The iPhone Wiki - User contributions [en]

Nonce

2021-05-05T00:08:46Z

5ynt4x 3rr0r:

'''Nonce''' is a signing method that randomizes Apple's cryptographic signature hash blobs ([[SHSH]] blobs) and is used with the BBTicket (baseband signing ticket), the APTicket (firmware signing ticket), and SEP ([[Secure Enclave]]). A12 and newer use a technique known as 'Nonce Entangling' making it harder to save blobs.

==Method==
The device bootloaders (baseband, firmware, and SEP) generate a random number at the restore, then send them to iTunes which sends them to Apple. Then Apple sends the APTicket / BBTicket [[SHSH]] certificate with the number generated. This level is the most critical: the number within the certificate is matched to the number generated on device, and if they match iTunes will prepare the matched certificate and finally will stitch the randomized blobs to the firmware. If the blobs don't match the restore will fail and the bootloaders will reject the certificate.

==Usage==
===BBTicket===
*No iPod touch (or iPad Wi-Fi) has been signed with the BBTicket, since by definition it has no baseband.
*[[M68AP|iPhone]] (bootloaders can be neutered to cancel this signchecks). [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] and [[K48AP|iPad Wi-Fi+3G]] - if the baseband is higher or equal (or just higher on bootloader 3.9 on [[M68AP|iPhone]]). Some bootloaders allow downgrade of the baseband if it is still signed.
*[[N90AP|iPhone 4 (iPhone3,1)]], [[N92AP|iPhone 4 (iPhone3,3)]], [[N94AP|iPhone 4S]], and [[K94AP|iPad 2 (iPad2,2)]] and [[K95AP|iPad 2 (iPad2,3)]] - [[AT+XNONCE]] - restores the baseband only if Apple is still signing it. On bootloaders 2.8, 2.13, Trek and Phoenix, both the [[AT+XNONCE]] and the "higher or equal" checks happen.

===APTicket===
*Devices with the [[S5L8900]] get [[SHSH]] blobs without APTicket on 4.0 - 4.2.1, even though they are not required and can be avoided with [[Pwnage]]+[[Pwnage 2.0]].
*Devices with the [[S5L8720]] get [[SHSH]] blobs without APTicket from 3.1.1 and on, even though [[Bootrom 240.4]] doesn't require them and they can be avoided with the [[0x24000 Segment Overflow]]
*Devices with the [[S5L8920]], [[S5L8922]], [[S5L8930]] and [[S5L8940]] got [[SHSH]] blobs without APTicket between 3.0 - 4.3.5, and they can not be avoided (except for the [[Bootrom 359.3]] with the 0x24000 Segment Overflow)
*Devices with the [[S5L8920]], [[S5L8922]], [[S5L8930]], [[S5L8940]], [[S5L8942]], [[S5L8945]], [[S5L8950]], and [[S5L8955]] get APTicket SHSH blobs on 5.0+. The SHSH requirement can not be avoided (except for the [[Bootrom 359.3]] with 0x24000 Segment Overflow), and the APTicket requirement can only be avoided on devices vulnerable to the [[limera1n Exploit]], or if the device is on iOS 5.1.1 or lower.
*Devices with the [[S5L8960]], [[S5L8965]], [[T7000]], [[T7001]], [[S7002]], [[S8000]], [[S8001]], [[S8003]], [[T8010]], and [[T8011]] get APTickets exclusively (with SepNonce, which also needs to match) and they cannot be avoided, but can be utilized with the prometheus method.
==Jailbreak difficulties==
With nonce signatures, signatures can't be cached, because signatures will not match if they have been reused. In other words, the widely used replay attack is no longer possible unless the nonce(s) (SepNonce + ApNonce on 64 bit, ApNonce only on 32 bit) the device generates matches the one on the APTicket.

==See also==
*[[AT+XNONCE]]

User:5ynt4x 3rr0r

2021-04-09T02:51:37Z

5ynt4x 3rr0r: Created page with "this is me."

this is me.

/private/var/containers

2021-04-08T22:50:29Z

5ynt4x 3rr0r:

/private/var/mobile is a folder in the [[iOS]] filesystem. Inside it, the {{parent|private|var|containers|Bundle|Application|}} folder contains some app store apps, though others may be located in .

== Children ==

=== Folders ===
* {{ipfw|Bundle}}
** {{ipfw|Bundle/Application|Application}}
* {{ipfw|Data}}
* {{ipfw|Shared}}
* {{ipfw|Temp}}

=== Files ===
(none)

== Parents ==
{{parent|private|etc|}}

[[Category:Filesystem]]

/private/var/containers

2021-04-08T22:50:19Z

5ynt4x 3rr0r:

/private/var/mobile is a folder in the [[iOS]] filesystem. Inside it, the {{parent|private|var|containers|Bundle|Application|}} folder contains some app store apps, though others may be located in .

== Children ==

=== Folders ===
* {{ipfw|Bundle|}}
** {{ipfw|Bundle/Application|Application}}
* {{ipfw|Data}}
* {{ipfw|Shared}}
* {{ipfw|Temp}}

=== Files ===
(none)

== Parents ==
{{parent|private|etc|}}

[[Category:Filesystem]]

/private/var/containers/Bundle/Application

2021-04-08T22:47:58Z

5ynt4x 3rr0r: Created page with "This folder contains some apps downloadable from the App Store. Some apps may be in {{parent|private|var|mobile|Containers}} instead. == Folders == Folders in this folder..."

This folder contains some apps downloadable from the [[App Store]]. Some apps may be in {{parent|private|var|mobile|Containers}} instead.

== Folders ==
Folders in this folder will vary from system to system, as each folder is named after a unique UUID given to each app upon install.

/private/var/containers

2021-04-08T22:32:23Z

5ynt4x 3rr0r: Created page with "/private/var/mobile is a folder in the iOS filesystem. Inside it, the {{parent|private|var|containers|Bundle|Application|}} folder contains most app store apps. == Child..."

/private/var/mobile is a folder in the [[iOS]] filesystem. Inside it, the {{parent|private|var|containers|Bundle|Application|}} folder contains most app store apps.

== Children ==

=== Folders ===
{{parent|private|var|containers|Bundle|}}
{{parent|private|var|containers|Data}}
{{parent|private|var|containers|Shared}}
{{parent|private|var|containers|Temp}}

=== Files ===
(none)

== Parents ==
{{parent|private|etc|}}

[[Category:Filesystem]]