The iPhone Wiki - User contributions [en]

TA Mobile

2010-04-14T22:45:41Z

.::Rizwan::.:

TA_Mobile [Admin of http://gsm.com.vn] A hardware technical person on the scene with the ability to read and modify the NOR flash directly. Dumped the 4.6 and 5.8 bootloaders.

Recovery Mode

2010-03-29T23:17:31Z

.::Rizwan::.:

Recovery Mode is a failsafe in [[iBoot]] that is used to reflash the device with a new OS, whether the currently installed one is somehow damaged or the device is undergoing an upgrade via [[iTunes]].

== Entering Recovery Mode ==
# Turn the device completely off and disconnect it from cable/dock.
# Hold down the home button.
# While holding down the home button connect to a computer with a cable (easiest) or dock.
# Keep holding down the home button until you see a connect-to-[[iTunes]] screen (on a QuickPwn'ed phone a drawing of Steve might be shown). You are now in recovery mode.

To escape Recovery Mode and power the phone off simply hold down power and home buttons for ten seconds.

Note: This method not works in iPhone 2G.

==Protocols==
*[[Recovery Mode 0x1280]] in pre-2.0
*[[Recovery Mode 0x1281]] in 2.0 and above

DFU Mode

2010-03-29T23:14:40Z

.::Rizwan::.:

'''DFU''' or '''Device Firmware Upgrade''' mode allows the [[S5L8900]], [[S5L8720]] and [[S5L8920]] to be restored from any state. It resides in the [[VROM]] and the [[S5L8900]] variant is vulnerable to the [[Pwnage 2.0]] exploit.

==Entering / Exitting DFU==
Software cannot be used to reliably enter DFU. Software methods rely on sending a signed WTF file which either calls the "real" DFU mode in bootrom or emulates it. Only ones calling the bootrom DFU is useful for exploiting bootrom (unpatchable) exploits and none exist that work for firmware 2.0 and later. If you are attempting to exploit the DFU, it is advisable to always use the hardware method. If your NOR firmware is corrupted then you have no other choice but to use the hardware method.

===How to Enter True Hardware DFU===
# Turn off the device.
# Hold Power and Home for 10 seconds
# Release Power, and keep holding Home
# Keep holding home for 4-8 seconds or until you are alerted by your computer that it has detected a device in DFU.

If the Restore Logo is present on the screen, you are in ''[[Recovery Mode]]'', '''not''' ''DFU''.

===Exiting DFU===
While in DFU, hold the power button for 30-60 seconds. When I have tested it, it has varied, so I don't know an exact length of time to hold it. Note that sometimes if you do this, when the device reboots from DFU, it will go into recovery mode for unknown reasons.

==Revisions==
===[[S5L8900]] (0x1222)===
This is the device ID in the [[N45ap|iPod Touch 1G]], the [[M68ap|iPhone]], and the [[N82ap|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].

===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===
This is the device ID in the [[N72ap|iPod Touch 2G]], the [[N88ap|iPhone 3GS]], and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].

[[Category:VROM]]

DFU Mode

2010-03-29T23:12:12Z

.::Rizwan::.:

'''DFU''' or '''Device Firmware Upgrade''' mode allows the [[S5L8900]], [[S5L8720]] and [[S5L8920]] to be restored from any state. It resides in the [[VROM]] and the [[S5L8900]] variant is vulnerable to the [[Pwnage 2.0]] exploit.

==Entering / Exitting DFU==
Software cannot be used to reliably enter DFU. Software methods rely on sending a signed WTF file which either calls the "real" DFU mode in bootrom or emulates it. Only ones calling the bootrom DFU is useful for exploiting bootrom (unpatchable) exploits and none exist that work for firmware 2.0 and later. If you are attempting to exploit the DFU, it is advisable to always use the hardware method. If your NOR firmware is corrupted, of course you have no recourse but to use the hardware method.

===How to Enter True Hardware DFU===
# Turn off the device.
# Hold Power and Home for 10 seconds
# Release Power, and keep holding Home
# Keep holding home for 4-8 seconds or until you are alerted by your computer that it has detected a device in DFU.

If the Restore Logo is present on the screen, you are in ''[[Recovery Mode]]'', '''not''' ''DFU''.

===Exiting DFU===
While in DFU, hold the power button for 30-60 seconds. When I have tested it, it has varied, so I don't know an exact length of time to hold it. Note that sometimes if you do this, when the device reboots from DFU, it will go into recovery mode for unknown reasons.

==Revisions==
===[[S5L8900]] (0x1222)===
This is the device ID in the [[N45ap|iPod Touch 1G]], the [[M68ap|iPhone]], and the [[N82ap|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].

===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===
This is the device ID in the [[N72ap|iPod Touch 2G]], the [[N88ap|iPhone 3GS]], and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].

[[Category:VROM]]

Baseband Bootrom Protocol

2010-03-29T22:34:49Z

.::Rizwan::.:

This is the protocol used to talk to the old, and probably the new baseband, at the bootrom level. The old bootrom didn't have a sig checking, the new one does.

==Protocol==
AT
0x30
2 byte length
n byte data
2 byte checksum
sends A5 on success, 5A on failure

===3G===
Correct me if I am wrong, but on the [[iPhone 3G]] bootrom, the "protocol" section is pretty much identical, besides the last line, which is instead this:
sends 01 on success, FF on failure

==Implementations==
[http://lpahome.com/geohot/gbootloader.rar bootrom.h in gbootloader]

[[Category:Protocols (Baseband)]]

Normal Mode

2010-03-26T23:36:26Z

.::Rizwan::.: /* Resources */

This is the protocol [[iTunes]] uses to talk to the booted iPhone. It uses usbmux to provide TCP like connectivity over a USB port using SSL. There is a pairing process iTunes uses to establish the secure channel. File transfer is provided by [[AFC]].

==Device IDs==
It appears that it uses different device IDs:
* [[iPhone]] - 0x1290
* [[iPod touch]] - 0x1291
* [[iPhone 3G]] - 0x1292
* [[iPod touch 2G]] - 0x1293
* [[iPhone 3GS]] - 0x1294
* [[iPod touch 3G]] - 0x1299

==Patch: Disable SSL==
There is a way to disable SSL encyption during iTunes communication on jailbroken devices by patching lockdownd binary:

:(#) Disable SSL protection
:(#) FW 2.1
:(#) binary /usr/libexec/lockdownd
:-0x1000
'''Offset''' 000112F8: 0C 30 98 E5 > 00 30 A0 E3 ; Conn.UseSSL = false

After applying the patch all packets between iPhone and iTunes become plain and clear. Musthave for R&D ppl.
==USBMux Protocol==

===Resources===
* [[MobileDevice Library]]
* [http://wikee.iphwn.org/usb:usbmux The dev team's page on the topic]
* [http://libimobiledevice.org/docs/html/files.html Protocol Documentation]
* [http://libimobiledevice.org/ iFuse]

[[Category:Protocols (S5L)]]

Normal Mode

2010-03-26T23:32:09Z

.::Rizwan::.: /* Resources */

This is the protocol [[iTunes]] uses to talk to the booted iPhone. It uses usbmux to provide TCP like connectivity over a USB port using SSL. There is a pairing process iTunes uses to establish the secure channel. File transfer is provided by [[AFC]].

==Device IDs==
It appears that it uses different device IDs:
* [[iPhone]] - 0x1290
* [[iPod touch]] - 0x1291
* [[iPhone 3G]] - 0x1292
* [[iPod touch 2G]] - 0x1293
* [[iPhone 3GS]] - 0x1294
* [[iPod touch 3G]] - 0x1299

==Patch: Disable SSL==
There is a way to disable SSL encyption during iTunes communication on jailbroken devices by patching lockdownd binary:

:(#) Disable SSL protection
:(#) FW 2.1
:(#) binary /usr/libexec/lockdownd
:-0x1000
'''Offset''' 000112F8: 0C 30 98 E5 > 00 30 A0 E3 ; Conn.UseSSL = false

After applying the patch all packets between iPhone and iTunes become plain and clear. Musthave for R&D ppl.
==USBMux Protocol==

===Resources===
* [[MobileDevice Library]]
* [http://wikee.iphwn.org/usb:usbmux The dev team's page on the topic]
* [http://matt.colyer.name/projects/iphone-linux/index.php?title=Protocol_Documentation Protocol Documentation]
* [http://libimobiledevice.org/ iFuse]

[[Category:Protocols (S5L)]]

Jailbreak

2010-03-26T23:21:46Z

.::Rizwan::.:

This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching /etc/fstab to mount the System partition as read-write. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the [[AFC|afc]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC|afc2]]) that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions.

==Exploits which were used in order to jailbreak (in chronological order)==
=== 1.0.2 ===
* [[Restore Mode]] (iBoot had a command named cp, which had access to the whole filesystem)
=== 1.1.1 ===
* [[Symlinks]] (an upgrade jailbreak)
* [[LibTiff | libtiff exploit]] (Adapted from the PSP scene, used by [[Jailbreakme]])
=== 1.1.2 ===
* [[Mknod]] (an upgrade jailbreak)
=== 1.1.3 / 1.1.4 ===
* [[Soft Upgrade]] (an upgrade jailbreak)
* [[Ramdisk Hack]]

==Exploits which are used in order to jailbreak 2.0 and above==
===iPhone / iPhone 3G / iPod Touch===
* [[Pwnage]] and [[Pwnage 2.0]] (together)
===iPod Touch 2G===
* [[ARM7 Go]] (used by tethered jailbreaks)
* [[0x24000 Segment Overflow]]

===iPhone 3GS===
* [[iBoot Environment Variable Overflow]] (also uses the [[24kPwn]] exploit to make it untethered)
* [[usb_control_msg(0x21, 2) Exploit]] (also uses the [[24kPwn]] exploit to make it untethered)

Jailbreak

2010-03-26T23:20:10Z

.::Rizwan::.:

This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching /etc/fstab to mount the System partition as read-write. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the [[AFC|afc]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service [[AFC|(afc2)]] that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions.

==Exploits which were used in order to jailbreak (in chronological order)==
=== 1.0.2 ===
* [[Restore Mode]] (iBoot had a command named cp, which had access to the whole filesystem)
=== 1.1.1 ===
* [[Symlinks]] (an upgrade jailbreak)
* [[LibTiff | libtiff exploit]] (Adapted from the PSP scene, used by [[Jailbreakme]])
=== 1.1.2 ===
* [[Mknod]] (an upgrade jailbreak)
=== 1.1.3 / 1.1.4 ===
* [[Soft Upgrade]] (an upgrade jailbreak)
* [[Ramdisk Hack]]

==Exploits which are used in order to jailbreak 2.0 and above==
===iPhone / iPhone 3G / iPod Touch===
* [[Pwnage]] and [[Pwnage 2.0]] (together)
===iPod Touch 2G===
* [[ARM7 Go]] (used by tethered jailbreaks)
* [[0x24000 Segment Overflow]]

===iPhone 3GS===
* [[iBoot Environment Variable Overflow]] (also uses the [[24kPwn]] exploit to make it untethered)
* [[usb_control_msg(0x21, 2) Exploit]] (also uses the [[24kPwn]] exploit to make it untethered)

LLB

2010-03-26T23:15:35Z

.::Rizwan::.:

This is the Low Level Bootloader. It runs several setup routines and on firmware versions 2.0 and higher it checks the signature of [[iBoot]] before jumping to it.

Those same setup routines are present in [[iBEC]] and [[iBSS]], which is why they can be launched directly from the [[DFU]].

LLB

2010-03-26T23:12:02Z

.::Rizwan::.:

This is the Low Level Bootloader. It runs several setup routines and on firmware versions 2.0 and higher it checks the signature of [[iBoot]] before jumping to it.

Those same setup routines are present in [http://www.theiphonewiki.com/wiki/index.php?title=IBEC iBEC] and [http://www.theiphonewiki.com/wiki/index.php?title=IBSS iBSS], which is why they can be launched directly from the [[DFU]].

User:Geohot

2008-07-28T17:10:47Z

.::Rizwan::.:

The founder of this wiki.

This kid is a media whore who lied about yiPhone :-) ;-)

[http://iphonejtag.blogspot.com/ Blog]