The iPhone Wiki - User contributions [en]

User:Ac3xx

2011-10-30T20:52:56Z

Ac3xx:

{{lowercase}}__NOTOC__
I am Cole Johnson, a 15-year-old (as of November 1, 2011) {{wp|Mormonism|Mormon}} who resides in Southern {{wp|California}}. You can find me by my many [[#Aliases|aliases]]. My [[#My Projects|projects]] are listed below. I know many [[#Programming Languages|languages]]. My {{user:balloonhead66/site|/cms/Cole_Stuff:Main|site}} consists of many sections.

== My Projects ==
* [[iDecryptIt]] ([[Talk:iDecryptIt|talk]]) - A GUI for decrypting [[iOS]] {{wp|FileVault}} file systems
* [[iSim]] ([[Talk:iSim|talk]]) - A web-based simulator of [[iOS]] requiring a {{wp|web server}}
* {{User:balloonhead66/site|cms/Cole_Stuff:Main|Cole Stuff CMS}} - A {{wp|Content management system|CMS}} for my site
* Downloading EVERY firmware file for iOS (currently 1.0-5.0 and 3.0b1-5.0GM)

== Aliases ==
* balloonhead66
* colejohnson66
* cole66
* balloomhead66 on [http://ifans.com iFans] (spelling error)

== Devices ==
{| class="wikitable"
|-
! style="width:12.5%" | Device
! style="width:12.5%" | [[N90ap|iPhone 4 (GSM)]]
! style="width:12.5%" | [[N45ap|iPod touch 1G]]
! style="width:12.5%" | [[N72ap|iPod touch 2G (MC)]]
! style="width:12.5%" | [[N81ap|iPod touch 4G]]
! style="width:12.5%" | [[N81ap|iPod touch 4G]]
! style="width:12.5%" | [[K93ap|iPad 2 (Wi-Fi)]]
|-
! Recieved
| July 2010
| March 2010
| November 1, 2009
| October 1, 2010
| November 2010
| March 2011
|-
! Paid
| Unknown
| $120 - Craigslist
| Unknown (Gift)
| $250 - Discount! :)
| Free!
| $799
|-
! Size
| 16GB
| colspan="2" | 8GB
| colspan="2" | 32GB
| 64GB
|-
! Starting FW
| [[Apex 8A293 (iPhone 4)|4.0]] (8A293)
| [[Snowbird 3A100a (iPod touch)|1.1]] (3A100a)
| [[Northstar 7C145 (iPod touch 2G)|3.1.1]] (7C145)
| [[Baker 8B117 (iPod touch 4G)|4.1]] (8B117)
| [[Baker 8B118 (iPod touch 4G)|4.1]] (8B118)
| [[Durango 8F191 (iPad 2 Wi-Fi)|4.3]] (8F191)
|-
! Current FW
| [[Telluride 9A334 (iPhone 4)|5.0]] (9A334)
| [[SUNorthstarTwo 7E18 (iPod touch)|3.1.3]] (7E18)
| [[Apex 8A293 (iPod touch 2G)|4.0]] (8A293)
| [[Baker 8B118 (iPod touch 4G)|4.1]] (8B118)
| [[Telluride 9A334 (iPod touch 4G)|5.0]] (9A334)
| [[Telluride 9A334 (iPad 2 Wi-Fi)|5.0]] (9A334)
|-
! Comments
| Mom's
| Brother's
| colspan="2" |  
| Free replacement
| Mom's
|-
! Jailbroken?
| colspan="2" {{no}}
| {{yes|Yes; till sold}}
| {{yes|Yes; till broke}}
| colspan="2" {{no}}
|-
! [[iBoot (Bootloader)|iBoot]]
| [[iBoot-1219.43.32|1219.43.32]]
| [[iBoot-636.66.33|636.66.33]]
| [[iBoot-889.24|889.24]]
| [[iBoot-931.18.27|931.18.27]]
| colspan="2" | [[iBoot-1219.43.32|1219.43.32]]
|-
! Owned
| colspan="2" {{yes}}
| {{no|No; Sold}}
| {{no|No; Cracked}}
| colspan="2" {{yes}}
|-
! Sold or Lost
| colspan="2" {{n/a}}
| {{yes|August 2010}}
| {{yes|November 2010}}
| colspan="2" {{n/a}}
|}

== Programming Languages ==
{| class="wikitable" style="float:right;"
|-
| {{yes|Known}}
|-
| {{partial|Learning}}
|-
| style="background-color:#87CEEB; color: black; text-align: center;" | Learned and forgot
|-
| {{no|Going to learn}}
|-
| style="background-color:#966FD6; color: black; text-align: center;" | Learned and stopped
|}
{| class="wikitable"
|-
! rowspan="2" | General
| colspan="3" {{yes|{{wp|Visual BASIC}} + {{wp|Windows Presentation Foundation|WPF}}}}
| colspan="3" {{yes|{{wp|Extensible Application Markup Language|XAML}}}}
|-
| colspan="3" {{yes|{{wp|C (programming language)|C}}}}
| colspan="3" {{partial|{{wp|C Sharp (programming language)|C#}}}}
|-
! rowspan="2" | Web
| colspan="2" {{yes|{{wp|HTML}}}}
| colspan="2" {{yes|{{wp|XHTML}}}}
| colspan="2" {{yes|{{wp|XML}}}}
|-
| colspan="3" {{yes|{{wp|PHP}}}}
| colspan="3" {{yes|Mediawiki Wiki-Markup}}
|-
! Java
| style="background:#87CEEB; color:black; text-align:center;" colspan="3" | {{wp|Java}}
| style="background:#966FD6; color:black; text-align:center;" colspan="3" | G-Java
|-
! Database
| colspan="6" {{yes|{{wp|SQL}} ({{wp|MySQL}})}}
|-
! Low-level
| colspan="6" {{no|{{wp|Assembly language|Assembly}}}}
|}

== Contact Info ==
* OpenFeint
** colejohnson66
* [[:/Applications/GameCenter~iphone.app|Game Center]]
* Plus+
* {{wp|Skype}}
** balloonhead66
* Jelly Car 2
** cole66
* {{wp|Twitter}}
** {{twitter|colejohnson66}}
* Google Profile
** [http://www.google.com/profiles/coleharrisjohnson coleharrisjohnson]

Mojave 8M89 (AppleTV2,1)

2010-10-29T20:05:53Z

Ac3xx:

This is iOS 4.1 on the [[k66ap|Apple TV 2G]].

== Decryption Keys ==
=== Main Filesystem (018-8609-066.dmg) ===
* '''[[VFDecrypt Keys|VFDecrypt]] Key''': 31c700a852f1877c88efc05bc5c63e8c7f081c4cb28d024ed7f9b0dbc98c7e1406e499c6

===Restore Ramdisk===
* '''IV:'''
* '''Key:'''

===Update Ramdisk===
* '''IV:''' 8d9ece8519b2b36c36292c7abc8e8a6032598c7f
* '''Key:''' 1cdaede20dfc5f2299f23c237688b341390088c71b8aa63793770e5c1f3e6dc9

===AppleLogo===
* '''IV:''' b33700bd5540efdfbca317b9a1fd9a4c
* '''Key:''' 0fea871e64de2cddb336b2507dd19bc9a8a1af64132d963faec19acf7b8fb20d

===Batterycharging0===
* '''IV:''' 8de0d6cd248ef395510e1d20230cd941
* '''Key:''' 5a65719d006a92c3901053eec73cec66a9da95fe99e5ffb95038ca162d854b9d

===Batterycharging1===
* '''IV:''' f821980de89219774dd173b624594dc1
* '''Key:''' 52d7917543c7308203093d2fa829fd8b6ce788928673d51fef3904555695e616

===Batteryfull===
* '''IV:''' f8bc23e80494d0bde741c7e221ebaa8e
* '''Key:''' f7256c36141a0a3fb68ae633432351dbbfb3e3c5891aa332e4247a5d42a49a44

===Batterylow0===
* '''IV:''' 8e9df3bcaa54837361a5ed6328a6326a
* '''Key:''' 2b0ef27340d2e3137491ebc7fbba578e519e013b48dc2b14ce87f12282bc89d1

===Batterylow1===
* '''IV:''' 847395a8f78da69696ea16900137e537
* '''Key:''' ed90a51d8a3a2ab07ec80ba50cfc3e030e8efd850833354678773e7c0a9502a6

===DeviceTree===
*'''IV:''' d0b28f3d1370c3c3042bf96b18e93078
*'''Key:''' faeb30db4b35e53ec76cf9ef159f331bd2902fa0d71075b7a1d31689cab666b6

===Glyphcharging===
* '''IV:''' 91bd8d68e794de15b72113fa8f3c1e33
* '''Key:''' c37986feb1fd83c9cb1d5e9009c9002f2b1ae41b69587ea6b0f45fe30cdcfe69

===Glyphplugin===
* '''IV:''' 083fdf7a566bfef613512f50907fab43
* '''Key:''' 58b4719aa449b469d0d6f76cbb149b3758673a329f9d1d0bd266034d64a2915c

===iBoot===
* '''IV:''' c9fc3b7f612911c2626a08a532d3e726
* '''Key:''' d978ace5459d666602efd53a1b24a5837d350f33e91bad31a739bd742a9be813

===LLB===
* '''IV:''' ca059d2e76f9fa549843c51e796cc210
* '''Key:''' 2c4c14d24f629f8d66d16e63fe5a24f091ee450c98fbfa48ab871ecb92a6e02e

===RecoveryMode===
*'''IV:''' fdb039259f52d102694953d8a35cb13a
*'''Key:''' 04b565f72e2f5117dc171c782ef6199294e1bdff2c98bbad6caea2a0ca52a24f

===iBEC===
* '''IV:''' 56f018315b461bfce4b9f38b990544b9
* '''Key:''' e8735b92311930b5ea7ddeea3455af21944454daf03f67216aefb0384e10a6cc

===iBSS===
* '''IV:''' 921a1405543996714f80d2fb1f8d0242
* '''Key:''' e31d511699eb9564c7174932e595e75f08aaa11d392d9026f28fe60ede336fc2

==Thanks==
Thanks to GreySyntax

Mojave 8M89 (AppleTV2,1)

2010-10-29T13:31:58Z

Ac3xx:

== Decryption Keys ==
=== Main Filesystem (“Mojave8M89.K66OS” 018-8609-066.dmg) ===
* '''[[VFDecrypt Keys|VFDecrypt]] Key''': 31c700a852f1877c88efc05bc5c63e8c7f081c4cb28d024ed7f9b0dbc98c7e1406e499c6

===AppleLogo===
* '''IV:''' b33700bd5540efdfbca317b9a1fd9a4c
* '''Key:''' 0fea871e64de2cddb336b2507dd19bc9a8a1af64132d963faec19acf7b8fb20d

===Batterycharging0===
* '''IV:''' 8de0d6cd248ef395510e1d20230cd941
* '''Key:''' 5a65719d006a92c3901053eec73cec66a9da95fe99e5ffb95038ca162d854b9d

===Batterycharging1===
* '''IV:''' f821980de89219774dd173b624594dc1
* '''Key:''' 52d7917543c7308203093d2fa829fd8b6ce788928673d51fef3904555695e616

===Batteryfull===
* '''IV:''' f8bc23e80494d0bde741c7e221ebaa8e
* '''Key:''' f7256c36141a0a3fb68ae633432351dbbfb3e3c5891aa332e4247a5d42a49a44

===Batterylow0===
* '''IV:''' 8e9df3bcaa54837361a5ed6328a6326a
* '''Key:''' 2b0ef27340d2e3137491ebc7fbba578e519e013b48dc2b14ce87f12282bc89d1

===Batterylow1===
* '''IV:''' 847395a8f78da69696ea16900137e537
* '''Key:''' ed90a51d8a3a2ab07ec80ba50cfc3e030e8efd850833354678773e7c0a9502a6

===DeviceTree===
* '''IV:''' d0b28f3d1370c3c3042bf96b18e93078
*''''Key:''' faeb30db4b35e53ec76cf9ef159f331bd2902fa0d71075b7a1d31689cab666b6

===Glyphcharging===
* '''IV:''' 91bd8d68e794de15b72113fa8f3c1e33
* '''Key:''' c37986feb1fd83c9cb1d5e9009c9002f2b1ae41b69587ea6b0f45fe30cdcfe69

===Glyphplugin===
* '''IV:''' 083fdf7a566bfef613512f50907fab43
* '''Key:''' 58b4719aa449b469d0d6f76cbb149b3758673a329f9d1d0bd266034d64a2915c

===iBoot===
* '''IV:''' c9fc3b7f612911c2626a08a532d3e726
* '''Key:''' d978ace5459d666602efd53a1b24a5837d350f33e91bad31a739bd742a9be813

===LLB===
* '''IV:''' ca059d2e76f9fa549843c51e796cc210
* '''Key:''' 2c4c14d24f629f8d66d16e63fe5a24f091ee450c98fbfa48ab871ecb92a6e02e

===RecoveryMode===
* '''IV:''' fdb039259f52d102694953d8a35cb13a
*''''Key:''' 04b565f72e2f5117dc171c782ef6199294e1bdff2c98bbad6caea2a0ca52a24f

===iBEC===
* '''IV:''' 56f018315b461bfce4b9f38b990544b9
* '''Key:''' e8735b92311930b5ea7ddeea3455af21944454daf03f67216aefb0384e10a6cc

===iBSS===
* '''IV:''' 921a1405543996714f80d2fb1f8d0242
* '''Key:''' e31d511699eb9564c7174932e595e75f08aaa11d392d9026f28fe60ede336fc2

Thanks to GreySyntax

Mojave 8M89 (AppleTV2,1)

2010-10-29T13:23:58Z

Ac3xx:

== Decryption Keys ==
=== Main Filesystem (“Mojave8M89.K66OS” 018-8609-066.dmg) ===
* '''[[VFDecrypt Keys|VFDecrypt]] Key''': 31c700a852f1877c88efc05bc5c63e8c7f081c4cb28d024ed7f9b0dbc98c7e1406e499c6

===AppleLogo===
'''IV:''' b33700bd5540efdfbca317b9a1fd9a4c
'''Key:''' 0fea871e64de2cddb336b2507dd19bc9a8a1af64132d963faec19acf7b8fb20d

batterycharging0.s5l8930x.img3
'''IV:''' 8de0d6cd248ef395510e1d20230cd941
'''Key:''' 5a65719d006a92c3901053eec73cec66a9da95fe99e5ffb95038ca162d854b9d

batterycharging1.s5l8930x.img3
'''IV:''' f821980de89219774dd173b624594dc1
'''Key:''' 52d7917543c7308203093d2fa829fd8b6ce788928673d51fef3904555695e616

batteryfull.s5l8930x.img3
'''IV:''' f8bc23e80494d0bde741c7e221ebaa8e
'''Key:''' f7256c36141a0a3fb68ae633432351dbbfb3e3c5891aa332e4247a5d42a49a44

batterylow0.s5l8930x.img3
'''IV:''' 8e9df3bcaa54837361a5ed6328a6326a
'''Key:''' 2b0ef27340d2e3137491ebc7fbba578e519e013b48dc2b14ce87f12282bc89d1

batterylow1.s5l8930x.img3
'''IV:''' 847395a8f78da69696ea16900137e537
'''Key:''' ed90a51d8a3a2ab07ec80ba50cfc3e030e8efd850833354678773e7c0a9502a6

DeviceTree.k66ap.img3
'''IV:''' d0b28f3d1370c3c3042bf96b18e93078
'''Key:''' faeb30db4b35e53ec76cf9ef159f331bd2902fa0d71075b7a1d31689cab666b6

glyphcharging.s5l8930x.img3
'''IV:''' 91bd8d68e794de15b72113fa8f3c1e33
'''Key:''' c37986feb1fd83c9cb1d5e9009c9002f2b1ae41b69587ea6b0f45fe30cdcfe69

glyphplugin.s5l8930x.img3
'''IV:''' 083fdf7a566bfef613512f50907fab43
'''Key:''' 58b4719aa449b469d0d6f76cbb149b3758673a329f9d1d0bd266034d64a2915c

iBoot.k66ap.RELEASE.img3
'''IV:''' c9fc3b7f612911c2626a08a532d3e726
'''Key:''' d978ace5459d666602efd53a1b24a5837d350f33e91bad31a739bd742a9be813

LLB.k66ap.RELEASE.img3
'''IV:''' ca059d2e76f9fa549843c51e796cc210
'''Key:''' 2c4c14d24f629f8d66d16e63fe5a24f091ee450c98fbfa48ab871ecb92a6e02e

recoverymode-1280x720.s5l8930x.img3
'''IV:''' fdb039259f52d102694953d8a35cb13a
'''Key:''' 04b565f72e2f5117dc171c782ef6199294e1bdff2c98bbad6caea2a0ca52a24f

iBEC.k66ap.RELEASE.dfu
'''IV:''' 56f018315b461bfce4b9f38b990544b9
'''Key:''' e8735b92311930b5ea7ddeea3455af21944454daf03f67216aefb0384e10a6cc

iBSS.k66ap.RELEASE.dfu
'''IV:''' 921a1405543996714f80d2fb1f8d0242
'''Key:''' e31d511699eb9564c7174932e595e75f08aaa11d392d9026f28fe60ede336fc2

Thanks to GreySyntax

Mojave 8M89 (AppleTV2,1)

2010-10-29T13:15:29Z

Ac3xx:

== Decryption Keys ==
=== Main Filesystem (“Mojave8M89.K66OS” 018-8609-066.dmg) ===
* '''[[VFDecrypt Keys|VFDecrypt]] Key''': 31c700a852f1877c88efc05bc5c63e8c7f081c4cb28d024ed7f9b0dbc98c7e1406e499c6

applelogo-1280x720.s5l8930x.img3
-iv b33700bd5540efdfbca317b9a1fd9a4c
-k 0fea871e64de2cddb336b2507dd19bc9a8a1af64132d963faec19acf7b8fb20d

batterycharging0.s5l8930x.img3
-iv 8de0d6cd248ef395510e1d20230cd941
-k 5a65719d006a92c3901053eec73cec66a9da95fe99e5ffb95038ca162d854b9d

batterycharging1.s5l8930x.img3
-iv f821980de89219774dd173b624594dc1
-k 52d7917543c7308203093d2fa829fd8b6ce788928673d51fef3904555695e616

batteryfull.s5l8930x.img3
-iv f8bc23e80494d0bde741c7e221ebaa8e
-k f7256c36141a0a3fb68ae633432351dbbfb3e3c5891aa332e4247a5d42a49a44

batterylow0.s5l8930x.img3
-iv 8e9df3bcaa54837361a5ed6328a6326a
-k 2b0ef27340d2e3137491ebc7fbba578e519e013b48dc2b14ce87f12282bc89d1

batterylow1.s5l8930x.img3
-iv 847395a8f78da69696ea16900137e537
-k ed90a51d8a3a2ab07ec80ba50cfc3e030e8efd850833354678773e7c0a9502a6

DeviceTree.k66ap.img3
-iv d0b28f3d1370c3c3042bf96b18e93078
-k faeb30db4b35e53ec76cf9ef159f331bd2902fa0d71075b7a1d31689cab666b6

glyphcharging.s5l8930x.img3
-iv 91bd8d68e794de15b72113fa8f3c1e33
-k c37986feb1fd83c9cb1d5e9009c9002f2b1ae41b69587ea6b0f45fe30cdcfe69

glyphplugin.s5l8930x.img3
-iv 083fdf7a566bfef613512f50907fab43
-k 58b4719aa449b469d0d6f76cbb149b3758673a329f9d1d0bd266034d64a2915c

iBoot.k66ap.RELEASE.img3
-iv c9fc3b7f612911c2626a08a532d3e726
-k d978ace5459d666602efd53a1b24a5837d350f33e91bad31a739bd742a9be813

LLB.k66ap.RELEASE.img3
-iv ca059d2e76f9fa549843c51e796cc210
-k 2c4c14d24f629f8d66d16e63fe5a24f091ee450c98fbfa48ab871ecb92a6e02e

recoverymode-1280x720.s5l8930x.img3
-iv fdb039259f52d102694953d8a35cb13a
-k 04b565f72e2f5117dc171c782ef6199294e1bdff2c98bbad6caea2a0ca52a24f

iBEC.k66ap.RELEASE.dfu
-iv 56f018315b461bfce4b9f38b990544b9
-k e8735b92311930b5ea7ddeea3455af21944454daf03f67216aefb0384e10a6cc

iBSS.k66ap.RELEASE.dfu
-iv 921a1405543996714f80d2fb1f8d0242
-k e31d511699eb9564c7174932e595e75f08aaa11d392d9026f28fe60ede336fc2

Thanks to GreySyntax

SHSH Protocol

2010-10-28T15:23:53Z

Ac3xx: Updated gs.apple.com IP

Here is a description about the protocol that is used when [[iTunes]] or [[TinyUmbrella]] request the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is gs.apple.com (as of 28. October 2010 at IP 17.112.176.11) and runs on the common [[wikipedia:Hypertext Transfer Protocol|HTTP]] [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way.

===Sending data (request)===
POST /TSS/controller?action=2 HTTP/1.1
Accept: */*
Cache-Control: no-cache
Content-type: text/xml; charset="utf-8"
User-Agent: InetURL/1.0
Content-Length: 12345
Host: gs.apple.com

(here comes the XML request file)

===Receiving data (answer)===
HTTP/1.1 200 OK
Date: Sun, 15 Aug 2010 19:25:18 GMT
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.5.GA (build: CVSTag=Branch_4_0 date=200610162339)/Tomcat-5.5
Content-Type: text/html
Content-Length: 123456
MS-Author-Via: DAV

STATUS=0&MESSAGE=SUCCESS&REQUEST_STRING=(here comes the requested shsh file)

===XML request file===
As you can see, this is a simple XML file. Within <dict> there is always a <key> and then a value.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">

<plist version="1.0">
<dict>
<key>@APTicket</key>
<true />
<key>@BBTicket</key>
<true />
<key>@HostIpAddress</key>
<string>192.168.0.1</string>
<key>@HostPlatformInfo</key>
<string>windows</string>
<key>@Locality</key>
<string>en_US</string>
<key>@VersionInfo</key>
<string>libauthinstall-34</string>
<key>ApBoardID</key>
<integer>2</integer>
<key>ApChipID</key>
<integer>12345</integer>
<key>ApECID</key>
<string>1234567890123</string>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data>123412341234123412341234123=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<data>123412341234123412341234123=</data>
<key>PartialDigest</key>
<data>12341234123412341234123412341234123412==</data>
<key>Trusted</key>
<true />
</dict>
The <key><dict> tags repeat here.
</plist>

In the above request, the <key><dict> tags repeat for:
*AppleLogo
*BatteryCharging
*BatteryCharging0
*BatteryCharging1
*BatteryFull
*BatteryLow0
*BatteryLow1
*BatteryPlugin
*DeviceTree
*KernelCache
*LLB (*)
*RecoveryMode
*RestoreDeviceTree
*RestoreKernelCache
*RestoreLogo
*RestoreRamDisk
*iBEC (*)
*iBSS (*)
*iBoot
The requested <key><dict> values may depend on the firmware version, because we need a certificate for each part.

All these <key> values have a <dict> block with the tags Digest, PartialDigest, Trusted. Only exception are the marked (*) values: These have a dict block with the tags BuildString and PartialDigest only. The BuildString always contains the value "iBoot-889.24~4" in my test request for all three keys.

Infos about the needed values:
*ApChipID: 5 digit number - probably platform ID.
*ApECID: This is the [[ECID]] in decimal format.
*UniqueBuildID: (unknown) [[wikipedia:Base64|Base64]] encoded
*Digest: (unknown) [[wikipedia:Base64|Base64]] encoded
*PartialDigest: (unknown) [[wikipedia:Base64|Base64]] encoded

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*action=2 in the request. What other values exist and what is their meaning?
*STATUS=0&MESSAGE=SUCCESS in the answer. What other values exist?
*@APTicket can have other values than true? What is this for?
*@BBTicket can have other values than true? What is this for?
*@HostIpAddress This was not my IP address, so it is assumed this will not be checked.
*@HostPlatformInfo What would this value be on a MAC?
*@Locality This will probably not be checked. This test request was from outside US.
*@VersionInfo Are other values in use?
*ApBoardID Do values other than 2 exist? Where can this value be read?
*ApProductionMode What does this mean? Is there a test environment?
*ApSecurityDomain Meaning?
*Trusted What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

[[Category:Firmware Tags]]
[[Category:Firmware Parsing]]

Talk:Usb control msg(0xA1, 1) Exploit

2010-09-30T17:44:43Z

Ac3xx:

Is this even suppose to be here? :S

[[User:Ih8sn0w|iH8sn0w]] 00:31, 21 September 2010 (UTC)
:[[User:Pod2g|Pod2g]] posted it himself so I don't see much of a problem for it as it doesn't sound like it will work on new devices. --[[User:OMEGA_RAZER|OMEGA_RAZER]]

So would this exploit lead to a tethered jailbreak or would it be untethered? --[[User:JacobVengeance|JacobVengeance]] 01:50, 21 September 2010 (UTC)

:Tethered. This just allows unsigned code execution to be performed regardless of SHSH or model revision at the DFU/bootrom level. This is useful for redsn0w or blackra1n type hacks as they provide a quick and unclosable exploit to perform the actual jailbreak. Functionally, this replaces the need for sending 2.1.1 iBSS + iBEC to use Arm7Go or the 3.1.2 iBSS/iBEC (if that can even be done?) for that other USB control msg exploit in 3.1.2 iBoot. [[User:Iemit737|Iemit737]] 02:37, 21 September 2010 (UTC)

the new bootrom ipod touch 2g where ipod touch 3g so will this exploit work on ipod3g and iphone 3gs --[[User:Liamchat|liamchat]] 14:51, 21 September 2010 (UTC)

:I don't completely understand your question, but no, this exploit will work on nothing other than the 2nd generation iPod touch (and is not particularly big news, since we can already run unsigned code on the second gen touch). [[User:AriX|AriX]] 18:01, 21 September 2010 (UTC)

[[User:Pod2g|Pod2g]] : I released this one because it's old devices only (Apple engineers already found and fixed it).
The good thing about it, is that it's a way to execute unsigned assembly code easily ''in the context of the bootrom''.
Researchers can use it to explore the bootrom, try things, etc. Also, maybe it could be useful for iDroid ?

palz2015 : So could it be untethered using the exploit to run code that patches the kernel, and preform a userland-only jailbreak, just from DFU?

no because the exploit will replace the rdisk with a pwnd one ( that will fail the check ) and cydia will need to know how to use the exploit but you can re inject apple's rdisk --[[User:Liamchat|liamchat]] 18:55, 27 September 2010 (UTC)

What is classified as a 'New Device'. Would an iPod Touch 2G with the 2nd revision of the S5L8720 bootrom be classified as a new device? --[[User:Ac3xx|ac3xx]] 17:44, 30 September 2010 (UTC)

User:Ac3xx

2010-09-30T17:43:42Z

Ac3xx: New page: Member of the 0wn-Dev Team.

Member of the 0wn-Dev Team.

Talk:Usb control msg(0xA1, 1) Exploit

2010-09-30T17:37:46Z

Ac3xx:

Talk:Usb control msg(0xA1, 1) Exploit

2010-09-30T17:35:44Z

Ac3xx: