Purplera1n

Credit

geohot

OSX client: AriX, and westbaer.

Phase 1: Signature Grabber

• Blog Post: http://iphonejtag.blogspot.com/2009/06/usbdump-huh-how.html

Allows anyone with a 3GS right now to generate a file that contains:

• The Exclusive Chip ID tag for your device
• The new RSA signature for a 3.0GM iPhone 3GS iBSS that includes your ECID

This way, if Apple tries to pull a fast one and disallow downgrades to earlier versions, you have a backup that can be used to still allow you to boot an older iBSS.

Apple can not stop you from obtaining the ECID from your phone. But the webapp behind purplera1n calls the same Apple servers which are also used by iTunes for signing your personal iBSS ECID combination. So this will stop working, when

• a new firmware gets released and Apple does not allow downgrading any more or
• Apple finds a way to distinguish between requests from iTunes and purplera1n

As purplera1n uses a distributed application hosting it is not easy for Apple to filter it using IP addresses.

Phase 2: Jailbreak Tool (3.0)

• Web Site: http://purplera1n.com

One-Click, dead simple, jailbreak for the iPhone 3GS. Currently available for Windows, Mac, and Linux. It utilizes the iBoot Environment Variable Overflow.

How purplera1n Works

purplera1n is so simple, that it hides the complex work it's doing from the user. Figured I'd describe it step by step

• purplera1n sends the enter recovery commands using iTunesMobileDevice
• once in recovery(iBoot), it sends the IBoot Environment Variable Overflow exploit
• the exploit adds a "geohot" command to the phone which runs the payload
• the "geohot" command is run, control is now transferred from iboot to the payload
• the purplera1n client is done

Inside payload

• the payload restores the default environment variable ring buffer and saves the environment to nvram(sets auto-boot to true)
• it patches iBoot to load unsigned img3s and not care about the tags
• it loads the purplera1n picture(sent with payload)
• the nor patcher starts
• llb is decrypted, patched, and increased in size to 0x24200. this is the resident 0x24000 Segment Overflow exploit
• a little loader code is put @ 0x20000 in the LLB to load it and fix the stack
• iboot is decrypted, patched
• everything else is read as is
• nor is written back, nor patcher is done
• kernel is loaded, decrypted, and patched
• ramdisk is loaded(sent with payload) and moved to ramdisk region at 0x44000000, patched kernel is tacked on to the end
• patched kernel is booted
• control is now transferred from payload to ramdisk

Inside ramdisk

• launchd is run, all stuff happens here
• /dev/disk0s1 is mounted
• fstab and services are overwritten here to allow disk0s1 writes and afc2 respectively
• Freeze.app is transferred and Freeze.app loader has SUID bit set
• patched kernel is read from end of ramdisk block device and written to filesystem
• ramdisk is done, rebooting...

Reboots as jailbroken phone