So the error I was getting with pillow I was also getting with gym I'm not posting the error cause I already did
ERROR: Command errored out with exit status 1: command: 'c:\users\admin\appdata\local\programs\python\python39\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillowa3b55fd831c54a3faa03a24b506449f6\setup.py'"'"'; __file='"'"'C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(file);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file, '"'"'exec'"'"'))' install --record 'C:\Users\Admin\AppData\Local\Temp\pip-record-eawx1du6\install-record.txt' --single-version-externally-managed --compile --install-headers 'c:\users\admin\appdata\local\programs\python\python39\Include\Pillow' cwd: C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\ Complete output (174 lines): C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py:42: RuntimeWarning: Pillow 7.2.0 does not support Python 3.9 and does not provide prebuilt Windows binaries. We do not recommend building from source on Windows. warnings.warn( running install running build running build_py creating build creating build\lib.win-amd64-3.9 creating build\lib.win-amd64-3.9\PIL copying src\PIL\BdfFontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BlpImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BmpImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BufrStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ContainerIO.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\CurImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\DcxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\DdsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\EpsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ExifTags.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\features.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FitsStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FliImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FpxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FtexImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GbrImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GdImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GifImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GimpGradientFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GimpPaletteFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GribStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Hdf5StubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IcnsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IcoImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Image.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageChops.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageCms.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageColor.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageDraw.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageDraw2.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageEnhance.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFilter.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFont.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageGrab.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMath.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMode.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMorph.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageOps.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImagePalette.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImagePath.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageQt.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageSequence.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageShow.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageStat.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageTk.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageTransform.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageWin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImtImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IptcImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Jpeg2KImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\JpegImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\JpegPresets.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\McIdasImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MicImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MpegImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MpoImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MspImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PaletteFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PalmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcdImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcfFontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PdfImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PdfParser.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PixarImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PngImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PpmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PsdImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PSDraw.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PyAccess.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SgiImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SpiderImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SunImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TarIO.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TgaImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TiffImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TiffTags.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WalImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WebPImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WmfImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XbmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XpmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XVThumbImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL_binary.py -> build\lib.win-amd64-3.9\PIL copying src\PIL_tkinter_finder.py -> build\lib.win-amd64-3.9\PIL copying src\PIL_util.py -> build\lib.win-amd64-3.9\PIL copying src\PIL_version.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\init.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\main_.py -> build\lib.win-amd64-3.9\PIL running egg_info writing src\Pillow.egg-info\PKG-INFO writing dependency_links to src\Pillow.egg-info\dependency_links.txt writing top-level names to src\Pillow.egg-info\top_level.txt reading manifest file 'src\Pillow.egg-info\SOURCES.txt' reading manifest template 'MANIFEST.in' warning: no files found matching '.c' warning: no files found matching '.h' warning: no files found matching '.sh' warning: no previously-included files found matching '.appveyor.yml' warning: no previously-included files found matching '.coveragerc' warning: no previously-included files found matching '.editorconfig' warning: no previously-included files found matching '.readthedocs.yml' warning: no previously-included files found matching 'codecov.yml' warning: no previously-included files matching '.git' found anywhere in distribution warning: no previously-included files matching '.pyc' found anywhere in distribution warning: no previously-included files matching '.so' found anywhere in distribution no previously-included directories found matching '.ci' writing manifest file 'src\Pillow.egg-info\SOURCES.txt' running build_ext

 The headers or library files could not be found for zlib, a required dependency when compiling Pillow from source. Please see the install instructions at: https://pillow.readthedocs.io/en/latest/installation.html Traceback (most recent call last): File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 864, in  setup( File "c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\setuptools\__init__.py", line 165, in setup return distutils.core.setup(**attrs) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\core.py", line 148, in setup dist.run_commands() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 966, in run_commands self.run_command(cmd) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\setuptools\command\install.py", line 61, in run return orig.install.run(self) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\install.py", line 546, in run self.run_command('build') File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\cmd.py", line 313, in run_command self.distribution.run_command(command) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\build.py", line 135, in run self.run_command(cmd_name) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\cmd.py", line 313, in run_command self.distribution.run_command(command) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\build_ext.py", line 340, in run self.build_extensions() File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 694, in build_extensions raise RequiredDependencyException(f) __main__.RequiredDependencyException: zlib During handling of the above exception, another exception occurred: Traceback (most recent call last): File "", line 1, in  File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 918, in  raise RequiredDependencyException(msg) __main__.RequiredDependencyException: The headers or library files could not be found for zlib, a required dependency when compiling Pillow from source. Please see the install instructions at: https://pillow.readthedocs.io/en/latest/installation.html ---------------------------------------- Rolling back uninstall of pillow Moving to c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\pil\ from C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\~il Moving to c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\pillow-8.1.0.dist-info\ from C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\~illow-8.1.0.dist-info ERROR: Command errored out with exit status 1: 'c:\users\admin\appdata\local\programs\python\python39\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"'; __file__='"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'C:\Users\Admin\AppData\Local\Temp\pip-record-eawx1du6\install-record.txt' --single-version-externally-managed --compile --install-headers 'c:\users\admin\appdata\local\programs\python\python39\Include\Pillow' Check the logs for full command output. 

so i tried to import/install pillow after i install gym but it keeps saying no module with that name i tried everything nothing seems to work and a error keeps poping up when i tried to install gym again to get pillow
here the error

 ERROR: Command errored out with exit status 1: command: 'c:\users\admin\appdata\local\programs\python\python39\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"'; __file__='"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'C:\Users\Admin\AppData\Local\Temp\pip-record-eawx1du6\install-record.txt' --single-version-externally-managed --compile --install-headers 'c:\users\admin\appdata\local\programs\python\python39\Include\Pillow' cwd: C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\ Complete output (174 lines): C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py:42: RuntimeWarning: Pillow 7.2.0 does not support Python 3.9 and does not provide prebuilt Windows binaries. We do not recommend building from source on Windows. warnings.warn( running install running build running build_py creating build creating build\lib.win-amd64-3.9 creating build\lib.win-amd64-3.9\PIL copying src\PIL\BdfFontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BlpImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BmpImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BufrStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ContainerIO.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\CurImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\DcxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\DdsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\EpsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ExifTags.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\features.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FitsStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FliImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FpxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FtexImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GbrImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GdImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GifImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GimpGradientFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GimpPaletteFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GribStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Hdf5StubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IcnsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IcoImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Image.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageChops.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageCms.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageColor.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageDraw.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageDraw2.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageEnhance.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFilter.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFont.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageGrab.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMath.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMode.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMorph.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageOps.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImagePalette.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImagePath.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageQt.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageSequence.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageShow.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageStat.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageTk.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageTransform.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageWin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImtImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IptcImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Jpeg2KImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\JpegImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\JpegPresets.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\McIdasImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MicImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MpegImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MpoImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MspImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PaletteFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PalmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcdImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcfFontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PdfImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PdfParser.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PixarImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PngImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PpmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PsdImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PSDraw.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PyAccess.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SgiImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SpiderImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SunImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TarIO.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TgaImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TiffImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TiffTags.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WalImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WebPImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WmfImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XbmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XpmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XVThumbImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\_binary.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\_tkinter_finder.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\_util.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\_version.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\__init__.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\__main__.py -> build\lib.win-amd64-3.9\PIL running egg_info writing src\Pillow.egg-info\PKG-INFO writing dependency_links to src\Pillow.egg-info\dependency_links.txt writing top-level names to src\Pillow.egg-info\top_level.txt reading manifest file 'src\Pillow.egg-info\SOURCES.txt' reading manifest template 'MANIFEST.in' warning: no files found matching '*.c' warning: no files found matching '*.h' warning: no files found matching '*.sh' warning: no previously-included files found matching '.appveyor.yml' warning: no previously-included files found matching '.coveragerc' warning: no previously-included files found matching '.editorconfig' warning: no previously-included files found matching '.readthedocs.yml' warning: no previously-included files found matching 'codecov.yml' warning: no previously-included files matching '.git*' found anywhere in distribution warning: no previously-included files matching '*.pyc' found anywhere in distribution warning: no previously-included files matching '*.so' found anywhere in distribution no previously-included directories found matching '.ci' writing manifest file 'src\Pillow.egg-info\SOURCES.txt' running build_ext The headers or library files could not be found for zlib, a required dependency when compiling Pillow from source. Please see the install instructions at: https://pillow.readthedocs.io/en/latest/installation.html Traceback (most recent call last): File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 864, in  setup( File "c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\setuptools\__init__.py", line 165, in setup return distutils.core.setup(**attrs) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\core.py", line 148, in setup dist.run_commands() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 966, in run_commands self.run_command(cmd) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\setuptools\command\install.py", line 61, in run return orig.install.run(self) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\install.py", line 546, in run self.run_command('build') File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\cmd.py", line 313, in run_command self.distribution.run_command(command) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\build.py", line 135, in run self.run_command(cmd_name) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\cmd.py", line 313, in run_command self.distribution.run_command(command) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\build_ext.py", line 340, in run self.build_extensions() File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 694, in build_extensions raise RequiredDependencyException(f) __main__.RequiredDependencyException: zlib During handling of the above exception, another exception occurred: Traceback (most recent call last): File "", line 1, in  File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 918, in  raise RequiredDependencyException(msg) __main__.RequiredDependencyException: The headers or library files could not be found for zlib, a required dependency when compiling Pillow from source. Please see the install instructions at: https://pillow.readthedocs.io/en/latest/installation.html ---------------------------------------- Rolling back uninstall of pillow Moving to c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\pil\ from C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\~il Moving to c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\pillow-8.1.0.dist-info\ from C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\~illow-8.1.0.dist-info ERROR: Command errored out with exit status 1: 'c:\users\admin\appdata\local\programs\python\python39\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"'; __file__='"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'C:\Users\Admin\AppData\Local\Temp\pip-record-eawx1du6\install-record.txt' --single-version-externally-managed --compile --install-headers 'c:\users\admin\appdata\local\programs\python\python39\Include\Pillow' Check the logs for full command output. 

so i tried to import/install pillow after i install gym but it keeps saying no module with that name i tried everything nothing seems to work and a error keeps poping up when i tried to install gym again to get pillow
here the error

 ERROR: Command errored out with exit status 1: command: 'c:\users\admin\appdata\local\programs\python\python39\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"'; __file__='"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'C:\Users\Admin\AppData\Local\Temp\pip-record-eawx1du6\install-record.txt' --single-version-externally-managed --compile --install-headers 'c:\users\admin\appdata\local\programs\python\python39\Include\Pillow' cwd: C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\ Complete output (174 lines): C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py:42: RuntimeWarning: Pillow 7.2.0 does not support Python 3.9 and does not provide prebuilt Windows binaries. We do not recommend building from source on Windows. warnings.warn( running install running build running build_py creating build creating build\lib.win-amd64-3.9 creating build\lib.win-amd64-3.9\PIL copying src\PIL\BdfFontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BlpImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BmpImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\BufrStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ContainerIO.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\CurImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\DcxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\DdsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\EpsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ExifTags.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\features.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FitsStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FliImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FpxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\FtexImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GbrImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GdImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GifImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GimpGradientFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GimpPaletteFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\GribStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Hdf5StubImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IcnsImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IcoImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Image.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageChops.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageCms.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageColor.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageDraw.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageDraw2.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageEnhance.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFilter.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageFont.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageGrab.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMath.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMode.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageMorph.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageOps.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImagePalette.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImagePath.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageQt.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageSequence.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageShow.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageStat.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageTk.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageTransform.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImageWin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\ImtImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\IptcImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\Jpeg2KImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\JpegImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\JpegPresets.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\McIdasImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MicImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MpegImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MpoImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\MspImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PaletteFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PalmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcdImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcfFontFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PcxImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PdfImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PdfParser.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PixarImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PngImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PpmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PsdImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PSDraw.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\PyAccess.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SgiImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SpiderImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\SunImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TarIO.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TgaImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TiffImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\TiffTags.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WalImageFile.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WebPImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\WmfImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XbmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XpmImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\XVThumbImagePlugin.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\_binary.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\_tkinter_finder.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\_util.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\_version.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\__init__.py -> build\lib.win-amd64-3.9\PIL copying src\PIL\__main__.py -> build\lib.win-amd64-3.9\PIL running egg_info writing src\Pillow.egg-info\PKG-INFO writing dependency_links to src\Pillow.egg-info\dependency_links.txt writing top-level names to src\Pillow.egg-info\top_level.txt reading manifest file 'src\Pillow.egg-info\SOURCES.txt' reading manifest template 'MANIFEST.in' warning: no files found matching '*.c' warning: no files found matching '*.h' warning: no files found matching '*.sh' warning: no previously-included files found matching '.appveyor.yml' warning: no previously-included files found matching '.coveragerc' warning: no previously-included files found matching '.editorconfig' warning: no previously-included files found matching '.readthedocs.yml' warning: no previously-included files found matching 'codecov.yml' warning: no previously-included files matching '.git*' found anywhere in distribution warning: no previously-included files matching '*.pyc' found anywhere in distribution warning: no previously-included files matching '*.so' found anywhere in distribution no previously-included directories found matching '.ci' writing manifest file 'src\Pillow.egg-info\SOURCES.txt' running build_ext The headers or library files could not be found for zlib, a required dependency when compiling Pillow from source. Please see the install instructions at: https://pillow.readthedocs.io/en/latest/installation.html Traceback (most recent call last): File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 864, in  setup( File "c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\setuptools\__init__.py", line 165, in setup return distutils.core.setup(**attrs) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\core.py", line 148, in setup dist.run_commands() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 966, in run_commands self.run_command(cmd) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\setuptools\command\install.py", line 61, in run return orig.install.run(self) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\install.py", line 546, in run self.run_command('build') File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\cmd.py", line 313, in run_command self.distribution.run_command(command) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\build.py", line 135, in run self.run_command(cmd_name) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\cmd.py", line 313, in run_command self.distribution.run_command(command) File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command cmd_obj.run() File "c:\users\admin\appdata\local\programs\python\python39\lib\distutils\command\build_ext.py", line 340, in run self.build_extensions() File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 694, in build_extensions raise RequiredDependencyException(f) __main__.RequiredDependencyException: zlib During handling of the above exception, another exception occurred: Traceback (most recent call last): File "", line 1, in  File "C:\Users\Admin\AppData\Local\Temp\pip-install-8ullt7u7\pillow_a3b55fd831c54a3faa03a24b506449f6\setup.py", line 918, in  raise RequiredDependencyException(msg) __main__.RequiredDependencyException: The headers or library files could not be found for zlib, a required dependency when compiling Pillow from source. Please see the install instructions at: https://pillow.readthedocs.io/en/latest/installation.html ---------------------------------------- Rolling back uninstall of pillow Moving to c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\pil\ from C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\~il Moving to c:\users\admin\appdata\local\programs\python\python39\lib\site-packages\pillow-8.1.0.dist-info\ from C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\~illow-8.1.0.dist-info ERROR: Command errored out with exit status 1: 'c:\users\admin\appdata\local\programs\python\python39\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"'; __file__='"'"'C:\\Users\\Admin\\AppData\\Local\\Temp\\pip-install-8ullt7u7\\pillow_a3b55fd831c54a3faa03a24b506449f6\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'C:\Users\Admin\AppData\Local\Temp\pip-record-eawx1du6\install-record.txt' --single-version-externally-managed --compile --install-headers 'c:\users\admin\appdata\local\programs\python\python39\Include\Pillow' Check the logs for full command output. 

keep getting this melonloader error and it instructs me to post my log on the discord but I literally cannot post on the discord, any help would be appreciated.
It would seem that because I've moved my steam downloads from program files to my documents folder that my computer won't give access to melon loader. (I mod a lot of my games and I get less errors if the installs are in this folder)
Thank you again for any help you can offer
​
Edit: Got it fixed and can use all those fun gun mods, if you are receiving the same message I bet your antivirus is blocking MelonLoader from making changes, so you need to give MelonLoader.AssemblyGenerator.exe permissions in your antivirus settings. btw, the IMI Uzi mod is a hell of a lot of fun to use.
​
[13:38:49.037] Assembly Generation Needed!
[13:38:49.038] Downloading Il2CppDumper
[13:38:49.039] Cleaning C:\Users\unfor\Documents\New Steam Folder\Steam\steamapps\common\BONEWORKS\BONEWORKS\MelonLoader\Dependencies\AssemblyGenerator\Il2CppDumper
[13:38:49.040] Downloading https://github.com/Perfare/Il2CppDumpereleases/download/v6.4.12/Il2CppDumper-v6.4.12.zip to C:\Users\unfor\AppData\Local\Temp\tmp4B3D.tmp
[13:38:50.276] Extracting C:\Users\unfor\AppData\Local\Temp\tmp4B3D.tmp to C:\Users\unfor\Documents\New Steam Folder\Steam\steamapps\common\BONEWORKS\BONEWORKS\MelonLoader\Dependencies\AssemblyGenerator\Il2CppDumper
[13:38:50.298] Extracting config.json
[13:38:50.317] Extracting ghidra.py
[13:38:50.319] Extracting ida.py
[13:38:50.320] Extracting ida_py3.py
[13:38:50.320] Extracting ida_with_struct.py
[13:38:50.322] Extracting ida_with_struct_py3.py
[13:38:50.323] Extracting Il2CppDumper.exe
[13:38:50.326] Extracting Il2CppDumper.exe.config
[13:38:50.327] Extracting Il2CppDumper.pdb
[13:38:50.328] Extracting Mono.Cecil.dll
[13:38:50.331] Extracting Mono.Cecil.Mdb.dll
[13:38:50.332] Extracting Mono.Cecil.Pdb.dll
[13:38:50.334] Extracting Mono.Cecil.Rocks.dll
[13:38:50.335] Extracting Newtonsoft.Json.dll
[13:38:50.348] Downloading Il2CppAssemblyUnhollower
[13:38:50.349] Cleaning C:\Users\unfor\Documents\New Steam Folder\Steam\steamapps\common\BONEWORKS\BONEWORKS\MelonLoader\Dependencies\AssemblyGenerator\Il2CppAssemblyUnhollower
[13:38:50.367] System.IO.IOException: Access to the path 'C:\Users\unfor\Documents\New Steam Folder\Steam\steamapps\common\BONEWORKS\BONEWORKS\MelonLoader\Dependencies\AssemblyGenerator\Il2CppAssemblyUnhollower\Output' is denied.
[13:38:50.368] at System.IO.Directory.DeleteHelper(String fullPath, String userPath, Boolean recursive, Boolean throwOnTopLevelDirectoryNotFound, WIN32_FIND_DATA& data)
[13:38:50.369] at System.IO.Directory.Delete(String fullPath, String userPath, Boolean recursive, Boolean checkHost)
[13:38:50.370] at MelonLoader.AssemblyGenerator.DownloaderAndUnpacker.Run(String url, String targetVersion, String currentVersion, String destinationFolder, String tempFile)
[13:38:50.371] at MelonLoader.AssemblyGenerator.Main.DownloadDependencies(String unityVersion)
[13:38:50.372] Can't download Il2CppAssemblyUnhollower!
[13:38:50.376] [Error] Assembly Generator exited with code -2

PS E:\Downloads\TDeskDroid-master> pip3 install -r requirements.txt
Collecting Pillow==4.0.0
Downloading Pillow-4.0.0.tar.gz (11.1 MB)
|████████████████████████████████| 11.1 MB 6.8 MB/s
Collecting tinify==1.5.0
Downloading tinify-1.5.0.tar.gz (149 kB)
|████████████████████████████████| 149 kB ...
Collecting requests>=2.13
Downloading requests-2.24.0-py2.py3-none-any.whl (61 kB)
|████████████████████████████████| 61 kB 168 kB/s
Requirement already satisfied: olefile in c:\users\win 10\appdata\local\programs\python\python39\lib\site-packages (from Pillow==4.0.0->-r requirements.txt (line 1)) (0.46)
Collecting certifi>=2017.4.17
Downloading certifi-2020.6.20-py2.py3-none-any.whl (156 kB)
|████████████████████████████████| 156 kB ...
Collecting chardet<4,>=3.0.2
Downloading chardet-3.0.4-py2.py3-none-any.whl (133 kB)
|████████████████████████████████| 133 kB 6.8 MB/s
Collecting urllib3!=1.25.0,!=1.25.1,<1.26,>=1.21.1
Downloading urllib3-1.25.10-py2.py3-none-any.whl (127 kB)
|████████████████████████████████| 127 kB ...
Collecting idna<3,>=2.5
Downloading idna-2.10-py2.py3-none-any.whl (58 kB)
|████████████████████████████████| 58 kB 2.9 MB/s
Using legacy 'setup.py install' for Pillow, since package 'wheel' is not installed.
Using legacy 'setup.py install' for tinify, since package 'wheel' is not installed.
Installing collected packages: Pillow, certifi, chardet, urllib3, idna, requests, tinify
Running setup.py install for Pillow ... error
ERROR: Command errored out with exit status 1:
command: 'c:\users\win 10\appdata\local\programs\python\python39\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\\Users\\Win 10\\AppData\\Local\\Temp\\pip-install-unm1yi4r\\pillow\\setup.py'"'"'; __file__='"'"'C:\\Users\\Win 10\\AppData\\Local\\Temp\\pip-install-unm1yi4r\\pillow\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'C:\Users\Win 10\AppData\Local\Temp\pip-record-_7wq4e44\install-record.txt' --single-version-externally-managed --compile --install-headers 'c:\users\win 10\appdata\local\programs\python\python39\Include\Pillow'
cwd: C:\Users\Win 10\AppData\Local\Temp\pip-install-unm1yi4r\pillow\
Complete output (170 lines):
Single threaded build for windows
running install
running build
running build_py
creating build
creating build\lib.win-amd64-3.9
creating build\lib.win-amd64-3.9\PIL
copying PIL\BdfFontFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\BmpImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\BufrStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ContainerIO.py -> build\lib.win-amd64-3.9\PIL
copying PIL\CurImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\DcxImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\DdsImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\EpsImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ExifTags.py -> build\lib.win-amd64-3.9\PIL
copying PIL\features.py -> build\lib.win-amd64-3.9\PIL
copying PIL\FitsStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\FliImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\FontFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\FpxImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\FtexImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\GbrImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\GdImageFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\GifImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\GimpGradientFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\GimpPaletteFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\GribStubImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\Hdf5StubImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\IcnsImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\IcoImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\Image.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageChops.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageCms.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageColor.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageDraw.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageDraw2.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageEnhance.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageFilter.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageFont.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageGrab.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageMath.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageMode.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageMorph.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageOps.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImagePalette.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImagePath.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageQt.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageSequence.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageShow.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageStat.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageTk.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageTransform.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImageWin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\ImtImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\IptcImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\Jpeg2KImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\JpegImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\JpegPresets.py -> build\lib.win-amd64-3.9\PIL
copying PIL\McIdasImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\MicImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\MpegImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\MpoImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\MspImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\OleFileIO.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PaletteFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PalmImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PcdImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PcfFontFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PcxImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PdfImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PixarImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PngImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PpmImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PsdImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PSDraw.py -> build\lib.win-amd64-3.9\PIL
copying PIL\PyAccess.py -> build\lib.win-amd64-3.9\PIL
copying PIL\SgiImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\SpiderImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\SunImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\TarIO.py -> build\lib.win-amd64-3.9\PIL
copying PIL\TgaImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\TiffImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\TiffTags.py -> build\lib.win-amd64-3.9\PIL
copying PIL\WalImageFile.py -> build\lib.win-amd64-3.9\PIL
copying PIL\WebPImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\WmfImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\XbmImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\XpmImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\XVThumbImagePlugin.py -> build\lib.win-amd64-3.9\PIL
copying PIL\_binary.py -> build\lib.win-amd64-3.9\PIL
copying PIL\_tkinter_finder.py -> build\lib.win-amd64-3.9\PIL
copying PIL\_util.py -> build\lib.win-amd64-3.9\PIL
copying PIL\__init__.py -> build\lib.win-amd64-3.9\PIL
running egg_info
writing Pillow.egg-info\PKG-INFO
writing dependency_links to Pillow.egg-info\dependency_links.txt
writing requirements to Pillow.egg-info\requires.txt
writing top-level names to Pillow.egg-info\top_level.txt
reading manifest file 'Pillow.egg-info\SOURCES.txt'
reading manifest template 'MANIFEST.in'
warning: no files found matching '*.sh'
no previously-included directories found matching 'docs\_static'
warning: no previously-included files found matching '.coveragerc'
warning: no previously-included files found matching '.editorconfig'
warning: no previously-included files found matching '.landscape.yaml'
warning: no previously-included files found matching 'appveyor.yml'
warning: no previously-included files found matching 'build_children.sh'
warning: no previously-included files found matching 'tox.ini'
warning: no previously-included files matching '.git*' found anywhere in distribution
warning: no previously-included files matching '*.pyc' found anywhere in distribution
warning: no previously-included files matching '*.so' found anywhere in distribution
writing manifest file 'Pillow.egg-info\SOURCES.txt'
running build_ext
The headers or library files could not be found for zlib,
a required dependency when compiling Pillow from source.
Please see the install instructions at:
http://pillow.readthedocs.io/en/latest/installation.html
Traceback (most recent call last):
File "C:\Users\Win 10\AppData\Local\Temp\pip-install-unm1yi4r\pillow\setup.py", line 746, in
setup(name=NAME,
File "c:\users\win 10\appdata\local\programs\python\python39\lib\site-packages\setuptools\__init__.py", line 165, in setup
return distutils.core.setup(**attrs)
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\core.py", line 148, in setup
dist.run_commands()
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\dist.py", line 966, in run_commands
self.run_command(cmd)
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command
cmd_obj.run()
File "c:\users\win 10\appdata\local\programs\python\python39\lib\site-packages\setuptools\command\install.py", line 61, in run
return orig.install.run(self)
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\command\install.py", line 546, in run
self.run_command('build')
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\cmd.py", line 313, in run_command
self.distribution.run_command(command)
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command
cmd_obj.run()
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\command\build.py", line 135, in run
self.run_command(cmd_name)
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\cmd.py", line 313, in run_command
self.distribution.run_command(command)
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\dist.py", line 985, in run_command
cmd_obj.run()
File "c:\users\win 10\appdata\local\programs\python\python39\lib\distutils\command\build_ext.py", line 340, in run
self.build_extensions()
File "C:\Users\Win 10\AppData\Local\Temp\pip-install-unm1yi4r\pillow\setup.py", line 549, in build_extensions
raise RequiredDependencyException(f)
__main__.RequiredDependencyException: zlib
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "", line 1, in
File "C:\Users\Win 10\AppData\Local\Temp\pip-install-unm1yi4r\pillow\setup.py", line 791, in
raise RequiredDependencyException(msg)
__main__.RequiredDependencyException:
The headers or library files could not be found for zlib,
a required dependency when compiling Pillow from source.
Please see the install instructions at:
http://pillow.readthedocs.io/en/latest/installation.html
----------------------------------------
ERROR: Command errored out with exit status 1: 'c:\users\win 10\appdata\local\programs\python\python39\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'C:\\Users\\Win 10\\AppData\\Local\\Temp\\pip-install-unm1yi4r\\pillow\\setup.py'"'"'; __file__='"'"'C:\\Users\\Win 10\\AppData\\Local\\Temp\\pip-install-unm1yi4r\\pillow\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'C:\Users\Win 10\AppData\Local\Temp\pip-record-_7wq4e44\install-record.txt' --single-version-externally-managed --compile --install-headers 'c:\users\win 10\appdata\local\programs\python\python39\Include\Pillow' Check the logs for full command output.
PS E:\Downloads\TDeskDroid-master>

Hello everybody,
First of all I want to say that this is my first post on reddit so please go easy on me.
[Intro]
As most of you guys know, retrofitting an MIB2 unit on a MIB1 mk7 was always a problem because of CP and Fec's (especially if you are on a budget). As of now, there are a few people on the internet that can remotely remove CP and enable all Fec's for a substantial sum of money (aprox. 250-300 euros) either by ODIS online or by hacking the unit. The later one caught my attention so I did some research on my own. Recently some Porsche owners have been upset that PCM4 (equivalent to MIB2) units only support CarPlay and no AndroidAuto so they did their own research and managed to enable this function on their units using some programming and reverse engineering skills. This opens a lot of possibilities for MIB users too. They managed to do this by dumping the PCM's firmware on a SD card, modifying it and then flashing back the firmware into the unit. Unfortunately this involves some advanced programming skills. Luckily for us, one Porsche owner has managed to do a step by step guide on how to do this, except for one step. This is where we need to work together in order to make this work.
Since my programming skills are limited (next to nothing), I ask you, my fellow MK7 owners, for help.
I will attach the instructions that explain this process step by step and the links to the topics where this has been discussed. I highly recommend taking the time to read these.
Together we might be able to do this retrofit without ever stepping into a VW dealer.
Enjoy
[Instructions]
Enabling Android Auto on PCM4
Step 1. Required Components

1. ⁃ UART -> USB Adapter (Setam's eddit: From what I understood, this might be done using a d-link dub-e100)
2. ⁃ PuTTY or similar terminal app
3. ⁃ IDA Pro ($$$$$), Ghidra (free), or similar ARM V7-A compatible disassembler
4. ⁃ SD Card
5. ⁃ Linux computer to unpack + repack filesystem
6. ⁃ dumpifs and mkxfs from QNX SDP / OpenQNX. Build these from source on your linux machine to ensure proper compatibility. (available at https://github.com/ibreakifix/PorschePCMStuff pre-built for Ubuntu 19.04 x64)
7. ⁃ mkxfs attributes file from https://github.com/ibreakifix/PorschePCMStuff

Step 2. Connect to PCM4 via UART

1. ⁃ Connect GND to GND (PCM4 chassis works), RX on adapter to J5_TX on PCM4, TX to J5_RX on PCM4; pins B3 and B9. 📷
2. ⁃ To connect, you can remove the connector block from the quad-lock, then route your TX/RX/GND pigtails through the opening.
3. ⁃ Open PuTTY, launch a serial connection to your COM port (see devmgmt.msc) - 115200, 8, N, 1
4. ⁃ Login with root / oaIQOqkW

Step 3. Download Root-IFS

1. ⁃ Issue the "stfu" command to stop verbose logging to the terminal.
2. ⁃ Insert SD card into PCM4, left slot
3. ⁃ Issue the following command to download your filesystem: "dd if=/dev/fs0 of=/net/mmx/fs/sda0/PCM4_NOR.bin".
4. ⁃ Issue the following command to copy your existing FEC file: "cp /mnt/efs-persist/FecContainer.fec /net/mmx/fs/sda0/orig_FecContainer.fec"
5. ⁃ Remove SD card and insert into your PC.
6. ⁃ You can also pull this image from an update SD card at ./RCC/ifs-root/*/default/ifs-root.ifs **Note: The desired image is the second ifs contained within this update file, use ctrl+f and find the second instance of file magic "EB 7E FF", your IFS image begins at this location and ends at the end of the file. If you do this, you can skip steps 4.1 to 4.3**

Step 4. Unpack Root-IFS (if using downloaded image from PCM4)

1. ⁃ Open downloaded RCC NOR image (PCM4_NOR.bin) in your favorite hex editor
2. ⁃ Jump to offset 0xBA0000, ensure IFS magic of "EB 7E FF" is present. If not, issue "flashlock" on PCM4 shell to obtain correct offset, target IFS is ~15.6mb. See screenshot. 📷
3. ⁃ Select from 0xBA0000 to the end of the IFS, which is indicated by a block of padding "FF FF FF FF FF". In my case, this data was 15,639,040 bytes. See screenshot. 📷
4. ⁃ Cut and paste this block of data into a new file, name it ifsroot_stage2_orig.ifs
5. ⁃ Move to a linux computer with dumpifs binary (available from QNX SDP)
6. ⁃ Copy ifsroot_stage2_orig.ifs to some folder, open your terminal and CD to that folder.
7. ⁃ Copy dumpifs_helper.sh to this same folder. Chmod it to 755
8. ⁃ Issue "./dumpifs_helper.sh ifsroot_stage2_orig.ifs" to extract the IFS, your files will be in ./ifs_extracted. Ensure files are present as shown in the terminal output
9. ⁃ Place a copy of /usapps/MIBRoot so it can be patched with IDA, Ghidra or similar

Step 5. Patch out the FEC checks.

1. 📷

Step 6. Rebuild IFS image

1. ⁃ Place your patched MIBRoot into your extracted IFS location, overwriting the old MIBRoot. It should be located at ./ifs_extracted/apps/bin/
2. ⁃ Open terminal. Issue command: EXPORT QNX_TARGET="/"
3. - cd to whatever the parent directory is to the ifs_extracted folder we made earlier
4. ⁃ Download mkifs_attributes.txt from github repo. Place it in your current working directory
5. ⁃ Build the new IFS with mkxfs, issue command "mkxfs -t ifs -nn -o ./ -r / ./mkifs_attributes.txt ./ifs_extracted ./patched_ifs.ifs"
6. ⁃ Place patched_ifs.ifs back onto your SD card

Step 7. Create your new FEC file

1. ⁃ Open the FEC container (orig_FecContainer.fec) from earlier in your favorite hex editor
2. ⁃ Copy VIN from file. This should match your car's VIN, unless component protection is enabled, then it would be the VIN from the donor car
3. ⁃ Copy down VCRN (hex values of bytes 16-20 in file). Write it down as shown in the blue highlighted text in the screenshot. The VCRN may be obtained through measurement channels on PIWIS if you only have a 4 byte empty FEC file. 📷
4. ⁃ Make a comma separated list of your existing FECs, from offset 0x43 until the checksum begins. Use hex values, add commas at every 4 bytes (8 digits), for example, from screenshot it would be 00030000,00030001,(...),06310099 📷
5. ⁃ Add one last FEC to the end of that list, which will enable Android Auto: 00060900
6. ⁃ You can also add other FECs to your PCM4 at this time, see below. Additional coding / adaptations may be required.
7. ⁃ Download MIB2_FEC_Generator.sh from Github, chmod it to 755
8. ⁃ Issue command to generate FEC Container "MIB2_FEC_Generator.sh -f {YOUR_FEC_LIST_CSV} -n {YOUR_VCRN} -v {YOUR_VIN} -d {Output_Directory}"
9. ⁃ Output file is FecContainer.fec, copy this new file to your SD card

Step 8. Load new files to head unit

1. ⁃ Insert SD card into PCM4, left slot
2. ⁃ Login with root / oaIQOqkW
3. ⁃ Issue the "stfu" command to stop verbose logging to the terminal.
4. ⁃ Remount efs-persist as w with command "mount -uw /mnt/efs-persist/"
5. ⁃ Copy your new FECs with command "mv /mnt/efs-persist/FEC/FecContainer.fec /mnt/efs-persist/FEC/FecContainer.fec.orig; cp /net/mmx/fs/sda0/FecContainer.fec /mnt/efs-persist/FEC/FecContainer.fec"
6. ⁃ Issue commands to flash your stage2 ifs-root... THIS CAN BRICK YOUR HEAD UNIT, SO BE CAREFUL! Important note: "flash.it" is actually one word, but RL censors it, so remove the period otherwise the command won't work.
7. ⁃ flashunlock
8. ⁃ /usbin/flash.it -v -x -d -a0x00BA0000 -f/net/mmx/fs/sda0/patched_ifs.ifs
9. ⁃ flashlock
10. ⁃ Reboot unit by holding down power button for 30s.
11. ⁃ Cross fingers and hope your patch worked 📷

Step 9. Adaptations

1. With PIWIS II / PIWIS III, or VCDS
2. ⁃ If using PIWIS II, place it into engineering mode via Settings -> Diagnostics Configuration -> 911, 918s, etc... -> Mode -> Select "E". Save + Exit
3. ⁃ In PIWIS, Open Diagnostics -> 911 -> 991, scan car (F12) to obtain installed modules, select head unit (Named MIB2...). In VCDS open module 5F
4. ⁃ Select "Manuelle Codierung ohne MCR-Regeln" -> Vehicle_configuration
5. ⁃ Set Bitfield (3) Google_GAL -> "on"
6. ⁃ Save coding, wait for system to reboot
7. Alternate method coding through PCM4 shell:
8. export LD_LIBRARY_PATH=/mnt/app/root/lib-target:/eso/lib:/mnt/app/uslib:/mnt/app/armle/lib:/mnt/app/armle/lib/dll:/mnt/app/armle/uslib
9. export IPL_CONFIG_DIR=/etc/eso/production
10. on -f mmx /eso/bin/apps/pc b:0:3221356628:7.7 1

Step 10. Done!

1. ⁃ Plug in your phone. You should now have Android Auto 📷

It is important to note that this hack will be overwritten if you ever decide to perform a software update on your PCM4. You'll then have to re-complete these steps with your new version of software. Given that there are no PCM4 updates available, this will probably be a non-issue.
What if I flash a bad ifs image to my head unit? ⁃ If this happens, MIBRoot will fail to start and you will not be able to interface with PCM4. it will appear to boot from the LCD panel, but touch and audio will not work. However, it will still boot into QNX for recovery since we are only flashing the stage2 image. ⁃ To recover, log into QNX with root / oaIQOqkW ⁃ Copy your original IFS root file (ifsroot_stage2_orig.ifs) to your SD card and install to left slot of PCM4. ⁃ Issue commands: ⁃ flashunlock ⁃ flash.it -v -x -d -a0x00BA0000 -f/net/mmx/fs/sda0/ifsroot_stage2_orig.ifs ⁃ flashlock ⁃ Note: If stage2 ifs flashing fails, flash.it, flashlock and flashunlock may no longer be present on your system. Copy them to your SD card from your extracted ifs directory and run them from the SD card, for example /net/mmx/fs/sda0/flashunlock.
What if my firmware flash works but I still don't have Android Auto? ⁃ Your VIN, VCRN, or FECs may need to be corrected, review step 7. Cars without CarPlay may need to add FECs 00030000, or 00060700 and 00060800 ⁃ If your FECs are being removed from FecContainer.fec and being placed into IllegalFecContainer.fec, then your FECs are failing the signature check. Your patch is wrong and you need to review step 5 again. ⁃ If you did not have CarPlay or Android Auto previously, you may also need to code USB media player functionality within PIWIS II.
What if I want to return to stock? ⁃ Connect to PCM4 via UART ⁃ Log into QNX with root / oaIQOqkW ⁃ Copy your original IFS root file (ifsroot_stage2_orig.ifs) to your SD card and install to left slot of PCM4. ⁃ Issue commands: ⁃ flashunlock ⁃ flash.it -v -x -d -a0x00BA0000 -f/net/mmx/fs/sda0/ifsroot_stage2_orig.ifs ⁃ flashlock ⁃ mount -uw /mnt/efs-persist ⁃ rm /mnt/efs-persist/FEC/FecContainer.fec ⁃ mv /mnt/efs-persist/FEC/FecContainer.fec.orig /mnt/efs-persist/FEC/FecContainer.fec ⁃ Done. Reboot by holding power button for 30s
​
[Links]
https://rennlist.com/forums/991/1142493-retrofitting-pcm4-in-a-991-1-a-3.html
https://rennlist.com/forums/991/1049794-porsche-pcm-upgrade-hack-for-android-auto-is-this-real.html
https://github.com/herrfrei/PorschePCMStuff

Someone PM'd me and asked generally about writing a processor specification. I figured I might write something in a post if I were to answer. So just going to ramble with a whiskey.
TL;DR read the SLEIGH/PCODE docs, read the cspec/pspec docs, learn by example, reference other processors implementations of similar instructions. Read the ISA manual and think about your SLEIGH layout. Reference other tools that do similar breakdowns and intermediate lifting. It’s tedious.
I had no prior experience writing SLEIGH/PCODE, but have been professionally doing embedded development and low-level analysis (C/ARM/PPC/MIPS/Intel) with experience in IDA for around 10 years or so. None of this has been for work, only a learning experience (hobby?). I have only ever used Ghidra at work with ppc.
You'll want to get familiar with the SLEIGH and PCODE documentation, which can be found in the ghidra install directory GhidraDocs/languages/index.html. If you're already comfortable with an instruction set, pick one and read along the SLEIGH specification using the reference ISA.
SLEIGH is not complicated and once you get the idea behind the approach you need to take, it becomes easier. I really recommend learning by example. Of all the supported processors, there is a good change most features and instructions have been implemented already.
Once you kind of get familiar with SLEIGH and PCODE , I started with reading through the ISA manual to get a decent overview of things and how they related to the SLEIGH terminology.
I would say the biggest thing to worry about at this point is noticing how the instructions are formatted and mapped (what sort of bit patterns there are). This would be a simple as the first two bits are 11 for 32-bit instructions or 01 for 16-bit instructions or maybe each type of format has specific locations for immediates and registers.
Another concern might be what parts of the instructions are laid out in some logical way that would simplify the SLEIGH (using tables). An easy example here is condition codes. For example you may not need separate instructions for beq, bgt, blt, bne, etc... You can create one branch instruction that uses a table of all the condition codes. Another example might be addressing modes could be put into a table. You might have an address that is a 32-bit immediate, a preload register value, an offset plus a register, an offset plus a register indexed by another register. Instead of having instructions for all of these, you might only need one, paired with a table that exports each of these cases.
Lastly scrape from available sources if possible. There are probably already a lot of resources out there that have done some sort of programmatic analysis or instrumentation of the ISA. Obvious examples here would be binutils, QEMU, or other disassemblers or emulators. Your goal here would be getting a decent layout for your instruction constructors: table header, display section, bit pattern, disassembly action, and semantics action. The first three are basically the minimum to get the listing window working and the latter two the analysis functionality and decompiler.
I took this approach of scripting out the first three sections for my Tricore, RISC-V, and 80960 processor modules(I included those scripts with the processors in my PRs). I did it quick and ugly just to get something resembling what I had in mind. It took a significant amount of copy/paste/regex replace to get into a betteworking state or you might notice how to add better tables and it’s already too late to script.
Once the listing window was semi-working and I was semi-happy with the bit pattern breakdown and variable naming (tokens, registers, etc...) I would begin the process of implementing the instructions in SLEIGH. No real words of wisdom here, I cannot reiterate learn and do by example enough here. This can get super tedious and monotonous so just break it down to reasonable goals or a break down of instruction types (ie arithmetic vs load/store vs state) to work on just to get some feeling of progress.
Once you get far enough into your processor, you will need to implement the other files needed for the processor specification. Every processor will have: slaspec, pspec, cspec, and a ldefs files. Optionally you can implement opinion, patterns, and idx (maybe others vOv).
The slaspec is your SLEIGH, most processors; however, will implement the SLEIGH in sinc files and include the needed sinc in several slapsec that might also define preprocessor macros (ie endianness, register size, floating point size). The cspec or compiler specification defines things like register usage for calling conventions and how data is organized (basic type sizes and alignment) The pspec or processor specification defines context values or named/memory-mapped registers. See github issue #472 for building the documentation for these. The ldefs is the breakdown of the processors that are then listed when selecting a processor when loading a binary.
idx is the page for each instruction in a given ISA manual PDF. The PDF are not distributed with ghidra, but these files include the PDF filename. This allows a user to right-clicking an instruction and easily get to the instruction documentation by choosing Processor Manual.... opinion file uses binary format information to select specific variants found in the ldefs (PE, ELF, COFF, etc... have processor independent fields that can be parsed). patterns file can be used to help Ghidra determine interesting points of disassembly such when a function ends and a new begins to help improve the amount of disassembly generated during auto-analysis.
Lastly in regard to SLEIGH, NSA has created an extension, SleighDevTools, that provides a base source code along with j-unit testing that uses the built-in emulator to test your implementation. If possible get a cross compiler for your platform and build this source, this will probably result in an ELF. If you get to the point in your development that this ELF can be loaded into Ghidra without much issue, you can make use of this feature.
The SLEIGH can also be augmented by Java, making real use of Ghidra as a suite. Additional analysis can be added for EABI specifics (tracking gp/t9 in MIPS across your program) or executable formats (architecture specific relocations, special symbols, etc...). I have not done too much here yet, mostly limited to implementing processor specific ELF relocations.
think that's a good overview.

Collection of pentesting tools by BrainfuckSec

Anti Forensics Tools

• AudioStego - Audio file steganography. Hides files or text inside audio files and retrieve them automatically
• dban - Hard Drive Eraser & Data Clearing Utility
• OpenStego - The free steganography solution
• srm - srm (secure rm) is a command-line program to delete files securely
• Steghide - Steganography program that is able to hide data in various kinds of image- and audio-files

Exploitation Tools

• Auto-Root-Exploit - Find exploits on Linux Kernel
• AutoSploit - Automated Mass Exploiter
• beef - The Browser Exploitation Framework Project
• BeeRoot - Find a way to escalate our privilege
• Autobuf - Buffer Overflow Exploit Tool
• CrackMapExec - A swiss army knife for pentesting networks
• DccwBypassUAC - Windows 8.1 and 10 UAC bypass abusing WinSxS in "dccw.exe"
• Invoke-PSImage - Embeds a PowerShell script in the pixels of a PNG file
• KeeFarce - Extracts passwords from a KeePass 2.x database, directly from memory
• koadic - C3 COM Command & Control
• meterssh - Inject shellcode into memory and tunnel port over SSH
• PowerShell-Suite - Collection of PowerShell utilities
• UACME - Defeating Windows User Account Control
• WinPwnage - Elevate, UAC bypass, privilege escalation, dll hijack techniques

Forensics Tools

• Autopsy - Digital forensics platform
• bulk_extractor - Scans a disk image, a file, or a directory of files
• Scalpel - Open source data carving too
• volatility - Volatile memory extraction utility framework
• binwalk - A fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images
• Catfish - Versatile file searching tool
• dc3dd - A patched version of GNU dd with added features for computer forensics
• DumpsterDiver - Analyze big volumes of various file types in search of hardcoded secrets
• frida-extract - Based RunPE extraction tool
• Image-ExifTool - Read, Write and Edit Exif metadata
• PdfParser - A standalone PHP library, provides various tools to extract data from a PDF file
• peepdf - Powerful Python tool to analyze PDF documents
• whatsapp-viewer - Small tool to display chats from the Android msgstore.db database

Information Gathering

• bing-ip2hosts - Enumerate hostnames from Bing
• datasploit - OSINT Framework to perform various recon techniques
• dnsenum - Perl script that enumerates DNS information
• dnsmap - Subdomain brute-forcing
• dnsrecon - DNS Enumeration Script
• dork-cli - Command-line Google dork tool
• dorks - Google hack database automation tool
• pagodo - Automate Google Hacking Database scraping
• faraday - Collaborative Penetration Test and Vulnerability Management Platform
• fierce - DNS Analysis perl script
• FOCA - Fingerprinting Organizations with Collected Archives
• hping - Network tool able to send custom TCP/IP packets
• image-match - Quickly search over billions of images
• knock - Subdomain Scan
• masscan - Fast TCP port scanner
• metagoofil - Document and metadata reconnaissance (updated version)
• onioff - An onion url inspector for inspecting deep web links
• OSINT-SPY - Performs OSINT scan on email/domain/ip_address/organization
• SimplyEmail - Email recon made fast and easy
• sniff-paste - Pastebin OSINT Harvester
• spiderfoot - OSINT collection and reconnaissance tool
• surfraw - a fast UNIX command line interface to a variety of popular WWW search engines
• TekDefense-Automater - IP URL and MD5 OSINT Analysis
• theHarvester - E-mails, subdomains and names Harvester - OSINT
• trape - People tracker on the Internet: OSINT analysis and research tool by Jose Pino
• WhatWeb - Web scanner
• xray - A tool for recon, mapping and OSINT gathering from public networks
• zmap - Fast single packet network scanner

Keyloggers

• BeeLogger - Generate Gmail Emailing Keyloggers to Windows
• Blackcat-Keylogger - Blackcat Keylogger is 100% invisible keylogger
• Keylogger - A simple keylogger for Windows, Linux and Mac
• Radium-Keylogger - Python keylogger with multiple features

Maintaining Access

• EggShell - iOS/macOS/Linux Remote Administration Tool
• EvilOSX - An evil RAT (Remote Administration Tool) for macOS / OS X
• Metasploit - The world’s most used penetration testing framework
• Parat - Python based Remote Administration Tool(RAT)
• pupy - An opensource, cross-platform, multi function RAT
• QuasarRAT - Remote Administration Tool for Windows
• tgcd - TCP/IP Gender Changer Daemon
• TheFatRat - An Easy tool to Generate Backdoor for bypass AV
• Veil - Tool designed to generate metasploit payloads that bypass common anti-virus solutions
• WMImplant - PowerShell based tool that is designed to act like a RAT
• AhMyth - Android RAT

Password Attacks

• BEWGor - Bull's Eye Wordlist Generator
• bruteforce-wallet - Try to find the password of an encrypted Peercoin (or Bitcoin, Litecoin, etc...) wallet file
• chntpw - Utility to reset the password on Windows
• chromepass - View passwords stored by Google Chrome Web browser
• crowbar - Brute forcing tool
• cupp - Common User Passwords Profiler
• hashcat - Advanced Password Recovery
• John the Ripper - A fast password cracker
• LaZagne - Credentials recovery project
• mimikatz - A little tool to play with Windows security
• passwordfox - Extract the user names/passwords stored in Firefox
• fcrackzip - A braindead program for cracking encrypted ZIP archives
• SSH-Brute-Forcer - A Simple Multi-Threaded SSH Brute Forcer
• thc-hydra - Parallelized login cracker which supports numerous protocols to attack
• WCE - Windows Credentials Editor

Reverse Engineering

• Explorer Suite - A freeware suite of tools including a PE editor called CFF Explorer and a process viewer
• IDA - Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger
• OllyDBG - A 32-bit assembler level analysing debugger for Microsoft Windows
• radare - unix-like reverse engineering framework and commandline tools
• Resource Hacker - A freeware resource compiler & decompiler for Windows applications
• apktool - A tool for reverse engineering Android apk files
• smali - smali/baksmali is an assembledisassembler for the dex format used by dalvik, Android's Java VM implementation

Sniffing Spoofing

• Ettercap - A comprehensive suite for man in the middle attacks
• bettercap - The Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and MITM attacks
• macchanger - Utility that makes the manipulation of MAC addresses of network interfaces easier
• mitmproxy - Free and open source interactive HTTPS proxy
• mkcert - Make locally trusted development certificates with any names you'd like
• sslstrip - SSL/TLS man-in-the-middle attack tool
• Wireshark - The world’s foremost and widely-used network protocol analyzer
• moloch - An open source, large scale, full packet capturing, indexing, and database system.

Social Engineering

• evilginx2 - Standalone man-in-the-middle attack framework
• Gophish - Open-Source Phishing Framework
• HiidenEye - Modern phishing tool with advanced functionality
• king-phisher - Phishing Campaign Toolkit
• ReelPhish - A Real-Time Two-Factor Phishing Tool
• social-engineer-toolkit - Open-source penetration testing framework designed for social engineering
• SocialFish - An Advanced Phishing Tool

Vulnerability Analysis

• Am-I-affected-by-Meltdown - Meltdown Exploit - Proof-of-concept
• CMSmap - python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs
• InSpectre - Examine Windows for Meltdown and Spectre attack
• linux-exploit-suggester - Linux privilege escalation auditing tool
• Lynis - Auditing tool for Unix-based systems
• Nmap - The Network Mapper
• sqlmap - Automatic SQL injection and database takeover tool
• T50 - The fastest network packet injector
• unix-privesc-check - Shell script to check for simple privilege escalation vectors on Unix systems
• Wapiti - The web-application vulnerability scanner
• wesng - Windows Exploit Suggester - Next Generation
• Mobile Security Framework (MobSF) - Mobile Security Framework is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing framework

Web Applications

• Burp Suite - Web vulnerability scanner
• CLOUDKiLL3R - Bypasses Cloudflare protection service via TOR Browser using crimeflare !
• fuzzdb - Dictionary of attack patterns and primitives
• Nikto - Web server scanner
• owtf - Offensive Web Testing Framework (OWTF)
• wafw00f - Fingerprint Web Application Firewall (WAF)
• w3af - Web Application Attack and Audit Framework
• Wfuzz - Web application fuzzer
• WhatWaf - Detect and bypass web application firewalls and protection systems
• WPscan - WordPress vulnerability scanner

Web Shells

• weevely3 - Weaponized web shell
• b374k - PHP Webshell with handy features
• Miyachung - PHP BackConnect Shell
• wso-2.8-web-shell - Automatically exported from code.google.com/p/wso-web-shell-2-8

Wireless Attacks

• Aircrack-ng - A complete suite of tools to assess WiFi network security
• airgeddon - Multi-use bash script for Linux systems to audit wireless networks
• Bluelog - A highly configurable Linux Bluetooth scanner
• BoopSuite - A Suite of Tools written in Python for wireless auditing
• fluxion - Fluxion is a remake of linset by vk496 with less bugs and enhanced functionality
• infernal-twin - This is automated wireless hacking tool
• kismet - An 802.11 layer2 wireless network detector, sniffer, and intrusion detection system
• krackattacks-scripts - WPA2 Krack Attack Scripts
• KRACK Detector - Detect and prevent KRACK attacks in your network
• Pixiewps - An offline Wi-Fi Protected Setup brute-force utility
• RouterSploit - Exploitation Framework for Embedded Devices
• wifi-arsenal - Resources for WiFi Pentesting
• Wifiphisher - The Rogue Access Point Framework
• WiFi-Pumpkin - Framework for Rogue Wi-Fi Access Point Attack

NOTE: Initially available modified Odysseus bundles for downgrading with xerub's iBoot exploit are for iOS 6.1.4, 7.0.2, 7.1.2, 8.1.3, 8.3, 9.0, 9.1, and iOS 9.3.4. More bundles will be added in the future, and bundles for iOS betas will only be made on request, and remember, requests to make iOS 10 bundles won't be accepted, because iOS 10 is much more complicated, and iOS 10.3 removes AMFI boot-arguments. OK, let's get started.
First, these are the requirements to up/downgrade with xerub's iBoot exploit:

• A jailbroken iPhone 5 on iOS 7.0.x, and iOS 7.0.x SHSH blobs. Dumped or OTA blobs work. You could try on other iOS 7 versions, on iOS 6, or on other devices, but do it on your own risk as I haven't tested the exploit on other devices. If you happen to get the exploit working on other devices, please let me know and I'll happily make bundles for more devices.
  
• xpwntool from Odysseus
  
• My modified Odysseus bundles from here
  
• idevicererestore, you can use idevicerestore from Odysseus if you wish to preserve the currently installed baseband.
  
• Odysseus
  
• irecovery, either from Odysseus or libirecovery
  
• OpenSSH on the device
  
• iBoot32Patcher to patch the iBEC for booting the device
  

Now the actual tutorial begins.
Building the ipsw(s)

1. Download the ipsw you want to install and dump the iOS 7.0.4 blobs using this tutorial. Skip the blob dumping step if you already have valid blobs.
   
2. Download the modified Odysseus bundles I made from here, and copy them to the FirmwareBundles directory, and on the Terminal app, type cd /Odysseus/macos.
   
3. Build the ipsw by typing ./ipsw /path/to/ipsw /path/to/output/ -bbupdate. Note: Do NOT add the -bbupdate flag if you want to preserve the baseband, if you want to save the baseband, install OpenSSH on the device, and on the terminal app, type ./sshtool -s baseband.tar -p 22 device_IP. The default password is alpine. To pack the baseband when building the ipsw, type ./ipsw /path/to/ipsw /path/to/output -memory baseband.tar. Only use the -memory flag if your computer has at least 4GBs or RAM.
   
4. This step is very important, as the device will enter a DFU loop if you don't do this, and you'll have to restore, open the ipsw with any software that can edit zip files and replace the LLB and iBoot in Firmware/all_flash with LLB/iBoot for iOS 7.0.4 or with LLB/iBoot that matches your blobs. Note that unzipping the ipsw and zipping it again doesn't work or else idevicererestore will fail to extract the ipsw.
   

Extracting iBSS and using kloader to boot pwned iBSS
Note: This part is only needed if you are restoring for the first time (if you're already on a version installed with this method, just upload a patched, unpacked iBSS and upload an iOS 9.x iBEC patched with these .patch files. Don't upload an iBEC from Odysseus however, because when idevicererestore uploads another iBEC, the device will hang upon loading another iBEC, and the device will need to be hard rebooted).

1. Unzip the ipsw by renaming the extension to .zip, and extract the ipsw. Then, unpack iBSS by typing xpwntool /path/to/iBSS /path/to/output, but do not specify any keys, since it is already decrypted. Then copy kloader and the iBSS to the root directory of the device.
   
2. SSH into the device by typing ssh root@device_ip. If it says "Are you sure you want to continue connecting?", type yes and the root password. Next, type chmod +x /kloader. Then type /kloader /iBSS. If it worked, then iTunes would say "iTunes has detected an iPhone in recovery mode", but the screen on the device would be black with no logos and the backlight should be off. Alternatively, you can use kDFUApp to boot a pwned iBSS.
   

Starting the restore

1. Once you have verified that you replaced LLB/iBoot with LLB/iBoot from iOS 7.0.4 or with LLB/iBoot that matches your blobs and you have SHSH blobs for iOS 7, download idevicererestore and create a folder named "shsh", copy the iOS 7 blob, and rename the blob to be, for example, if you are trying to install iOS 6.1.4, rename the blob to be ECID_here-iPhone5,2-6.1.4-10B350.shsh.
   
2. Now type idevicererestore -r /path/to/ipsw. When it asks "What type of blobs are you using?", type e, since we want to erase the device.
   
3. Wait for the device to restore, if the restore fails when flashing LLB, this means you didn't replace LLB and iBoot before, and you have to restore to iOS 10.3.3, replace LLB and iBoot in the ipsw, kload a patched iBSS, but you'll have to use kloader that works with hgsp4. You can download hgsp4 version of kloader from here.
   

Installing the iBoot payload

1. When the restore finishes or fails, the device won't reboot on its own, because reboot is renamed to reboot_bak. Now on the Terminal app, type iproxy 2222 22, and open a new window on Terminal. Then, type ssh -p 2222 [email protected], and the root password is alpine. First, type mount -t hfs /dev/disk0s1s2 /mnt2 to mount the data partition. Now type gptfdisk /dev/rdisk0s1, type i and 2, and get the unique GUID for the data partition. Type d and 2 to delete the data partition. Don't worry, it doesn't save the changes right away. Type n and 2, and hit Enter once, Next, subtract the last sector by 128 sectors, or 524288 bytes to make room for the partition that serves as the exploit. Type c and 2 and rename the second partition to Data. Now type x, a, 2, 48, 49. Then type c, 2, and copy and paste the unique GUID from before. This is very important, if you don't, the data partition will be corrupted. Type s, 4 to resize the partition table. Type m, n, 3, hit Enter once, and this time subtract 3 sectors to create the third partition for the exploit, or else gptfdisk will fail to save the partition table. You don't need to name the third partition. Type i and 2 once again to get the size of the data partition. Multiply the size in sectors by 4096 and you'll get the size of data partition in bytes. Hit w and type y to save the changes to the disk. Next, type hfs_resize /mnt2 , because the data partition is actually now smaller. To write the exploit to the third partition, first type nvram boot-partition=2, then type newfs_hfs /dev/disk0s1s3 && dd if=/ramdiskF.dmg of=/dev/rdisk0s1s3 bs=512k count=1, and also nvram boot-ramdisk="/a/b/c/d/e/f/g/h/i/j/k/l/m/disk.dmg" to set the boot-ramdisk variable if up/downgrading for the first time. Then reboot the device by typing reboot_bak.

Booting

1. When the device turns on, it'll show the recovery logo. Then, upload an unpacked iBSS because the load address is set to 0x8400000 by typing irecovery -f /path/to/iBSS. Then type irecovery -c go. If it hangs here, hard reset the device and try again. It is fine if the screen becomes glitchy after typing go. If it succeeded, iTunes will say "iTunes has detected an iPhone in recovery mode", and then patch an iBEC from the original ipsw with iBoot32Patcher and repack it with xpwntool by typing:

xpwntool /path/to/original/iBEC /path/to/decrypted/iBEC -iv -k
iBoot32Patcher /path/to/decrypted/iBEC /path/to/patched/iBEC -b "-v"
xpwntool /path/to/patched/iBEC /path/to/packed/iBEC -t /path/to/original/iBEC
The -b flag is optional, and is only needed if you want to verbose boot your device. Also, iOS 9 iBECs clear boot-partition variable upon loading, and on next reboot, you'll be forced to restore. I made some .patch files for iOS 9.x iBECs here, which includes the boot-partition patch and the iBoot32Patcher patch. That is only necessary when going to iOS 9, and for all other versions, you can just patch an iBEC with iBoot32Patcher like before, repack it into an img3 file, and upload it with irecovery.
Upload the patched iBEC twice to get the display working, and on the second time, type irecovery -c go. Finally, upload the devicetree and kernelcache with these commands. They can be encrypted or decrypted, since the AES engine is enabled:
irecovery -s
/upload applelogo
setpicture
bgcolor 0 0 0
/upload devicetree
devicetree
/upload kernelcache
bootx
Finally, set up the device, and you're done!
FAQ
Q: Do I need SHSH blobs to use this tutorial?
A: You just need iOS 7 SHSH blobs, no matter what version you're trying to install, since the LLB and iBoot is replaced with the ones from iOS 7.
Q: How do I do it on Windows?
A: You can, but with a few differences: First you need Odysseus for Windows, and if you want to preserve currently installed baseband, the -memory flag doesn't work, and you dump the baseband in the same way, but when bundling the baseband into the ipsw, you type ./ipsw /path/to/ipsw /path/to/output /path/to/baseband.tar. And second, you need Putty to SSH into the device, and bsdiff for Windows.
Q: Does this work on iOS 10.3.3? Or 8.4.1?
A: No, because the iBoot exploit was patched in iOS 8. You can use the exploit if you have iOS 7(.0.4).
Q: Does this work on 64 bit devices?
A: Hypothetically yes, but it would only work on iPhone 5s/iPad Air on iOS 7.x, and you'll have to heavily patch AppleSEPManager.kext so it can communicate with SEP.
Q: Is this untethered?
A: It could be untethered, but the iBoot payload will have to be modified in such that it patches the running iBoot so it loads kernel from partition 0 (partitions are indexed from 0), and also that it ignores boot-ramdisk variable.
Q: How do I jailbreak after up/downgrading?
A: You can. Just remember that pangu jailbreaks time out after a few minutes, so upload the iBSS, iBEC, etc. fast after reboot if jailbreaking with pangu.

Update

Now that I added iPhone 4 iOS 5.0-7.0.6 bundles, and improved iPhone5,2 bundles that include @dora_iOS's modified ramdiskF.dmg that is untethered, you're probably wondering how to use them. The procedure is mostly the same, except the block size on the iPhone 4 is 8192 bytes instead of 4096 bytes, typing reboot_bakwill now automatically set NVRAM variables and dd /ramdiskF.dmg to /dev/rdisk0s1s3 automatically, however you still have to partition the device manually, and you need to patch the iBoot used for booting manually. To patch an iBoot so it can be used to boot an iOS used for booting:

Pre-iOS 9

Requirements

• xpwntool
• iBoot32Patcher
• A disassembler (I use IDA Pro)
• A hex editor
• image3maker from here. You can use image3maker from RestoreTools.pkg.

1. Decrypt the iBoot using xpwntool:

xpwntool /path/to/original/iBoot /path/to/decrypted/iBoot -iv -k

1. Patch it using iBoot32Patcher:

iBoot32Patcher /path/to/decrypted/iBoot /path/to/patched/iBoot -b "-v"
The "-b "-v" flag is only needed if you want verbose boot.

1. Open the patched iBoot in the disassembler you use, like IDA Pro in my case, change the processor type to ARM Little-endian and rebase the program by going to Edit > Segments > Rebase program and set the value to 0xBFF00000 in the case of the iPhone5,2 or 0x5FF00000 for iPhone3,1. Then go to Edit > Select all and type "C" to convert to code and click "Analyze".
   
2. Search for "boot-partition" and check "Search for all occurrences". Click on the first hit and then click on the first BL. Go to Edit > Patch program > Change byte..., write down the original value. Now you can close the disassembler.
   
3. Open the same patched iBoot using your favorite hex editor and search for the original value from before and replace the first 4 bytes with 00 20 00 20. Then save the patched iBoot.
   
4. Re-pack the patched iBoot into a img3 container with this command:
   

image3maker -t ibec -f /path/to/patched/iBoot -o iBEC
Important: The img3 tag must be ibec because iBoot will not load the patched iBoot if the img3 tag is ibot, and the patched iBoot must be named iBEC.

1. Finally, copy the patched iBoot to the root directory of /dev/disk0s1s1 by typing mount -t hfs /dev/disk0s1s1 /mnt1 on the device after partitioning using gptfdisk but before rebooting, and use scp to copy the patched iBoot.

iOS 9+

Requirements
Same as before, but a disassembler isn't needed.
Since iOS 9+ bootloaders clear boot-partition and ignore boot-ramdisk the patches are different and are more simple.

1. Decrypt with xpwntool and patch with iBoot32Patcher the same way as before.
   
2. Open the patched iBoot using your favorite hex editor and search for boot-partition and 0. Write down the address of boot-partition and 0. Now reverse the byte order of both addresses (e.g. if the boot-partition address was 0x396CE then it becomes 0xCE96), and search for the boot-partition address (it is 0xB5C and 0x1400 on iOS 9.x), and replace with the address of 0.
   
3. Re-pack and copy the patched iBoot to the device like before.
   

In either methods to patch iBoot, once you have rebooted the device, the apple logo should flash twice and boot to iOS, untethered!
Edit: it turns out that it works on iPhone5,1 as well as on all iOS 7.0.x firmwares!

Hi Jailbreak! GeoSn0w here!
Spoiler alert! Long tutorial, suitable for beginners!
A couple days ago I've decided to try to complete the Xylex challenge created by developer Billy Ellis. Some of you know Billy already, but for those who don't I'll have some links down below.
Basically, Xylex is an application that is made purposefully vulnerable by Billy as part of his Exploit-challenges project on GitHub. As I liked the idea of trying some ROP, I've decided to complete the challenge and while I am at it, maybe to also write a tutorial. Keep in mind, this is going to be a long tutorial, so reload your patience cartridges and let's do it. Also, do keep in mind that Billy made a very good video on it too, will have a link down below if you're a visual learner.
Enough Introduction, let's sploit
Okay, so we know that Xylex is an armv7 Mach-O binary, this means we can't play with it in macOS terminal, we have to side-load it to a Jailbroken device. I think any device would do. I have tried on aarch64 as well and it works.
You can download the armv7 compiled Xylex from Billy's Github. I've used iFunBox to load it into DCIM and from there I've moved it with Filza to a Development folder somewhere in /va
Okay so when we run the application for the first time, via SSH, of course, as we want to exploit it remotely from the PC, we can see an ASCII welcome screen.
As you can see from the screenshot, the application asks for authentication (username only), so I thought I should try feeding the app a couple "AAAAA" to see if we can trigger a crash and therefore a buffer overflow, but the application is apparently well made and it is not vulnerable on that part as can be seen from the next screenshot. The application responds with the fact that there is no user with that name and quits normally.
Okay, so we need another approach. Time to fire up Hopper (Or IDA... Or Radare...).
Okay, so we've loaded the Mach-O into Hopper Disassembler, and we've located the _main function. In this screenshot of Hopper you can see that we've located the ASCII welcome message and looking a bit further down we can easily spot the username being hardcoded into the app and that being guest as can be seen from here.
Let's test the username we've found hardcoded in the app. Yep, it does indeed work and sends us to a new screen.
Okay, but how can we exploit this application so that we can change its control flow in a way that it would facilitate us to do things that were not intended to be done? Well, since the username part seem to not be vulnerable, let's try further with something else. You can see that after we've managed to log in, the app gives 3 possible operations:

• Display system version, which in fact displays Xylex version, not very useful for what we need as it does not accept any kind of user inputs.
• Open file (now we're talking!)
• Exit (clearly not useful for us)

Okay, so we have a feature that allows us to open files inside Xylex, well, let's try the same fuzzing method, only inside a file. In order to craft our file we can use the following command in terminal:

printf "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" > testdummy 

That would create a a new file called testdummy in the current directory containing a bunch of "A". Let's see what effect it has on Xylex once we load it on.
Sweeeeet! As you can see the application has returned "Segmentation Failed: 11" which means it has crashed, so it is definitely vulnerable! We've got the vulnerability, now how we can exploit it? Well, let's first find the cause of the crash. To do that, we're going to analyze the crashlog.
The crashlogs can be found on the following path /vamobile/Library/Logs/CrashReporte and as you can see, with ls command we can see all the crash logs, including Xylex. We're going to select the most recent. The date is in the name of the log as can be seen here
Let's cat the last log. As you can see, we've managed to overwrite the PC (Program counter) register with 0x41414140 which is the hex for "AAAAA". So we basically got control over the program's flow, but where? The PC holds the address to which the program flow will be redirected next, so if we can possibly put our own address there, we can execute whatever we want, but what we want to execute? Let's go ahead back to Hopper and see if we can find anything useful, but before we do that, we must see WHERE in that huge chunk of "A"s is the PC being overwritten? We need to know that either way, there's nothing much we can do with this vuln. To do that, let's change our testdummy file from "AAAAA" to a pattern like "AAAAABBBBBCCCCCDDDDD" so that we can detect in which group the PC gets overwritten. So the command would look like:

printf "AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHKKKKLLLLMMMM" > testdummy 

Alright, so we've managed to produce another "Segmentation Fault:11" with the new file, now let's analyze the crash log an see which pair caused the overwrite on PC.
As you can see from the crashlog, PC is now 0x46464646, which happens to be "F" in hex, so we know that the PC register got overwritten after E. There is where we are going to place our good stuff, but what is this good stuff? Time for Hooper.
As you can see, in Hopper we can easily see the system() function being referenced, and Billy was kind enough to leave an "uname -a" in the program at address 0xc040 ;) So theoretically we can pwn the program so that once our shellcode is loaded via the file opening function, we redirect the program to a specific address and possibly execute uname -a which will give us details about the iDevice (the Kernel version and so on). This was never intended to be possible, so how the hell we can do that?
Billy has left an Easter egg for us in the program, apparently. See, there is a _gadget method at 0xbb74 that literally contains

 pop {r0, pc} 

A better ROP gadget wouldn't be possible for this program. If we can overwrite the PC (program counter) and the r0 (general purpose register) to contain the good stuff we need, we will be able to run our command and hijack the program!
Okay, so we have all we need, now we need to craft our shellcode.
We're going to use the chars from A to E as and then we're going to place the good stuff. Let's collect addresses ;)
We know that "uname -a" is located at address 0xc040 and if you look closely, at 0xbb98, we have a branch with link (bl) instruction that looks like this:

0000bb98 bl imp___symbolstub1__system 

Here we go with our system() call!
Okay, so we have the gadget and the good stuff, we know where PC register gets overwritten, let's craft our shellcode:
So we have the following important addresses collected:

• 0xbb74 - The _gadget we're going to use!
• 0xbb98 - The system() call!
• 0xc040 - The "uname -a" command!

At first we will copy the A -> E from the dummy file:

AAAABBBBCCCCDDDDEEEE 

And now we add the addresses we've collected. Now, because the byte sex is Little Endian, we have to put it backwards! like this:

AAAABBBBCCCCDDDDEEEE\x74\xbb\x00\x00\x40\xc0\x00\x00\x98\xbb\x00\x00 

So we have the addresses written in Little Endian, and we have the gadget, the uname command and finally the system() call.
Let's write this into a new exploit file!
Okay, now let's feed the exploit file to the program and see what happens! AND HERE IS THE RESULT! As you can see, we've pwned the program! It did run "uname -a", printed out the output of the command which is represented by details about the kernel, and the Seg. Faulted and quit :)
That's it! We've pwned the program, controlled the flow of it, ran an arbitrary command and got to where we wanted!
Thanks a lot of reading, I really hope you've enjoyed this tutorial, took a while to put together, and I wanna thank Billy Ellis for the amazing Xylex program he has created. Billy has also made a video with the exploitation (exactly what we did) of Xylex.
Other Resources

• A video tutorial on this by Billy Ellis
• Follow Billy on Twitter
• You can also check my iOS Channel if you want
• Or follow me on twitter if you wish

I hope this tutorial helps! Note that I am a beginner on iOS Exploitation myself, so I am teaching you as I learn. I hope I made things clear.
~GeoSn0w

So, as has been discussed before ([1] [2] and in plenty of other threads), Oculus Runtime 1.3 removed the IPD setting found in beta versions, since the CV1 hardware has a slider to physically adjust IAD (mechanical lens separation), and the software can now assume that IPD = IAD. That's nice, but leaves DK2 users like me stuck with the default IPD of 64mm, other than those with IAD mods. I thought I'd do a bit of reverse engineering to see if I could get the setting back.
[TL;DR: There is a fix below, but it's pretty ugly (involving code patching), so you might want to just wait and hope for an official fix instead.]
The three methods I've seen suggested for adjusting IPD are:

1. DK2LensSeparationOverrride in NetServer.cfg. As described in the above links, this changes the IAD rather than the IPD and is not what you want. As I found out, it currently doesn't even do that properly.
   
2. Changing your height in the settings supposedly changes IPD as a side effect. I tested this (with the below methods). It doesn't. If I had to guess, I'd say that having the camera higher than it should be makes things look smaller and thus partially compensates for the IPD being too low, but I could be wrong.
   
3. According to an Oculus employee's post in this bug report, the old setting in ProfileDB.json is supposed to still work, if you have it left over from an earlier runtime installation or insert it manually. Hopefully this will become true before long, so the hacky stuff described below isn't necessary. For now, it doesn't, which I'm pretty sure is a bug...
   

First of all, the way the "TaggedData" in ProfileDB.json works is that the "vals" only apply if all of the "tags" match the current configuration. In my old 0.x configuration, tags specified include the user name (which is also no longer changeable in the UI) and my DK2's serial number, and if they don't match, the IPD setting will be ignored anyway. I wanted to figure out the minimum configuration file required to specify the setting properly, so I deleted the whole Oculus directory (under C:\Users\X\AppData\Local) and let the software recreate it. ProfileDB came back after I ran the setup to set my height, which you can see as the first two "vals" below; I then added EyeToNoseDist (which is each eye's half-IPD in meters - 0.0001 is just for testing). This is what should work in the future:

{ "Oculus Profile Version": 2, "Users": [], "TaggedData": [{ "tags": [{ "Product": "RiftDK2" }], "vals": { "FloorLevelCenteredFromWorld": [0, -0.01286152, 0, 0.9999173, -0.02157612, 1.675719, 0.2934233], "EyeLevelCenteredFromWorld": [0, -0.01286152, 0, 0.9999173, -0.02157612, 0.4001277, 0.2934233], "EyeToNoseDist": [0.0001, 0.0001] } }] } 

Careful: The file needs to be valid JSON; if it isn't, the setting will be "silently" ignored. (There may be an error in a log file somewhere I haven't seen, but you won't get an alert or anything.) In particular, this means there must not be any trailing commas, e.g. at the end of the line containing "EyeToNoseDist". You can check validity using JSONLint or whatever.
But anyway, that's not good enough. You can verify that by setting it to near 0 as above and checking that things don't look huge, or more directly by using this quick tool I just wrote. (source)
So why do I think it'll work in the future? As I said, reverse engineering - of the LibOVRRT library (in C:\Program Files (x86)\Oculus\Support\oculus-runtime). If you want to follow along, open LibOVRRT64_1.dll (or 32) in IDA or your disassembler of choice - in the version I'm looking at, with SHA-1 hashes 5E2242E9FA9B1B6982153654C13C3DA062A00BBD and A40A08B9E24EDF8C19AB7A63AA224F6E65D4ADA2 respectively. Find the function(s) referring to the strings "IAD changed to %.1fmm\n" and "IAD data invalid, setting to default\n". (In my copy, they're in separate functions in the 32-bit runtime but were both inlined into the caller in the 64-bit runtime. In the 32-bit case, look at the caller.) Then look at the two functions that call that one (one of which calls it twice). In each case, two fields which initially contain the EyeToNoseDist for each eye (from ProfileDB) are set to half the calculated IAD (look for the multiplication by 0.5). You can verify this using a debugger - when that code is run, the previous value of the field should be what you put in ProfileDB, and it should be overwritten with 0.032.
Then where does that IAD come from? Would setting DK2LensSeparationOverrride change it; is it true that it's wrong to set because it also affects other aspects of distortion? Is there another setting that can change it? If not, I can at least patch the library to nop out the above-mentioned code; am I sure that doesn't somehow change the IAD as well?
Well... I did a bit more RE than necessary, but the most useful result is a way to check, at the point where the library is actually calculating the distortion parameters, what it thinks both the IPD and IAD are. The part of the library containing this actually had its source published in older versions of the SDK; it's changed since, but little enough that the old source is still useful as a reference.
https://start-x.github.io/relatorio/doxygen/OVR__Stereo_8cpp_source.html#l01364
In CalculateFovFromHmdInfo, we can see:

offsetToRightInMeters = hmd.EyeRight.NoseToPupilInMeters - 0.5f * hmd.LensSeparationInMeters; 

NoseToPupilInMeters is half IPD, and LensSeparationInMeters is IAD. On the CV1, offsetToRightInMeters should be 0, but I don't have one so I can't test this. Anyway, we can identify this function in LibOVRRT by looking for the magic constant 0.006f found some lines below that. 0.006 as an IEEE 32-bit float is 3bc49ba6 (be careful with endianness), and there is only one occurrence of that constant and one function that uses it. The nearby subss is what we want, and again, you can use a debugger to check the two values.
Here's why I said DK2LensSeparationOverrride doesn't even do its intended job properly: if I set it and break at that point, it affects LensSeparationInMeters, but not NoseToPupilInMeters, which is stuck at 0.032 no matter what. As far as I can tell, if you modded your DK2 and set that DK2LensSeparationOverrride, at least it won't give you a headache due to incorrect IAD, but scale will still be off due to incorrect IPD. Also a bug, I think. This despite the fact that IPD is set to IAD in the previously mentioned bit of code - I think that IAD is only affected by the physical slider (so this should all the okay with the CV1).
I didn't find any other relevant-looking settings in either LibOVRRT or OVRServer, nor did I see any code path where LibOVRRT would not override the IPD with the so-called IAD; the fact that it reads it from ProfileDB only to overwrite it is why I think this is just a bug. For now, I figured I'd hex edit the LibOVRRT DLLs.
Which was much harder than it should be, because after I edited them, apps stopped working altogether. Not because I screwed up the patches - it turns out that LibOVR.lib (the shim statically linked into SDK client applications that searches for and loads LibOVRRT*.DLL) explicitly performs a code signing check on an explicit code signing check on the DLL, bailing out if there isn't a valid signature or the signer isn't Oculus. The source to this part is (still) published:
https://chromium.googlesource.com/experimental/chromium/src/+/bb68dcb38dd0875c74ece15bce07f18d907f40f6/third_party/libovLibOVSrc/OVR_CAPIShim.c
Since this check is copied into each client application, it's a bit difficult to work around. At this point I double-checked that I really cared - the bug might be fixed soon, and my IPD (although not my siblings') is almost exactly 64mm anyway! But I consider this kind of code fundamentally anti-user, so it pissed me off enough to come up with a workaround. Not the most elegant one, but the easiest one to write, at least... The library uses wintrust.dll to do the check, so I wrote a replacement DLL, which will be used instead if placed in the same directory as the EXE (of each SDK-using application). The DLL just loads the original wintrust but modifies the filename by adding "orig" after "ovrrt"; the unpatched OVRRT DLLs need to be present under such filenames. Oh, and although Windows normally prioritizes the EXE directory when searching for DLLs, since wintrust is a "KnownDll" (implicitly as a dependency of one of the ones named in the registry), Windows will only look in System32 for it unless it's listed as an exception.
(Incidentally, Revive, a neat project which appeared earlier today (after I wrote the first draft of this post), has the same problem. Currently its solution is arguably less elegant than this DLL thing, but maybe they'll come up with something better eventually and I'll be able to use that instead. They probably shouldn't copy this method because it would be easy for Oculus to break by updating the SDK, but there are plenty of more general ways to hook Windows applications without actually patching anything... I ought to add Windows support to my Substitute project.)
If you actually want to do this, here are the steps:

1. Close Oculus and stop OVRService in Task Manager -> Services (or else you won't be able to modify the DLLs).
   
2. Go to C:\Program Files (x86)\Oculus\Support\oculus-runtime and copy LibOVRRT64_1.dll and LibOVRRT32_1.dll to LibOVRRTorig64_1.dll and LibOVRRTorig32_1.dll, respectively.
   
3. Hex edit the files with the original names as follows:
   

For LibOVRRT64_1.dll, find:

• F3 0F 11 4C 24 30 F3 0F 11 4C 24 34
• F3 0F 11 47 10
• F3 0F 11 47 14

For LibOVRRT32_1.dll, find:

• F3 0F 11 85 60 FF FF FF F3 0F 11 85 64 FF FF FF
• F3 0F 11 47 10
• F3 0F 11 47 14

Each of these should only appear once. In each case, overwrite with 90 90 90 etc. (NOP).

1. Open regedit and go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager. Double-click the ExcludeFromKnownDlls item (on the right) and enter wintrust.dll. Ignore any message about empty strings.
   
2. Download https://a.qoid.us/wintrust-shim.zip (source code included) and copy the appropriate bitness of wintrust.dll into at least the following directories:
   

• C:\Program Files (x86)\Oculus\Support\oculus-overlays (64-bit)
• C:\Program Files (x86)\Oculus\Support\oculus-home (64-bit)

and the directory of the EXE files of whatever games you want to play.

1. Put something like what I have above in C:\Users\X\AppData\Local\Oculus\ProfileDB.json.
   
2. Reboot (needed for the registry thing to take effect).
   

Tested on Windows 10 x64 - I verified that setting the IPD to a tiny value made things look appropriately weird in Oculus Home and Windlands.