Failed to delete BaseBin (filesystem corruption)

[9vkvmgtyrf-png]

Jailbreak failed with error: Error Domain=BootstrapErrorDomain Code=-4 "Failed deleting existing basebin file with error: “basebin” couldn’t be removed." UserInfo={NSLocalizedDescription=Failed deleting existing basebin file with error: “basebin” couldn’t be removed.}
Updating BaseBin
Elevating Privileges
Cleaning Up Exploits
Building Phys R/W Primitive
Bypassing SPTM (Titan)
[i] Time taken for KRW: 7563.737 ms
[i] kernel_slide: 0x42d08000
[i] kernel_base: 0xfffffff069d0c000
[i] success_read_count: 785
[i] highiest_success_idx: 500
[i] found control_socket at idx: 0x1568
[i] target corrupted: 0xffffffde30070950
[i] corrupting icmp6filter pointer...
[i] icmp6filter: 0xffffffe0dda2a1c0
[i] inp_list_next_pointer: 0xffffffde30070800
[i] target_inp_gencnt: 0x44ac8
[i] pcb_start_offset: 0x400
[debug] search mapping size 0x8000000
[i] looking in search mapping: 0
[i] end_pcb_id: 0x4cff6
[i] start_pcb_id: 0x41ff8
[i] socket_ports_count: 0x5800
[i] pc_address: 0x2e3ed0000
[i] pc_object: 0x8c03
[i] physical_mapping_address: 0x10329c000
[i] free_thread_shared: 0x282274700
[i] write_fd: 15
[i] read_fd: 13
0x00007ff000000000 <- kernelConstant.ARM_TT_L1_INDEX_MASK
0x0000000000000002 <- kernelConstant.smrBase
0x7400000000000000 <- kernelConstant.PVH_HIGH_FLAGS
0xfffffff02a2652a8 <- kernelSymbol.allproc
0x000000000000001c <- kernelStruct.proc_ro.csflags
0x0000000000000040 <- kernelStruct.proc_ro.task_tokens
0x0000000000000010 <- kernelStruct.fileproc.glob
0x0000000000000300 <- kernelStruct.task.itk_space
0x0000000000000048 <- kernelStruct.ipc_port.kobject
0x0000000000000010 <- kernelStruct.vm_map.hdr
0x0000000000000018 <- kernelStruct.vm_map_header.max_offset
0x00000000000000ba <- kernelStruct.pmap.wx_allowed
0x0000000000000018 <- kernelStruct.trustcache.size
0x0000000000000068 <- kernelStruct.inpcbinfo.ipi_zone
0x0000000000000010 <- kernelStruct.kalloc_type_view.kt_zv_zv_name
0x0000000000000420 <- kernelStruct.IOSurface.ranges
0xfffffff017004000 <- kernelConstant.staticTxmBase
0x0000000000000080 <- kernelConstant.mach_trap_count
0x0000000000000006 <- kernelConstant.VM_PAGE_PACKED_PTR_SHIFT
0xfffffff027869380 <- kernelSymbol.pp_attr_table
0xfffffff0278fc580 <- kernelSymbol.libsptm_papt_ranges
0xfffffff0070991e0 <- kernelSymbol.papt_ranges_compressed
0x0000000000000078 <- kernelStruct.proc_ro.t_flags_ro
0x0000000000000028 <- kernelStruct.cs_blob.base_offset
0x0000000000000018 <- kernelStruct.ucred.uid
0x0000000000000078 <- kernelStruct.ucred.label
0x0000000000000028 <- kernelStruct.task.map
0x0000000000000008 <- kernelStruct.vm_map_header.first
0x000000000000000b <- kernelStruct.vm_map_entry.flags_maxprot
0x00000000000001ec <- kernelStruct.pmap_cs_code_directory.trust
0x0000000000000008 <- kernelStruct.pt_desc.va
0x0000000000000010 <- kernelStruct.trustcache.type
0x0000000000000020 <- kernelStruct.trustcache.fileptr
0xfffffff027004000 <- kernelConstant.staticBase
0xfffffff007004000 <- kernelConstant.staticSptmBase
0x000000000000022c <- kernelConstant.nsysent
0x0000000000000003 <- kernelConstant.PVH_TYPE_MASK
0xfffffff0278fc588 <- kernelSymbol.vm_first_phys
0x0000000000000730 <- kernelStruct.proc.struct_size
0x0000000000000070 <- kernelStruct.proc_ro.mach_kobj_filter_mask
0x0000000000000008 <- kernelStruct.task_token_ro_data.audit_token
0x0000000000000038 <- kernelStruct.fileglob.data
0x0000000000000060 <- kernelStruct.task.threads
0x00000000000000c8 <- kernelStruct.vm_map.flags
0x0000000000000010 <- kernelStruct.vm_map_entry.start
0x0000000000000190 <- kernelStruct.pmap_cs_code_directory.main_binary
0x0000000000000008 <- kernelStruct.trustcache.prevptr
0x0000000000000038 <- kernelStruct.inpcb.pcbinfo
0x0000000000000030 <- kernelStruct.IOMachPort.object
0x0000000000000002 <- kernelStruct.sptm_frame.type
0x0000000000000020 <- kernelStruct.TXMCodeRegion.codeSignature
0x0000000000000010 <- kernelStruct.RBLink.rbe_parent
0x0000000000000001 <- kernelConstant.kernel_el
0x0000000000000400 <- kernelConstant.TFRO_PLATFORM
0xfffffff0278ba2a8 <- kernelSymbol.gPhysSize
0xfffffff0278a10c0 <- kernelSymbol.mach_kobj_count
0x0000000000000008 <- kernelStruct.proc.list_prev
0x0000000000000010 <- kernelStruct.proc.pptr
0x0000000000000454 <- kernelStruct.proc.flag
0x0000000000000078 <- kernelStruct.vnode.un
0x0000000000000010 <- kernelStruct.ucred.ref
0x000000000000001c <- kernelStruct.ucred.ruid
0x0000000000000068 <- kernelStruct.ucred.rgid
0x0000000000000018 <- kernelStruct.ipc_entry.struct_size
[i] running on non-A18 devices
0x0000000000000040 <- kernelStruct.vm_map.pmap
0x0000000000000090 <- kernelStruct.pmap.pmap_cs_main
0x0000000000000090 <- kernelStruct.pmap.asid
0x0000000000000020 <- kernelStruct.inpcb.list_next
0x0000000000000040 <- kernelStruct.IOSurface.memoryDescriptor
0x0000000000000428 <- kernelStruct.IOSurface.rangeCount
0x0000000000000006 <- kernelStruct.sptm_frame.nested_refcnt
0x0000000000000020 <- kernelStruct.TXMAddressSpace.allowsInvalidCode
0xfffffff027d6437c <- kernelSymbol.kalloc_data_external
0xfffffff0278ba2a0 <- kernelSymbol.gPhysBase
0xfffffff027869b68 <- kernelSymbol.cpu_ttep
0xfffffff02a246430 <- kernelSymbol.vm_first_phys_ppnum
0xfffffff0278fc590 <- kernelSymbol.vm_last_phys
0xfffffff0278693b8 <- kernelSymbol.vm_page_array_beginning_addr
0xfffffff02a246428 <- kernelSymbol.vm_page_array_ending_addr
0xfffffff017058a26 <- kernelSymbol.txm_developer_mode_storage
0x000000000000003c <- kernelStruct.proc.svuid
0x0000000000000040 <- kernelStruct.proc.svgid
0x00000000000000d0 <- kernelStruct.proc.fd
0x0000000000000068 <- kernelStruct.proc_ro.mach_trap_filter_mask
0x0000000000000028 <- kernelStruct.filedesc.ofiles_start
0x0000000000000050 <- kernelStruct.ubc_info.cs_blobs
0x0000000000000020 <- kernelStruct.ucred.svuid
0x000000000000006c <- kernelStruct.ucred.svgid
0x0000000000000010 <- kernelStruct.vm_map_header.min_offset
0x000000000000001c <- kernelStruct.vm_map_entry.flags_xnu_user_debug
0x000000000000009c <- kernelStruct.pmap.type
0x00000000000000b0 <- kernelStruct.pmap.txm_address_space
0x0000000000000028 <- kernelStruct.trustcache.struct_size
0x0000000000000028 <- kernelStruct.inpcb.list_prev
0x0000000000000040 <- kernelStruct.inpcb.socket
0x0000000000000158 <- kernelStruct.inpcb.chksum
0x000000000000022c <- kernelStruct.socket.usecount
0x0000000000000018 <- kernelStruct.socket.proto
0x0000000000000012 <- kernelStruct.TXMCodeRegion.type
0x0000000000000028 <- kernelStruct.TXMCodeRegion.startAddr
0x0000000000000030 <- kernelStruct.TXMCodeRegion.endAddr
0x0000000000000008 <- kernelStruct.RBLink.rbe_right
0x0000000000000011 <- kernelConstant.T1SZ_BOOT
0xffffffdc00000000 <- kernelConstant.VM_PAGE_PACKED_PTR_BASE
0xfffffff027869388 <- kernelSymbol.pv_head_table
0xfffffff0278fc578 <- kernelSymbol.libsptm_n_papt_ranges
[i] Running on iPhone15,3
0xfffffff0070991d0 <- kernelSymbol.n_papt_ranges_compressed
0x0000000000000018 <- kernelStruct.proc.proc_ro
0x0000000000000018 <- kernelStruct.cs_blob.cpu_type
0x000000000000001c <- kernelStruct.cs_blob.cpu_subtype
0x0000000000000020 <- kernelStruct.ipc_space.table
0x0000000000000008 <- kernelStruct.vm_map_entry.next
0x0000000000000007 <- kernelStruct.vm_map_entry.flags_prot
0x0000000000000008 <- kernelStruct.pmap.ttep
0x0000000000000018 <- kernelStruct.pt_desc.ptd_info
0x0000000000000028 <- kernelStruct.protosw.input
0x0000000000000004 <- kernelStruct.sptm_frame.level
0x0000000000000030 <- kernelStruct.TXMAddressSpace.codeRegions
System Info libjailbreak:
0xfffffff027d649c4 <- kernelSymbol.kfree_data_external
0xfffffff0278fb648 <- kernelSymbol.SPTMArgs
0xfffffff02788cca0 <- kernelSymbol.gVirtBase
0xffff800000000000 <- kernelConstant.pointer_mask
0xfffffff0170104b8 <- kernelSymbol.txm_trustcache_root
0xfffffff0278fc5b0 <- kernelSymbol.libsptm_frame_table
0xfffffff02a2652a8 <- kernelSymbol.allproc
0x00007ff000000000 <- kernelConstant.ARM_TT_L1_INDEX_MASK
0x0000000000000300 <- kernelStruct.task.itk_space
0x0000000000000420 <- kernelStruct.IOSurface.ranges
0x0000000000000080 <- kernelConstant.mach_trap_count
0xfffffff027869380 <- kernelSymbol.pp_attr_table
0xfffffff0278fc580 <- kernelSymbol.libsptm_papt_ranges
0xfffffff0070991e0 <- kernelSymbol.papt_ranges_compressed
0xfffffff017004000 <- kernelConstant.staticTxmBase
0x000000000000022c <- kernelConstant.nsysent
0xfffffff0278fc588 <- kernelSymbol.vm_first_phys
0x0000000000000730 <- kernelStruct.proc.struct_size
0xfffffff027004000 <- kernelConstant.staticBase
0xfffffff007004000 <- kernelConstant.staticSptmBase
0x0000000000000001 <- kernelConstant.kernel_el
0xfffffff0278ba2a8 <- kernelSymbol.gPhysSize
0xfffffff0278a10c0 <- kernelSymbol.mach_kobj_count
0x0000000000000040 <- kernelStruct.vm_map.pmap
0x0000000000000428 <- kernelStruct.IOSurface.rangeCount
[i] Running on iOS 17.0
0xfffffff027d6437c <- kernelSymbol.kalloc_data_external
0xfffffff027869b68 <- kernelSymbol.cpu_ttep
0xfffffff0278ba2a0 <- kernelSymbol.gPhysBase
0xfffffff0278693b8 <- kernelSymbol.vm_page_array_beginning_addr
0xfffffff02a246428 <- kernelSymbol.vm_page_array_ending_addr
0xfffffff02a246430 <- kernelSymbol.vm_first_phys_ppnum
0xfffffff0278fc590 <- kernelSymbol.vm_last_phys
0xfffffff017058a26 <- kernelSymbol.txm_developer_mode_storage
0x0000000000000011 <- kernelConstant.T1SZ_BOOT
0xfffffff027869388 <- kernelSymbol.pv_head_table
0xfffffff0278fc578 <- kernelSymbol.libsptm_n_papt_ranges
0xfffffff0070991d0 <- kernelSymbol.n_papt_ranges_compressed
Exploiting Kernel (ClearSword)
System Info:
2026-08-09 09:15:12.296 Dopamine[670:14998] TXM at /private/preboot/BA40E07239E8D2C32F41CAB67B2C77B45C48F664F87E48D890887BFC386C0397E51336D52816AC21DA6A405C1246D34B/usr/standalone/firmware/FUD/Ap,TrustedExecutionMonitor.img4
Patchfinding
2026-08-09 09:15:12.296 Dopamine[670:14998] SPTM at /private/preboot/BA40E07239E8D2C32F41CAB67B2C77B45C48F664F87E48D890887BFC386C0397E51336D52816AC21DA6A405C1246D34B/usr/standalone/firmware/FUD/Ap,SecurePageTableMonitor.img4
2026-08-09 09:15:12.296 Dopamine[670:14998] Kernel at /private/preboot/BA40E07239E8D2C32F41CAB67B2C77B45C48F664F87E48D890887BFC386C0397E51336D52816AC21DA6A405C1246D34B/System/Library/Caches/com.apple.kernelcaches/kernelcache
Starting Jailbreak (Model: iPhone15,3, Version 17.0 (Build 21A329), Configuration: {removeJailbreak=0, tweakInjection=1, idownload=0, appJIT=1})

[jimmyorz]

I'm experiencing the same issue. It started about an hour ago;everything was working fine before that.
Is it possible that something changed on the server side?

Starting Jailbreak (Model: iPhone12,1, Version 17.3.1 (Build 21D61), Configuration: {removeJailbreak=0, tweakInjection=1, idownload=0, appJIT=1})
Downloading Kernel
2026-08-09 20:33:36.576 Dopamine[272:3877] Kernel at /var/mobile/Containers/Data/Application/F6E5E79D-A4B1-47A0-94DD-2CE3A060613B/Documents/kernelcache
Patchfinding
System Info:
0xfffffff0078e1b10 <- kernelSymbol.pv_head_table
0x0000000000000019 <- kernelConstant.T1SZ_BOOT
0xfffffff007904d20 <- kernelSymbol.vm_last_phys
Exploiting Kernel (ClearSword)
0xfffffff00a20c190 <- kernelSymbol.vm_first_phys_ppnum
0xfffffff00a20c188 <- kernelSymbol.vm_page_array_ending_addr
0xfffffff0078e1bb8 <- kernelSymbol.vm_page_array_beginning_addr
0xfffffff0079316b8 <- kernelSymbol.gPhysBase
0xfffffff007904010 <- kernelSymbol.cpu_ttep
0xfffffff007d92fd0 <- kernelSymbol.kalloc_data_external
0x0000000000000428 <- kernelStruct.IOSurface.rangeCount
0x0000000000000040 <- kernelStruct.vm_map.pmap
0xfffffff0079184a0 <- kernelSymbol.mach_kobj_count
0xfffffff007922138 <- kernelSymbol.ppl_trust_cache_rt
0xfffffff0079316c0 <- kernelSymbol.gPhysSize
0x0000000000000001 <- kernelConstant.kernel_el
0xfffffff007004000 <- kernelConstant.staticBase
0x0000000000000730 <- kernelStruct.proc.struct_size
0xfffffff007ea9b38 <- kernelSymbol.pmap_enter_options_addr
0xfffffff007904d18 <- kernelSymbol.vm_first_phys
0x000000000000022c <- kernelConstant.nsysent
0xfffffff007ea9738 <- kernelSymbol.pmap_remove_options
0xfffffff0078e1b08 <- kernelSymbol.pp_attr_table
0x0000000000000080 <- kernelConstant.mach_trap_count
0xfffffff007922690 <- kernelSymbol.developer_mode_enabled
0x0000000000000420 <- kernelStruct.IOSurface.ranges
0x0000000000000300 <- kernelStruct.task.itk_space
0x0000000000000001 <- kernelConstant.PT_INDEX_MAX
0xfffffff0078e2dd8 <- kernelSymbol.ptov_table
0x0000007000000000 <- kernelConstant.ARM_TT_L1_INDEX_MASK
0xfffffff00a22b040 <- kernelSymbol.allproc
0xffffff8000000000 <- kernelConstant.pointer_mask
0xfffffff00792f878 <- kernelSymbol.gVirtBase
0xfffffff007d9363c <- kernelSymbol.kfree_data_external
System Info libjailbreak:
0x0000000000000028 <- kernelStruct.protosw.input
0x0000000000000020 <- kernelStruct.pt_desc.ptd_info
0x0000000000000008 <- kernelStruct.pmap.ttep
0x0000000000000007 <- kernelStruct.vm_map_entry.flags_prot
0x0000000000000008 <- kernelStruct.vm_map_entry.next
0x0000000000000020 <- kernelStruct.ipc_space.table
0x000000000000001c <- kernelStruct.cs_blob.cpu_subtype
0x0000000000000018 <- kernelStruct.cs_blob.cpu_type
0x0000000000000018 <- kernelStruct.proc.proc_ro
0xfffffff0078e1b10 <- kernelSymbol.pv_head_table
0xffffffdc00000000 <- kernelConstant.VM_PAGE_PACKED_PTR_BASE
0x0000000000000019 <- kernelConstant.T1SZ_BOOT
0x0000000000000008 <- kernelStruct.RBLink.rbe_right
0x0000000000000018 <- kernelStruct.socket.proto
0x000000000000024c <- kernelStruct.socket.usecount
0x0000000000000150 <- kernelStruct.inpcb.chksum
0x0000000000000040 <- kernelStruct.inpcb.socket
0x0000000000000028 <- kernelStruct.inpcb.list_prev
0x0000000000000028 <- kernelStruct.trustcache.struct_size
0x00000000000000c9 <- kernelStruct.pmap.type
0x000000000000001c <- kernelStruct.vm_map_entry.flags_xnu_user_debug
0x0000000000000010 <- kernelStruct.vm_map_header.min_offset
0x000000000000006c <- kernelStruct.ucred.svgid
0x0000000000000020 <- kernelStruct.ucred.svuid
0x0000000000000050 <- kernelStruct.ubc_info.cs_blobs
0x0000000000000028 <- kernelStruct.filedesc.ofiles_start
0x0000000000000068 <- kernelStruct.proc_ro.mach_trap_filter_mask
0x00000000000000d0 <- kernelStruct.proc.fd
0x0000000000000040 <- kernelStruct.proc.svgid
0x000000000000003c <- kernelStruct.proc.svuid
0xfffffff00a20c188 <- kernelSymbol.vm_page_array_ending_addr
0xfffffff0078e1bb8 <- kernelSymbol.vm_page_array_beginning_addr
0xfffffff007904d20 <- kernelSymbol.vm_last_phys
0xfffffff00a20c190 <- kernelSymbol.vm_first_phys_ppnum
0xfffffff007904010 <- kernelSymbol.cpu_ttep
0xfffffff0079316b8 <- kernelSymbol.gPhysBase
0xfffffff007d92fd0 <- kernelSymbol.kalloc_data_external
0x0000000000000428 <- kernelStruct.IOSurface.rangeCount
0x0000000000000040 <- kernelStruct.IOSurface.memoryDescriptor
0x0000000000000020 <- kernelStruct.inpcb.list_next
0x0000000000000010 <- kernelStruct.pt_desc.pmap
0x0000000000000090 <- kernelStruct.pmap.pmap_cs_main
0x0000000000000040 <- kernelStruct.vm_map.pmap
0x0000000000000018 <- kernelStruct.ipc_entry.struct_size
0x0000000000000068 <- kernelStruct.ucred.rgid
[i] Running on iOS 17.3.1
[i] Running on iPhone12,1
[i] running on non-A18 devices
[i] read_fd: 5
[i] write_fd: 7
[i] free_thread_shared: 0x280600380
[i] physical_mapping_address: 0x10beec000
[i] pc_object: 0x8f07
[i] pc_address: 0x36662c000
[i] socket_ports_count: 0x5800
[i] start_pcb_id: 0x8
[i] end_pcb_id: 0xb006
[i] looking in search mapping: 0
[debug] search mapping size 0x8000000
[i] pcb_start_offset: 0x400
[i] target_inp_gencnt: 0x6246
[i] inp_list_next_pointer: 0xffffffdefe7a0800
[i] icmp6filter: 0xffffffe1ffd77d80
[i] corrupting icmp6filter pointer...
[i] target corrupted: 0xffffffdefe7a0948
[i] found control_socket at idx: 0x311f
[i] highiest_success_idx: 312
[i] success_read_count: 76
[i] kernel_base: 0xfffffff01c55c000
[i] kernel_slide: 0x15558000
[i] Time taken for KRW: 776.129 ms
Bypassing PPL (momentarius)
[momentarius] text_pa: 0x8002dc000
[momentarius] info_offset: 0x860
[momentarius] data_va: 0xffffff800004c000
[momentarius] data_size: 0x95018
[momentarius] text_size: 0x4c000
[momentarius] encoded_data_addr: 0xffffff800000423c
[momentarius] encoded_ttbr_addr: 0xffffff8000049fb9
[momentarius] unshifted_data_pa: 0x801698000
[momentarius] unshifted_ttbr_pa: 0x8fffb8000
[momentarius] data_pa: 0x801698000
[momentarius] ttbr_pa: 0x8fffb8000
[momentarius] ttbr_kva: 0xffffffe868e70000
[momentarius] target_pte: 0x460000820788603
[momentarius] target_kern_addr: 0xfffffff059b1eae0
[momentarius] target_gfx_addr: 0xfffffff00078aae0
[momentarius] ttbr1_load_offset: 0x63b8
[momentarius] hook_offset: 0x6460
[momentarius] shc_offset: 0x2000
Building Phys R/W Primitive
Cleaning Up Exploits
Elevating Privileges
Updating BaseBin
Jailbreak failed with error: Error Domain=BootstrapErrorDomain Code=-4 "Failed deleting existing basebin file with error: “basebin” couldn’t be removed." UserInfo={NSLocalizedDescription=Failed deleting existing basebin file with error: “basebin” couldn’t be removed.}

[jimmyorz]

When attempting to use Remove Jailbreak, the process fails and returns an error.

Starting Jailbreak (Model: iPhone12,1, Version 17.3.1 (Build 21D61), Configuration: {removeJailbreak=1, tweakInjection=1, idownload=0, appJIT=1})
Downloading Kernel
2026-08-09 20:39:44.464 Dopamine[249:3524] Kernel at /var/mobile/Containers/Data/Application/F6E5E79D-A4B1-47A0-94DD-2CE3A060613B/Documents/kernelcache
Patchfinding
System Info:
0xfffffff0078e1b10 <- kernelSymbol.pv_head_table
0x0000000000000019 <- kernelConstant.T1SZ_BOOT
0xfffffff007904d20 <- kernelSymbol.vm_last_phys
0xfffffff00a20c190 <- kernelSymbol.vm_first_phys_ppnum
0xfffffff00a20c188 <- kernelSymbol.vm_page_array_ending_addr
0xfffffff0078e1bb8 <- kernelSymbol.vm_page_array_beginning_addr
0xfffffff0079316b8 <- kernelSymbol.gPhysBase
0xfffffff007904010 <- kernelSymbol.cpu_ttep
0xfffffff007d92fd0 <- kernelSymbol.kalloc_data_external
0x0000000000000428 <- kernelStruct.IOSurface.rangeCount
0x0000000000000040 <- kernelStruct.vm_map.pmap
0xfffffff0079184a0 <- kernelSymbol.mach_kobj_count
0xfffffff007922138 <- kernelSymbol.ppl_trust_cache_rt
0xfffffff0079316c0 <- kernelSymbol.gPhysSize
0x0000000000000001 <- kernelConstant.kernel_el
0xfffffff007004000 <- kernelConstant.staticBase
Exploiting Kernel (ClearSword)
0x0000000000000730 <- kernelStruct.proc.struct_size
0xfffffff007ea9b38 <- kernelSymbol.pmap_enter_options_addr
0xfffffff007904d18 <- kernelSymbol.vm_first_phys
0x000000000000022c <- kernelConstant.nsysent
0xfffffff007ea9738 <- kernelSymbol.pmap_remove_options
[i] Running on iOS 17.3.1
0xfffffff0078e1b08 <- kernelSymbol.pp_attr_table
0x0000000000000080 <- kernelConstant.mach_trap_count
0xfffffff007922690 <- kernelSymbol.developer_mode_enabled
0x0000000000000420 <- kernelStruct.IOSurface.ranges
0x0000000000000300 <- kernelStruct.task.itk_space
0x0000000000000001 <- kernelConstant.PT_INDEX_MAX
0xfffffff0078e2dd8 <- kernelSymbol.ptov_table
0x0000007000000000 <- kernelConstant.ARM_TT_L1_INDEX_MASK
0xfffffff00a22b040 <- kernelSymbol.allproc
0xffffff8000000000 <- kernelConstant.pointer_mask
0xfffffff00792f878 <- kernelSymbol.gVirtBase
0xfffffff007d9363c <- kernelSymbol.kfree_data_external
System Info libjailbreak:
0x0000000000000028 <- kernelStruct.protosw.input
0x0000000000000020 <- kernelStruct.pt_desc.ptd_info
0x0000000000000008 <- kernelStruct.pmap.ttep
0x0000000000000007 <- kernelStruct.vm_map_entry.flags_prot
0x0000000000000008 <- kernelStruct.vm_map_entry.next
0x0000000000000020 <- kernelStruct.ipc_space.table
0x000000000000001c <- kernelStruct.cs_blob.cpu_subtype
0x0000000000000018 <- kernelStruct.cs_blob.cpu_type
0x0000000000000018 <- kernelStruct.proc.proc_ro
0xfffffff0078e1b10 <- kernelSymbol.pv_head_table
0xffffffdc00000000 <- kernelConstant.VM_PAGE_PACKED_PTR_BASE
0x0000000000000019 <- kernelConstant.T1SZ_BOOT
0x0000000000000008 <- kernelStruct.RBLink.rbe_right
0x0000000000000018 <- kernelStruct.socket.proto
0x000000000000024c <- kernelStruct.socket.usecount
0x0000000000000150 <- kernelStruct.inpcb.chksum
0x0000000000000040 <- kernelStruct.inpcb.socket
0x0000000000000028 <- kernelStruct.inpcb.list_prev
0x0000000000000028 <- kernelStruct.trustcache.struct_size
0x00000000000000c9 <- kernelStruct.pmap.type
0x000000000000001c <- kernelStruct.vm_map_entry.flags_xnu_user_debug
0x0000000000000010 <- kernelStruct.vm_map_header.min_offset
0x000000000000006c <- kernelStruct.ucred.svgid
0x0000000000000020 <- kernelStruct.ucred.svuid
0x0000000000000050 <- kernelStruct.ubc_info.cs_blobs
0x0000000000000028 <- kernelStruct.filedesc.ofiles_start
0x0000000000000068 <- kernelStruct.proc_ro.mach_trap_filter_mask
0x00000000000000d0 <- kernelStruct.proc.fd
0x0000000000000040 <- kernelStruct.proc.svgid
0x000000000000003c <- kernelStruct.proc.svuid
0xfffffff00a20c188 <- kernelSymbol.vm_page_array_ending_addr
0xfffffff0078e1bb8 <- kernelSymbol.vm_page_array_beginning_addr
0xfffffff007904d20 <- kernelSymbol.vm_last_phys
0xfffffff00a20c190 <- kernelSymbol.vm_first_phys_ppnum
0xfffffff007904010 <- kernelSymbol.cpu_ttep
0xfffffff0079316b8 <- kernelSymbol.gPhysBase
0xfffffff007d92fd0 <- kernelSymbol.kalloc_data_external
0x0000000000000428 <- kernelStruct.IOSurface.rangeCount
0x0000000000000040 <- kernelStruct.IOSurface.memoryDescriptor
0x0000000000000020 <- kernelStruct.inpcb.list_next
0x0000000000000010 <- kernelStruct.pt_desc.pmap
0x0000000000000090 <- kernelStruct.pmap.pmap_cs_main
0x0000000000000040 <- kernelStruct.vm_map.pmap
0x0000000000000018 <- kernelStruct.ipc_entry.struct_size
0x0000000000000068 <- kernelStruct.ucred.rgid
[i] Running on iPhone12,1
[i] running on non-A18 devices
[i] read_fd: 5
[i] write_fd: 7
[i] free_thread_shared: 0x281b6db80
[i] physical_mapping_address: 0x100d1c000
[i] pc_object: 0x9807
[i] pc_address: 0x15fbd8000
[i] socket_ports_count: 0x5800
[i] start_pcb_id: 0x8
[i] end_pcb_id: 0xb006
[i] looking in search mapping: 0
[debug] search mapping size 0x8000000
[i] pcb_start_offset: 0x400
[i] target_inp_gencnt: 0x97e2
[i] inp_list_next_pointer: 0xffffffde2477c800
[i] icmp6filter: 0xffffffe207d062c0
[i] corrupting icmp6filter pointer...
[i] target corrupted: 0xffffffde2477c948
[i] found control_socket at idx: 0x4bed
[i] highiest_success_idx: 1
[i] success_read_count: 2
[i] kernel_base: 0xfffffff028f4c000
[i] kernel_slide: 0x21f48000
[i] Time taken for KRW: 350.071 ms
Bypassing PPL (momentarius)
[momentarius] text_pa: 0x8002dc000
[momentarius] info_offset: 0x860
[momentarius] data_va: 0xffffff800004c000
[momentarius] data_size: 0x95018
[momentarius] text_size: 0x4c000
[momentarius] encoded_data_addr: 0xffffff800000423c
[momentarius] encoded_ttbr_addr: 0xffffff8000049fb9
[momentarius] unshifted_data_pa: 0x801698000
[momentarius] unshifted_ttbr_pa: 0x8fffb8000
[momentarius] data_pa: 0x801698000
[momentarius] ttbr_pa: 0x8fffb8000
[momentarius] ttbr_kva: 0xffffffe3291a4000
[momentarius] target_pte: 0x4600008277e0603
[momentarius] target_kern_addr: 0xfffffff05eb76310
[momentarius] target_gfx_addr: 0xfffffff0017e2310
[momentarius] ttbr1_load_offset: 0x63b8
[momentarius] hook_offset: 0x6460
[momentarius] shc_offset: 0x2000
Building Phys R/W Primitive
Cleaning Up Exploits
Elevating Privileges
Removing Jailbreak
Jailbreak failed with error: Error Domain=NSCocoaErrorDomain Code=512 "“dopamine-wLWqvc” couldn’t be removed." UserInfo={NSUserStringVariant=(
    Remove
), NSFilePath=/private/preboot/8C46CB19A8246FA4BCC4BB7CC86A97D2B5CDF099FEA152AC7568BFE9EAE2DA2AF08C7CA9FB8EAB634DFEEC72771B90E2/dopamine-wLWqvc, NSUnderlyingError=0x28007f5a0 {Error Domain=NSPOSIXErrorDomain Code=92 "Illegal byte sequence"}}

[9vkvmgtyrf-png]

Update: I deleted the basebin folder in Filza and rejailbroke and it worked. Not sure how it happened but that seemed to fix it.

[opa334]

Update: I deleted the basebin folder in Filza and rejailbroke and it worked. Not sure how it happened but that seemed to fix it.

That's odd, for another user that folder was straight up undeletable in Filza so I assumed it was some sort of file system corruption.

[opa334]

So I have no idea why this happens but here is an IPA with which you can jailbreak once and it will clean this issue up. Once it failed with "Cleaned", install the regular Dopamine again and jailbreak with that.

https://cdn.discordapp.com/attachments/688126462066163756/1535996700068544542/Dopaclean.ipa?ex=6a79cbe6&is=6a787a66&hm=e3a315c07595104afefd76ec5946758ee56b0d13e54bef8fb682bfc666b3abb6&

In case the direct download link dies, here is a link to the discord message (discord.gg/jb): https://discord.com/channels/349243932447604736/688126462066163756/1535996700546703360

[opa334]

My best guess is the missing post exploit cleanup that I fixed in 3.0.4, but it's a big stretch. There isn't really any way to figure out what's going on other than just guessing unfortunately.

[jimmyorz]

So I have no idea why this happens but here is an IPA with which you can jailbreak once and it will clean this issue up. Once it failed with "Cleaned", install the regular Dopamine again and jailbreak with that.

I tried Dopaclean, and everything is working normally again now.
Thanks a ton for the quick fix!

[Thedrxgon]

Hi opa334, i am getting the same error - iPhone 14, iOS 16.6.
I was able to jailbreak on versions - 3.0.1, 3.0.2,3.0.3 but when I updated from v3.0.3 to v3.0.4, I started getting above error. v3.0.3 was working a lot better than previous ones.

[opa334]

Hi opa334, i am getting the same error - iPhone 14, iOS 16.6. I was able to jailbreak on versions - 3.0.1, 3.0.2,3.0.3 but when I updated from v3.0.3 to v3.0.4, I started getting above error. v3.0.3 was working a lot better than previous ones.

See my comment here #906 (comment) for how to fix this