The iPhone Wiki - User contributions [en]

25C3 presentation "Hacking the iPhone"

2010-07-14T17:49:09Z

DecoDe:

This was a presentation held on the 27 December 2008 at the [http://events.ccc.de/congress/2008/wiki/Main_Page/ 25th Chaos Communication Congress (25C3)] in Berlin. Speakers were [[User:MuscleNerd|MuscleNerd]], [[planetbeing]] and [[pytey]].

Short event description of the presentation: [http://events.ccc.de/congress/2008/Fahrplan/events/2976.en.html "Hacking the iPhone"]

[http://vimeo.com/2646755?pg=embed&sec=2646755 presentation video on Vimeo]

During the presentation [[User:MuscleNerd|MuscleNerd]] wanted to show the [http://qik.com/video/729275 video of a live demo of the unlock] with ([[yellowsn0w]]), but skipped it because of the missing time. This video was actually released [[Timeline#December|some days before]].

To MuscleNerd: can you make the presentation file available? Can't read the slides in the Vimeo video. Thanks *DecoDe

Talk:X-Gold 608 Unlock

2008-11-10T13:23:57Z

DecoDe: /* Find the theorized algorithm of NCK generation */

== current 3G unlock status?? ==

just citing:

:'''Q:''' You can take 1.45.00 (or at least 1.43.00), patch it somewhere, flash this file and it's run? Yes or no?

:'''A:''' No(t yet as easy as that, but be sure we're on it) :p Zf

So, that's very good news :) -caique2001-

To speak more technical... The X-Gold 608 has TPM features. So normally one would expect it only to run signed code. This in turn means, it doesn't matter if the code is interchangeable, because only original Apple code can be run. The crucial hack needed is the hack to run ''unsigned'' code, say patched code (as Apple's private key to sign is not known of course).

TPM doesn't come into play here. We're running unsigned code, and convincing s-gold3 bootrom we deserve a downgrade. It happily complies.

Wow! Even more good news :-) Where do we have to send the beer to :-) ?? If it should not go to much into detail, could you shortly explain what issue you are currently working on? The fact you have the possibility to run patched unsigned code, does it imply you are currently working on a patch that actually does the unlock? And does TPM come into play here or are there other issues to be solved? caique2001

I would assume that with unsigned code, you could patch the 3G equivalant of Simple Unlock. IIRC, geohot has already found the bits. we just need a way to patch them. About bypassing TPM...it would be interesting to see how this is done. Perhaps a malformed sig like with pwnage 2.0 and DFU mode? guess we will just have to wait and see :P [[User:ChronicDev|ChronicDev]]

== opensource baseband? ==
Is to make one? With 3G support? or modify the 4.6 baseband to have have 3g support?

4.6 is on different platform, you cannot modify that for 3G.

== get unlocked bootloader ?? ==

as in countrys like belgium, the 3g is sold without any carrier lock. (belgium law)

wouldnt it be possible to get the bootloader from such an iphone and transfer it to any other device ??

/harald

"Bootloader" has NOTHING todo with official unlock (or unlock). Official Unlock is IMHO done by IMEI and NCK. ~wEsTbAeR--

== Find the theorized algorithm of NCK generation ==

Isn't this what the thousands of keygens for PC apps do? Why is it so much harder to do it for the iPhone? Is it because you would normally decompile the software that does the validation, and this is run on apple servers and so is inaccessible? Sorry, just thinking out loud...

Reply: In softwares we can (after a good amount of work) see the routine that is used to verify the numbers you input. In the iPhone it's not that simple. We know the routine but we don't know what the iPhone starts with (or even if it's generated of the iPhone's serial or just a number in a database)

Example: In a software, you input your name and a serial number. The software gets your name, translates it to numbers and does some math like (FirstLetter)*(SecondLetter)/(ThirdLetter + FourthLetter)

So by knowing those rules, we run the same routine in a software and find out what the original software will expect when you input a name such as "funny". Then you use "funny" and 129837987239187 as serial and it works.

On the iPhone we don't know what the "name" is. We know your iphone will do something like TEA(RSA(token+"name")) and will compare the response of that with what is has stored in it.

Some people believe the NCK (aka "name" in the above example) doesn't have any relation to the numbers on the phone, such as the serial, IMEI, etc. Some people believe Apple has a big table of numbers relating one NCK for each SERIAL but the NCK isn't formed from the serial.

I don't believe so...I think it's a number generated by the IMEI,Serial and any other unique numbers. Either with all of them, or parts of each. I started coding a program that would do a different search than Geohot's NCKBruteForcer. He was trying all the combinations and would eventually find the correct answer for each iPhone but it would take a million years with the computing power we have. I thought of it in a different way. I would assume that the NCK is made by a rule out of the combination of the following "items" [-, +, /, *, ^, Log, Ln, Log(2), exp, mod, imei, serial] and then code something to search for all the rules inside that space such as imei*serial/log(serial)+imei for instance. Another idea was that they could use only a couple digits of each, so something like this would be possible: (3 digits of imei)*(first digit of serial)^(4 last digits of imei) mod (2 last digits of serial) .. and so on. This would be a smaller search than Geohots but would not work if Apple has a table with all the NCKs.

I was coding this for the 1.1.4 OOTB when Geohot found the exploit and unlocked it. So I gave up..but maybe it's time to look at it again. ~ Deco

== Unlock by changing model and serial number ==

Chinese grey-market importers are reportedly unlocking the iPhone 3G by changing the model and serial numbers stored in the phone to match the Hong Kong version. Can someone please test if this method works?

IDA Pro Setup

2008-08-17T14:32:59Z

DecoDe: /* How to set up IDA pro to reverse the 3G baseband */

==How to set up IDA pro to reverse the 3G baseband==

The [[X-Gold 608]] has a memory map, as seen in it's page.

The [[Secpack 2.0]] takes up the first 0xCF8 of the .fls file.

So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)

For real noobs:
1. Drag the fls file into IDA
2. Select ARM
3. Change ROM start address to 0x20040000
4. Change Loading address to 0x20040000
5. Change File offset to 0xCF8
6. Copy Loading size into ROM size
7. Press OK
8. The entry point is the address at 0x20040408

9. Go to 20100004 and Press "C" to start. ~Deco
10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco

IDA Pro Setup

2008-08-17T14:32:47Z

DecoDe: /* How to set up IDA pro to reverse the 3G baseband */

Talk:NCK Brute Force

2008-08-17T12:07:17Z

DecoDe: /* Time? */

Is this method usable to permanently unlock the iPhone (like IPSF) aka upgrade resistant and not needing a software like signal.app (and being able to use SIM PIN Code)?
This would allowed to have the "official" unlock (except activation)?

== Time? ==

How long would it take to search the 15 digit one?

Geohots NCKBF program could do around 100,000 keys/second which would produce a hit in many years.

To get to a point where this is actually doable we would need many orders of magnitude of improvement. Even if you use a PSP3 or special hardware (within 1,000 US$ range) you will only get an improvement of 20-100 times.. which doesn't help much. - Deco

Talk:IDA Pro Setup

2008-08-16T16:53:50Z

DecoDe: /* re: into ida */

prereqs.: IDA Pro Advanced, baseband files

wanted: Howto load these files correctly into IDA

'''Anybody to give this information here?''' TIA -caique2001-

== into ida ==
I suggest you look more into IDA Pro, see how things work. you may not be ready for a baseband yet.

the most important thing you need is the address. for example, i knew the iBoot was at 0x18000000 because at the beginning there is a routine to look if it is there and relocate it if not. also it has many references to 0x1800000 throughout the file.

Here are some key combinations to use:
c = turn the 'gibberish' into code
d = turn the 'gibberish' into data
a = turn the 'gibberish' into a string
u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing
Alt+G = change the 0 to a 1 to switch to thumb mode when needed

really i feel that you should do some more research on ARM and IDA Pro because a wiki article would not be enough to fully explain it

== re: into ida ==
I roughly know how ida works and what the keys are. I think there are some people that have already setup the right values for reversing the baseband. So what I want to see here is just a quick intro to set up the project (segments, fileoffsets, changed options, entry points and so on), not how to use ida. This should almost fit into your article above, just counting words ;-)

Yea, but if you don't understand how to get those numbers, you'll be pretty useless as a reverser. Not to discourage, but the numbers really aren't that hard to get. Look at the memory map I posted. All the information you need is here. ~geohot

Probably I missed something in the constitution, just to cite: "Let's document this device better than anyone at apple knows it." Fact is, you and some other people know how to set up the IDA project. If now, someother people, including me (btw. my first reversing was a CP/M in 1986), don't know how to set up it, one thing is clear: It's not documented. So if you guys reply to my request "this isn't hard to get", this actually means "it isn't hard to get for us" (1st) and "we _don't_want_ to document it" (2nd). This is against the constitution set up by yourselves! Should we change the constitution? My (tongue in cheek) proposal: "This pseudo wiki is intended for <fill in names here> to absorb knowledge. Everybody is invited to give us knowledge..." - The world could be that easy: Just give those people that lack some knowlegde a chance!!! And don't mistake knowledge with qualification. -caique2001-

geohot's claim that you are "useless" as a reverser unless you can figure out the loading offsets from the .fls files is certainly untrue. -- MuscleNerd

Maybe you can share some info with us MuscleNerd? -- Deco

== offsets ==
For example, if you look into ICE2_01.45 using a hex editor, you will see starting 0x634 there contains the memory maps. It started at 0x20000000 and ends at 0x21000000 with sections in between doing its own thing. The code/data in the .fls starts at 0xCF8 indicated by location 0xCF4. The length of the code is indicated by the location at 0xCEC which amounts to 0x5E9E18.

So, you may want to load the data in the .fls file from 0xCF8 to 0X5EAB0F at offset 0x20000000 in IDA pro.

-- CPICH

Hey, you speak my language :-) Thanks -caique2001-

Main Page

2008-07-27T23:01:50Z

DecoDe: Creating Tutorial Topic

<table border=1 width=100%><tr>
<td bgcolor=#64ff64 width=50%><center><b>[[PwnageTool|Jailbreak]]</b></center></td>
<td bgcolor=#ff6464 width=50%><center><b>[[Unlock 2.0|Unlock]]</b></center></td>
</tr></table>

Welcome to the iPhone wiki. This is a conglomerate work of everything done by everyone on the iPhone. Anyone can post here, just create an account. This is needed to avoid spam.

Read the [[constitution]] to understand why this wiki was created.

Read [[Up to speed|this]] to get up to speed in the iPhone community.

==Hardware==
* [[m68ap|iPhone(m68ap)]]
* [[n82ap|iPhone 3G(n82ap)]]

==App Processor(Jailbreak)==
* [[S5L8900]]

===Exploits===
* [[restore mode]]
* [[jailbreakme]]
* [[symlinks]]
* [[Ramdisk Hack]]
* [[pwnage]]
* [[diags]]
* [[pwnage 2.0]]

===Boot Chain===
[[VROM]]->[[iBoot]]->[[Kernel]]->[[System|System Software]]

===Upgrade Process===
[[VROM]]->[[DFU]]->[[WTF]]->[[iBoot]]->[[Kernel]]->[[Ramdisk]]->[[Restore]]

==Baseband(Unlock)==
* [[S-Gold 2]]
* [[X-Gold 608]]

===Exploits===
* [[SIM hacks]]
* [[Fakeblank|Hardware Fakeblank]]
* [[IPSF]]
* [[Minus 0x400]]
* [[Jerrysim]]
* [[Minus 0x20000 with Back Extend Erase]]

===Theoretical Attacks===
* [[NCK Brute Force]]
* [[Baseband JTAG]]

===Boot Chain===
[[Baseband Bootrom|bootrom]]->[[Baseband Bootloader|bootloader]]->[[Baseband Firmware|firmware]]

==File formats==
* [[8900 File Format]]
* [[IMG2 File Format]]
* [[IMG3 File Format]]
* [[secpack]]
* [[secpack 2.0]]
* [[seczone]]

==Protocols==
* [[Recovery Mode 0x1280]]
* [[Recovery Mode 0x1281]]
* [[DFU 0x1222]]
* [[WTF 0x1227]]
* [[Normal Mode 0x1290]]
* [[Restore Mode]]
* [[Baseband Bootrom Protocol]]
* [[Interactive Mode|Baseband Bootloader Protocol]]

==Keys==
* [[AES Keys]]
* [[Apple Certificate]]
* [[Baseband RSA Keys]]
* [[Baseband TEA Keys]]

==Application Development==
* [[Toolchain]]
* [[Frameworks]]
* [[Apple Certification Process]]
* [[Distribution Methods]]

==Tutorials==
* [[Toolchain]]