The iPhone Wiki - User contributions [en]

User:Dra1nerdrake

2011-08-25T06:13:21Z

Dra1nerdrake: It's been a while since I've been on here.

== Devices ==
* '''AppleTV 2G'''
* '''iPhone 4:''' iOS 5 beta 6

== Contact Info ==
* '''Public email:''' [mailto:drakealleg@gmail.com]

== Pet Peeves ==
* Following incorrect formatting!
* Linking to things that don't exist!
* Not signing your talk page posts.

Talk:Preventing Baseband Update

2010-11-30T01:24:09Z

Dra1nerdrake: /* No success */

==No success==
I tried this and it didn't work. I used an iPhone 4 with firmware 4.1 and baseband 1.59.00, trying to upgrade it to stock firmware 4.2.1, preserving the baseband.

One thing that was unclear is the plist edit. There was another entry SystemPartitionSyize=1024(integer) (<nowiki><key>SystemPartitionSize</key><integer>1024</integer></nowiki>). It was not clear if this should be removed or not. I tried both.

To reencrypt, it used the command
xpwntool 038-0032-002_modified.dmg 038-0032-002_reencrypted.dmg -t 038-0032-002_original.dmg -k 06849aead2e9a6ca8a82c3929bad5c2368942e3681a3d5751720d2aacf0694c0 -iv 9b20ae16bebf4cf1b9101374c3ab0095
With key and iv [[Jasper 8C148 (iPhone 4)|from here]] (must be correct, otherwise decryption wouldn't have worked).
Then rename 038-0032-002_reencrypted.dmg to original name and back into the ipsw.

To prepare for custom firmware flashing, I used redsn0w 0.9.6b4, reading initial 4.1 firmware.

Without the SystemPartitionSize, I received an iTunes unknown error 46 when it started to flash. With the SystemPartitionSize it went a few seconds longer and I got iTunes error 14.

Anything I am doing wrong? Did anybody else complete this successfully? Or was this just a joke?
--[[User:Http|http]] 03:14, 29 November 2010 (UTC)
:well what ipsw did you restore to because [[restored]] will signature check the root filesystem after [[ASR]] but the SystemPartitionSize should be replaced with <nowiki> <key>SystemImage</key> <false/> </nowiki> if you dont want to update the root partition --[[User:Liamchat|liamchat]] 16:06, 29 November 2010 (UTC)
::ipsw: 4.2.1 as I said. Why should I not update the root partition? The goal is to upgrade firmware from 4.1 to 4.2.1, without updating the baseband. Did you do this and were successful? --[[User:Http|http]] 19:40, 29 November 2010 (UTC)
:::why are you using the original file as a template --[[User:Liamchat|liamchat]] 23:02, 29 November 2010 (UTC)
::::Because [[xpwntool]] says so. Is that wrong? --[[User:Http|http]] 23:17, 29 November 2010 (UTC)
:::::it is optional if you want to the code just says create an abstract copy of template if has key --[[User:Liamchat|liamchat]] 23:30, 29 November 2010 (UTC)
::::::Are you guessing? Did you ever try all this? If yes: Did it work for you? If no: no guessing please and better no answer in that case. Thanks. --[[User:Http|http]] 00:48, 30 November 2010 (UTC)
:I don't have MUCH experience with this, but I assume that since you've got yourself a modded ramdisk, you have to pwn the bootstrapper iBEC and the other fw parts, as in pwnagetool. --[[User:Dra1nerdrake|dra1nerdrake]] 01:24, 30 November 2010 (UTC)

== merge all ipsw modifications ==

Shuld all pages that describe how to make changes to the restore process be merged into one page --[[User:Liamchat|liamchat]] 23:02, 29 November 2010 (UTC)

Talk:Main Page

2010-11-26T16:56:12Z

Dra1nerdrake: /* Protection on Main Page/Welcome */

{{Talk Archive|Start to November 12, 2010}}

== Posting [[KBAG]]s ==
Is there really a need to post [[KBAG]]s, if we already have decryption keys? Hell better yet instead of posting [[KBAG]]'s post missing keys. --[[User:GreySyntax|GreySyntax]] 16:57, 12 November 2010 (UTC)
: i agree, [[KBAG]]'s are practically useless after you have got the keys from them but [[User:liamchat|liamchat]] seems to post them anyway... --[[User:Cj|cj]] 17:01, 12 November 2010 (UTC)
:: i added them because i didn't have that device and on some pages the [[KBAG]]'s are there with the keys so why not do that on all pages --[[User:Liamchat|liamchat]] 20:38, 12 November 2010 (UTC)
:::Posting the [[KBAG]] and not saying what there from is useless. --[[User:GreySyntax|GreySyntax]] 20:40, 12 November 2010 (UTC)
:::the layout was confusing i grab them in one big lump and it follows a generic system ( see [[User_talk:Liamchat#KBAGs|KBAG layout ]] ) --[[User:Liamchat|liamchat]] 20:45, 12 November 2010 (UTC)
::::The least you could do is place them appropriately, and not force someone like me to clean up after you. --[[User:Dialexio|Dialexio]] 21:10, 12 November 2010 (UTC)

== Protection ==
Can someone inform me why the main page was protected from all users? Not just newly created users? Cheers. --[[User:Beau|Beau]] 03:19, 8 November 2010 (UTC)
:An edit war took place earlier, and unfortunately there's no option to protect it from just newly created users. If you want to make a change, Http and I will be more than happy to carry it out (pending approval, but we're pretty reasonable). --[[User:Dialexio|Dialexio]] 03:46, 8 November 2010 (UTC)
::There kindof is, you just need to update to 1.16, but i guess only geohot can do that... :( --[[User:Balloonhead66|Balloonhead66]] 03:49, 8 November 2010 (UTC)
:::What was the war about? --[[User:Balloonhead66|Balloonhead66]] 00:22, 17 November 2010 (UTC)
:::Thanks [[User:Dialexio|Dialexio]], just thought that it was strange that Wiki pages are starting to be put together for [[:/Applications]] yet there's no link present on the main page - if anything it might fit best atop the Software list. --[[User:Beau|Beau]] 03:58, 8 November 2010 (UTC)
::::It's actually already there, under the name "Filesystem" (which links to the root directory of iOS). :) --[[User:Dialexio|Dialexio]] 04:33, 8 November 2010 (UTC)

== Protection on [[Main Page/Welcome]] ==

I think you should protect [[Main Page/Welcome]] as it is editable by anyone... That is how I added the info on an IRC chatroom... --[[User:Balloonhead66|Balloonhead66]] 18:51, 24 November 2010 (UTC)
:does this work on any other part's of this page and do we need an irc channel for a wiki --[[User:Liamchat|liamchat]] 23:18, 24 November 2010 (UTC)
::No reason not to have an IRC, just leave it be and people can go there to discuss things like formatting and what not. --[[User:JacobVengeance|JakeAnthraX]] 23:41, 24 November 2010 (UTC)
:::It would be better to have it on a more iOS centered network such as Chronic's irc or OSx86. --[[User:GreySyntax|GreySyntax]] 23:52, 24 November 2010 (UTC)
:::i have just made a better one on irc.expl0it.com in the room theiphonewiki however we need a system if people decide to use this --[[User:Liamchat|liamchat]] 00:37, 25 November 2010 (UTC)
::The Main Page is protected for three years only because n00bs kept adding themselves as iPhone hackers. Otherwise, it'd be open for editing by users like you. I see no need to protect [[Main Page/Welcome]] as long as there's no edit war, vandalism, or spam. :) --[[User:Dialexio|Dialexio]] 23:27, 24 November 2010 (UTC)
:::Surely there is no way it'll stay protected for 3 years, right? Just until we can get the n00bs to stop being so ridiculous, I suppose. It doesn't really matter, as I don't actually edit the main page, but I think it's rather funny. :P --[[User:Dra1nerdrake|dra1nerdrake]] 00:00, 25 November 2010 (UTC)
::::Too bad people ignored [http://theiphonewiki.com/wiki/index.php?title=Special%3ALog&type=protect&user=Dialexio&page=Main+Page my warning from September]. :s ''Maybe'' I'll feel nice during the holidays? --[[User:Dialexio|Dialexio]] 00:19, 25 November 2010 (UTC)
:::::If I could 'Like', 'Favorite', or 'Retweet' that post, I'd do it in a heartbeat. --[[User:Dra1nerdrake|dra1nerdrake]] 16:56, 26 November 2010 (UTC)

Talk:Main Page

2010-11-25T00:00:45Z

Dra1nerdrake: /* Protection on Main Page/Welcome */

{{Talk Archive|Start to November 12, 2010}}

== Posting [[KBAG]]s ==
Is there really a need to post [[KBAG]]s, if we already have decryption keys? Hell better yet instead of posting [[KBAG]]'s post missing keys. --[[User:GreySyntax|GreySyntax]] 16:57, 12 November 2010 (UTC)
: i agree, [[KBAG]]'s are practically useless after you have got the keys from them but [[User:liamchat|liamchat]] seems to post them anyway... --[[User:Cj|cj]] 17:01, 12 November 2010 (UTC)
:: i added them because i didn't have that device and on some pages the [[KBAG]]'s are there with the keys so why not do that on all pages --[[User:Liamchat|liamchat]] 20:38, 12 November 2010 (UTC)
:::Posting the [[KBAG]] and not saying what there from is useless. --[[User:GreySyntax|GreySyntax]] 20:40, 12 November 2010 (UTC)
:::the layout was confusing i grab them in one big lump and it follows a generic system ( see [[User_talk:Liamchat#KBAGs|KBAG layout ]] ) --[[User:Liamchat|liamchat]] 20:45, 12 November 2010 (UTC)
::::The least you could do is place them appropriately, and not force someone like me to clean up after you. --[[User:Dialexio|Dialexio]] 21:10, 12 November 2010 (UTC)

== Protection ==
Can someone inform me why the main page was protected from all users? Not just newly created users? Cheers. --[[User:Beau|Beau]] 03:19, 8 November 2010 (UTC)
:An edit war took place earlier, and unfortunately there's no option to protect it from just newly created users. If you want to make a change, Http and I will be more than happy to carry it out (pending approval, but we're pretty reasonable). --[[User:Dialexio|Dialexio]] 03:46, 8 November 2010 (UTC)
::There kindof is, you just need to update to 1.16, but i guess only geohot can do that... :( --[[User:Balloonhead66|Balloonhead66]] 03:49, 8 November 2010 (UTC)
:::What was the war about? --[[User:Balloonhead66|Balloonhead66]] 00:22, 17 November 2010 (UTC)
:::Thanks [[User:Dialexio|Dialexio]], just thought that it was strange that Wiki pages are starting to be put together for [[:/Applications]] yet there's no link present on the main page - if anything it might fit best atop the Software list. --[[User:Beau|Beau]] 03:58, 8 November 2010 (UTC)
::::It's actually already there, under the name "Filesystem" (which links to the root directory of iOS). :) --[[User:Dialexio|Dialexio]] 04:33, 8 November 2010 (UTC)

== Protection on [[Main Page/Welcome]] ==

I think you should protect [[Main Page/Welcome]] as it is editable by anyone... That is how I added the info on an IRC chatroom... --[[User:Balloonhead66|Balloonhead66]] 18:51, 24 November 2010 (UTC)
:does this work on any other part's of this page and do we need an irc channel for a wiki --[[User:Liamchat|liamchat]] 23:18, 24 November 2010 (UTC)
::No reason not to have an IRC, just leave it be and people can go there to discuss things like formatting and what not. --[[User:JacobVengeance|JakeAnthraX]] 23:41, 24 November 2010 (UTC)
:::It would be better to have it on a more iOS centered network such as Chronic's irc or OSx86. --[[User:GreySyntax|GreySyntax]] 23:52, 24 November 2010 (UTC)
::The Main Page is protected for three years only because n00bs kept adding themselves as iPhone hackers. Otherwise, it'd be open for editing by users like you. I see no need to protect [[Main Page/Welcome]] as long as there's no edit war, vandalism, or spam. :) --[[User:Dialexio|Dialexio]] 23:27, 24 November 2010 (UTC)
:::Surely there is no way it'll stay protected for 3 years, right? Just until we can get the n00bs to stop being so ridiculous, I suppose. It doesn't really matter, as I don't actually edit the main page, but I think it's rather funny. :P --[[User:Dra1nerdrake|dra1nerdrake]] 00:00, 25 November 2010 (UTC)

User:Dra1nerdrake

2010-11-24T01:53:54Z

Dra1nerdrake: /* Devices & SHSH's */ Update.

== Bio ==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

== Devices & SHSH's ==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.1.

== Contact Info ==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/drakealleg]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

== Pet Peeves ==
* Following incorrect formatting!
* Linking to things that don't exist!
* Not signing your talk page posts.

User talk:VMax

2010-11-23T03:00:30Z

Dra1nerdrake: /* Apology */ new section

==Welcome==
Hello VMax, and welcome to The iPhone Wiki! We certainly appreciate contributions like the addition of missing firmware keys, but there is an established format for key pages that we'd like people to adhere to. Please adhere to the format for future postings. Thanks! :) --[[User:Dialexio|Dialexio]] 02:22, 23 November 2010 (UTC)

i Fixed it

== Apology ==

I might have come off as a little gruff with my edits, but I assure you that I'm not nearly as belligerent as I appeared. (It's like 10 PM here, I'm not having a good week so far, and I've fought some other template-battles within the last few days, so you know where I'm coming from. ;P) Welcome to the wiki! :D --[[User:Dra1nerdrake|dra1nerdrake]] 03:00, 23 November 2010 (UTC)

Baker 8B117 (iPod3,1)

2010-11-23T02:55:34Z

Dra1nerdrake: /* Root Filesystem (038-0061-002.dmg.dmg) */

== Decryption Keys ==
=== Root Filesystem (038-0061-002.dmg) ===
*'''[[VFDecrypt]] Key''': abd68f16920490865a09e559123db1f471ff19743ad15ea8b970a73e28f5efc6c6e76925

=== Update Ramdisk (038-0055-002.dmg) ===
* '''IV''': d7f909a6bace11ab7f7a606ed3afce70
* '''Key''': 2b5bdeb344f4973e69ba5e5491ce052dcd67001729ec77585c5b8e86b4e7e99b

=== Restore Ramdisk (038-0031-002.dmg) ===
* '''IV''': 9064ae28aef1db52cde6f7568c188766
* '''Key''': 1229ee227f260b8746021d4a46366ec42f987c36d4910a4925e6ca0ce369f69f

=== AppleLogo ===
* '''IV''': 7e04e5a857cb61e2cc0038d68fdf1a73
* '''Key''': 91aeeb5b0e932480ad557c55d1c61221481b91918c5da8516ab8383d5bc60ea1

=== BatteryCharging0 ===
* '''IV''': a4c1375bb158b08fbeef918ae9e4ba90
* '''Key''': 42e7d0d97c442c26723471c5eaf28af3e2dcf59485f9677ee8a7afbd62441b43

=== BatteryCharging1 ===
* '''IV''': 5be4a8f373e36594c8f19b8a90ebda94
* '''Key''': 4d4763deac3cf912d5d23c15260edfbc5f75a8005c8235c6d40f2cc1296280a9

=== BatteryFull ===
* '''IV''': 1b58d3a8bfd299a39f5465c0df4ee564
* '''Key''': f508f6547c02c671ae15d0beefe4b7e018f3ce1e155f1ae7cf9ef5aac35517b8

=== BatteryLow0 ===
* '''IV''': ebbc6c6c267367dba62b95ecbd41c2d4
* '''Key''': ab8848b520391fbb8558129b473d08fcfa6924a6bf6de1e29f40b9a9e5480fa6

=== BatteryLow1 ===
* '''IV''': 36b7097b3f539c3eb4c5605f338bd44f
* '''Key''': 5afc4c06e0c02416bcd25e8d71111dc3043200eb2432d1efa7c763651590f499

=== DeviceTree ===
* '''IV''': 279487a4411fbeef59c6a56f28034712
* '''Key''': a0da3d6726a9dfda9de135959e31e693c23c3216c08f72a6e6768a08f3892976

=== GlyphCharging ===
* '''IV''': 3cb90a84e7be3fc872fbae60b9c300fa
* '''Key''': fffdb6ced18e00bdf240f5aa7ac81144fe353c496225d14f983645a9660ca0c8

=== GlyphPlugin ===
* '''IV''': da21d8b49b66a8e1732f4f0df3724c09
* '''Key''': 2e7c8703279208a80044b322d4ed914e71e65f3a2a4c2d9eecaa51ba2c05bb47

=== [[iBEC]] ===
* '''IV''': a37b98d9e465c60bcc59045d27654e78
* '''Key''': ad80964c516a7f87bab8ce9214f8fece6a2cc83bca98b6e5679fe7aef7a77f1f

=== [[IBoot (Bootloader)|iBoot]] ===
* '''IV''': 6d8082d05c8edd3d259bc004766d1e56
* '''Key''': 45820b2a38c8e7ab8becde45a3e618ceafd32ab56c83fc9f09e183159cca6485

=== [[iBSS]] ===
* '''IV''': 962cc5a04ef71269630fd05b7d43f0d6
* '''Key''': f51e414ba2cb4bf68fcd1ea70d420207d4e269d048265b6480764e65af511904

=== [[Kernelcache]] ===
* '''IV''': 6f0638cceb5b242e9cbd5c81a1904d95
* '''Key''': 0aece5fc2836f6b75cc2363a178a3c0e91d50628ccd263319d0213669cbb25d1

=== [[LLB]] ===
* '''IV''': 7ca40a75fc54dcb3d07dcc0e290a4937
* '''Key''': ebd73e7f4810a8a592ae3cd00830ceb38aace28ee3dc5661437ba7c3c3c10d38

=== RecoveryMode ===
* '''IV''': 1c9b8f01f4b1da66cf46eefdfee96359
* '''Key''': d7a5126c00b60ec61a758ecfe5a9ca53fc64d2829613d5c59d099d3e8d426942

Baker 8B117 (iPod3,1)

2010-11-23T02:54:31Z

Dra1nerdrake: /* Decryption Keys */ All done.

== Decryption Keys ==
=== Root Filesystem (038-0061-002.dmg.dmg) ===
*'''[[VFDecrypt]] Key''': abd68f16920490865a09e559123db1f471ff19743ad15ea8b970a73e28f5efc6c6e76925

=== Update Ramdisk (038-0055-002.dmg) ===
* '''IV''': d7f909a6bace11ab7f7a606ed3afce70
* '''Key''': 2b5bdeb344f4973e69ba5e5491ce052dcd67001729ec77585c5b8e86b4e7e99b

=== Restore Ramdisk (038-0031-002.dmg) ===
* '''IV''': 9064ae28aef1db52cde6f7568c188766
* '''Key''': 1229ee227f260b8746021d4a46366ec42f987c36d4910a4925e6ca0ce369f69f

=== AppleLogo ===
* '''IV''': 7e04e5a857cb61e2cc0038d68fdf1a73
* '''Key''': 91aeeb5b0e932480ad557c55d1c61221481b91918c5da8516ab8383d5bc60ea1

=== BatteryCharging0 ===
* '''IV''': a4c1375bb158b08fbeef918ae9e4ba90
* '''Key''': 42e7d0d97c442c26723471c5eaf28af3e2dcf59485f9677ee8a7afbd62441b43

=== BatteryCharging1 ===
* '''IV''': 5be4a8f373e36594c8f19b8a90ebda94
* '''Key''': 4d4763deac3cf912d5d23c15260edfbc5f75a8005c8235c6d40f2cc1296280a9

=== BatteryFull ===
* '''IV''': 1b58d3a8bfd299a39f5465c0df4ee564
* '''Key''': f508f6547c02c671ae15d0beefe4b7e018f3ce1e155f1ae7cf9ef5aac35517b8

=== BatteryLow0 ===
* '''IV''': ebbc6c6c267367dba62b95ecbd41c2d4
* '''Key''': ab8848b520391fbb8558129b473d08fcfa6924a6bf6de1e29f40b9a9e5480fa6

=== BatteryLow1 ===
* '''IV''': 36b7097b3f539c3eb4c5605f338bd44f
* '''Key''': 5afc4c06e0c02416bcd25e8d71111dc3043200eb2432d1efa7c763651590f499

=== DeviceTree ===
* '''IV''': 279487a4411fbeef59c6a56f28034712
* '''Key''': a0da3d6726a9dfda9de135959e31e693c23c3216c08f72a6e6768a08f3892976

=== GlyphCharging ===
* '''IV''': 3cb90a84e7be3fc872fbae60b9c300fa
* '''Key''': fffdb6ced18e00bdf240f5aa7ac81144fe353c496225d14f983645a9660ca0c8

=== GlyphPlugin ===
* '''IV''': da21d8b49b66a8e1732f4f0df3724c09
* '''Key''': 2e7c8703279208a80044b322d4ed914e71e65f3a2a4c2d9eecaa51ba2c05bb47

=== [[iBEC]] ===
* '''IV''': a37b98d9e465c60bcc59045d27654e78
* '''Key''': ad80964c516a7f87bab8ce9214f8fece6a2cc83bca98b6e5679fe7aef7a77f1f

=== [[IBoot (Bootloader)|iBoot]] ===
* '''IV''': 6d8082d05c8edd3d259bc004766d1e56
* '''Key''': 45820b2a38c8e7ab8becde45a3e618ceafd32ab56c83fc9f09e183159cca6485

=== [[iBSS]] ===
* '''IV''': 962cc5a04ef71269630fd05b7d43f0d6
* '''Key''': f51e414ba2cb4bf68fcd1ea70d420207d4e269d048265b6480764e65af511904

=== [[Kernelcache]] ===
* '''IV''': 6f0638cceb5b242e9cbd5c81a1904d95
* '''Key''': 0aece5fc2836f6b75cc2363a178a3c0e91d50628ccd263319d0213669cbb25d1

=== [[LLB]] ===
* '''IV''': 7ca40a75fc54dcb3d07dcc0e290a4937
* '''Key''': ebd73e7f4810a8a592ae3cd00830ceb38aace28ee3dc5661437ba7c3c3c10d38

=== RecoveryMode ===
* '''IV''': 1c9b8f01f4b1da66cf46eefdfee96359
* '''Key''': d7a5126c00b60ec61a758ecfe5a9ca53fc64d2829613d5c59d099d3e8d426942

Baker 8B117 (iPod3,1)

2010-11-23T02:47:34Z

Dra1nerdrake: Since you cut out a lot of data, I'll fix this according to the template. Welcome to the iPhone wiki!

== Decryption Keys ==
=== Root Filesystem (038-0061-002.dmg.dmg) ===
*'''[[VFDecrypt]] Key''': abd68f16920490865a09e559123db1f471ff19743ad15ea8b970a73e28f5efc6c6e76925

=== Update Ramdisk (038-0055-002.dmg) ===
* '''IV''': d7f909a6bace11ab7f7a606ed3afce70
* '''Key''': 2b5bdeb344f4973e69ba5e5491ce052dcd67001729ec77585c5b8e86b4e7e99b

=== Restore Ramdisk (038-0031-002.dmg) ===
* '''IV''': 9064ae28aef1db52cde6f7568c188766
* '''Key''': 1229ee227f260b8746021d4a46366ec42f987c36d4910a4925e6ca0ce369f69f

// DeviceTree.n18ap.img3:
* '''IV''': 279487a4411fbeef59c6a56f28034712
* '''Key''': a0da3d6726a9dfda9de135959e31e693c23c3216c08f72a6e6768a08f3892976

// LLB.n18ap.RELEASE.img3:
* '''IV''': 7ca40a75fc54dcb3d07dcc0e290a4937
* '''Key''': ebd73e7f4810a8a592ae3cd00830ceb38aace28ee3dc5661437ba7c3c3c10d38

// applelogo.s5l8922x.img3:
* '''IV''': 7e04e5a857cb61e2cc0038d68fdf1a73
* '''Key''': 91aeeb5b0e932480ad557c55d1c61221481b91918c5da8516ab8383d5bc60ea1

// batterycharging0.s5l8922x.img3:
* '''IV''': a4c1375bb158b08fbeef918ae9e4ba90
* '''Key''': 42e7d0d97c442c26723471c5eaf28af3e2dcf59485f9677ee8a7afbd62441b43

// batterycharging1.s5l8922x.img3:
* '''IV''': 5be4a8f373e36594c8f19b8a90ebda94
* '''Key''': 4d4763deac3cf912d5d23c15260edfbc5f75a8005c8235c6d40f2cc1296280a9

// batteryfull.s5l8922x.img3:
* '''IV''': 1b58d3a8bfd299a39f5465c0df4ee564
* '''Key''': f508f6547c02c671ae15d0beefe4b7e018f3ce1e155f1ae7cf9ef5aac35517b8

// batterylow0.s5l8922x.img3:
* '''IV''': ebbc6c6c267367dba62b95ecbd41c2d4
* '''Key''': ab8848b520391fbb8558129b473d08fcfa6924a6bf6de1e29f40b9a9e5480fa6

// batterylow1.s5l8922x.img3:
* '''IV''': 36b7097b3f539c3eb4c5605f338bd44f
* '''Key''': 5afc4c06e0c02416bcd25e8d71111dc3043200eb2432d1efa7c763651590f499

// glyphcharging.s5l8922x.img3:
* '''IV''': 3cb90a84e7be3fc872fbae60b9c300fa
* '''Key''': fffdb6ced18e00bdf240f5aa7ac81144fe353c496225d14f983645a9660ca0c8

// glyphplugin.s5l8922x.img3:
* '''IV''': da21d8b49b66a8e1732f4f0df3724c09
* '''Key''': 2e7c8703279208a80044b322d4ed914e71e65f3a2a4c2d9eecaa51ba2c05bb47

// iBEC.n18ap.RELEASE.dfu:
* '''IV''': a37b98d9e465c60bcc59045d27654e78
* '''Key''': ad80964c516a7f87bab8ce9214f8fece6a2cc83bca98b6e5679fe7aef7a77f1f

// iBSS.n18ap.RELEASE.dfu:
* '''IV''': 962cc5a04ef71269630fd05b7d43f0d6
* '''Key''': f51e414ba2cb4bf68fcd1ea70d420207d4e269d048265b6480764e65af511904

// iBoot.n18ap.RELEASE.img3:
* '''IV''': 6d8082d05c8edd3d259bc004766d1e56
* '''Key''': 45820b2a38c8e7ab8becde45a3e618ceafd32ab56c83fc9f09e183159cca6485

// kernelcache.release.n18:
* '''IV''': 6f0638cceb5b242e9cbd5c81a1904d95
* '''Key''': 0aece5fc2836f6b75cc2363a178a3c0e91d50628ccd263319d0213669cbb25d1

// recoverymode.s5l8922x.img3:
* '''IV''': 1c9b8f01f4b1da66cf46eefdfee96359
* '''Key''': d7a5126c00b60ec61a758ecfe5a9ca53fc64d2829613d5c59d099d3e8d426942

Baker 8B117 (iPod3,1)

2010-11-23T02:39:27Z

Dra1nerdrake: PLEASE FOLLOW THE TEMPLATE

038-0061-002.dmg
*'''[[VFDecrypt]] Key''': abd68f16920490865a09e559123db1f471ff19743ad15ea8b970a73e28f5efc6c6e76925

// 038-0031-002.dmg (Restore Ramdisk):
* '''IV''': 9064ae28aef1db52cde6f7568c188766
* '''Key''': 1229ee227f260b8746021d4a46366ec42f987c36d4910a4925e6ca0ce369f69f

// 038-0055-002.dmg (Update Ramdisk):
* '''IV''': d7f909a6bace11ab7f7a606ed3afce70
* '''Key''': 2b5bdeb344f4973e69ba5e5491ce052dcd67001729ec77585c5b8e86b4e7e99b

// DeviceTree.n18ap.img3:
* '''IV''': 279487a4411fbeef59c6a56f28034712
* '''Key''': a0da3d6726a9dfda9de135959e31e693c23c3216c08f72a6e6768a08f3892976

// LLB.n18ap.RELEASE.img3:
* '''IV''': 7ca40a75fc54dcb3d07dcc0e290a4937
* '''Key''': ebd73e7f4810a8a592ae3cd00830ceb38aace28ee3dc5661437ba7c3c3c10d38

// applelogo.s5l8922x.img3:
* '''IV''': 7e04e5a857cb61e2cc0038d68fdf1a73
* '''Key''': 91aeeb5b0e932480ad557c55d1c61221481b91918c5da8516ab8383d5bc60ea1

// batterycharging0.s5l8922x.img3:
* '''IV''': a4c1375bb158b08fbeef918ae9e4ba90
* '''Key''': 42e7d0d97c442c26723471c5eaf28af3e2dcf59485f9677ee8a7afbd62441b43

// batterycharging1.s5l8922x.img3:
* '''IV''': 5be4a8f373e36594c8f19b8a90ebda94
* '''Key''': 4d4763deac3cf912d5d23c15260edfbc5f75a8005c8235c6d40f2cc1296280a9

// batteryfull.s5l8922x.img3:
* '''IV''': 1b58d3a8bfd299a39f5465c0df4ee564
* '''Key''': f508f6547c02c671ae15d0beefe4b7e018f3ce1e155f1ae7cf9ef5aac35517b8

// batterylow0.s5l8922x.img3:
* '''IV''': ebbc6c6c267367dba62b95ecbd41c2d4
* '''Key''': ab8848b520391fbb8558129b473d08fcfa6924a6bf6de1e29f40b9a9e5480fa6

// batterylow1.s5l8922x.img3:
* '''IV''': 36b7097b3f539c3eb4c5605f338bd44f
* '''Key''': 5afc4c06e0c02416bcd25e8d71111dc3043200eb2432d1efa7c763651590f499

// glyphcharging.s5l8922x.img3:
* '''IV''': 3cb90a84e7be3fc872fbae60b9c300fa
* '''Key''': fffdb6ced18e00bdf240f5aa7ac81144fe353c496225d14f983645a9660ca0c8

// glyphplugin.s5l8922x.img3:
* '''IV''': da21d8b49b66a8e1732f4f0df3724c09
* '''Key''': 2e7c8703279208a80044b322d4ed914e71e65f3a2a4c2d9eecaa51ba2c05bb47

// iBEC.n18ap.RELEASE.dfu:
* '''IV''': a37b98d9e465c60bcc59045d27654e78
* '''Key''': ad80964c516a7f87bab8ce9214f8fece6a2cc83bca98b6e5679fe7aef7a77f1f

// iBSS.n18ap.RELEASE.dfu:
* '''IV''': 962cc5a04ef71269630fd05b7d43f0d6
* '''Key''': f51e414ba2cb4bf68fcd1ea70d420207d4e269d048265b6480764e65af511904

// iBoot.n18ap.RELEASE.img3:
* '''IV''': 6d8082d05c8edd3d259bc004766d1e56
* '''Key''': 45820b2a38c8e7ab8becde45a3e618ceafd32ab56c83fc9f09e183159cca6485

// kernelcache.release.n18:
* '''IV''': 6f0638cceb5b242e9cbd5c81a1904d95
* '''Key''': 0aece5fc2836f6b75cc2363a178a3c0e91d50628ccd263319d0213669cbb25d1

// recoverymode.s5l8922x.img3:
* '''IV''': 1c9b8f01f4b1da66cf46eefdfee96359
* '''Key''': d7a5126c00b60ec61a758ecfe5a9ca53fc64d2829613d5c59d099d3e8d426942

Got them via PwnPie, (cc)qwertyoruiop, 2010. follow @0wnTeam on twitter.

Baker 8B117 (iPod3,1)

2010-11-23T02:38:58Z

Dra1nerdrake: Undo revision 13468 by VMax (Talk) Yeah, don't do that.

// 038-0061-002.dmg
*'''[[VFDecrypt]] Key''': abd68f16920490865a09e559123db1f471ff19743ad15ea8b970a73e28f5efc6c6e76925

// 038-0031-002.dmg (Restore Ramdisk):
* '''IV''': 9064ae28aef1db52cde6f7568c188766
* '''Key''': 1229ee227f260b8746021d4a46366ec42f987c36d4910a4925e6ca0ce369f69f

// 038-0055-002.dmg (Update Ramdisk):
* '''IV''': d7f909a6bace11ab7f7a606ed3afce70
* '''Key''': 2b5bdeb344f4973e69ba5e5491ce052dcd67001729ec77585c5b8e86b4e7e99b

// DeviceTree.n18ap.img3:
* '''IV''': 279487a4411fbeef59c6a56f28034712
* '''Key''': a0da3d6726a9dfda9de135959e31e693c23c3216c08f72a6e6768a08f3892976

// LLB.n18ap.RELEASE.img3:
* '''IV''': 7ca40a75fc54dcb3d07dcc0e290a4937
* '''Key''': ebd73e7f4810a8a592ae3cd00830ceb38aace28ee3dc5661437ba7c3c3c10d38

// applelogo.s5l8922x.img3:
* '''IV''': 7e04e5a857cb61e2cc0038d68fdf1a73
* '''Key''': 91aeeb5b0e932480ad557c55d1c61221481b91918c5da8516ab8383d5bc60ea1

// batterycharging0.s5l8922x.img3:
* '''IV''': a4c1375bb158b08fbeef918ae9e4ba90
* '''Key''': 42e7d0d97c442c26723471c5eaf28af3e2dcf59485f9677ee8a7afbd62441b43

// batterycharging1.s5l8922x.img3:
* '''IV''': 5be4a8f373e36594c8f19b8a90ebda94
* '''Key''': 4d4763deac3cf912d5d23c15260edfbc5f75a8005c8235c6d40f2cc1296280a9

// batteryfull.s5l8922x.img3:
* '''IV''': 1b58d3a8bfd299a39f5465c0df4ee564
* '''Key''': f508f6547c02c671ae15d0beefe4b7e018f3ce1e155f1ae7cf9ef5aac35517b8

// batterylow0.s5l8922x.img3:
* '''IV''': ebbc6c6c267367dba62b95ecbd41c2d4
* '''Key''': ab8848b520391fbb8558129b473d08fcfa6924a6bf6de1e29f40b9a9e5480fa6

// batterylow1.s5l8922x.img3:
* '''IV''': 36b7097b3f539c3eb4c5605f338bd44f
* '''Key''': 5afc4c06e0c02416bcd25e8d71111dc3043200eb2432d1efa7c763651590f499

// glyphcharging.s5l8922x.img3:
* '''IV''': 3cb90a84e7be3fc872fbae60b9c300fa
* '''Key''': fffdb6ced18e00bdf240f5aa7ac81144fe353c496225d14f983645a9660ca0c8

// glyphplugin.s5l8922x.img3:
* '''IV''': da21d8b49b66a8e1732f4f0df3724c09
* '''Key''': 2e7c8703279208a80044b322d4ed914e71e65f3a2a4c2d9eecaa51ba2c05bb47

// iBEC.n18ap.RELEASE.dfu:
* '''IV''': a37b98d9e465c60bcc59045d27654e78
* '''Key''': ad80964c516a7f87bab8ce9214f8fece6a2cc83bca98b6e5679fe7aef7a77f1f

// iBSS.n18ap.RELEASE.dfu:
* '''IV''': 962cc5a04ef71269630fd05b7d43f0d6
* '''Key''': f51e414ba2cb4bf68fcd1ea70d420207d4e269d048265b6480764e65af511904

// iBoot.n18ap.RELEASE.img3:
* '''IV''': 6d8082d05c8edd3d259bc004766d1e56
* '''Key''': 45820b2a38c8e7ab8becde45a3e618ceafd32ab56c83fc9f09e183159cca6485

// kernelcache.release.n18:
* '''IV''': 6f0638cceb5b242e9cbd5c81a1904d95
* '''Key''': 0aece5fc2836f6b75cc2363a178a3c0e91d50628ccd263319d0213669cbb25d1

// recoverymode.s5l8922x.img3:
* '''IV''': 1c9b8f01f4b1da66cf46eefdfee96359
* '''Key''': d7a5126c00b60ec61a758ecfe5a9ca53fc64d2829613d5c59d099d3e8d426942

Got them via PwnPie, (cc)qwertyoruiop, 2010. follow @0wnTeam on twitter.

User talk:Liamchat

2010-11-22T20:30:40Z

Dra1nerdrake: /* How do you get your keys? */ new section

{{Talk Archive|Start to November 1, 2010}}

== KBAGs ==

Hello, Liamchat! I noticed that you've been adding KBAGs to the key pages. I certainly appreciate the addition of such information, but just listing KBAGs without mentioning which file they're for isn't exactly helpful. Would you mind mentioning which file each KBAG is for? --[[User:Dialexio|Dialexio]] 21:39, 11 November 2010 (UTC)
:i added them because i don't have those devices and i think it may help people get the key's if i add them however the exact is
*018-7074-092.dmg:
*018-7082-092.dmg:
*DeviceTree.n90ap.img3:
*LLB.n90ap.RELEASE.img3:
*applelogo-640x960.s5l8930x.img3:
*batterycharging0-640x960.s5l8930x.img3:
*batterycharging1-640x960.s5l8930x.img3:
*batteryfull-640x960.s5l8930x.img3:
*batterylow0-640x960.s5l8930x.img3:
*batterylow1-640x960.s5l8930x.img3:
*glyphcharging-640x960.s5l8930x.img3:
*glyphplugin-640x960.s5l8930x.img3:
*iBEC.n90ap.RELEASE.dfu:
*iBSS.n90ap.RELEASE.dfu:
*iBoot.n90ap.RELEASE.img3:
*kernelcache.release.n81:
*recoverymode-640x960.s5l8930x.img3:
--[[User:Liamchat|liamchat]] 22:09, 11 November 2010 (UTC)

== Ban liamchat request ==
=== Basic discussion ===
There is a petition going on to ban liamchat from this wiki. I'm not sure how serious it is and nobody can vote for him there. So please comment here, pro and contra, preferrably with arguments. I think five users more against him with serious arguments would be enough. --[[User:Http|http]] 22:05, 17 November 2010 (UTC)
:??? Why would you ban him? I havn't seen anything wrong he has done... Please give more info... --[[User:Balloonhead66|Balloonhead66]] 22:15, 17 November 2010 (UTC)
::I don't understand it ether but I do help by filling in the missing keys and check the Current ones --[[User:Liamchat|liamchat]] 22:45, 17 November 2010 (UTC)
:::Just to make it clear: Nobody will be banned just because others don't like someone. For a ban we need a clear majority of people with good arguments. --[[User:Http|http]] 22:52, 17 November 2010 (UTC)
:::Please give evidence of deleting / filling in wrong data. Single mistakes can happen. And his problems on IRC are unrelated to this wiki. --[[User:Http|http]] 21:55, 18 November 2010 (UTC)
:I'm someone who wants him banned. My name is Fike here on the net. He constantly spams IRC networks with all types of shit... I had quite a job getting rid of him from Sauriks server, but I did it. He alsdo takes other peoples nicks, for instance "cj"'s nick was taken on sauriks server. cj couldn't ghost it, because services weren't online. And I've heard from numerous people he adds inaccurate information here on the wiki. My 2 cents. --[[User:Fike|Fike]] 20:59, 20 November 2010 (UTC)
::Lets not forget that you spammed my [http://cole.freehostingcloud.com/wiki/Cole_Stuff wiki]... --[[User:Balloonhead66|Balloonhead66]] 23:28, 20 November 2010 (UTC)

===Table===
Please fill out this table with info... use <code><nowiki>{{yes|Pro}}</nowiki></code> for a pro, <code><nowiki>{{no|Con}}</nowiki></code> for a con, or <code><nowiki>{{partial|Somewhat}}</nowiki></code> for a ehh... in the first column
{| class="sortable wikitable" border="1"
|-
! Pro/Con
! What it is
! Evidence
! Adder
|-
| {{yes|Pro}}
| He helps out this wiki alot
| [[Special:Contributions/Liamchat]]
| [[User:Balloonhead66|Balloonhead66]]
|-
| {{yes|Pro}}
| He helps overall, but could take a little break every so often and learn more about orginizing.
| Many pages
| [[User:JacobVengeance|JacobVengeance]]
|-
| {{partial|Somewhat}}
| He needs to work on formatting
| [[:/dev]]
| [[User:Balloonhead66|Balloonhead66]]
|-
| {{yes|Pro}}
| He tested software to help developers
| [[Talk:PwnPie]]
| [[User:liamchat|liamchat]]
|-
| {{yes|Pro}}
| He finished the transcript of the [[25C3 presentation Hacking the iPhone]]
| [[25C3 presentation Hacking the iPhone]]
| [[User:liamchat|liamchat]]
|-
| {{yes|Pro}}
| He added iv/keys that where old and ignored
| [[Timberline 5G77a (iPod touch 2G)]]
| [[User:liamchat|liamchat]]
|-
| {{yes|Pro}}
| He help's people when they ask on the wiki
| [[Talk:AES Keys]]
| [[User:liamchat|liamchat]]
|-
| {{No|Con}}
| He has stolen keys from users like GreySyntax and often posts useless/incorrect keys. He also deletes proper info and cites the Wiki for everything. Finally, his KBAGS aren't needed.
| {{cn}}
| [[User:vexenon|vexenon]]
|-
| {{No|Con}}
| For several times he has posted wrong keys in the wiki. Deletes correct info replacing it with he's own. (Apart from being a major spammer and general annoyance at IRC)
| {{Cn}}
| [[User:Z00L|Z00L]]
|-
|{{no|Con}}
| He does not follow the proper format for posting keys.
|[[JasperVail 8C148 (iPhone 4)]] a few revisions ago
|[[User:Dra1nerdrake]]
|}

===stolen keys===
can you give evidence of which keys are the stolen keys because i use [[PwnPie]] to grab my keys and only greysyntax can say i stole his keys --[[User:Liamchat|liamchat]] 17:28, 18 November 2010 (UTC)

===useless/incorrect keys===
i check every key i post and use the kbag's as evidence to prove it works --[[User:Liamchat|liamchat]] 17:28, 18 November 2010 (UTC)
:Where? I personally have tested almost all VFDecrypt keys he has posted and they are correct --[[User:Balloonhead66|Balloonhead66]] 00:23, 19 November 2010 (UTC)
Kernelcache keys for wrong AP posted (expected: n90; actual:k48)
[http://theiphonewiki.com/wiki/index.php?title=JasperVail_8C148_(iPhone_4)&oldid=13282#kernelcache] [http://theiphonewiki.com/wiki/index.php?title=JasperVail_8C148_%28iPhone_4%29&diff=13354&oldid=13282] Note that keys were correct, but not for the target AP. A4 firmware is tricky ;)

===Conclusions===
I can see a lot of haters and some problems. I don't think we should ban him for what he has done. What seems to be proven for me is that he wants to make himself important. He is clearly no hacker and hasn't contributed any real value in this wiki. But this applies to many others also (maybe also to me?)

I think this should be a warning to him: Please be very careful with all your next edits, especially page additions. Better ask on the talk page if others agree with you before you edit. For keys pages use the standard template and avoid multiple edits. Also, please watch what you do outside of this wiki (tools, IRC, etc). I won't judge you for that, but others do.

For the haters: Please tell him friendly what he does wrong. And/or tell me and I'll tell it to him. I could forbid him to change any keys pages for example or to make more than one edit per day or whatever. Depending on how big the problem is. And it is clear that if he doesn't obey any given rules what I can do.

Let's forgive him all his mistakes of the past and treat him as a new user for now. And remember to tell me if it doesn't work. So I'll close this discussion for now and I will treat this case as solved, expecting adult, friendly behavior from all sides.

We can delete and/or archive this discussion in a while. --[[User:Http|http]] 00:40, 20 November 2010 (UTC)
:Well said, mate! :) --[[User:Dialexio|Dialexio]] 00:57, 20 November 2010 (UTC)

== Edit Wars ==

* Opinion - "a belief or judgment that rests on grounds insufficient to produce complete certainty." [http://dictionary.reference.com/browse/opinion]

One doesn't need evidence to state an opinion. For example, I can safely go around saying, "Cookies taste good," without proof and no one will bash me for it. THEREFORE, the entries in the above table should NOT be edited by anyone other than their author, as that is their opinion. You can't make me think that red isn't a good color anymore than I can make you enjoy using hairspray.

My point is, it's someone's opinion and you can't change it.

Therefore, </edit-war> --[[User:Dra1nerdrake|dra1nerdrake]] 00:45, 19 November 2010 (UTC)
:I like your thinking. I agree 100%
:P.S: I object your "Cookies taste good" since I'm always right ;P
:--[[User:Ifish|Ifish]] 00:59, 19 November 2010 (UTC)
::Thank you. ~drake
:::also can we remove the mentioning of greysyntax he never said i stole his keys --[[User:Liamchat|liamchat]] 15:39, 19 November 2010 (UTC)

== Template for keys ==

Hi liamchat! It's nice if you post new keys pages. But could you use the standard format (template), I mean like [[JasperVail 8C134 (iPhone_3GS)]], instead of [http://theiphonewiki.com/wiki/index.php?title=JasperVail_8C148_%28iPod_touch_2G%29&oldid=13271 this new page from you]? Preferrably without the KBAGs (until all agreed that we want them). This way you save us some reformatting work and you'll have less haters. Thanks! --[[User:Http|http]] 23:35, 19 November 2010 (UTC)
:ok when I grab the keys it reads the restore.plist and places them in the order that apple use however I do think i can change that also I will remove the kbag field --[[User:Liamchat|liamchat]] 00:29, 20 November 2010 (UTC)
::Not only the order, also the titles, etc. --[[User:Http|http]]
::On your new page [[Jasper 8C148 (iPad)]] you did it again. Please update it according to the [[Template:Keys|template]]. Thanks. --[[User:Http|http]] 19:15, 22 November 2010 (UTC)
:::ok i am trying to incorporate the template into the program, i am editing them now --[[User:Liamchat|liamchat]] 19:33, 22 November 2010 (UTC)
::::You have been warned before that you have to use the template. And even after my message above you posted another one not following the rules. Please understand that you have to play nice with others. There is no race to be the first here. As a consequence you have been blocked for a day to think about this. Next time it's more than a day. I hope you understand that. -- [[User:Http|http]] 20:22, 22 November 2010 (UTC)

== How do you get your keys? ==

You may or may not realize it, but you can only get iPhone 4 keys with an iPhone 4. Likewise, you can only get iPad keys with an iPad. So on and so on. This is because each device has a unique AES engine. If you have been posting iPhone 4 keys by running your shell script with an iPod touch 2G or anything else than an iPhone 4, you've been posting incorrect keys and I'd appreciate it if you tested them with xpwn to see if they give you binaries or gobbledygook. In the case of the latter, please remove the keys that are incorrect but leave the pages intact, as I've just reformatted some of them. --[[User:Dra1nerdrake|dra1nerdrake]] 20:30, 22 November 2010 (UTC)

Jasper 8C148 (iPhone3,1)

2010-11-22T20:01:12Z

Dra1nerdrake: /* Decryption Keys */ Fixed the template. O.o Please for the love of all that is holy, USE THE TEMPLATE

== Decryption Keys ==
=== Root Filesystem (038-0019-002.dmg) ===
*'''[[VFDecrypt]] Key''': b2ee5018ef7d02e45ef67449d9e2ed5f876efae949de64a9a93dbcf7ff9ed84e041e9167

=== Update Ramdisk (038-0024-002.dmg) ===
* '''IV''': 509e699fcfbc5317fa5eb3e79fc5a932
* '''Key''': 9cee1bb0bf019db324eb266f426b80fbcfba614464932c6b416ed039fbde73dd

=== Restore Ramdisk (038-0032-002.dmg) ===
* '''IV''': 9b20ae16bebf4cf1b9101374c3ab0095
* '''Key''': 06849aead2e9a6ca8a82c3929bad5c2368942e3681a3d5751720d2aacf0694c0

=== AppleLogo ===
* '''IV''': 0dcee7d1b9982793558d588d84c44af0
* '''Key''': 91866d7b929b971c72fa6e90530a5b2a361bed9486f2cb884b632f61253ed204

=== BatteryCharging0 ===
* '''IV''': bf594f1948cfe699ed81978da918c9a2
* '''Key''': 6059d6622dc37946e52d2fe87d64541b2142362a9f33576647d0e4210bd98d1b

=== BatteryCharging1 ===
* '''IV''': 55fbd7a9c6b27af1edc3d79a1e4a7a5e
* '''Key''': e4b8dd16397ce416a6309b594034c8e024c245dcff046014331d71e307047939

=== BatteryFull ===
* '''IV''': 6ea98a78db9deca4cc1d37ab2b01bf72
* '''Key''': 311b3abb89083cd245b2c00bb9207b3fa721435b4f53836a97c38cfde4b20268

=== BatteryLow0 ===
* '''IV''': 411cf59c075aed7412eac6cb209b635f
* '''Key''': 809a6d52d5ed34d6d35397c1bce23190a09e353418394b33e60b5257de1ee117

=== BatteryLow1 ===
* '''IV''': 76d3f38f8badef93c8a243f4e96e739e
* '''Key''': fdacba0a29f3b650cd135864ee95cb088cb905342912de93fd5a7bf288c99d75

=== DeviceTree ===
* '''IV''': ea8153bd8ef0b7965e1855959f8706ed
* '''Key''': 91fb8c543820ad313578a175d28e74caac973759a766167e423d872dae361ca7

=== GlyphCharging ===
* '''IV''': 604dfca9640b9f800a3b478adbe63aa0
* '''Key''': 3fa0ae7d2411725bfbffff4e06adcf24373d641703a0cd24d2fa34c64544f90a

=== GlyphPlugin ===
* '''IV''': 746787d5ea62187e084c2d0c1f9399cc
* '''Key''': edc4ee23eff28d4b021e23d986972558bc9d108b7332abff1600e0e01eac23bf

=== [[iBEC]] ===
* '''IV''': 5125bb86e2139b3f4cfb3a470c699df2
* '''Key''': 9aa1f074b26ae75bd394e7138f1195dc784bd774c81f9cc4d80f9b3eedd60edf

=== [[IBoot (Bootloader)|iBoot]] ===
* '''IV''': dadfae4f4967eff4f149b606cbe34060
* '''Key''': 65b69a67acc72771aea43b15b70a566139a42257bdab7659cdab1ab2537713af

=== [[iBSS]] ===
* '''IV''': 45bbf0fa98573425fa21dc6e529eba6b
* '''Key''': 32398d3d1328ed3f0e1949446a1357585ae1973b3c8434b83df49ac55cf45d06

=== [[Kernelcache]] ===
* '''IV''': ca2d0d625d71d50f32be0e82ab83415f
* '''Key''': 0173639a2d737a063b25956464f5907abae4e0081e102330206e8636817561d4

=== [[LLB]] ===
* '''IV''': e0514f26e05ab9db509033f36d7440e8
* '''Key''': 3c135743c32306664125a9e07cc280ee8fd014830353e385fb13a85b28698d05

=== RecoveryMode ===
* '''IV''': 9a59ae16a84808e8d7546269e36a21c0
* '''Key''': ff278adcb52647785fd58ad689739fdcdace7acd08d932b4c32d54ea2c2032d8

Jasper 8C148 (iPhone3,1)

2010-11-22T19:53:04Z

Dra1nerdrake: PLEASE FOLLOW THE TEMPLATE

==Decryption Keys==
=== Root Filesystem (038-0019-002.dmg) ===
*'''[[VFDecrypt]] Key''': b2ee5018ef7d02e45ef67449d9e2ed5f876efae949de64a9a93dbcf7ff9ed84e041e9167

=== Update Ramdisk (038-0024-002.dmg) ===
* '''IV''': 509e699fcfbc5317fa5eb3e79fc5a932
* '''Key''': 9cee1bb0bf019db324eb266f426b80fbcfba614464932c6b416ed039fbde73dd

===restore ramdisk 038-0032-002.dmg===
* '''IV''': 9b20ae16bebf4cf1b9101374c3ab0095
* '''Key''': 06849aead2e9a6ca8a82c3929bad5c2368942e3681a3d5751720d2aacf0694c0

===applelogo-640x960.s5l8930x.img3===
* '''IV''': 0dcee7d1b9982793558d588d84c44af0
* '''Key''': 91866d7b929b971c72fa6e90530a5b2a361bed9486f2cb884b632f61253ed204

===batterycharging0-640x960.s5l8930x.img3===
* '''IV''': bf594f1948cfe699ed81978da918c9a2
* '''Key''': 6059d6622dc37946e52d2fe87d64541b2142362a9f33576647d0e4210bd98d1b

===batterycharging1-640x960.s5l8930x.img3===
* '''IV''': 55fbd7a9c6b27af1edc3d79a1e4a7a5e
* '''Key''': e4b8dd16397ce416a6309b594034c8e024c245dcff046014331d71e307047939

===batteryfull-640x960.s5l8930x.img3===
* '''IV''': 6ea98a78db9deca4cc1d37ab2b01bf72
* '''Key''': 311b3abb89083cd245b2c00bb9207b3fa721435b4f53836a97c38cfde4b20268

===batterylow0-640x960.s5l8930x.img3===
* '''IV''': 411cf59c075aed7412eac6cb209b635f
* '''Key''': 809a6d52d5ed34d6d35397c1bce23190a09e353418394b33e60b5257de1ee117

===batterylow1-640x960.s5l8930x.img3===
* '''IV''': 76d3f38f8badef93c8a243f4e96e739e
* '''Key''': fdacba0a29f3b650cd135864ee95cb088cb905342912de93fd5a7bf288c99d75

===DeviceTree.n90ap.img3===
* '''IV''': ea8153bd8ef0b7965e1855959f8706ed
* '''Key''': 91fb8c543820ad313578a175d28e74caac973759a766167e423d872dae361ca7

===glyphcharging-640x960.s5l8930x.img3===
* '''IV''': 604dfca9640b9f800a3b478adbe63aa0
* '''Key''': 3fa0ae7d2411725bfbffff4e06adcf24373d641703a0cd24d2fa34c64544f90a

===glyphplugin-640x960.s5l8930x.img3===
* '''IV''': 746787d5ea62187e084c2d0c1f9399cc
* '''Key''': edc4ee23eff28d4b021e23d986972558bc9d108b7332abff1600e0e01eac23bf

===iBEC.n90ap.RELEASE.dfu===
* '''IV''': 5125bb86e2139b3f4cfb3a470c699df2
* '''Key''': 9aa1f074b26ae75bd394e7138f1195dc784bd774c81f9cc4d80f9b3eedd60edf

===iBoot.n90ap.RELEASE.img3===
* '''IV''': dadfae4f4967eff4f149b606cbe34060
* '''Key''': 65b69a67acc72771aea43b15b70a566139a42257bdab7659cdab1ab2537713af

===iBSS.n90ap.RELEASE.dfu===
* '''IV''': 45bbf0fa98573425fa21dc6e529eba6b
* '''Key''': 32398d3d1328ed3f0e1949446a1357585ae1973b3c8434b83df49ac55cf45d06

===kernelcache.release.k48===
* '''IV''': ca2d0d625d71d50f32be0e82ab83415f
* '''Key''': 0173639a2d737a063b25956464f5907abae4e0081e102330206e8636817561d4

===LLB.n90ap.RELEASE.img3===
* '''IV''': e0514f26e05ab9db509033f36d7440e8
* '''Key''': 3c135743c32306664125a9e07cc280ee8fd014830353e385fb13a85b28698d05

===[[Recovery Mode]]===
* '''IV''': 9a59ae16a84808e8d7546269e36a21c0
* '''Key''': ff278adcb52647785fd58ad689739fdcdace7acd08d932b4c32d54ea2c2032d8

User:Dra1nerdrake

2010-11-21T22:11:20Z

Dra1nerdrake:

== Bio ==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

== Devices & SHSH's ==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2.1 GM.

== Contact Info ==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/drakealleg]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

== Pet Peeves ==
* Following incorrect formatting!
* Linking to things that don't exist!
* Not signing your talk page posts.

User:Dra1nerdrake

2010-11-21T22:10:17Z

Dra1nerdrake: /* Pet Peeves */

== Bio ==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

== Devices & SHSH's ==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2.1 GM.

== Contact Info ==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/drakealleg]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

== Pet Peeves ==
'' * Following incorrect formatting!
* Linking to things that don't exist!
* Not signing your talk page posts.''

User:Dra1nerdrake

2010-11-21T22:09:58Z

Dra1nerdrake: /* Pet Peeves */

== Bio ==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

== Devices & SHSH's ==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2.1 GM.

== Contact Info ==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/drakealleg]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

== Pet Peeves ==
*'' Following incorrect formatting!
* Linking to things that don't exist!
* Not signing your talk page posts.''

User:Dra1nerdrake

2010-11-21T22:09:37Z

Dra1nerdrake:

== Bio ==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

== Devices & SHSH's ==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2.1 GM.

== Contact Info ==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/drakealleg]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

== Pet Peeves ==
''* Following incorrect formatting!
* Linking to things that don't exist!
* Not signing your talk page posts.''

User:Dra1nerdrake

2010-11-21T05:24:19Z

Dra1nerdrake: /* Devices & SHSH's */

==Bio==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

==Devices & SHSH's==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2.1 GM.

==Contact info==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/drakealleg]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

==Pet Peeves==
* Following incorrect formatting!
* Linking to things that don't exist!
* Not signing your talk page posts.

User:Dra1nerdrake

2010-11-21T05:24:02Z

Dra1nerdrake:

==Bio==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

==Devices & SHSH's==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2 GM.

==Contact info==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/drakealleg]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

==Pet Peeves==
* Following incorrect formatting!
* Linking to things that don't exist!
* Not signing your talk page posts.

User talk:Liamchat

2010-11-21T05:22:52Z

Dra1nerdrake: /* Table */

{{Talk Archive|Start to November 1, 2010}}

== KBAGs ==

Hello, Liamchat! I noticed that you've been adding KBAGs to the key pages. I certainly appreciate the addition of such information, but just listing KBAGs without mentioning which file they're for isn't exactly helpful. Would you mind mentioning which file each KBAG is for? --[[User:Dialexio|Dialexio]] 21:39, 11 November 2010 (UTC)
:i added them because i don't have those devices and i think it may help people get the key's if i add them however the exact is
*018-7074-092.dmg:
*018-7082-092.dmg:
*DeviceTree.n90ap.img3:
*LLB.n90ap.RELEASE.img3:
*applelogo-640x960.s5l8930x.img3:
*batterycharging0-640x960.s5l8930x.img3:
*batterycharging1-640x960.s5l8930x.img3:
*batteryfull-640x960.s5l8930x.img3:
*batterylow0-640x960.s5l8930x.img3:
*batterylow1-640x960.s5l8930x.img3:
*glyphcharging-640x960.s5l8930x.img3:
*glyphplugin-640x960.s5l8930x.img3:
*iBEC.n90ap.RELEASE.dfu:
*iBSS.n90ap.RELEASE.dfu:
*iBoot.n90ap.RELEASE.img3:
*kernelcache.release.n81:
*recoverymode-640x960.s5l8930x.img3:
--[[User:Liamchat|liamchat]] 22:09, 11 November 2010 (UTC)

== Ban liamchat request ==
=== Basic discussion ===
There is a petition going on to ban liamchat from this wiki. I'm not sure how serious it is and nobody can vote for him there. So please comment here, pro and contra, preferrably with arguments. I think five users more against him with serious arguments would be enough. --[[User:Http|http]] 22:05, 17 November 2010 (UTC)
:??? Why would you ban him? I havn't seen anything wrong he has done... Please give more info... --[[User:Balloonhead66|Balloonhead66]] 22:15, 17 November 2010 (UTC)
::I don't understand it ether but I do help by filling in the missing keys and check the Current ones --[[User:Liamchat|liamchat]] 22:45, 17 November 2010 (UTC)
:::Just to make it clear: Nobody will be banned just because others don't like someone. For a ban we need a clear majority of people with good arguments. --[[User:Http|http]] 22:52, 17 November 2010 (UTC)
:::Please give evidence of deleting / filling in wrong data. Single mistakes can happen. And his problems on IRC are unrelated to this wiki. --[[User:Http|http]] 21:55, 18 November 2010 (UTC)
:I'm someone who wants him banned. My name is Fike here on the net. He constantly spams IRC networks with all types of shit... I had quite a job getting rid of him from Sauriks server, but I did it. He alsdo takes other peoples nicks, for instance "cj"'s nick was taken on sauriks server. cj couldn't ghost it, because services weren't online. And I've heard from numerous people he adds inaccurate information here on the wiki. My 2 cents. --[[User:Fike|Fike]] 20:59, 20 November 2010 (UTC)
::Lets not forget that you spammed my [http://cole.freehostingcloud.com/wiki/Cole_Stuff wiki]... --[[User:Balloonhead66|Balloonhead66]] 23:28, 20 November 2010 (UTC)

===Table===
Please fill out this table with info... use <code><nowiki>{{yes|Pro}}</nowiki></code> for a pro, <code><nowiki>{{no|Con}}</nowiki></code> for a con, or <code><nowiki>{{partial|Somewhat}}</nowiki></code> for a ehh... in the first column
{| class="sortable wikitable" border="1"
|-
! Pro/Con
! What it is
! Evidence
! Adder
|-
| {{yes|Pro}}
| He helps out this wiki alot
| [[Special:Contributions/Liamchat]]
| [[User:Balloonhead66|Balloonhead66]]
|-
| {{yes|Pro}}
| He helps overall, but could take a little break every so often and learn more about orginizing.
| Many pages
| [[User:JacobVengeance|JacobVengeance]]
|-
| {{partial|Somewhat}}
| He needs to work on formatting
| [[:/dev]]
| [[User:Balloonhead66|Balloonhead66]]
|-
| {{yes|Pro}}
| He tested software to help developers
| [[Talk:PwnPie]]
| [[User:liamchat|liamchat]]
|-
| {{yes|Pro}}
| He finished the transcript of the [[25C3 presentation Hacking the iPhone]]
| [[25C3 presentation Hacking the iPhone]]
| [[User:liamchat|liamchat]]
|-
| {{yes|Pro}}
| He added iv/keys that where old and ignored
| [[Timberline 5G77a (iPod touch 2G)]]
| [[User:liamchat|liamchat]]
|-
| {{yes|Pro}}
| He help's people when they ask on the wiki
| [[Talk:AES Keys]]
| [[User:liamchat|liamchat]]
|-
| {{No|Con}}
| He has stolen keys from users like GreySyntax and often posts useless/incorrect keys. He also deletes proper info and cites the Wiki for everything. Finally, his KBAGS aren't needed.
| {{cn}}
| [[User:vexenon|vexenon]]
|-
| {{No|Con}}
| For several times he has posted wrong keys in the wiki. Deletes correct info replacing it with he's own. (Apart from being a major spammer and general annoyance at IRC)
| {{Cn}}
| [[User:Z00L|Z00L]]
|-
|{{no|Con}}
| He does not follow the proper format for posting keys.
|[[JasperVail 8C148 (iPhone 4)]] a few revisions ago
|[[User:Dra1nerdrake]]
|}

===stolen keys===
can you give evidence of which keys are the stolen keys because i use [[PwnPie]] to grab my keys and only greysyntax can say i stole his keys --[[User:Liamchat|liamchat]] 17:28, 18 November 2010 (UTC)

===useless/incorrect keys===
i check every key i post and use the kbag's as evidence to prove it works --[[User:Liamchat|liamchat]] 17:28, 18 November 2010 (UTC)
:Where? I personally have tested almost all VFDecrypt keys he has posted and they are correct --[[User:Balloonhead66|Balloonhead66]] 00:23, 19 November 2010 (UTC)
Kernelcache keys for wrong AP posted (expected: n90; actual:k48)
[http://theiphonewiki.com/wiki/index.php?title=JasperVail_8C148_(iPhone_4)&oldid=13282#kernelcache] Note that keys were correct, but not for the target AP. A4 firmware is tricky ;)

===Conclusions===
I can see a lot of haters and some problems. I don't think we should ban him for what he has done. What seems to be proven for me is that he wants to make himself important. He is clearly no hacker and hasn't contributed any real value in this wiki. But this applies to many others also (maybe also to me?)

I think this should be a warning to him: Please be very careful with all your next edits, especially page additions. Better ask on the talk page if others agree with you before you edit. For keys pages use the standard template and avoid multiple edits. Also, please watch what you do outside of this wiki (tools, IRC, etc). I won't judge you for that, but others do.

For the haters: Please tell him friendly what he does wrong. And/or tell me and I'll tell it to him. I could forbid him to change any keys pages for example or to make more than one edit per day or whatever. Depending on how big the problem is. And it is clear that if he doesn't obey any given rules what I can do.

Let's forgive him all his mistakes of the past and treat him as a new user for now. And remember to tell me if it doesn't work. So I'll close this discussion for now and I will treat this case as solved, expecting adult, friendly behavior from all sides.

We can delete and/or archive this discussion in a while. --[[User:Http|http]] 00:40, 20 November 2010 (UTC)
:Well said, mate! :) --[[User:Dialexio|Dialexio]] 00:57, 20 November 2010 (UTC)

== Edit Wars ==

* Opinion - "a belief or judgment that rests on grounds insufficient to produce complete certainty." [http://dictionary.reference.com/browse/opinion]

One doesn't need evidence to state an opinion. For example, I can safely go around saying, "Cookies taste good," without proof and no one will bash me for it. THEREFORE, the entries in the above table should NOT be edited by anyone other than their author, as that is their opinion. You can't make me think that red isn't a good color anymore than I can make you enjoy using hairspray.

My point is, it's someone's opinion and you can't change it.

Therefore, </edit-war> --[[User:Dra1nerdrake|dra1nerdrake]] 00:45, 19 November 2010 (UTC)
:I like your thinking. I agree 100%
:P.S: I object your "Cookies taste good" since I'm always right ;P
:--[[User:Ifish|Ifish]] 00:59, 19 November 2010 (UTC)
::Thank you. ~drake
:::also can we remove the mentioning of greysyntax he never said i stole his keys --[[User:Liamchat|liamchat]] 15:39, 19 November 2010 (UTC)

== Template for keys ==

Hi liamchat! It's nice if you post new keys pages. But could you use the standard format (template), I mean like [[JasperVail 8C134 (iPhone_3GS)]], instead of [http://theiphonewiki.com/wiki/index.php?title=JasperVail_8C148_%28iPod_touch_2G%29&oldid=13271 this new page from you]? Preferrably without the KBAGs (until all agreed that we want them). This way you save us some reformatting work and you'll have less haters. Thanks! --[[User:Http|http]] 23:35, 19 November 2010 (UTC)
:ok when I grab the keys it reads the restore.plist and places them in the order that apple use however I do think i can change that also I will remove the kbag field --[[User:Liamchat|liamchat]] 00:29, 20 November 2010 (UTC)
::Not only the order, also the titles, etc. --[[User:Http|http]]

Template:Keys

2010-11-21T05:08:29Z

Dra1nerdrake:

This is the accepted standard for Key/IV .imgX decryption page. In the event of a new firmware, one should:

'''A)''' Create a new page with a title that is like the current accepted standard;

'''B)''' Copy and paste the following template into said page;

'''C)''' From BuildManifest.plist, one should discover which "XXX-XXXX-XXX.dmg" is which and list them, replacing the X's;

'''D)''' Add in the appropriate keys for the corresponding fields;

'''E)''' (Optional)Write a brief description of the purpose of the firmware.

'''''NB''' The order of importance when finding keys is ALWAYS system files first (e.g. ramdisks, filesystem, LLB, iBoot, iBSS, iBEC, DeviceTree, etc...), then the iBoot images (e.g. GlyphCharging, etc...).''

'''''NB''' Also, the things linked to in the below template ARE LINKED TO FOR A REASON. If it's not linked to, it doesn't exist. So don't make a bunch of red links, please.''
<nowiki>
== Decryption Keys ==
=== Root Filesystem (XXX-XXXX-XXX.dmg) ===
*'''[[VFDecrypt]] Key''':

=== Update Ramdisk (XXX-XXXX-XXX.dmg) ===
* '''IV''':
* '''Key''':

=== Restore Ramdisk (XXX-XXXX-XXX.dmg) ===
* '''IV''':
* '''Key''':

=== AppleLogo ===
* '''IV''':
* '''Key''':

=== BatteryCharging0 ===
* '''IV''':
* '''Key''':

=== BatteryCharging1 ===
* '''IV''':
* '''Key''':

=== BatteryFull ===
* '''IV''':
* '''Key''':

=== BatteryLow0 ===
* '''IV''':
* '''Key''':

=== BatteryLow1 ===
* '''IV''':
* '''Key''':

=== DeviceTree ===
* '''IV''':
* '''Key''':

=== GlyphCharging ===
* '''IV''':
* '''Key''':

=== GlyphPlugin ===
* '''IV''':
* '''Key''':

=== [[iBEC]] ===
* '''IV''':
* '''Key''':

=== [[IBoot (Bootloader)|iBoot]] ===
* '''IV''':
* '''Key''':

=== [[iBSS]] ===
* '''IV''':
* '''Key''':

=== [[Kernelcache]] ===
* '''IV''':
* '''Key''':

=== [[LLB]] ===
* '''IV''':
* '''Key''':

=== RecoveryMode ===
* '''IV''':
* '''Key''': </nowiki>

Talk:JasperVail 8C148 (iPhone 4)

2010-11-21T04:58:08Z

Dra1nerdrake: KBAG

== KBAG ==

Can I get rid of 'em? --[[User:Dra1nerdrake|dra1nerdrake]] 04:58, 21 November 2010 (UTC)

Template:Keys

2010-11-21T01:34:43Z

Dra1nerdrake: LOOOONGGGG overdue...

This is the accepted standard for Key/IV .imgX decryption page. In the event of a new firmware, one should:

'''A)''' Create a new page with a title that is like the current accepted standard;

'''B)''' Copy and paste the following template into said page;

'''C)''' From BuildManifest.plist, one should discover which "XXX-XXXX-XXX.dmg" is which and list them, replacing the X's;

'''D)''' Add in the appropriate keys for the corresponding field;

'''E)''' (Optional)Write a brief description of the purpose of the firmware.

'''''NB''' The order of importance when finding keys is ALWAYS system files first (e.g. ramdisks, filesystem, LLB, iBoot, iBSS, iBEC, DeviceTree, etc...), then the iBoot images (e.g. GlyphCharging, etc...).''

<nowiki>
== Keys ==
=== Root Filesystem (XXX-XXXX-XXX.dmg) ===
*'''[[VFDecrypt]] Key''':

=== Update Ramdisk (XXX-XXXX-XXX.dmg) ===
* '''IV''':
* '''Key''':

=== Restore Ramdisk (XXX-XXXX-XXX.dmg) ===
* '''IV''':
* '''Key''':

=== AppleLogo ===
* '''IV''':
* '''Key''':

=== BatteryCharging0 ===
* '''IV''':
* '''Key''':

=== BatteryCharging1 ===
* '''IV''':
* '''Key''':

=== BatteryFull ===
* '''IV''':
* '''Key''':

=== BatteryLow0 ===
* '''IV''':
* '''Key''':

=== BatteryLow1 ===
* '''IV''':
* '''Key''':

=== DeviceTree ===
* '''IV''':
* '''Key''':

=== GlyphCharging ===
* '''IV''':
* '''Key''':

=== GlyphPlugin ===
* '''IV''':
* '''Key''':

=== [[iBEC]] ===
* '''IV''':
* '''Key''':

=== [[IBoot (Bootloader)|iBoot]] ===
* '''IV''':
* '''Key''':

=== [[iBSS]] ===
* '''IV''':
* '''Key''':

=== [[Kernelcache]] ===
* '''IV''':
* '''Key''':

=== [[LLB]] ===
* '''IV''':
* '''Key''':

=== RecoveryMode ===
* '''IV''':
* '''Key''': </nowiki>

Talk:Limera1n

2010-11-19T22:05:27Z

Dra1nerdrake: /* MOve to limera1n.app */

{{DISPLAYTITLE:Talk:limera1n}}
== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out SHAtter and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:geohot|geohot's]] exploit not used and keep SHAtter for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)
:::I think it's because they need to be plugged in for the ramdisk to be uploaded (hence the logo). --[[User:Palz|Palz]] 21:15, 12 October 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)

::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)

== He did it==
It's in the wild. Thoughts? ~Drake
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)
::::::Blackra1n uses purpled1sk too :/ All it is is an exploit like arm7_go in DFU that pwns iBoot (temporarily) and applies a userland jailbreak from a ramdisk. --[[User:Palz|Palz]] 22:16, 15 October 2010 (UTC)
the exploit ( it is a heap overflow ) is used to create a command called geohot ( in the [[NOR_%28NVRAM%29]] same as in [[Purplera1n]] ) maybe purpled1sk is the best for the job [[iBoot]] cannot be changed it will remove [[SHSH]] preventing the device from booting --[[User:Liamchat|liamchat]] 22:32, 15 October 2010 (UTC)
:do u hear urself talk? the bootrom exploit in limera1n is not a heap overflow. -__- the heap overflow is the userland exploit used to achieve an untethered status.[[User:Leobruh|Leobruh]] 20:20, 19 October 2010 (UTC)!
The kernel patch ocurs after the lime logo is shown ( when a ramdisk is mounted ) after the ramdisk is sent you can disconnect the device --[[User:Liamchat|liamchat]] 21:23, 19 October 2010 (UTC)

== Pwnage ==

Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)

== Support ==

I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)

== Why no ipt2g support? ==

I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)

:It works for the ipt2g new bootrom, but geohot didn't take his time to remake anything so that it would work with our device. greenpois0n will support our devices, just takes a little while to write up everything needed. --[[User:JacobVengeance|JakeAnthraX]] 05:24, 13 October 2010 (UTC)

:IPT2G support is now in GreenPois0n --[[User:Fclinton|FClinton]] 23:39, 19 October 2010 (UTC)

:It's not a matter of time, the exploit itself is not compatible with ipt2g bootrom. GreenPois0n use another bootrom exploit to achieve the compatiblity with ipt2g. --[[User:Pod2g|Pod2g]]

== hacktivation.dylib ==

I added info about it and how to remove it for people who activate with iTunes. Hope no one minds. --[[User:Cmdshft|cmdshft]] 04:31, 13 October 2010 (UTC)
:I have my 3GS officially activated and had no problems at all with this dylib or anything else related to activation so far... I'm officially unlocked too... Should I still remove the dylib even if I had no problems?? --[[User:Luxiel|Luxiel]] 17:02, 19 October 2010 (UTC)
::Nevermind, i just followed that tutorial and end up fucking my 3GS, restoring it ATM... So, I will use greenpois0n once it is done... That tutorial just fucked my activation... thx for the one that posted it... --[[User:Luxiel|Luxiel]] 02:26, 21 October 2010 (UTC)
:::Just completing this history... I followed those commands with my officially activated 3GS and I had to clean restore and rejailbreak with limera1n... So I guess this "hacktivation may be harmfull" thing may be wrong... --[[User:Luxiel|Luxiel]] 19:56, 21 October 2010 (UTC)

== Pwn4life ==

Is this a pwned4life? If it is, can a restore remove it? --[[User:Balloonhead66|Balloonhead66]] 02:10, 15 October 2010 (UTC)
:A DFU Mode restore will return you to a fresh and all Apple state --[[User:OMEGA RAZER|OMEGA RAZER]] 04:20, 15 October 2010 (UTC)

:Pwned4life isn't like permanent jailbreak on the device, just means there is an exploit that will always be there to allow jailbreaks. A restore will get rid of it simple. --[[User:JacobVengeance|JakeAnthraX]] 19:37, 19 October 2010 (UTC)

== MOve to limera1n.app ==
I think this page should be moved to limera1n.app --[[User:Balloonhead66|Balloonhead66]] 18:39, 23 October 2010 (UTC)
:Why? Limera1n.app is the application installed by the ramdisk used in this jailbreak. Therefore, it's a very minute part of the jailbreak. Limera1n as a whole, consists of the initial exploit in the hardware, the exploit to achieve unsigned code exec., and etc. It's much more than a simple app for your phone. :P --[[User:Dra1nerdrake|dra1nerdrake]] 04:20, 19 November 2010 (UTC)
::Wrong, [[:/var/stash/Applications.*****/blackra1n.app]] is what is installed by the ramdisk. He uses blackra1n.app for blackra1n and limera1n. I know. I looked in my device, want proof, just use OpenSSH on a 4.1 device and you will see. Anyways, [[Cydia.app]], howabout blackra1n.app and limera1n.app? --[[User:Balloonhead66|Balloonhead66]] 04:24, 19 November 2010 (UTC)
:::Even better, the title limera1n.app means nothing. That's like saying we should move PwnageTool to pwnagetool.app or redsn0w to redsn0w.app. It's meaningless. :P --[[User:Dra1nerdrake|dra1nerdrake]] 04:28, 19 November 2010 (UTC)
::::Stop being anal about every little detail. blackra1n and limera1n are two different things. You can't just mix them together. limera1n is the jailbreak not the app. Please get your facts straight [[User:Balloonhead66|Balloonhead66]] Your behavior here is sometimes unappreciated. Please grow up. --[[User:Gamer765|Gamer765]] 06:05, 19 November 2010 (UTC)
:::::I'm sorry, but I just don't see a point in moving a page to something that /doesn't exist./ This article encompasses every detail about limera1n. The jailbreak is called limera1n, therefore it should stay here. --[[User:Dra1nerdrake|dra1nerdrake]] 22:05, 19 November 2010 (UTC)

Limera1n

2010-11-19T04:29:34Z

Dra1nerdrake: Let's not link to things that don't exist.

{{DISPLAYTITLE:limera1n}}
[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices. The following devices are technically supported:

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] (creates a bare-bones jailbreak by mounting '/' as read/write in /etc/fstab)

Limera1n has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
* '''[[User:Geohot|geohot]]''' - The program itself, and the bootrom exploit.
* '''[[User:Comex|comex]]''' - The userland exploit that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* Limera1n has nothing to do with SHAtter at all.
* Limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* Limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* Limera1n uses a hacktivation dylib to perform hacktivation.

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU Mode]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev (team)]] into not releasing SHAtter, but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing SHAtter would uselessly disclose another bootrom exploit to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy hacktivation.dylib to /usr/lib and change entries to com.apple.mobile.lockdown.plist, whether it has been activated using iTunes or not. This, while helpful to many, can also be harmful to legitimate activators. For a guide on how to remove this hacktivation on iTunes activated devices, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

[[Category:Hacking Software]]

Talk:Limera1n

2010-11-19T04:28:04Z

Dra1nerdrake: /* MOve to limera1n.app */

{{DISPLAYTITLE:Talk:limera1n}}
== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out SHAtter and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:geohot|geohot's]] exploit not used and keep SHAtter for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)
:::I think it's because they need to be plugged in for the ramdisk to be uploaded (hence the logo). --[[User:Palz|Palz]] 21:15, 12 October 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)

::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)

== He did it==
It's in the wild. Thoughts? ~Drake
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)
::::::Blackra1n uses purpled1sk too :/ All it is is an exploit like arm7_go in DFU that pwns iBoot (temporarily) and applies a userland jailbreak from a ramdisk. --[[User:Palz|Palz]] 22:16, 15 October 2010 (UTC)
the exploit ( it is a heap overflow ) is used to create a command called geohot ( in the [[NOR_%28NVRAM%29]] same as in [[Purplera1n]] ) maybe purpled1sk is the best for the job [[iBoot]] cannot be changed it will remove [[SHSH]] preventing the device from booting --[[User:Liamchat|liamchat]] 22:32, 15 October 2010 (UTC)
:do u hear urself talk? the bootrom exploit in limera1n is not a heap overflow. -__- the heap overflow is the userland exploit used to achieve an untethered status.[[User:Leobruh|Leobruh]] 20:20, 19 October 2010 (UTC)!
The kernel patch ocurs after the lime logo is shown ( when a ramdisk is mounted ) after the ramdisk is sent you can disconnect the device --[[User:Liamchat|liamchat]] 21:23, 19 October 2010 (UTC)

== Pwnage ==

Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)

== Support ==

I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)

== Why no ipt2g support? ==

I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)

:It works for the ipt2g new bootrom, but geohot didn't take his time to remake anything so that it would work with our device. greenpois0n will support our devices, just takes a little while to write up everything needed. --[[User:JacobVengeance|JakeAnthraX]] 05:24, 13 October 2010 (UTC)

:IPT2G support is now in GreenPois0n --[[User:Fclinton|FClinton]] 23:39, 19 October 2010 (UTC)

== hacktivation.dylib ==

I added info about it and how to remove it for people who activate with iTunes. Hope no one minds. --[[User:Cmdshft|cmdshft]] 04:31, 13 October 2010 (UTC)
:I have my 3GS officially activated and had no problems at all with this dylib or anything else related to activation so far... I'm officially unlocked too... Should I still remove the dylib even if I had no problems?? --[[User:Luxiel|Luxiel]] 17:02, 19 October 2010 (UTC)
::Nevermind, i just followed that tutorial and end up fucking my 3GS, restoring it ATM... So, I will use greenpois0n once it is done... That tutorial just fucked my activation... thx for the one that posted it... --[[User:Luxiel|Luxiel]] 02:26, 21 October 2010 (UTC)
:::Just completing this history... I followed those commands with my officially activated 3GS and I had to clean restore and rejailbreak with limera1n... So I guess this "hacktivation may be harmfull" thing may be wrong... --[[User:Luxiel|Luxiel]] 19:56, 21 October 2010 (UTC)

== Pwn4life ==

Is this a pwned4life? If it is, can a restore remove it? --[[User:Balloonhead66|Balloonhead66]] 02:10, 15 October 2010 (UTC)
:A DFU Mode restore will return you to a fresh and all Apple state --[[User:OMEGA RAZER|OMEGA RAZER]] 04:20, 15 October 2010 (UTC)

:Pwned4life isn't like permanent jailbreak on the device, just means there is an exploit that will always be there to allow jailbreaks. A restore will get rid of it simple. --[[User:JacobVengeance|JakeAnthraX]] 19:37, 19 October 2010 (UTC)

== MOve to limera1n.app ==
I think this page should be moved to limera1n.app --[[User:Balloonhead66|Balloonhead66]] 18:39, 23 October 2010 (UTC)
:Why? Limera1n.app is the application installed by the ramdisk used in this jailbreak. Therefore, it's a very minute part of the jailbreak. Limera1n as a whole, consists of the initial exploit in the hardware, the exploit to achieve unsigned code exec., and etc. It's much more than a simple app for your phone. :P --[[User:Dra1nerdrake|dra1nerdrake]] 04:20, 19 November 2010 (UTC)
::Wrong, [[:/var/stash/Applications.*****/blackra1n.app]] is what is installed by the ramdisk. He uses blackra1n.app for blackra1n and limera1n. I know. I looked in my device, want proof, just use OpenSSH on a 4.1 device and you will see. Anyways, [[Cydia.app]], howabout blackra1n.app and limera1n.app? --[[User:Balloonhead66|Balloonhead66]] 04:24, 19 November 2010 (UTC)
:::Even better, the title limera1n.app means nothing. That's like saying we should move PwnageTool to pwnagetool.app or redsn0w to redsn0w.app. It's meaningless. :P --[[User:Dra1nerdrake|dra1nerdrake]] 04:28, 19 November 2010 (UTC)

Limera1n

2010-11-19T04:24:13Z

Dra1nerdrake:

{{DISPLAYTITLE:limera1n}}
[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices. The following devices are technically supported:

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

Limera1n has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
* '''[[User:Geohot|geohot]]''' - The program itself, and the bootrom exploit.
* '''[[User:Comex|comex]]''' - The userland exploit that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* Limera1n has nothing to do with SHAtter at all.
* Limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* Limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* Limera1n uses a hacktivation dylib to perform hacktivation.

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU Mode]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev (team)]] into not releasing SHAtter, but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing SHAtter would uselessly disclose another bootrom exploit to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy hacktivation.dylib to /usr/lib and change entries to com.apple.mobile.lockdown.plist, whether it has been activated using iTunes or not. This, while helpful to many, can also be harmful to legitimate activators. For a guide on how to remove this hacktivation on iTunes activated devices, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

[[Category:Hacking Software]]

Talk:Limera1n

2010-11-19T04:20:54Z

Dra1nerdrake: /* MOve to limera1n.app */

{{DISPLAYTITLE:Talk:limera1n}}
== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out SHAtter and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:geohot|geohot's]] exploit not used and keep SHAtter for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)
:::I think it's because they need to be plugged in for the ramdisk to be uploaded (hence the logo). --[[User:Palz|Palz]] 21:15, 12 October 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)

::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)

== He did it==
It's in the wild. Thoughts? ~Drake
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)
::::::Blackra1n uses purpled1sk too :/ All it is is an exploit like arm7_go in DFU that pwns iBoot (temporarily) and applies a userland jailbreak from a ramdisk. --[[User:Palz|Palz]] 22:16, 15 October 2010 (UTC)
the exploit ( it is a heap overflow ) is used to create a command called geohot ( in the [[NOR_%28NVRAM%29]] same as in [[Purplera1n]] ) maybe purpled1sk is the best for the job [[iBoot]] cannot be changed it will remove [[SHSH]] preventing the device from booting --[[User:Liamchat|liamchat]] 22:32, 15 October 2010 (UTC)
:do u hear urself talk? the bootrom exploit in limera1n is not a heap overflow. -__- the heap overflow is the userland exploit used to achieve an untethered status.[[User:Leobruh|Leobruh]] 20:20, 19 October 2010 (UTC)!
The kernel patch ocurs after the lime logo is shown ( when a ramdisk is mounted ) after the ramdisk is sent you can disconnect the device --[[User:Liamchat|liamchat]] 21:23, 19 October 2010 (UTC)

== Pwnage ==

Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)

== Support ==

I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)

== Why no ipt2g support? ==

I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)

:It works for the ipt2g new bootrom, but geohot didn't take his time to remake anything so that it would work with our device. greenpois0n will support our devices, just takes a little while to write up everything needed. --[[User:JacobVengeance|JakeAnthraX]] 05:24, 13 October 2010 (UTC)

:IPT2G support is now in GreenPois0n --[[User:Fclinton|FClinton]] 23:39, 19 October 2010 (UTC)

== hacktivation.dylib ==

I added info about it and how to remove it for people who activate with iTunes. Hope no one minds. --[[User:Cmdshft|cmdshft]] 04:31, 13 October 2010 (UTC)
:I have my 3GS officially activated and had no problems at all with this dylib or anything else related to activation so far... I'm officially unlocked too... Should I still remove the dylib even if I had no problems?? --[[User:Luxiel|Luxiel]] 17:02, 19 October 2010 (UTC)
::Nevermind, i just followed that tutorial and end up fucking my 3GS, restoring it ATM... So, I will use greenpois0n once it is done... That tutorial just fucked my activation... thx for the one that posted it... --[[User:Luxiel|Luxiel]] 02:26, 21 October 2010 (UTC)
:::Just completing this history... I followed those commands with my officially activated 3GS and I had to clean restore and rejailbreak with limera1n... So I guess this "hacktivation may be harmfull" thing may be wrong... --[[User:Luxiel|Luxiel]] 19:56, 21 October 2010 (UTC)

== Pwn4life ==

Is this a pwned4life? If it is, can a restore remove it? --[[User:Balloonhead66|Balloonhead66]] 02:10, 15 October 2010 (UTC)
:A DFU Mode restore will return you to a fresh and all Apple state --[[User:OMEGA RAZER|OMEGA RAZER]] 04:20, 15 October 2010 (UTC)

:Pwned4life isn't like permanent jailbreak on the device, just means there is an exploit that will always be there to allow jailbreaks. A restore will get rid of it simple. --[[User:JacobVengeance|JakeAnthraX]] 19:37, 19 October 2010 (UTC)

== MOve to limera1n.app ==

I think this page should be moved to limera1n.app --[[User:Balloonhead66|Balloonhead66]] 18:39, 23 October 2010 (UTC)
:Why? Limera1n.app is the application installed by the ramdisk used in this jailbreak. Therefore, it's a very minute part of the jailbreak. Limera1n as a whole, consists of the initial exploit in the hardware, the exploit to achieve unsigned code exec., and etc. It's much more than a simple app for your phone. :P --[[User:Dra1nerdrake|dra1nerdrake]] 04:20, 19 November 2010 (UTC)

Limera1n

2010-11-19T04:17:44Z

Dra1nerdrake: /* Hacktivation */

{{DISPLAYTITLE:limera1n}}
[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
* '''[[User:Geohot|geohot]]''' - The program itself, and the bootrom exploit.
* '''[[User:Comex|comex]]''' - The userland exploit that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* Limera1n has nothing to do with SHAtter at all.
* Limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* Limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* Limera1n uses a hacktivation dylib to perform hacktivation.

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU Mode]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev (team)]] into not releasing SHAtter, but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing SHAtter would uselessly disclose another bootrom exploit to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy hacktivation.dylib to /usr/lib and change entries to com.apple.mobile.lockdown.plist, whether it has been activated using iTunes or not. This, while helpful to many, can also be harmful to legitimate activators. For a guide on how to remove this hacktivation on iTunes activated devices, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

[[Category:Hacking Software]]

Limera1n

2010-11-19T04:16:48Z

Dra1nerdrake: /* Basics */ Tuning up, CAPITALIZATION.

{{DISPLAYTITLE:limera1n}}
[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
* '''[[User:Geohot|geohot]]''' - The program itself, and the bootrom exploit.
* '''[[User:Comex|comex]]''' - The userland exploit that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* Limera1n has nothing to do with SHAtter at all.
* Limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* Limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* Limera1n uses a hacktivation dylib to perform hacktivation.

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU Mode]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev (team)]] into not releasing SHAtter, but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing SHAtter would uselessly disclose another bootrom exploit to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy hacktivation.dylib to /usr/lib and change entries to com.apple.mobile.lockdown.plist, whether it has been activated using iTunes or not. This, while helpful to many, is also harmful to legitimate activators. For a guide on how to remove this hacktivation on iTunes activated devices, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

[[Category:Hacking Software]]

List of iPhones

2010-11-19T04:03:26Z

Dra1nerdrake: Undo revision 13193 by R3dblackh4ck (Talk) Please DON'T do that.

{{DISPLAYTITLE:iPhone}}
There are many iterations of the iPhone.

== Differences between iPhone Models ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
!Device
!Case Material
!Colours
!Dimensions
!Weight
!Capacity
!Processor Speed
!RAM
!Battery Life
!Initial Firmware
!Camera
!Voice Controls
!GPS
!Digital Compass
!Gyroscope
!Video Calls (FaceTime)
|-
|[[M68ap|iPhone 2G]]
|Aluminium
|Aluminium
|4.5x2.4x0.46 in.
|4.8oz.
|4*/8/16**GB
|412MHz
|128Mb
|24h (Music), 7h (Video)
|1.0 (1A543a)
|2MP
|{{no}}
|{{no}}
|{{no}}
|{{no}}
|{{no}}
|-
|[[N82ap|iPhone 3G]]
|Plastic
|Black/White***
|4.5x2.4x0.48 in.
|4.7oz.
|8/16GB
|412MHz
|128Mb
|24h (Music), 7h (Video)
|2.0 (5A345)
|2MP
|{{no}}
|{{yes}}
|{{no}}
|{{no}}
|{{no}}
|-
|[[N88ap|iPhone 3GS]]
|Plastic
|Black/White
|4.5x2.4x0.48 in.
|4.8oz.
|8/16/32GB
|620MHz
|256Mb
|30h (Music), 10h (Video)
|3.0 (7A341)
|3.2MP Auto Focus
|{{yes}}
|{{yes}}
|{{yes}}
|{{no}}
|{{no}}
|-
|[[N90ap|iPhone 4]]
|Steel/Glass
|Black
|4.5x2.31x0.37 in.
|4.8oz.
|16/32GB
|1GHz
|512Mb
|40h (Music), 10h (Video)
|4.0 (8A293)
|5.0MP Auto Focus with LED Flash
|{{yes}}
|{{yes}}
|{{yes}}
|{{yes}}
|{{yes}}
|}

(*) Discontinued on September 5, 2007

(**) Introduced on February 5, 2008

(***) 16GB version only

The iPhone Wiki:Current events

2010-11-19T03:09:43Z

Dra1nerdrake: Undo revision 13179 by Balloonhead66 (Talk) Honestly, I'd like to get this solved ASAP.

== Primary Goals ==
* [[X-Gold 608 Unlock|Break X-Gold 608 Chain of Trust]]
* [[X-Gold 618 Unlock|Break X-Gold 618 Chain of Trust]]
* Break the chain of trust on devices with newer bootroms ([[N72ap|iPod touch 2G]], [[N18ap|iPod touch 3G]], [[N88ap|iPhone 3GS]], [[K48ap|iPad]], [[N90ap|iPhone 4]]).

== Secondary ==
* Get [[iPhoneLinux]] running on [[N72ap|iPod touch 2G]] and newer devices.
* Get kernel extensions working on 2.x
* Get kernel extensions working on 3.x
* Get kernel extensions working on 4.x
* Finish the [[/|Firmware]] Listing

== Tertiary ==
* Solve the [[User:Liamchat|liamchat]] debate.

User talk:Liamchat

2010-11-19T01:27:31Z

Dra1nerdrake: /* Edit Wars */ Grammar and response.

User talk:Liamchat

2010-11-19T00:51:21Z

Dra1nerdrake: /* Edit Wars */ botched wording.

User talk:Liamchat

2010-11-19T00:45:29Z

Dra1nerdrake: /* Edit Wars */ new section

The iPhone Wiki:Current events

2010-11-19T00:36:02Z

Dra1nerdrake: #JustSayin'

User:Dra1nerdrake

2010-11-18T12:05:52Z

Dra1nerdrake: /* Contact info */ Minor update

==Bio==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

==Devices & SHSH's==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2 GM.

==Contact info==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/drakealleg]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

User:Dra1nerdrake

2010-11-18T12:05:28Z

Dra1nerdrake: /* Devices & SHSH's */

==Bio==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

==Devices & SHSH's==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2 GM.

==Contact info==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/dra1nerdrake]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

User:Dra1nerdrake

2010-11-02T02:23:15Z

Dra1nerdrake: /* Devices & SHSH's */

==Bio==
My name's Drake. I'm a hacker. I can't really code, but I know a lot about ARM assembly and firmware decryption. Therefore, you'll most likely see me on those pages. I also know how to write payloads. I live in Connecticut, which you'd probably know if you follow my twitter. My birthday is November 14.

==Devices & SHSH's==
* '''iPod touch 3G:''' 3.1.2+ Running a non-stock version of 3.1.2.
* '''iPhone 4:''' 4.0.1+ Running iOS 4.2 GM.
* '''Apple TV:''' Not in my possession yet, but it will be soon.

==Contact info==
* '''GameCenter Tag:''' d14
* '''Twitter Account:''' [http://twitter.com/dra1nerdrake]
* '''Public email:''' [mailto:drakealleg@gmail.com]
* '''Blog:''' [http://d14a.tk]

The iPhone Wiki:Community portal

2010-10-30T22:52:42Z

Dra1nerdrake: /* VFDecrypt GUIs */

This is the place to post tasks that need to be done on the wiki. Also this is the place for proposed changes. I heard about people wanting a favicon and arranging the main page into categories.

== Site Related Requests ==

=== iPhone Compatibility ===

Well the wikis startpage (and maybe other pages) do not display really good on the iphone ;) -- [[User:M2m|M2m]] 16:11, 14 September 2010 (UTC)

:Well, I think it's good enough. Ok, it's not optimized, but it's ok. If we improve the startpage to have only one column, then that would look ugly on a PC. I work a lot in here from my iPhone. The biggest problem is the edit box. You cannot really edit big texts from your iPhone. But that's a problem of the Wiki itself (Mediawiki) and we cannot fix that just by changing texts or layout. -- [[User:Http|http]] 22:25, 14 September 2010 (UTC)

::On all textboxes, use 2 fingers to scroll --[[User:Balloonhead66|Balloonhead66]] 02:52, 27 October 2010 (UTC)

=== Logo ===
The Logo should be updated as the wiki is no longer iPhone only but (I think) all iOS devices (or a larger part of it). Possibly also a new URL? theioswiki (but i know this is not as easy) -- [[User:M2m|M2m]] 16:09, 14 September 2010 (UTC)

:A new URL would be something that Geohot would have to do. But although this is not only about iPhones, that doesn't mean we have to change the logo or the URL. At the beginning there was the iPhone and the iPod touch. Now only the iPad has come to the family. Nothing really new. -- [[User:Http|http]] 22:25, 14 September 2010 (UTC)

::Isn't the new AppleTV said to be running iOS as well ? ;) --[[User:M2m|M2m]] 23:22, 14 September 2010 (UTC)

=== Merge pages ===
[[/private/var]] is the correct name and has a better description, but [[/var]] has a full folder listing. --[[User:Ryccardo|Ryccardo]] 12:33, 7 June 2010 (UTC)
:Dealt with. :) --[[User:Dialexio|Dialexio]] 02:58, 26 July 2010 (UTC)

I think [[Sierra_7C108b]] and [[SwitchBoard.app]] should be merged. Or are there any differences that I misunderstood? --[[User:Http|http]] 22:13, 28 July 2010 (UTC)
:I wouldn't merge the two since [[SwitchBoard.app]] ''is'' in [[Sierra 7C108b]], but it's not exclusive to that build. --[[User:Dialexio|Dialexio]] 00:09, 29 July 2010 (UTC)
::I understand. Ok, no merge. But currently both are about the app. We should put that content into [[SwitchBoard.app]] and focus [[Sierra 7C108b]] more on the firmware then (would be very short right now). Also we should delete one of the two images. What do you think? --[[User:Http|http]] 03:10, 29 July 2010 (UTC)
:::Agreed. Both of the screenshots show different "apps" though, so it might be best to keep both images. --[[User:Dialexio|Dialexio]] 03:41, 29 July 2010 (UTC)

=== Hackers and Teams ===

We have only one page for [[User:Ih8sn0w|IH8sn0w]], but with this name we have both things: the person and the team. I'm not sure how to do this. He is listed as a member of his group. Also all referals should distinguish then, that's quite difficult. He himself also had no idea. Maybe a new page with [[IH8sn0w team]] where the current content should go to? -- [[User:Http|http]] 19:20, 6 August 2010 (UTC)

A similar problem exists for chronic. It is split already: [[User:ChronicDev]] (user) and [[Chronic Dev (team)|Chronic Dev]] (team). I think we should rename the team to [[Chronic Dev (team)|Chronic Dev Team]], although this is not their official name, but it helps to distinguish. What do you think? -- [[User:Http|http]] 19:27, 6 August 2010 (UTC)

:We could use parentheses, such as [[iH8sn0w (team)]] and [[Chronic Dev (team)]]. Alternatively, we could use prefixes, like [[Team:iH8sn0w]] and [[Team:Chronic Dev]]. --[[User:Dialexio|Dialexio]] 19:56, 6 August 2010 (UTC)

::Parentheses sounds good. Prefix is more wiki-internal stuff for me. -- [[User:Http|http]] 06:03, 7 August 2010 (UTC)

Thanks [[User:Dialexio|Dialexio]] for going ahead with this. We now have a few disambiguation pages, but they are not marked as such (see [[Special:Disambiguations]]). I don't know how to mark them with this template. Do you? -- [[User:Http|http]] 06:43, 8 August 2010 (UTC)
:I tried to see if I could get it to work (using the [[Chronic Dev]] page for testing), but I can't figure out why it won't appear on the [[Special:Disambiguations]]. --[[User:Dialexio|Dialexio]] 15:43, 8 August 2010 (UTC)

===Baseband: Processor vs. Platform===
All right, so The iPhone Wiki has articles about baseband ''processors''. However, the [[XMM 6180]] is about the baseband ''platform''. The wiki mostly references baseband processors, but I'm a bit reluctant to go that route since it was [[User:Oranav|Oranav]], who definitely knows more about the baseband than me, that changed the article from baseband processor to baseband platform. I'd like to keep things consistent, so should we stick with referencing it by processor or platform? This inconsistency is bugging the crap out of me. --[[User:Dialexio|Dialexio]] 06:19, 9 August 2010 (UTC)

=== Will this site keep running? ===
I'm enjoying learning about the highly technical side to the iPhone, but after what's happened with geohot, will this site continue? -- [[User:MaybachMan|MaybachMan]] 16:46, 14 July 2010 (UTC)

Yes it will continue. I had the same question and [[User:geohot|geohot]] already answered that on [[User_talk:geohot|his talk page]]. --[[User:Http|http]] 18:46, 14 July 2010 (UTC)

That's great to hear, thank you. [[User:MaybachMan|MaybachMan]]

=== REQUEST ===
Can somebody please make a wiki page on how to boot the device into Recovery mode via itunesmobiledevice?

Thank you!
--[[User:Johnnyfranks67|Johnnyfranks67]] 18:11, 18 October 2009 (UTC)

=== Cleanup orphaned pages ===
The [[Special:Lonelypages|orphaned pages]] should be cleaned up. Possible work:
*most of those pages need to get updated
*add a link on another page to it, so that it's not orphaned anymore
*The main page and some disambiguation pages may remain orphaned.
*Some pages are really old, outdated and not worth to get updated. In this case add a deletion request to its talk page.
*Maybe we need a new overview page that links to some of these pages (e.g. my request for a [[Beta Firmware]] page, see [[Talk:VFDecrypt_Keys:_3.x_BETA#STOP]])
*Please note that links with a prefix don't count for this list, so that pages that only appear on a Category page also appear in this list. To get the full links list, go to the page and click "what links here".
I started with a little cleanup already. --[[User:Http|http]] 10:02, 23 October 2010 (UTC)

===VFDecrypt GUIs===
I don't mean to sound like a dictator, but I'd like to request for no more VFDecrypt GUIs to be added here. There are more than enough of them, so I feel there really isn't a need to add any more. Whenever a new one arises, an argument spews over about its usefulness, as well as whether it belongs on this wiki. These arguments clog up the [[Special:Recentchanges|Recent changes]] page, making it tougher to keep an eye on things with the wiki. So, once again, I'd like to ask for no more VFDecrypt GUIs to have a place on this wiki. '''As of now, this is NOT a rule that will be imposed. It's just a polite request, nothing more.''' --[[User:Dialexio|Dialexio]] 19:35, 30 October 2010 (UTC)
:I'd ask for GUI's of all kinds, such as VFDecrypt, iRecovery, and so on. Anyone can make a GUI. It takes a real hacker to write a program. --[[User:Dra1nerdrake|dra1nerdrake]] 22:52, 30 October 2010 (UTC)

==iPhone Related Requests==
See: [[Unsolved problems]]

Keys/ivs for 4.0 beta 1/2/3 need to be updated. Many of them on are on the Internet, but not on here. Related pages:
*[[VFDecrypt_Keys:_4.x_BETA]]
*[[Beta Firmware]]

NAND

2010-10-30T22:48:07Z

Dra1nerdrake: Clarified and cleaned up.

[[Image:8GBflash.jpg|thumb|left|Example of a NAND chip.]]
This normally refers to the NAND flash chip used in the iPhone, iPad, iPod Touch, and Apple TV. This is where all the storage capacity comes from. The capacity can range between 4GB, 8GB, 16GB, 32GB, 64GB. Under the iOS standards, it is partitioned into two, the system partition and the user partition. The system partition contains the [[iOS]] operating system and the native Apple applications. This is mounted read only. The user partition contains all user data, including installed applications, music, and movies, and is mounted as read/write.
A bare-bones jailbreak modifies the "fstab" file in /etc and enables read and write on all 2 partitions.

Talk:Cydia.app

2010-10-24T03:33:26Z

Dra1nerdrake: /* Icon */

==Icon==
Can someone add a high resolution Cydia icon to this page? --[[User:JacobVengeance|JakeAnthraX]] 04:33, 22 October 2010 (UTC)
:Done. :) --[[User:Dialexio|Dialexio]] 05:03, 22 October 2010 (UTC)
::Thank You, I like images and icons for some reason. --[[User:JacobVengeance|JakeAnthraX]] 16:30, 22 October 2010 (UTC)

== Name Change? ==
How about Cydia.app? Sounds better, in my opinion. --[[User:Dra1nerdrake|dra1nerdrake]] 01:20, 23 October 2010 (UTC)
:Sounds good to me. :) --[[User:Dialexio|Dialexio]] 02:08, 23 October 2010 (UTC)

:I would prefer /var/stash/Applications.*****/Cydia.app as it sounds more like the fs --[[User:Balloonhead66|Balloonhead66]] 18:21, 23 October 2010 (UTC)

:I think the discussion isn't finished, although someone moved it already. If everybody agrees to leave it like Cydia.app, then we should update all links (click on "what links here" to see them). -- [[User:Http|http]] 19:51, 23 October 2010 (UTC)
::Yeah, I just moved it to shut you guys up. Balloonhead66, wouldn't it be better to describe an application rather than a directory? --[[User:Palz|Palz]] 21:02, 23 October 2010 (UTC)
:Is the name change needed? I preferred Cydia Application instead of trying to make it seem more technical for no reason. --[[User:JacobVengeance|JakeAnthraX]] 21:05, 23 October 2010 (UTC)
::I just figured that since we refer to things like Switchboard.app with the *.app type name, it's appropriate to do the same for Cydia. :P --[[User:Dra1nerdrake|dra1nerdrake]] 03:10, 24 October 2010 (UTC)

Talk:Cydia.app

2010-10-24T03:10:09Z

Dra1nerdrake: /* Name Change? */

==Icon==
Can someone add a high resolution Cydia icon to this page? --[[User:JacobVengeance|JakeAnthraX]] 04:33, 22 October 2010 (UTC)
:Done. :) --[[User:Dialexio|Dialexio]] 05:03, 22 October 2010 (UTC)
:Thank You, I like images and icons for some reason. --[[User:JacobVengeance|JakeAnthraX]] 16:30, 22 October 2010 (UTC)
== Name Change? ==
How about Cydia.app? Sounds better, in my opinion. --[[User:Dra1nerdrake|dra1nerdrake]] 01:20, 23 October 2010 (UTC)
:Sounds good to me. :) --[[User:Dialexio|Dialexio]] 02:08, 23 October 2010 (UTC)

:I would prefer /var/stash/Applications.*****/Cydia.app as it sounds more like the fs --[[User:Balloonhead66|Balloonhead66]] 18:21, 23 October 2010 (UTC)

:I think the discussion isn't finished, although someone moved it already. If everybody agrees to leave it like Cydia.app, then we should update all links (click on "what links here" to see them). -- [[User:Http|http]] 19:51, 23 October 2010 (UTC)
::Yeah, I just moved it to shut you guys up. Balloonhead66, wouldn't it be better to describe an application rather than a directory? --[[User:Palz|Palz]] 21:02, 23 October 2010 (UTC)
:Is the name change needed? I preferred Cydia Application instead of trying to make it seem more technical for no reason. --[[User:JacobVengeance|JakeAnthraX]] 21:05, 23 October 2010 (UTC)
::I just figured that since we refer to things like Switchboard.app with the *.app type name, it's appropriate to do the same for Cydia. :P --[[User:Dra1nerdrake|dra1nerdrake]] 03:10, 24 October 2010 (UTC)

Talk:Cydia.app

2010-10-23T01:20:18Z

Dra1nerdrake: /* Icon */

Limera1n

2010-10-17T19:54:15Z

Dra1nerdrake: /* Credit */

[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
* '''[[User:Geohot|geohot]]''' - The program itself, and the bootrom exploit.
* '''[[User:Comex|comex]]''' - The userland exploit that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* limera1n uses a different exploit to SHAtter.
* limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* limera1n uses a hacktivation dylib to activate, even on devices already activated by iTunes

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev]] into not releasing [[SHAtter]], but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing [[SHAtter]] would uselessly disclose another bootrom exploit to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy a dylib to unlock the phone to /usr/lib, whether it has been activated using iTunes or not. This, while helpful to many, is also harmful to legitimate activators. For a good guide, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

Limera1n

2010-10-17T19:54:00Z

Dra1nerdrake: /* Credit */

[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
* '''[[User:Geohot|geohot]] - The program itself, and the bootrom exploit.
* '''[[User:Comex|comex]]''' - The userland exploit that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* limera1n uses a different exploit to SHAtter.
* limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* limera1n uses a hacktivation dylib to activate, even on devices already activated by iTunes

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev]] into not releasing [[SHAtter]], but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing [[SHAtter]] would uselessly disclose another bootrom exploit to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy a dylib to unlock the phone to /usr/lib, whether it has been activated using iTunes or not. This, while helpful to many, is also harmful to legitimate activators. For a good guide, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

Limera1n

2010-10-17T19:52:03Z

Dra1nerdrake: /* Controversy */ "The shatter exploit" SHAtter IS an exploit, don't be repetitive. ;)

[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
*[[User:Geohot|geohot]] - the program itself, and bootrom exploit.
*[[User:Comex|comex]] - [[userland exploit]] that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* limera1n uses a different exploit to SHAtter.
* limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* limera1n uses a hacktivation dylib to activate, even on devices already activated by iTunes

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev]] into not releasing [[SHAtter]], but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing [[SHAtter]] would uselessly disclose another bootrom exploit to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy a dylib to unlock the phone to /usr/lib, whether it has been activated using iTunes or not. This, while helpful to many, is also harmful to legitimate activators. For a good guide, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

Limera1n

2010-10-17T19:50:18Z

Dra1nerdrake: /* Exploits */

[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
*[[User:Geohot|geohot]] - the program itself, and bootrom exploit.
*[[User:Comex|comex]] - [[userland exploit]] that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* limera1n uses a different exploit to SHAtter.
* limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* limera1n uses a hacktivation dylib to activate, even on devices already activated by iTunes

=== Exploits ===
Details of the exploits to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev]] into not releasing the SHAtter exploit, but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing [[SHAtter]] would uselessly disclose another [[bootrom exploit]] to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy a dylib to unlock the phone to /usr/lib, whether it has been activated using iTunes or not. This, while helpful to many, is also harmful to legitimate activators. For a good guide, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]

Limera1n

2010-10-17T19:49:55Z

Dra1nerdrake: /* Basics */ Let's not link to things that don't exist.

[[Image:Ra1ndrop.png|right]]
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and an undisclosed kernel exploit found by [[User:Comex|comex]] to achieve an [[untethered jailbreak]] on newer devices.

* [[N88ap|iPhone 3GS]]
* [[N90ap|iPhone 4]]
* [[N18ap|iPod touch 3G]]
* [[N81ap|iPod touch 4G]]
* [[K48ap|iPad]]
* [[K66ap|AppleTV 2G]] ([http://www.tuaw.com/2010/10/09/limera1n-jailbreak-released-greenpois0n-jailbreak-delayed/ However it's current usefulness is debatable])

It has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].

'''Release Date:''' October 9, 2010

'''Supported OS's:''' Mac OS X, Windows

'''Supported Operations:''' Hacktivation, jailbreaking

==Release text==
<center>limera1n, 6 months in the making 
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G 
4.0-4.1 and beyond+++ 
limera1n is unpatchable 
untethered thanks to jailbreakme star '''comex''' 
brought to you by '''geohot''' 
hacktivates 
Mac coming in 7 years 
donations keep support alive 
zero pictures of my face</center>

==Credit==
*[[User:Geohot|geohot]] - the program itself, and bootrom exploit.
*[[User:Comex|comex]] - [[userland exploit]] that allows limera1n to run [[untethered jailbreak|untethered]].

==Changelog==
{| class="wikitable" style="border-collapse:collapse;" border="1"
|-
|<center>'''Version'''</center>
|<center>'''Release time'''</center>
|<center>'''MD5 Hash'''</center>
|<center>'''Change comment'''</center>
|-
|BETA 1
|9 Oct 2010 XX:XX GMT
|2f2b09a6ed5c5613d5361d8a9d0696b6
|First release.
|-
|BETA 2
|10 Oct 2010 XX:XX GMT
|a70dccb3dfc0e505687424184dc3d1ce
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.
|-
|BETA 3
|10 Oct 2010 XX:XX GMT
|81730090f7de1576268ee8c2407c3d35
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])
|-
|BETA 4
|10 Oct 2010 XX:XX GMT
|d901c4b3a544983f095b0d03eb94e4db
|Uninstall fixed, respring fixed
|-
|RC1
|11 Oct 2010 XX:XX GMT
|0622d99ffe4c25f75c720a689853845f
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller
|-
|RC1b
|11 Oct 2010 XX:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|addresses an install issue, mainly with iPads
|-
|Final
|11 Oct 2010 23:XX GMT
|fc6f7d696a57c3baede49bdff8a7f43f
|(same as RC1b)
|}

==Technical Information==
=== Basics ===
* limera1n uses a different exploit to SHAtter.
* limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.
* limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].
* limera1n uses a hacktivation dylib to activate, even on devices already activated by iTunes

=== Exploits ===
Details of the [[bootrom exploit]] to follow.

=== Process ===
The jailbreak appears to execute something like the following (in no particular order):
* In recovery1,
"setenv debug-uarts 1
setenv auto-boot false
saveenv"
* In [[DFU]], it uploads a [[payload]].
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].
"setenv auto-boot true
reset
geohot done"

=== Interesting Messages ===
*
"geohot black is the new purple"
*
"blackra1n start: %d current IRQ mask is %8.8X
usb irq disabled...shhh
fxns found @ %8.8X %8.8X
found iBoot @ %8.8X
i'm back from IRQland...
3g detected, kicking nor
nor kicked
memcpy done
iBoot restored!!!
found command table @ %8.8X
cmd_geohot added
time to pray...%8.8X"
*
"2.2X send command(%d): %s
send exploit!!!
sent data to copy: %X
sent shellcode: %X has real length %X
never freed: %X
sent fake data to timeout: %X
sent exploit to heap overflow: %X
sending file with length: 0x%X Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d."

==Controversy==
The release of this jailbreak was specifically designed to pressure [[Chronic Dev]] into not releasing the SHAtter exploit, but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing [[SHAtter]] would uselessly disclose another [[bootrom exploit]] to Apple.

[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.

Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.

== Hacktivation ==
Limera1n will copy a dylib to unlock the phone to /usr/lib, whether it has been activated using iTunes or not. This, while helpful to many, is also harmful to legitimate activators. For a good guide, see the link below.

==External Links==
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]
* [http://limera1n.com/ Official domain]
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]
* [http://www.pastie.org/1210054 Veence's explanation for release]
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]