fixed restore options

README.markdown

@@ -76,7 +76,8 @@ after using xpwn (or any other pwnage-based utility). This is important, since
 that's how the jailbreak actually occurs.
 
 	./ipsw <input.ipsw> <output.ipsw> [-b <bootimage.png>] [-nowipe] \
-		[-r <recoveryimage.png>] [-e "<action to exclude>"] \
+		[-nobbupdate] [-r <recoveryimage.png>] \
+		[-e "<action to exclude>"] \
 		[[-unlock] [-use39] [-use46] [-cleanup] \
 		-3 <bootloader 3.9 file> -4 <bootloader 4.6 file>] \
 		<package1.tar> <package2.tar>...
@@ -94,6 +95,8 @@ The most common use of the '-e' flag is to disable automatic activation, i.e.
 -nowipe disables Apple's wiping of the NAND (user data), before proceeding
 with the restore. This allows the restore to happen much, much more quickly.
 
+-nobbupdate tells the restore ramdisk not to attempt to upgrade your baseband.
+
 -unlock, -use39, -use46, -cleanup, -3, and -4 are valid only if you merge the
 BootNeuter package. These provide instructions to BootNeuter (which provides
 unlocking for iPhones). If you choose to use BootNeuter, you must specify the

ipsw-patch/main.c

@@ -326,12 +326,14 @@ int main(int argc, char* argv[]) {
 			pRamdiskKey, pRamdiskKey[0], pRamdiskKey[1], pRamdiskKey[2], pRamdiskKey[3], pRamdiskKey[4], pRamdiskKey[5], pRamdiskKey[6], pRamdiskKey[7],
 			pRamdiskKey[8], pRamdiskKey[9], pRamdiskKey[10], pRamdiskKey[11], pRamdiskKey[12], pRamdiskKey[13], pRamdiskKey[14], pRamdiskKey[15]);
 
-		ramdiskFS = IOFuncFromAbstractFile(openAbstractFile2(getFileFromOutputState(&outputState, ramdiskFSPathInIPSW), pRamdiskKey, pRamdiskIV));
+		ramdiskFS = IOFuncFromAbstractFile(openAbstractFile2(getFileFromOutputStateForOverwrite(&outputState, ramdiskFSPathInIPSW), pRamdiskKey, pRamdiskIV));
 	} else {
 		printf("unencrypted ramdisk\n");
-		ramdiskFS = IOFuncFromAbstractFile(openAbstractFile(getFileFromOutputState(&outputState, ramdiskFSPathInIPSW)));
+		ramdiskFS = IOFuncFromAbstractFile(openAbstractFile(getFileFromOutputStateForOverwrite(&outputState, ramdiskFSPathInIPSW)));
 	}
 	ramdiskVolume = openVolume(ramdiskFS);
+	printf("growing ramdisk: %d -> %d\n", ramdiskVolume->volumeHeader->totalBlocks * ramdiskVolume->volumeHeader->blockSize, (ramdiskVolume->volumeHeader->totalBlocks + 4) * ramdiskVolume->volumeHeader->blockSize);
+	grow_hfs(ramdiskVolume, (ramdiskVolume->volumeHeader->totalBlocks + 4) * ramdiskVolume->volumeHeader->blockSize);
 
 	if(doBootNeuter) {
 		firmwarePatches = (Dictionary*)getValueByKey(info, "BasebandPatches");

ipsw-patch/plist.c

@@ -319,7 +319,7 @@ char* getXmlFromArrayValue(ArrayValue* myself, int tabsCount) {
 			toReturn = realloc(toReturn, toReturnSize);
 			toReturn = strcat(toReturn, buffer);
 		} else if(curValue->type == IntegerType) {
-			sprintf(buffer, "%s\t<string>%d</string>\n", tabs, ((IntegerValue*)curValue)->value);
+			sprintf(buffer, "%s\t<integer>%d</integer>\n", tabs, ((IntegerValue*)curValue)->value);
 			toReturnSize += sizeof(char) * (strlen(buffer) + 1);
 			toReturn = realloc(toReturn, toReturnSize);
 			toReturn = strcat(toReturn, buffer);
@@ -388,7 +388,7 @@ char* getXmlFromDictionary(Dictionary* myself, int tabsCount) {
 			toReturn = realloc(toReturn, toReturnSize);
 			toReturn = strcat(toReturn, buffer);
 		} else if(curValue->type == IntegerType) {
-			sprintf(buffer, "%s\t<string>%d</string>\n", tabs, ((IntegerValue*)curValue)->value);
+			sprintf(buffer, "%s\t<integer>%d</integer>\n", tabs, ((IntegerValue*)curValue)->value);
 			toReturnSize += sizeof(char) * (strlen(buffer) + 1);
 			toReturn = realloc(toReturn, toReturnSize);
 			toReturn = strcat(toReturn, buffer);
@@ -513,8 +513,20 @@ void addIntegerToDictionary(Dictionary* dict, const char* key, int value) {
 void addValueToDictionary(Dictionary* dict, const char* key, DictValue* value) {
 	value->key = (char*) malloc(sizeof(char) * (strlen(key) + 1));
 	strcpy(value->key, key);
-	value->next = dict->values;
+	DictValue* curValue = dict->values;
-	value->prev = NULL;
+	DictValue* prevValue = NULL;
-	dict->values = value;
+
+	while(curValue != NULL) {
+		prevValue = curValue;
+		curValue = curValue->next;
+	}
+
+	value->next = NULL;
+	value->prev = prevValue;
+
+	if(prevValue == NULL)
+		dict->values = value;
+	else
+		prevValue->next = value;
 }
 

ipsw-patch/pwnutil.c

@@ -239,17 +239,18 @@ void createRestoreOptions(Volume* volume, int SystemPartitionSize, int UpdateBas
 	Dictionary* info;
 	char* plist;
 
+	printf("start create restore options\n");
+
 	info = createRoot("<dict></dict>");
-	addBoolToDictionary(info, "WaitForStorageDevice", TRUE);
 	addBoolToDictionary(info, "CreateFilesystemPartitions", TRUE);
 	addIntegerToDictionary(info, "SystemPartitionSize", SystemPartitionSize);
-	addBoolToDictionary(info, "FlashNOR", TRUE);
 	addBoolToDictionary(info, "UpdateBaseband", UpdateBaseband);
-	addBoolToDictionary(info, "ForceBasebandUpdate", FALSE);
 
 	plist = getXmlFromRoot(info);
 	releaseDictionary(info);
 	
+	printf("%s", plist);
+
 	plistFile = createAbstractFileFromMemory((void**)&plist, sizeof(char) * strlen(plist));
 
 	add_hfs(volume, plistFile, optionsPlist);