iPhone debugging requires proper tools. The Bonobo cable connects to your target through Lightning and allows CPU debugging through JTAG/SWD using OpenOCD + AArch64 GDB. Among others, you can: access all CPUs and registers, single step, put hardware breakpoints, dump memory, etc… Perfect for security research.

The target serial console can be accessed on the control PC through Minicom (iBoot prompt), as well as Lightning USB (For DFU, USB exploitation, etc.)

EPIC JAILBREAK: Introducing checkm8 (read "checkmate"), a permanent unpatchable bootrom exploit for hundreds of millions of iOS devices.

Most generations of iPhones and iPads are vulnerable: from iPhone 4S (A5 chip) to iPhone 8 and iPhone X (A11 chip). https://t.co/dQJtXb78sG

— axi0mX (@axi0mX) September 27, 2019

• Buy it on our shop: Buy Bonobo Cable

• FPGA Chipset: Xilinx Spartan6 XC6SLX16
• Microcontroller: STM32F723
• USB HighSpeed Hub
• Serial + JTAG interfaces: Hi-Speed Quad USB UART FTDI FT4232H
• Lightning connector
• User Interfaces: 2x RBG LEDs

• Lightning SWD on ACC_ID/ACC_PWR wires.
• Lightning Serial (For iBoot console, etc.).
• Lightning USB (For DFU, …).
• Lightning ACC_ID sequence (As debug accessory).
• Lightning Power (For charging or if the target does not have a battery)

• OpenOCD (With Open Source Bonobo driver patch)
  • ARMv8 / ADIv5
  • Support SWD commands queue
  • Support target board reset

• GDB (AArch64)
  • Connects to OpenOCD
  • For Registers access, Hardware breakpoints, Instruction stepping, R/W memory, etc.

• iPhone debugging: iPhone BootROM Debug/SWD cable

The FPGA and STM32 come pre-flashed with a custom Gateware and Firmware, ready to be used with our open-source OpenOCD driver.

Configure and build:

git clone https://github.com/lambdaconcept/openocd.git
cd openocd
./bootstrap
./configure --enable-bonobo --disable-werror
make -j
make install

Get aarch64-linux-gnu-gdb from your distribution package manager.

Get the configuration file for iPhone. Depending on your target:

• iPhone 7: openocd-iphone-7.cfg
• iPhone 8: soon available.
• iPhone XR: openocd-iphone-xr.cfg

Axiomx's Checkm8 pwndfu

Plug the phone and run:

$ openocd -f openocd-iphone-7.cfg

or

$ openocd -f openocd-iphone-xr.cfg

At that stage, OpenOCD should have attached to your phone using Bonobo. More details

$ aarch64-linux-gnu-gdb

(gdb) target remote :3333
0x0000000100000508 in ?? ()

More details

Note: To be able to use this cable, the target system (iPhone) must be demoted to allow JTAG/SWD thanks to @axi0mX.

For full details on using the Bonobo cable refer to the blog article