exploit: fix checkm8 ROP chain, payload assembly, and usbipd compatibility

.gitattributes

@@ -0,0 +1,8 @@
+# Force LF line endings for all text content so that core.autocrlf=true
+# on Windows does not inject \r into shell scripts and C sources.
+* text=auto
+*.sh  text eol=lf
+*.c   text eol=lf
+*.h   text eol=lf
+Makefile text eol=lf
+*.md  text eol=lf

README.md

@@ -32,6 +32,8 @@ That's it. The script will:
 - Run the bypass
 - Tell you when it's done
 
+> **Best results for A5-A11/checkm8:** use native Linux (including Kali) or macOS with direct USB access. WSL + usbipd can miss checkm8 timing windows.
+
 ### 3. Put Your Device in DFU Mode
 
 The script will walk you through this, but here's the short version:
@@ -145,8 +147,12 @@ brew install libimobiledevice libirecovery libusb libplist openssl pkg-config
 
 ```bash
 sudo apt-get install -y \
-    libimobiledevice-dev libirecovery-1.0-dev libusb-1.0-0-dev \
-    libplist-dev libssl-dev pkg-config build-essential
+    libimobiledevice-dev libusb-1.0-0-dev libplist-dev \
+    libssl-dev libssh2-1-dev pkg-config build-essential usbutils usbmuxd
+
+# Debian/Kali package names vary by release for libirecovery and libcurl dev:
+sudo apt-get install -y libirecovery-1.0-dev || sudo apt-get install -y libirecovery-dev
+sudo apt-get install -y libcurl4-openssl-dev || sudo apt-get install -y libcurl4-gnutls-dev
 ```
 
 </details>
@@ -325,4 +331,3 @@ During development, the following proprietary tools were analyzed to understand
 | Checkm8.info Software | 9.5 | Two-section architecture (A5-A11 vs A12+), DFU exploit flow, FActivation protocol, offline bypass method, bundled go-ios binary, ipwndfu payloads |
 | iRemoveTools | 9.5 | A12+ activation APIs, signal vs no-signal handling, MobileDeviceFramework usage, mobileactivationd interaction |
 
-

include/device/usb_dfu.h

@@ -34,6 +34,12 @@ int usb_dfu_init(void);
  */
 void usb_dfu_cleanup(void);
 
+/*
+ * Return the libusb_context created by usb_dfu_init(). Used by callers
+ * that need to pass the explicit context to libusb event-handling APIs.
+ */
+libusb_context *usb_dfu_ctx(void);
+
 /*
  * Find an Apple device in DFU mode (VID=0x05AC, PID=0x1227).
  * On success, *handle is set to an opened device handle and 0 is

include/exploit/checkm8_internal.h

@@ -28,7 +28,7 @@
 
 #define MAX_EXPLOIT_TRIES          3
 #define STAGE_DELAY_USEC           10000    /* 10 ms */
-#define USB_RECONNECT_DELAY_USEC   2000000  /* 2 s: wait for device reset between retries */
+#define USB_RECONNECT_DELAY_USEC   8000000  /* 8 s: device reboot after exploit */
 #define STALL_TIMEOUT_MS           1        /* 1 ms async stall */
 #define USB_TIMEOUT_MS             5000
 
@@ -205,6 +205,44 @@ int usb_ctrl_transfer_async_ret(libusb_device_handle *dev,
                                 uint16_t wLength,
                                 unsigned int timeout_ms);
 
+/*
+ * Raw control transfer helpers for exploit timing-critical requests.
+ * Unlike util/usb_helpers.c these do not retry PIPE/STALL responses,
+ * because those responses are part of checkm8's signaling path.
+ */
+int usb_ctrl_transfer_raw(libusb_device_handle *dev,
+                          uint8_t bmRequestType,
+                          uint8_t bRequest,
+                          uint16_t wValue,
+                          uint16_t wIndex,
+                          unsigned char *data,
+                          uint16_t wLength,
+                          unsigned int timeout_ms);
+
+int usb_ctrl_transfer_no_data_raw(libusb_device_handle *dev,
+                                  uint8_t bmRequestType,
+                                  uint8_t bRequest,
+                                  uint16_t wValue,
+                                  uint16_t wIndex,
+                                  unsigned int timeout_ms);
+
+/*
+ * usb_ctrl_transfer_dnload_abort -- Async DFU_DNLOAD with proper cancel.
+ *
+ * Used only by checkm8_stage_setup (stage 2) to trigger the UAF.
+ * Submits an async transfer, waits abort_ms, then calls cancel_transfer.
+ * The transfer has a 200ms hard timeout so it always completes cleanly.
+ * Returns 0 if aborted (UAF condition), >0 if STATUS received first, -1 on error.
+ */
+int usb_ctrl_transfer_dnload_abort(libusb_device_handle *dev,
+                                   uint8_t bmRequestType,
+                                   uint8_t bRequest,
+                                   uint16_t wValue,
+                                   uint16_t wIndex,
+                                   unsigned char *data,
+                                   uint16_t wLength,
+                                   unsigned int abort_ms);
+
 /* ------------------------------------------------------------------ */
 /* Spray helpers (checkm8_spray.c)                                     */
 /* ------------------------------------------------------------------ */

include/exploit/exploit.h

@@ -29,6 +29,7 @@ typedef struct {
     int                  phase;       /* EXPLOIT_PHASE_* */
     uint8_t             *payload_buf;
     size_t               payload_len;
+    int                  skip_clrstatus; /* 1 = DFU already in dfuIDLE, skip CLR_STATUS in stage 3 */
 } exploit_ctx_t;
 
 /*