Error NVMe interBad ram pointer 0x200

[ghost]

Hi, i tried to install the emulator on my Laptop with Arch Linux. Ive done now the turotial 2 times and watched other people do it but i still can't figure out what i did wrong.
Specs:

OS: Arch Linux x86_64
Host: LIFEBOOK E556 (10601736731)
Kernel: Linux 6.16.0-arch1-1
Shell: bash 5.3.3
Display (BOE0665): 1366x768 @ 60 Hz in 16" [Built-in]
DE: KDE Plasma 6.4.3
WM: KWin (Wayland)
 Terminal: kitty 0.42.2
CPU: Intel(R) Core(TM) i5-6200U (4) @ 2.80 GHz
GPU: Intel HD Graphics 520 @ 1.00 GHz [Integrated]
Memory: 7.66 GiB
Swap: 3.83 GiB

RTBuddy(AOP): start(0xffffffe19bae8000) - (Aug 12 2020@22:50:37)
RTBuddy(ANS2): Boot args override: wdt = -1
RTBuddy(AOP): Boot args override: wdt = -1
RTBuddy(AOP): Resuming...

RTBuddy(ANS2): Resuming...

RTBuddy(SIO): start(0xffffffe19bb08000) - (Aug 12 2020@22:50:37)
RTBuddy(SIO): Boot args override: wdt = -1
RTBuddy(SIO): Resuming...

Starting AppleSMC kext(0xffffffe19b7f86b0) - (Aug 12 2020@22:51:44)
AppleSMCEmbedded::setPowerState(): ENTER powerStateOrdinal=1, _activeKeyCommand=13 newState=1
AppleA7IOPNub: withRegistryEntry, 47: allocated nub 0xffffffe19baa5d60

AppleAuthCPRelay:_sendCommandGated CMD=0x1 _receivedStatus ERROR ( status = 0xe00002e9 )
AppleAuthCPRelay:_getCert failed to send command kAuthCommandIDGetCert
AppleAuthCPRelay:start _getCert() failed (status = 0xe00002e9)
Failed to enable notifications (0x84)!

ERROR: Unable to enable notification interface (kSMCKeyNotFound).

AppleSPU::_handleReadyReport, serviceName (aop-audio) 
LPM state clear
pci (build 22:19:24 Aug 12 2020), flags 0x20c3008
LPM: Log data is NOT valid. 0x0 0x0
AppleDialogSPMIPMU::start: Primary PMU detected
AppleARMRTC started!#####
AppleDialogSPMIPMURTC started!******
Failed to read info-leg_scrpadAppleDialogSPMIPMURTC tick read!&&&&&&&
AppleDialogSPMIPMURTC ending!%%%
AppleSmartIO (RTBuddy-based)::start (0xffffffe19bb3d800) - (Aug 12 2020@22:19:30)
AppleARMRTC registering service!@@@@@@
AppleSPUFirmwareService: found node AOP
AppleARMRTC service registered!$$$$$
AppleARMRTC publishing service!^^^^^^
[ PCI configuration begin ]
[AOPAudio](debug) + Controller::start() {this: 0xffffffe19b86d800} built Aug 12 2020 22:19:38
[AOPAudio](debug) AppleAOPAudioService::create() got service controller 'aop '
[AOPAudio](debug) AppleAOPAudioService::create() service has 3 devices
[AOPAudio](debug) +-Controller::initForPM() -> 0x0
[ PCI configuration end, bridges 3, devices 0 ]
[AOPAudio](debug) + IOReporter::addIOReporters(0xffffffe19bb2a8a0)
[AOPAudio](debug) - IOReporter::addIOReporters(0xffffffe19bb2a8a0) -> 0x0
[AOPAudio](debug) + Controller::_publishBelow(0xffffffe19b98c200)
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61cf00, provider 0xffffffe19b86d800), IOReturn: 0x0
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa4be0 (audio-lp-mic-in), class is AppleAOPAudioDeviceNode
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61cfa0, provider 0xffffffe19b86d800), IOReturn: 0x0
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa4c80 (audio-mca0), class is AppleAOPAudioDeviceNode
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61d040, provider 0xffffffe19b86d800), IOReturn: 0x0
virtual bool AppleSEPManager::start(IOService *): 
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa6620 (audio-mca1), class is AppleAOPAudioDeviceNode
virtual IOService *AppleANS2NVMeController::probe(IOService *, SInt32 *)::194:Found (ANS2) provider, returning score 100000
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61ea80, provider 0xffffffe19b86d800), IOReturn: 0x0
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa7700 (audio-codecmclkmgr), class is AppleAOPAudioDeviceNode
virtual bool AppleSEPManager::start(IOService *): SEP memory IS coherent
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61f020, provider 0xffffffe19b86d800), IOReturn: 0x0
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa6b20 (audio-speaker), class is AppleAOPAudioDeviceNode
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61ef80, provider 0xffffffe19b86d800), IOReturn: 0x0
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa4d20 (audio-hw-pcm-audiomgr), class is AppleAOPAudioDeviceNode
virtual bool AppleSEPManager::start(IOService *): control endpoints created
virtual bool AppleANS2NVMeController::start(IOService *)::394:Found the ANS2Endpoint1
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61cd20, provider 0xffffffe19b86d800), IOReturn: 0x0
virtual IOFilterInterruptEventSource *AppleANS2NVMeController::CreateDeviceInterrupt(IOInterruptEventSource::Action, IOFilterInterruptEventSource::Filter, IOService *)::2719:ANS2 NVMe interBad ram pointer 0x200

./ios2.sh: line 28:  3592 Aborted                    (core dumped) QEMUAppleSilicon/build/qemu-system-aarch64 -M t8030,trustcache=iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/038-44135-124.dmg.trustcache,ticket=root_ticket.der,sep-fw=sep-firmware.n104.RELEASE.new.img4,sep-rom=AppleSEPROM-Cebu-B1,kaslr-off=true,usb-conn-type=ipv4,usb-conn-addr=127.0.0.1,usb-conn-port=8030 -kernel iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b -dtb iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/all_flash/DeviceTree.n104ap.im4p -append "tlto_us=-1 mtxspin=-1 agm-genuine=1 agm-authentic=1 agm-trusted=1 serial=3 launchd_unsecure_cache=1 wdt=-1 -vm_compressor_wk_sw" -smp 7 -m 4G -serial mon:stdio -drive file=sep_nvram,if=pflash,format=raw -drive file=sep_ssc,if=pflash,format=raw -drive file=root,format=raw,if=none,id=root -device nvme-ns,drive=root,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 -drive file=firmware,format=raw,if=none,id=firmware -device nvme-ns,drive=firmware,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 -drive file=syscfg,format=raw,if=none,id=syscfg -device nvme-ns,drive=syscfg,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 -drive file=ctrl_bits,format=raw,if=none,id=ctrl_bits -device nvme-ns,drive=ctrl_bits,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 -drive file=nvram,if=none,format=raw,id=nvram -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 -drive file=effaceable,format=raw,if=none,id=effaceable -device nvme-ns,drive=effaceable,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 -drive file=panic_log,format=raw,if=none,id=panic_log -device nvme-ns,drive=panic_log,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 -initrd iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/038-44135-124.dmg -display gtk,zoom-to-fit=on,show-cursor=on```

[chris-pcguy]

yeah I tried that as well, not even a window was opened. i think lldb was taking a while to load or something?

Just use gdb then. After you see it crashing, run the bt command.

[gallantcrusader]

AppleS8000AES::start: using DART Mapper: <ptr>
Identified Serial Port uart0 at 0x235200000(<ptr>)
AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

RTBuddy(SIO): start(<ptr>) - (Aug 12 2020@22:50:37)
RTBuddy(SIO): Boot args override: wdt = -1
RTBuddy(SIO): Resuming...

AppleDisplayPMU::start: display-pmu _pmuIICNub: <ptr> built 22:19:31 Aug 12 2020
AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

RTBuddy(SMC): start(<ptr>) - (Aug 12 2020@22:50:37)
RTBuddy(SMC): Boot args override: wdt = -1
virtual bool AppleSEPManager::start(IOService *): 
RTBuddy(SMC): Resuming...

virtual bool AppleSEPManager::start(IOService *): SEP memory IS coherent
AppleSmartIO (RTBuddy-based)::start (<ptr>) - (Aug 12 2020@22:19:30)
virtual bool AppleSEPManager::start(IOService *): control endpoints created
Starting AppleSMC kext(<ptr>) - (Aug 12 2020@22:51:44)
AppleSMCEmbedded::setPowerState(): ENTER powerStateOrdinal=1, _activeKeyCommand=0 newState=1
virtual bool AppleSEPManager::start(IOService *): PM init done
virtual bool AppleSEPManager::start(IOService *): registered
IOReturn AppleSEPManager::_setPowerState(unsigned long *): power state 0 -> 2
Bad ram pointer 0x200
(dart-sep) AppleT8020DART::_fatalException: DART(DART exception ERROR_STATUS 0x80000001 ERROR_ADDRESS 0x00000000

Thread 16 "qemu-system-aar" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffe727fc6c0 (LWP 180337)]
0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
(gdb) bt all
No symbol "all" in current context.
(gdb) bt
#0  0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
#1  0x0000555555c96c10 in ?? ()
#2  0x0000000000000000 in ?? ()
(gdb) 

[chris-pcguy]

(gdb) bt
#0  0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
#1  0x0000555555c96c10 in ?? ()
#2  0x0000000000000000 in ?? ()

And this time, please use the argument --extra-cflags="-O0" for the configure script.

[gallantcrusader]

Bad ram pointer 0x200
(dart-sep) AppleT8020DART:
Thread 16 "qemu-system-aar" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffe727fc6c0 (LWP 195465)]
0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
#1  0x0000555555e12246 in ?? ()
#2  0x00007ffe727fa1c0 in ?? ()
#3  0x0000000000000200 in ?? ()
#4  0x00007ffe727fa1a0 in ?? ()
#5  0xffffffffffffffff in ?? ()
#6  0x00007ffe727fa1c0 in ?? ()
#7  0x0000555555f1afa7 in ?? ()
#8  0x00000012727fa1a0 in ?? ()
#9  0x0000000000000000 in ?? ()
(gdb) 

[VisualEhrmanntraut]

yeah I tried that as well, not even a window was opened. i think lldb was taking a while to load or something?

did you type r to run the program

[Arbifoxx]

I'm running this project again after stepping away from it for a while, and I'm getting this error too. I've noticed that it appears at random moments. Sometimes the log goes something like this:

...
AppleDialogSPMIPMURTC started!******
Failed to read info-leg_scrpadAppleDialogSPMIPMURTC::handleStart: ro=0 nvram=0 helper=0 AppleDialogSPMIPMU _pmuNub: <ptr> 0x1102:0x9f04-0x9f15 built 22:52:53 Aug 12 2020
RTBuddy(AOP): start(<ptr>) - (Aug 12 2020@22:50:37)
AppleSmartIO (RTBuddy-based)::start (<ptr>) - (Aug 12 2020@22:19:30)
RTBuddy(AOP): Boot args override: wdt = -1
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
AppleDialogSPMIPMURTC tick read!&&&&&&&
AppleDialogSPMIPMURTC ending!%%%
virtual bool AppleANS2NVMeController::start(IOService *)::394:Found the ANS2Endpoint1
virtual bool AppleANS2NVMeController::start(IOService *)::394:Found the ANS2Endpoint1
virtual bool AppleSEPManager::start(IOService *): SEP memory IS coherent
virtual bool AppleSEPManager::start(IOService *): control endpoints created
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
AppleARMRTC registering service!@@@@@@
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT
bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT
RTBuddy(AOP): Resuming...

virtual bool AppleSEPManager::start(IOService *): PM init done
virtual bool AppleSEPManager::start(IOService *): registered
[ PCI configuration end, bridges 3, devices 0 ]
IOReturn AppleSEPManager::_setPowerState(unsigned long *): powerBad ram pointer 0x200 

...and sometimes it goes something like this.:

...
AppleDisplayPMU::start: display-pmu _pmuIICNub: <ptr> built 22:19:31 Aug 12 2020
AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

AppleDialogSPMIPMU::start: spmi-pmu _pmuNub: <ptr> built 22:52:54 Aug 12 2020
RTBuddy(SIO): start(<ptr>) - (Aug 12 2020@22:50:37)
RTBuddy(SIO): Boot args override: wdt = -1
virtual bool AppleSEPManager::start(IOService *): 
RTBuddy(ANS2): start(<ptr>) - (Aug 12 2020@22:50:37)
RTBuddy(ANS2): Boot args override: wdt = -1
virtual bool AppleSEPManager::start(IOService *): SEP memory IS coherent
virtual bool AppleSEPManager::start(IOService *): control endpoints created
LPM state clear
RTBuddy(ANS2): Resuming...

AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

virtual bool AppleSEPManager::start(IOService *): PM init done
virtual bool AppleSEPManager::start(IOService *): registered
IOReturn AppleSEPManager::_setPowerState(unsigned long *): power state 0 -> 2
Bad ram pointer 0x200

You get the idea. It never seems to make it past 10 seconds. I've tried to compile with clang and ninja, and I've tried -O0, -Og, and -g, but nothing seems to change the ultimate outcome. I'm on Tahoe, please let me know what additional information I can provide.

[VisualEhrmanntraut]

you have to use the same key as the ipsw build, as clearly warned by the website. each firmware has different keys.

[VisualEhrmanntraut]

I gave you the checksum for iOS 14.0 beta 5. You replied as if you're using iOS 14.0 beta 5. You sent a link to iOS 14.0 (non-beta). Now you're saying you are not using iOS 14.0 beta 5. The IV and Key used for the SEP firmware must match the IPSW version the SEP firmware is from, and the key argument to the command must be without spaces, but the IV proceeded by the Key glued together as one contiguous piece of text. The key is not unique per SoC, but per iOS version.

[chris-pcguy]

Ok.. In that case I can't emulate every iOS 14 Version outside the default one ? 🤨😢...

He never said that.

[VisualEhrmanntraut]

Please, I need to continue into this no matter what as I need it for Jailbreak Tweaked Apps and for finishing my unfinished Tweak experiments for Jailbreak Tweaks such as Flipboard Explorer's FLEX

Tweaks cannot be installed at this moment due to the kernel patches being minimal, and not the complete set from official jailbreaks. Official jailbreaks make assumptions of vulnerabilities and components like iBoot and cannot be installed. Only commandline utilities can be installed.

[chris-pcguy]

Should I try deleting the IPSW that I already have which is the 18A373 Build and downloading the Beta 5 one ?

Either that or just simply use the proper, matching, sepfw key.

[VisualEhrmanntraut]

I mean it literally says "B1" in bold bright text on the right of it, for goodness sake.

[VisualEhrmanntraut]

well, it's not my fault the site changed layout and format, it's literally not from us.