    </plist>
    Received 338 bytes:
    common.c:printing 338 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>399069</integer>
            <key>OOB Offset</key>
            <integer>6562272806</integer>
    </dict>
    </plist>
    Received 336 bytes:
    common.c:printing 336 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>1276</integer>
            <key>OOB Offset</key>
            <integer>6562671111</integer>
    </dict>
    </plist>
    Received 325 bytes:
    common.c:printing 325 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>72</integer>
            <key>OOB Offset</key>
            <integer>0</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 325 bytes:
    common.c:printing 325 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>64</integer>
            <key>OOB Offset</key>
            <integer>0</integer>
    </dict>
    </plist>
    Received 338 bytes:
    common.c:printing 338 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>399069</integer>
            <key>OOB Offset</key>
            <integer>6562272806</integer>
    </dict>
    </plist>
    Received 325 bytes:
    common.c:printing 325 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>55</integer>
            <key>OOB Offset</key>
            <integer>0</integer>
    </dict>
    </plist>
    Received 328 bytes:
    common.c:printing 328 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>210</integer>
            <key>OOB Offset</key>
            <integer>163</integer>
    </dict>
    </plist>
    Received 327 bytes:
    common.c:printing 327 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>108</integer>
            <key>OOB Offset</key>
            <integer>55</integer>
    </dict>
    </plist>
    Received 327 bytes:
    common.c:printing 327 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>108</integer>
            <key>OOB Offset</key>
            <integer>55</integer>
    </dict>
    </plist>
    Received 330 bytes:
    common.c:printing 330 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>18797</integer>
            <key>OOB Offset</key>
            <integer>373</integer>
    </dict>
    </plist>
    Received 327 bytes:
    common.c:printing 327 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>108</integer>
            <key>OOB Offset</key>
            <integer>55</integer>
    </dict>
    </plist>
    Received 328 bytes:
    common.c:printing 328 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>210</integer>
            <key>OOB Offset</key>
            <integer>163</integer>
    </dict>
    </plist>
    Received 325 bytes:
    common.c:printing 325 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>55</integer>
            <key>OOB Offset</key>
            <integer>0</integer>
    </dict>
    </plist>
    Received 332 bytes:
    common.c:printing 332 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>7500</integer>
            <key>OOB Offset</key>
            <integer>168112</integer>
    </dict>
    </plist>
    Received 331 bytes:
    common.c:printing 331 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>204</integer>
            <key>OOB Offset</key>
            <integer>175612</integer>
    </dict>
    </plist>
    Received 332 bytes:
    common.c:printing 332 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>7500</integer>
            <key>OOB Offset</key>
            <integer>168112</integer>
    </dict>
    </plist>
    Received 332 bytes:
    common.c:printing 332 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>7085</integer>
            <key>OOB Offset</key>
            <integer>138866</integer>
    </dict>
    </plist>
    Received 334 bytes:
    common.c:printing 334 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>192423</integer>
            <key>OOB Offset</key>
            <integer>175816</integer>
    </dict>
    </plist>
    Received 336 bytes:
    common.c:printing 336 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>213761</integer>
            <key>OOB Offset</key>
            <integer>21904205</integer>
    </dict>
    </plist>
    Received 332 bytes:
    common.c:printing 332 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>7500</integer>
            <key>OOB Offset</key>
            <integer>168112</integer>
    </dict>
    </plist>
    Received 332 bytes:
    common.c:printing 332 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>3186</integer>
            <key>OOB Offset</key>
            <integer>164926</integer>
    </dict>
    </plist>
    Received 332 bytes:
    common.c:printing 332 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>7500</integer>
            <key>OOB Offset</key>
            <integer>168112</integer>
    </dict>
    </plist>
    Received 336 bytes:
    common.c:printing 336 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>1276</integer>
            <key>OOB Offset</key>
            <integer>6562671111</integer>
    </dict>
    </plist>
    Received 325 bytes:
    common.c:printing 325 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>72</integer>
            <key>OOB Offset</key>
            <integer>0</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 335 bytes:
    common.c:printing 335 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>512</integer>
            <key>OOB Offset</key>
            <integer>6562671875</integer>
    </dict>
    </plist>
    Received 325 bytes:
    common.c:printing 325 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>64</integer>
            <key>OOB Offset</key>
            <integer>0</integer>
    </dict>
    </plist>
    Received 338 bytes:
    common.c:printing 338 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>399069</integer>
            <key>OOB Offset</key>
            <integer>6562272806</integer>
    </dict>
    </plist>
    Received 338 bytes:
    common.c:printing 338 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>OOBData</string>
            <key>OOB Length</key>
            <integer>399069</integer>
            <key>OOB Offset</key>
            <integer>6562272806</integer>
    </dict>
    </plist>
    Received 234 bytes:
    common.c:printing 234 bytes plist:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>Command</key>
            <string>Payload</string>
    </dict>
    </plist>
    Filesystem validated
    Sending filesystem now...
    progress: 2 0.010006
    progress: 2 0.020012
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.030018
    progress: 2 0.040005
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.050011
    progress: 2 0.060017
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.070003
    progress: 2 0.080009
    progress: 2 0.090015
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.100002
    progress: 2 0.110008
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.120014
    progress: 2 0.130000
    progress: 2 0.140006
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.150012
    progress: 2 0.160018
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.170005
    progress: 2 0.180011
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.190017
    progress: 2 0.200003
    progress: 2 0.210009
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.220015
    progress: 2 0.230002
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.240008
    progress: 2 0.250014
    progress: 2 0.260000
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.270006
    progress: 2 0.280012
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.290019
    progress: 2 0.300005
    progress: 2 0.310011
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.320017
    progress: 2 0.330003
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.340009
    progress: 2 0.350015
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.360002
    progress: 2 0.370008
    progress: 2 0.380014
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.390000
    progress: 2 0.400006
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.410012
    progress: 2 0.420019
    progress: 2 0.430005
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.440011
    progress: 2 0.450017
    progress: 2 0.460003
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.470009
    progress: 2 0.480015
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.490002
    progress: 2 0.500008
    progress: 2 0.510014
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.520000
    progress: 2 0.530006
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.540012
    progress: 2 0.550019
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.560005
    progress: 2 0.570011
    progress: 2 0.580017
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.590003
    progress: 2 0.600009
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.610016
    progress: 2 0.620002
    progress: 2 0.630008
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.640014
    progress: 2 0.650000
    progress: 2 0.660006
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.670012
    progress: 2 0.680019
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.690005
    progress: 2 0.700011
    progress: 2 0.710017
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.720003
    progress: 2 0.730009
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.740016
    progress: 2 0.750002
    progress: 2 0.760008
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.770014
    progress: 2 0.780000
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.790006
    progress: 2 0.800013
    progress: 2 0.810019
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.820005
    progress: 2 0.830011
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.840017
    progress: 2 0.850003
    progress: 2 0.860009
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.870016
    progress: 2 0.880002
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.890008
    progress: 2 0.900014
    progress: 2 0.910000
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.920006
    progress: 2 0.930013
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.940019
    progress: 2 0.950005
    progress: 2 0.960011
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.970017
    progress: 2 0.980003
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 2 0.990009
    progress: 2 1.000000
    Done sending filesystem
    Verifying restore (14)
    progress: 3 0.020000
    progress: 3 0.040000
    progress: 3 0.060000
    progress: 3 0.080000
    progress: 3 0.100000
    progress: 3 0.120000
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 3 0.140000
    progress: 3 0.160000
    progress: 3 0.180000
    progress: 3 0.200000
    progress: 3 0.220000
    progress: 3 0.240000
    progress: 3 0.260000
    progress: 3 0.280000
    progress: 3 0.300000
    progress: 3 0.320000
    progress: 3 0.340000
    progress: 3 0.360000
    progress: 3 0.380000
    progress: 3 0.400000
    progress: 3 0.420000
    progress: 3 0.440000
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 3 0.460000
    progress: 3 0.480000
    progress: 3 0.500000
    progress: 3 0.520000
    progress: 3 0.540000
    progress: 3 0.560000
    progress: 3 0.580000
    progress: 3 0.600000
    progress: 3 0.620000
    progress: 3 0.640000
    progress: 3 0.660000
    progress: 3 0.680000
    progress: 3 0.700000
    progress: 3 0.720000
    progress: 3 0.740000
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 3 0.760000
    progress: 3 0.780000
    progress: 3 0.800000
    progress: 3 0.820000
    progress: 3 0.840000
    progress: 3 0.860000
    progress: 3 0.880000
    progress: 3 0.900000
    progress: 3 0.920000
    progress: 3 0.940000
    progress: 3 0.960000
    progress: 3 0.980000
    progress: 3 1.000000
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Unmounting filesystems (29)
    Checking filesystems (15)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    No data to read (timeout)
    Checking filesystems (15)
    Checking filesystems (15)
    Mounting filesystems (16)
    Mounting filesystems (16)
    Mounting filesystems (16)
    Unknown operation (80)
    Unhandled progress operation 80 (80)
    Sending IsiBootEANFirmware image list
    Unhandled progress operation 80 (80)
    Sending IsiBootNonEssentialFirmware image list
    About to send NORData...
    Found firmware path Firmware/all_flash
    Getting firmware manifest from build identity
    Extracting LLB.n104.RELEASE.im4p (Firmware/all_flash/LLB.n104.RELEASE.im4p)...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    Not personalizing component LLB...
    Extracting [email protected]~iphone.im4p (Firmware/all_flash/[email protected]~iphone.im4p)...
    Not personalizing component AppleLogo...
    Extracting [email protected]~iphone.im4p (Firmware/all_flash/[email protected]~iphone.im4p)...
    Not personalizing component BatteryCharging0...
    Extracting [email protected]~iphone.im4p (Firmware/all_flash/[email protected]~iphone.im4p)...
    Not personalizing component BatteryCharging1...
    Extracting [email protected]~iphone.im4p (Firmware/all_flash/[email protected]~iphone.im4p)...
    Not personalizing component BatteryFull...
    Extracting [email protected]~iphone.im4p (Firmware/all_flash/[email protected]~iphone.im4p)...
    Not personalizing component BatteryLow0...
    Extracting [email protected]~iphone.im4p (Firmware/all_flash/[email protected]~iphone.im4p)...
    Not personalizing component BatteryLow1...
    Extracting [email protected]~iphone-lightning.im4p (Firmware/all_flash/[email protected]~iphone-lightning.im4p)...
    Not personalizing component BatteryPlugin...
    Extracting DeviceTree.n104ap.im4p (Firmware/all_flash/DeviceTree.n104ap.im4p)...
    Not personalizing component DeviceTree...
    Extracting [email protected]~iphone-lightning.im4p (Firmware/all_flash/[email protected]~iphone-lightning.im4p)...
    Not personalizing component LowPowerWallet0...
    Extracting [email protected]~iphone-lightning.im4p (Firmware/all_flash/[email protected]~iphone-lightning.im4p)...
    Not personalizing component LowPowerWallet1...
    Extracting [email protected]~iphone-lightning.im4p (Firmware/all_flash/[email protected]~iphone-lightning.im4p)...
    Not personalizing component RecoveryMode...
    Extracting WirelessPower.iphone12b.im4p (Firmware/WirelessPower/WirelessPower.iphone12b.im4p)...
    Not personalizing component WCHFirmwareUpdater...
    Extracting iBoot.n104.RELEASE.im4p (Firmware/all_flash/iBoot.n104.RELEASE.im4p)...
    Not personalizing component iBoot...
    Extracting sep-firmware.n104.RELEASE.im4p (Firmware/all_flash/sep-firmware.n104.RELEASE.im4p)...
    Not personalizing component RestoreSEP...
    Extracting sep-firmware.n104.RELEASE.im4p (Firmware/all_flash/sep-firmware.n104.RELEASE.im4p)...
    Not personalizing component SEP...
    common.c:supressed printing 27932382 bytes plist...
    Sending NORData now...
    Done sending NORData
    Flashing firmware (18)
    progress: 4 1.000000
    Unknown operation (80)
    Unhandled progress operation 80 (80)
    Sending IsEarlyAccessFirmware image list
    Unhandled progress operation 80 (80)
    Sending IsiBootEANFirmware image list
    Unhandled progress operation 80 (80)
    Sending IsiBootNonEssentialFirmware image list
    Requesting FUD data (36)
    progress: 6 0.010000
    Found IsFUDFirmware component ANE
    Found IsFUDFirmware component AOP
    Found IsFUDFirmware component AVE
    Found IsFUDFirmware component Ap,HapticAssets
    Found IsFUDFirmware component Ap,SystemVolumeCanonicalMetadata
    Found IsFUDFirmware component AudioCodecFirmware
    Found IsFUDFirmware component GFX
    Found IsFUDFirmware component ISP
    Found IsFUDFirmware component LeapHaptics
    Found IsFUDFirmware component Multitouch
    Found IsFUDFirmware component PMP
    Found IsFUDFirmware component RestoreTrustCache
    Found IsFUDFirmware component SIO
    Found IsFUDFirmware component StaticTrustCache
    Found IsFUDFirmware component SystemVolume
    Sending IsFUDFirmware image list
    Extracting h12_ane_fw_metis.im4p (Firmware/ane/h12_ane_fw_metis.im4p)...
    Not personalizing component ANE...
    Sending IsFUDFirmware for ANE...
    progress: 6 0.060000
    Extracting aopfw-iphone12baop.im4p (Firmware/AOP/aopfw-iphone12baop.im4p)...
    Not personalizing component AOP...
    Sending IsFUDFirmware for AOP...
    progress: 6 0.130000
    Extracting AppleAVE2FW_H12.im4p (Firmware/ave/AppleAVE2FW_H12.im4p)...
    Not personalizing component AVE...
    Sending IsFUDFirmware for AVE...
    progress: 6 0.200000
    Extracting N104_HapticAssets.im4p (Firmware/N104_HapticAssets.im4p)...
    Not personalizing component Ap,HapticAssets...
    Sending IsFUDFirmware for Ap,HapticAssets...
    progress: 6 0.260000
    Extracting 018-91937-063.dmg.mtree (Firmware/018-91937-063.dmg.mtree)...
    Not personalizing component Ap,SystemVolumeCanonicalMetadata...
    Sending IsFUDFirmware for Ap,SystemVolumeCanonicalMetadata...
    progress: 6 0.330000
    Extracting N104_AudioCodecFirmware.im4p (Firmware/N104_AudioCodecFirmware.im4p)...
    Not personalizing component AudioCodecFirmware...
    Sending IsFUDFirmware for AudioCodecFirmware...
    progress: 6 0.400000
    Extracting armfw_g12p.im4p (Firmware/agx/armfw_g12p.im4p)...
    Not personalizing component GFX...
    Sending IsFUDFirmware for GFX...
    progress: 6 0.460000
    Extracting adc-zelus-n104.im4p (Firmware/isp_bni/adc-zelus-n104.im4p)...
    Not personalizing component ISP...
    Sending IsFUDFirmware for ISP...
    progress: 6 0.530000
    Extracting N104_LeapHapticsFirmware.im4p (Firmware/N104_LeapHapticsFirmware.im4p)...
    Not personalizing component LeapHaptics...
    Sending IsFUDFirmware for LeapHaptics...
    progress: 6 0.600000
    Extracting N104_Multitouch.im4p (Firmware/N104_Multitouch.im4p)...
    Not personalizing component Multitouch...
    Sending IsFUDFirmware for Multitouch...
    FDR 0x56033bcb5bc0 timeout waiting for command
    FDR 0x56033bcb5bc0 waiting for message...
    progress: 6 0.660000
    Extracting t8030pmp.im4p (Firmware/pmp/t8030pmp.im4p)...
    Not personalizing component PMP...
    Sending IsFUDFirmware for PMP...
    progress: 6 0.730000
    Extracting 018-92126-069.dmg.trustcache (Firmware/018-92126-069.dmg.trustcache)...
    Not personalizing component RestoreTrustCache...
    Sending IsFUDFirmware for RestoreTrustCache...
    progress: 6 0.800000
    Extracting SmartIOFirmware_ASCv2.im4p (Firmware/SmartIOFirmware_ASCv2.im4p)...
    Not personalizing component SIO...
    Sending IsFUDFirmware for SIO...
    progress: 6 0.860000
    Extracting 018-91937-063.dmg.trustcache (Firmware/018-91937-063.dmg.trustcache)...
    Not personalizing component StaticTrustCache...
    Sending IsFUDFirmware for StaticTrustCache...
    progress: 6 0.930000
    Extracting 018-91937-063.dmg.root_hash (Firmware/018-91937-063.dmg.root_hash)...
    Not personalizing component SystemVolume...
    Sending IsFUDFirmware for SystemVolume...
    progress: 6 1.000000
    Updating gas gauge software (47)
    Updating gas gauge software (47)
    Updating Stockholm (55)
    Requesting FUD data (36)
    progress: 6 0.010000
    Found IsFUDFirmware component ANE
    Found IsFUDFirmware component AOP
    Found IsFUDFirmware component AVE
    Found IsFUDFirmware component Ap,HapticAssets
    Found IsFUDFirmware component Ap,SystemVolumeCanonicalMetadata
    Found IsFUDFirmware component AudioCodecFirmware
    Found IsFUDFirmware component GFX
    Found IsFUDFirmware component ISP
    Found IsFUDFirmware component LeapHaptics
    Found IsFUDFirmware component Multitouch
    Found IsFUDFirmware component PMP
    Found IsFUDFirmware component RestoreTrustCache
    Found IsFUDFirmware component SIO
    Found IsFUDFirmware component StaticTrustCache
    Found IsFUDFirmware component SystemVolume
    Sending IsFUDFirmware image list
    progress: 6 0.060000
    progress: 6 0.130000
    progress: 6 0.200000
    progress: 6 0.260000
    Extracting 018-91937-063.dmg.mtree (Firmware/018-91937-063.dmg.mtree)...
    Not personalizing component Ap,SystemVolumeCanonicalMetadata...
    Sending IsFUDFirmware for Ap,SystemVolumeCanonicalMetadata...
    progress: 6 0.330000
    progress: 6 0.400000
    progress: 6 0.460000
    progress: 6 0.530000
    progress: 6 0.600000
    progress: 6 0.660000
    progress: 6 0.730000
    Extracting 018-92126-069.dmg.trustcache (Firmware/018-92126-069.dmg.trustcache)...
    Not personalizing component RestoreTrustCache...
    Sending IsFUDFirmware for RestoreTrustCache...
    progress: 6 0.800000
    progress: 6 0.860000
    progress: 6 0.930000
    Extracting 018-91937-063.dmg.root_hash (Firmware/018-91937-063.dmg.root_hash)...
    Not personalizing component SystemVolume...
    Sending IsFUDFirmware for SystemVolume...
    progress: 6 1.000000
    Updating Veridian (66)
    Unknown operation (79)
    Unhandled progress operation 79 (79)
    Requesting EAN Data (74)
    Creating Protected Volume (67)
    ERROR: Could not read data (-256). Aborting.
    FDR 0x56033bcb5bc0 terminating...
    idevice_event_cb: device 1122334455667788 (udid: 00008030-1122334455667788) disconnected
    ERROR: Unable to restore device
    
    opened by asdfugil 24
runing qemu in Docker by BOA

myQemu runing qemu in Docker by BOA It currently only supports mipsel configuration, other architectures have not been added yet, please wait for subs

null 21 May 30, 2022
A patched QEMU that exposes an interface for LibAFL-based fuzzers

QEMU LibAFL Bridge This is a patched QEMU that exposes an interface for LibAFL-based fuzzers. This raw interface is used in libafl_qemu that expose a

Advanced Fuzzing League ++ 24 Apr 26, 2022
Sloth 🦥 is a coverage guided fuzzing framework for fuzzing Android Native libraries that makes use of libFuzzer and QEMU user-mode emulation

Sloth ?? Sloth is a fuzzing setup that makes use of libFuzzer and QEMU’s user-mode emulation (qemu/linux-user) on x86_64/aarch64 host to emulate aarch

Chaithu 72 Jun 20, 2022
Example virtual PCI devices for QEMU.

QEMU virtual device playground ?? UNDER CONSTRUCTION ?? Chicken or Egg? Development or Exploit..? Description Here are some example of QEMU virtual PC

smallkirby 2 Apr 5, 2022
Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU.

Unicorn Engine Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. Unicorn offers some unparalleled fe

lazymio 1 Nov 7, 2021
A test of judging code using qemu

QEMU Judger Test This project was done abandoned 2 months ago, and I can't remember everything very well, so the steps here may be wrong. Setup First,

null 7 Nov 13, 2021
This is an upgrade to the initial TerminalOS source, supporting real hardware other than just QEMU, using GRUB as a bootloader instead of the crappy one i wrote

Terminal OS Author: Maheswaran Date: 20th Nov 2021 PROGRESS Multiboot compilance achieved VGA driver from complete with print_hex, print_dec, printf f

Maheswaran Parameswaran 1 Nov 28, 2021
Add tensilica esp32 cpu and a board to qemu and dump the rom to learn more about esp-idf

qemu_esp32 Add tensilica esp32 cpu and a board to qemu and dump the rom to learn more about esp-idf ESP32 in QEMU. This documents how to add an esp32

null 333 Jun 22, 2022
Cross-platform, Serial Port library written in C++

Serial Communication Library (Linux and OS X) (Windows) This is a cross-platform library for interfacing with rs-232 serial like ports written in C++.

William Woodall 1.5k Jun 19, 2022
Lean4 port of Arduino balance car controller

lean4-balance-car This is a small proof-of-concept exercise to show a Lean 4 program controlling a real robotics platform which requires low latency c

Galois, Inc. 29 Jun 29, 2022
C++11 port of docopt

docopt.cpp: A C++11 Port Contents docopt creates beautiful command-line interfaces Isn't it awesome how getopt (and boost::program_options for you fan

null 966 Jun 19, 2022
Trial port of the rtf_433 Library for use with OpenMQTTGateway on a ESP32 and a CC1101 Transceiver

This is an attempt at creating an Arduino library for use on ESP32 boards with a CC1101 transceiver with the device decoders from the rtl_433 package.

Northern Man 70 Jun 19, 2022
Port of my M5Stack Core 2 audio monitor project to generic ESP32s with TFT screens

ESP32 Audio Monitor This is a port of this project to work with any ESP32 device with a TFT display. You can watch a video explainer here (YouTube) wh

atomic14 41 Jun 23, 2022
Doom port for InfOS - the University of Edinburgh Informatics research operating system used in the UG3 OS course

Doom on InfOS InfOS is the Informatics research operating system, designed specifically for the UG3 Operating Systems course. This project aims to por

Cheng Kai 14 Jun 19, 2022
Port of Golang channels to C++

Copper is a C++ library of a powerful queue object for communication between threads. It is based on Go's channels and follows the quote: Don't commun

null 152 Jun 24, 2022
NDS port of the uxn virtual machine

uxnds Quick and simple port of the uxn virtual machine to the NDS console. By default, uxnds will run /uxn/boot.rom. It also supports reading files fr

Adrian Siekierka 102 Jun 16, 2022
High Quality DeNoise 3D is an AviSynth port of the MPlayer filter of the same name

High Quality DeNoise 3D is an AviSynth port of the MPlayer filter of the same name. It performs a 3-way low-pass filter, which can completely remove high-frequency noise while minimizing blending artifacts.

null 12 Jun 7, 2022
A fast and small port of Zstandard to WASM.

Zstandard WASM A fast and small port of Zstandard to WASM. (Decompress-only for now). Features Fast: Zstandard has been compiled with the -03 flag, so

Fabio Spampinato 10 Apr 15, 2022
This is the Arduino® compatible port of the AIfES machine learning framework, developed and maintained by Fraunhofer Institute for Microelectronic Circuits and Systems.

AIfES for Arduino® AIfES (Artificial Intelligence for Embedded Systems) is a platform-independent and standalone AI software framework optimized for e

null 129 Jun 27, 2022