Pogo is not installed. (iPhone 8 Plus 10,5 - IOS 15,6 b1) about palera1n

[itsnebulalol]

Hi there, camera is a known issue.

Is it installed to the Tips app? If not you’ll have to use SSHRD_Script to install TrollStore to Tips, then boot palera1n and install Pogo through TrollStore.

[Burlaman]

I did that but the tips app doesn't open.

[itsnebulalol]

Reboot and run palera1n again

[Burlaman]

I did it twice but it still doesn't open the tips app.
Does TrollStore really work on version 15.6b1?

[itsnebulalol]

When booted with palera1n yes. Does the device show the apple troll bootlogo then verbose?

[Burlaman]

yes.

[itsnebulalol]

That’s weird, try the SSHRD method

[Burlaman]

what method?
Link?

[itsnebulalol]

https://github.com/opa334/TrollStore/blob/main/install_with_sshrd.md

[Burlaman]

I tried the methods but it doesn't open the tips app.

[itsnebulalol]

Did you boot palera1n

[Burlaman]

I SSH Ramdisk then booted it from palera1n.
I did SSH Ramdisk then sshrd.sh boot.
then boot from palera1n.
neither opens the tips app.

[itsnebulalol]

palera1n isn’t booting correctly then. Can you take a video of the phone doing the verbose boot, until it gets to the lock screen

[Burlaman]

yes.
take a minute please.

[Burlaman]

I uploaded the entire process to my drive.
Sorry about the recording.
https://drive.google.com/file/d/1FOk2OlUrwbGEzpmLWol880F3MIk_ImOz/view?usp=sharing

[itsnebulalol]

You’re supposed to run ./sshrd.sh boot to install TrollStore

[Burlaman]

First
./sshrd.sh 15.6 TrollStore Tips
OK.
Second
./sshrd.sh boot
OK
./palera1n.sh --debug
OK.
Boot ok verbose.
but the tips does not open.

[Burlaman]

./sshrd.sh 15.6 TrollStore Tips
[] Waiting for device in DFU mode
[] Getting device info... this may take a second
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f
Compiled with plist: YES
Saved IM4M to work/IM4M
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: BuildManifest.plist
100% [===================================================================================================>]
download succeeded
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: Firmware/dfu/iBSS.d21.RELEASE.im4p
100% [===================================================================================================>]
download succeeded
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: Firmware/dfu/iBEC.d21.RELEASE.im4p
100% [===================================================================================================>]
download succeeded
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: Firmware/all_flash/DeviceTree.d211ap.im4p
100% [===================================================================================================>]
download succeeded
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: Firmware/078-34285-078.dmg.trustcache
100% [===================================================================================================>]
download succeeded
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: kernelcache.release.iphone10
100% [===================================================================================================>]
download succeeded
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: 078-34285-078.dmg
100% [===================================================================================================>]
download succeeded
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23] PWND:[gaster]
Found the USB handle.
Now you can boot untrusted images.
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23] PWND:[gaster]
Found the USB handle.
Now you can boot untrusted images.
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
main: Starting...
iOS 15 iBoot detected!
getting get_debug_enabled_patch() patch
getting get_sigcheck_patch() patch
applying patch=0x18003077c : 000080d2
applying patch=0x1800307c4 : 000080d2
applying patch=0x1800323b4 : 200080d2
main: Writing out patched file to work/iBSS.patched...
main: Quitting...
none
main: Starting...
iOS 15 iBoot detected!
getting get_boot_arg_patch(rd=md0 debug=0x2014e -v wdt=-1 TrollStore=Tips ) patch
getting get_debug_enabled_patch() patch
getting get_unlock_nvram_patch() patch
getting get_sigcheck_patch() patch
applying patch=0x18003077c : 000080d2
applying patch=0x1800307c4 : 000080d2
applying patch=0x18001df64 : 000080d2c0035fd6
applying patch=0x18001dfbc : 000080d2c0035fd6
applying patch=0x180061924 : 000080d2c0035fd6
applying patch=0x1800323b4 : 200080d2
applying patch=0x1800339dc : 38420c10
applying patch=0x18004c220 : 72643d6d64302064656275673d30783230313465202d76207764743d2d312054726f6c6c53746f72653d546970732000
applying patch=0x1800385c0 : 1f2003d5
main: Writing out patched file to work/iBEC.patched...
main: Quitting...
none
krnl
main: Starting...
Kernel: Adding AMFI_get_out_of_my_way patch...
get_amfi_out_of_my_way_patch: Entering ...
get_amfi_out_of_my_way_patch: Kernel-8020 inputted
get_amfi_out_of_my_way_patch: Found Internal Error: No cdhash found. str loc at 0x39930c
get_amfi_out_of_my_way_patch: Found Internal Error: No cdhash found. str ref at 0x12d6da4
get_amfi_out_of_my_way_patch: Patching AMFI at 0x12d35e0
main: Writing out patched file to work/kcache.patched...
main: Quitting...
0x12d35e0 0xfd 0xe0
0x12d35e1 0x7b 0x3
0x12d35e2 0xbf 0x0
0x12d35e3 0xa9 0x32
0x12d35e4 0xfd 0xc0
0x12d35e6 0x0 0x5f
0x12d35e7 0x91 0xd6
krnl
dtre
rtsc
rdsk
/dev/disk4 /private/tmp/SSHRD
"disk4" ejected.
none
none

[] Cleaning up work directory
[] uploading logs, if this fails, your ramdisk is still created.
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1300k 0 73 100 1300k 4 90679 0:00:14 0:00:14 --:--:-- 152k
[*] done uploading logs!

[] Finished! Please use ./sshrd.sh boot to boot your device
b4nz4tech@MacBook-Pro-de-b4nz4Tech-4 SSHRD_Script % ./sshrd.sh boot
[] Getting device info... this may take a second
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[*] Device should now show text on screen

[Burlaman]

./palera1n.sh 15.6 --debug
palera1n | Version 1.0.0
Written by Nebula | Some code and ramdisk from Nathan | Patching commands and help from Mineek | Loader app by Amy

Hello, iPhone10,5 on 15.6!
[] Switching device into recovery mode...
Telling device with udid ea302189a5ef4185d35c46386eb79f4611c526dc to enter recovery mode.
Device is successfully switching to recovery mode.
[] Waiting for device to reconnect in recovery mode
[] Getting device info...
[] Press any key when ready for DFU mode
Get ready (0)
Hold volume down + side button (0)
Keep holding (0)
Release side button, but keep holding volume down (0)
[] Device entered DFU!
[] Pwning device
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: RESET
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: SPRAY
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: SETUP
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: PATCH
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23] PWND:[gaster]
Found the USB handle.
Now you can boot untrusted images.
[*] Booting device
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%

Done!
The device should now boot to iOS
If you already have ran palera1n, click Do All in the tools section of Pogo
If not, Pogo should be installed to Tips

[itsnebulalol]

That’s weird, patches aren’t being applied. Can you do ./palera1n.sh clean then ./palera1n.sh --debug and show the output.

[Burlaman]

./palera1n.sh clean
[*] Removed the created boot files
b4nz4tech@MacBook-Pro-de-b4nz4Tech-4 palera1n % ./palera1n.sh --debug
palera1n | Version 1.0.0
Written by Nebula | Some code and ramdisk from Nathan | Patching commands and help from Mineek | Loader app by Amy

Hello, iPhone10,5 on 15.6!
[] Switching device into recovery mode...
Telling device with udid ea302189a5ef4185d35c46386eb79f4611c526dc to enter recovery mode.
Device is successfully switching to recovery mode.
[] Waiting for device to reconnect in recovery mode
[] Getting device info...
[] Press any key when ready for DFU mode
Get ready (0)
Hold volume down + side button (0)
Keep holding (0)
Release side button, but keep holding volume down (0)
[] Device entered DFU!
[] Pwning device
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: RESET
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: SPRAY
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: SETUP
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Found the USB handle.
Stage: PATCH
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23] PWND:[gaster]
Found the USB handle.
Now you can boot untrusted images.
[] Converting blob
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f
Compiled with plist: YES
Saved IM4M to work/IM4M
[] Downloading BuildManifest
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: BuildManifest.plist
100% [===================================================================================================>]
download succeeded
[] Downloading and decrypting iBSS
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: Firmware/dfu/iBSS.d21.RELEASE.im4p
100% [===================================================================================================>]
download succeeded
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23] PWND:[gaster]
Found the USB handle.
Now you can boot untrusted images.
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
[] Downloading and decrypting iBEC
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: Firmware/dfu/iBEC.d21.RELEASE.im4p
100% [===================================================================================================>]
download succeeded
usb_timeout: 5
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0C ECID:00195D892047C02E IBFL:3C SRTG:[iBoot-3332.0.0.1.23] PWND:[gaster]
Found the USB handle.
Now you can boot untrusted images.
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
[] Downloading DeviceTree
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: Firmware/all_flash/DeviceTree.d211ap.im4p
100% [===================================================================================================>]
download succeeded
[] Downloading trustcache
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: Firmware/078-33596-077.dmg.trustcache
100% [===================================================================================================>]
download succeeded
[] Downloading kernelcache
Version: 9bfdde2b2456181045f74631683fba491d8bf4f2 - 38
libfragmentzip version: 0.64-aaf6fae83a0aa6f7aae1c94721857076d04a14e8-RELEASE
init pzb: https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41737/79896428-EDB5-4553-A65E-A1262ED2D342/iPhone_5.5_P3_15.6_19G71_Restore.ipsw
init done
getting: kernelcache.release.iphone10
100% [===================================================================================================>]
download succeeded
[] Patching and repacking iBSS/iBEC
main: Starting...
iOS 15 iBoot detected!
getting get_debug_enabled_patch() patch
getting get_sigcheck_patch() patch
applying patch=0x18003077c : 000080d2
applying patch=0x1800307c4 : 000080d2
applying patch=0x1800323b4 : 200080d2
main: Writing out patched file to iBSS.patched...
main: Quitting...
main: Starting...
iOS 15 iBoot detected!
getting get_boot_arg_patch(-v keepsyms=1 debug=0xfffffffe panic-wait-forever=1 wdt=-1) patch
getting get_debug_enabled_patch() patch
getting get_sigcheck_patch() patch
applying patch=0x18003077c : 000080d2
applying patch=0x1800307c4 : 000080d2
applying patch=0x1800323b4 : 200080d2
applying patch=0x1800339dc : 38420c10
applying patch=0x18004c220 : 2d76206b65657073796d733d312064656275673d307866666666666666652070616e69632d776169742d666f72657665723d31207764743d2d3100
main: Writing out patched file to iBEC.patched...
main: Quitting...
none
none
[] Patching and converting kernelcache
Reading work/kernelcache.release.iphone10...
[NOTE] Image4 payload data is LZFSE compressed, decompressing...
Extracted Image4 payload data to: work/kcache.raw
main: Starting...
Kernel: Adding AMFI_get_out_of_my_way patch...
get_amfi_out_of_my_way_patch: Entering ...
get_amfi_out_of_my_way_patch: Kernel-8020 inputted
get_amfi_out_of_my_way_patch: Found Internal Error: No cdhash found. str loc at 0x39930c
get_amfi_out_of_my_way_patch: Found Internal Error: No cdhash found. str ref at 0x12d6da4
get_amfi_out_of_my_way_patch: Patching AMFI at 0x12d35e0
Kernel: Adding could_not_authenticate_personalized_root_hash patch...
get_could_not_authenticate_personalized_root_hash_patch: Entering ...
get_could_not_authenticate_personalized_root_hash_patch: Found "successfully validated on-disk root hash" str loc at 0x523688
get_could_not_authenticate_personalized_root_hash_patch: Found "successfully validated on-disk root hash" xref at 0x1ddbb0c
get_could_not_authenticate_personalized_root_hash_patch: Found previous cbz at 0x1ddbae8
get_could_not_authenticate_personalized_root_hash_patch: Found "could not authenticate personalized root hash!" str loc at 0x5235dd
get_could_not_authenticate_personalized_root_hash_patch: Found "could not authenticate personalized root hash!" xref at 0x1ddc058
get_could_not_authenticate_personalized_root_hash_patch: Found cbz target at 0x1ddc038
get_could_not_authenticate_personalized_root_hash_patch: Patching root hash check at 0x1ddc038
main: Writing out patched file to work/kcache.patched...
main: Quitting...
Reading work/kcache.patched...
Compressing payload using LZSS...
IM4P outputted to: work/krnlboot.im4p
Reading work/krnlboot.im4p...
Reading work/IM4M...
Creating Image4...
Image4 file outputted to: boot-iPhone10,5/kernelcache.img4
[] Converting DeviceTree
dtre
[] Patching and converting trustcache
trst
none
[] Booting device
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%
[==================================================] 100.0%

Done!
The device should now boot to iOS
If you already have ran palera1n, click Do All in the tools section of Pogo
If not, Pogo should be installed to Tips

[Burlaman]

I restored it to iOS 15.6 [RC] (19G69) I did the procedures.
And it worked.
TrollStore.
Ipogo.
Sileo.
Now I will test.
Thanks.

[itsnebulalol]

And what were you on before? Patches might fail for some devices on some versions.

[Burlaman]

It was on 15.6 beta 1.