The iPhone Wiki - User contributions [en]

Talk:Tutorial:Unlocking iPhone 4 (iPhone3,3) model with OTA

2011-02-24T03:50:52Z

Cmdshft: New page: It is not "iPhone 4G", it is iPhone 4. Please use proper nomenclature, or use Apple's device generation number scheme if you are unsure (iPhone1,1, iPhone1,2, iPhone2,1, iPhone3,1, iPhone3...

It is not "iPhone 4G", it is iPhone 4. Please use proper nomenclature, or use Apple's device generation number scheme if you are unsure (iPhone1,1, iPhone1,2, iPhone2,1, iPhone3,1, iPhone3,3, which are iPhone, iPhone 3G, iPhone 3GS, iPhone 4 (GSM) and iPhone 4 (CDMA) respectively). --[[User:Cmdshft|cmdshft]] 03:50, 24 February 2011 (UTC)

Talk:Tutorial:Re-Provisioning iPhone 4 using file system (Incomplete)

2011-02-24T03:49:47Z

Limera1n

2010-10-23T18:31:31Z

Cmdshft: /* Hacktivation */

[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
* '''[[User:Geohot|geohot]]''' - The program itself, and the bootrom exploit.
* '''[[User:Comex|comex]]''' - The userland exploit that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* limera1n uses a different exploit to SHAtter.
* limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* limera1n uses a hacktivation dylib to activate, even on devices already activated by iTunes

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU Mode]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev (team)]] into not releasing SHAtter, but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing SHAtter would uselessly disclose another bootrom exploit to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy hacktivation.dylib to /usr/lib and change entries to com.apple.mobile.lockdown.plist, whether it has been activated using iTunes or not. This, while helpful to many, is also harmful to legitimate activators. For a guide on how to remove this hacktivation on iTunes activated devices, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

Talk:Limera1n

2010-10-13T04:31:09Z

Cmdshft:

== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out [[SHAtter]] and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:Geohot|Geohots]] exploit not used and keep [[SHAtter]] for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)
:::I think it's because they need to be plugged in for the ramdisk to be uploaded (hence the logo). --[[User:Palz|Palz]] 21:15, 12 October 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)

::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)

== He did it==
It's in the wild. Thoughts? ~Drake
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)

== Pwnage ==

Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)

== Support ==

I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)

== Why no ipt2g support? ==

I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)

== hacktivation.dylib ==

I added info about it and how to remove it for people who activate with iTunes. Hope no one minds. --[[User:Cmdshft|cmdshft]] 04:31, 13 October 2010 (UTC)

Limera1n

2010-10-13T04:29:15Z

Cmdshft:

[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses his undisclosed exploit, along with [[User:Comex|comex]]'s [[userland exploit]], to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

limera1n was released to the public on October 9, 2010, delaying the release of [[greenpois0n]] using the [[SHAtter]] exploit. [[greenpois0n]] has been rewritten to use the same exploit that limera1n uses. It only supports Windows at the moment, and there are some devices with issues.

Limera1n also installs a hacktivation dynamic library (.dylib) to /usr/lib, no matter if the device is properly activated by iTunes or not. This is lazy and can pose some issues (such as Push Donor users having to restore their device). It's recommended to properly remove this dylib only if you can activate via iTunes. A guide to do so can be found [http://www.cmdshft.ipwn.me/blog/?p=555 here].

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
*[[User:Geohot|geohot]] - the program itself, and [[bootrom exploit]].
*[[User:Comex|comex]] - [[userland exploit]] that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* limera1n uses a different exploit to [[SHAtter]].
* limera1n uses a [[bootrom exploit]] to achieve the [[tethered jailbreak]] and [[unsigned code execution]].
* limera1n uses a userland exploit to make the jailbreak [[Untethered jailbreak|untethered]], which was developed by [[User:Comex|comex]].
* limera1n uses a hacktivation dylib to activate, even on devices already activated by iTunes

=== Exploits ===
Details of the [[bootrom exploit]] to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In [[recovery1]],
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU]], it uploads a [[payload]].
* In [[recovery2]], it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev]] into not releasing the SHAtter exploit, instead implementing the limera1n exploit into [[greenpois0n]].
After releasing limera1n, releasing [[SHAtter]] would uselessly disclose another [[bootrom exploit]] to Apple.

[[User:Geohot|geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. geohot observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful in the 5th generation iPhone should it not be disclosed at this time.

limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|comex]] did in fact end up giving his approval for the exploit to be included in limera1n as of beta 2.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]

PROD

2010-08-17T08:09:43Z

Cmdshft: Undo revision 8407 by Jennie (Talk)

Denotes if the firmware image should be used on a production mode device or not. This is set to 1 on personalized + release firmware images (complete images that have ECID included and such), while set to 0 on yet-to-be-personalized images. This is probably to prevent production devices from running them, since Apple wants iTunes to phone home for every restore, but at the same time will not affect their debug devices, because there is a check in iBoot's do_load_image(); routine that will skip all tag checks if it is running on a debug device.

[[Category:Firmware Tags]]
[[Category:Firmware Parsing]]

Talk:Ramdisk Hack

2010-04-29T23:42:01Z

Cmdshft: /* To the idiot that wrote the last comment about Zibri */

This is just a 'overall' explanations to give someone that is not involved a 'clue'.

Could please someone explain more specifically to enable an experienced user to follow the hack?

== Ramdisk Hack ==

It's not difficult at all. You just send a file to 1.1.4 or lower iBoot (iphuc: sendfiletophone or something) then "change" some boot-args. -wEsTbAeR--

I believe that it is not difficult. But where do you put the file and how do you change boot args. And how you put the file there, because at this point it isn't jailbreaked yet!? -caique2001-

== Re: Ramdisk Hack ==

We don't talk to the iPhone via AFC. We talk to the iBoot (Recovery Mode), which is implemented in iPHUC too.
In iBoot you upload a file to RAM (no jailbreak required) and then change boot-args to boot it.

* setenv boot-args rd=md0 -s -x pmd0=0x9340000.0xA00000
* saveenv
* fsboot

I'm not sure about the last command, you must try it. If it does not work, try 'bootx'.

- wEsTbAeR--

== To the idiot that wrote the last comment about Zibri ==

Get the fuck out of the community, and stop sucking dick. This is for facts, not fanboism.

//cmdshft

cmdshift: you are the idiot. it was a joke, and i believe it was posted by a member of the dev team, planetbeing. saying that he "invented ramdisks" and their workings is absolutely ridiculous, and that sir, is a fact. get over yourself.

// gojohnnyboi

How the fuck are you supposed to tell that it is a joke without at least a comment in the discussion page? People have been known to still give him way more credit than he deserves.

// cmdshft

User:Cmdshft

2010-04-29T02:59:06Z

Cmdshft: New page: go away

go away

Ramdisk Hack

2010-04-29T02:56:52Z

Cmdshft: /* History */

This allows unsigned ramdisks to be booted. It was first publicized by [[ZiPhone]]

==Credit==
[[Zibri]]

==Exploit==
Passing pmd*= boot-args specifying a ramdisk in ram > 0x9C000000 allows any ramdisk to be booted.

==Implementation==
* [[PwnageTool]]
* [[ZiPhone]]
* iPlus
* iLibertyX / [[iLiberty+]]
* iFree
* iPhone Forensics Toolkit
* iNdependence
* Any Jailbreak program so far
* iTunes
* Android
* Zune
* Linux
* Windows Mobile
* webOS
* BlackBerry OS

== History ==

Credit goes to Zibri for the discovery of the ramdisk hack. First implemented in ZiPhone, it allowed running jailbreaks on the fly to be quicker than previous jailbreak implementations.

[[Category:Jailbreaks]]
[[Category:Exploits]]

Talk:Ramdisk Hack

2010-04-29T02:53:44Z

Cmdshft: /* To the idiot that wrote the last comment about Zibri */

Talk:Ramdisk Hack

2010-04-29T02:53:28Z

Cmdshft: /* To the idiot that wrote the last comment about Zibri */ new section

Ramdisk Hack

2010-04-29T02:52:16Z

Cmdshft: History

This allows unsigned ramdisks to be booted. It was first publicized by [[ZiPhone]]

==Credit==
[[Zibri]]

==Exploit==
Passing pmd*= boot-args specifying a ramdisk in ram > 0x9C000000 allows any ramdisk to be booted.

==Implementation==
* [[PwnageTool]]
* [[ZiPhone]]
* iPlus
* iLibertyX / [[iLiberty+]]
* iFree
* iPhone Forensics Toolkit
* iNdependence
* Any Jailbreak program so far
* iTunes
* Android
* Zune
* Linux
* Windows Mobile
* webOS
* BlackBerry OS

== History ==

All modern operating systems and every program running on them neglect to credit Zibri for the invention of the ramdisk even though he discovered this hack. First implemented in ZiPhone, it allowed running jailbreaks on the fly to be quicker than previous jailbreak implementations.

[[Category:Jailbreaks]]
[[Category:Exploits]]