The iPhone Wiki - User contributions [en]

Unthredera1n

2017-03-07T07:08:36Z

IApeiron: /* External Links */ Added links to archived files from unthreadedjb.com

{{lowercase}}
'''unthredera1n''' is an [[untethered jailbreak]] for [[N18AP|iPod touch 3G]], [[N88AP|iPhone 3GS]] and [[A4]] devices except [[K66AP|Apple TV 2G]] running iOS 4.3.4, 4.3.5, 5.0, 5.0.1, 5.1 and 5.1.1. It is currently available for Linux (x86_64) and OS X. Not much is currently known about this tool.

== unthredeh4il ==
[[unthredera1n|unthredeh4il]] is an improved version of [[unthredera1n]] for [[N18AP|iPod touch 3G]], [[N88AP|iPhone 3GS]] and [[A4]] devices including [[K66AP|Apple TV 2G]] running iOS 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.2.10, 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 5.0, 5.0.1, 5.1 and 5.1.1 including Apple TV OS versions: 4.2, 4.2.1, 4.3 (all versions), 4.4, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 5.0, and 5.0.1. This is still an [[untethered jailbreak]].

== Controversy ==
On Reddit, where [http://www.reddit.com/r/jailbreak/comments/1j4u02/we_hav_releese_isounthreadedjb_redy_4_dl/cbbapvp planetbeing and saurik discussed unthredera1n], saurik said:

<blockquote>
The program is custom; it is using the Rocky Racoon packet filter kernel exploit, but the evasi0n amfid bypass. I verified this somewhat by glancing at the binary (opens /dev/pf, etc.), but they also say this explicitly in some strings inside of the binary (which might be output when it runs or something) and in a hidden readme file.
From .REAL_USAGE:
<blockquote>Thanks to @Chronic-Dev/@planetbeing/@posixninja for the original rocky-raccon pf kernel exploit. Thanks to @evad3rs for their awesome MobileBackup2 stuff. It worked really well on this.</blockquote>
From jb binary:
<blockquote>WE R NOT #FAKR, UNTHREADEDJB IS REEL tanks 2 @planetbeing n @posixninja n @chronicdev for #explot code in rkcy raccon :) :) :) krnl patchs from #opensn0w ))</blockquote>
</blockquote>

== Exploits ==
*MobileBackup2
*[[AMFID code signing evasion|AMFI.dylib]]
*[[launchd.conf Untether|launchd.conf]]

==External Links==
* [http://pastie.org/8255242 unthredeh4il supported firmwares/devices]
* [https://github.com/Malvix/isounthreadedjb Github source code ]
* [http://www.reddit.com/r/jailbreak/comments/1kjddw/we_r_relees_ful_src_code_of_unthreaddra1n_clasic/cbplh58 Comments from planetbeing and Saurik]
* [https://web.archive.org/web/20130806002203/http://unthreadedjb.com/unthreadera1n-classic.tar.bz2 unthreadera1n Classic]
* [https://web.archive.org/web/20130825093659/http://unthreadedjb.com/unthredeh4il.tar.xz unthredeh4il]

{{stub|jailbreaking}}
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Evasi0n7

2017-03-07T06:41:53Z

IApeiron: /* Download */ Added iClarified mirrors

{{lowercase}}
{{about|the untethered jailbreak for iOS 7.0.x|the untethered jailbreak for iOS 6.0 through 6.1.2|evasi0n}}
{{Infobox software
| name = evasi0n7
| title = evasi0n7
| logo = [[File:Evasi0n.png|96px]]
| screenshot = [[File:Evasi0n7.png|300px]]
| caption = evasi0n7 1.0.4 on OS X
| author = [[evad3rs]]
| developer = [[evad3rs]]
| released = {{Start date|2013|12|22|df=yes}}
| discontinued =
| latest release version = 1.0.7
| latest release date = {{Start date|2014|3|1|df=yes}}
| latest preview version = 1.0.8
| latest preview date = {{Start date|2014|3|27|df=yes}}
| programming language = C
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]]
| size = Windows 1.0.7: 16.18 MiB [ZIP] Windows 1.0.8: 16.17 MiB [ZIP] OS X 1.0.7: 15.82 MiB [DMG] OS X 1.0.8: 15.80 MiB [DMG]
| platform =
| language = [[wikipedia:English|English]]
| status = Deprecated
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://evasi0n.com evasi0n.com]
}}

'''evasi0n7''' is a [[jailbreak]] program from the [[evad3rs]]. It performs an [[untethered jailbreak]] for all devices on iOS 7.0 through 7.1 beta 3, except the [[List of Apple TVs|Apple TV]]. It was initially released on 22 December 2013, and became subject to [[#Controversy|controversy and criticism]]. On 28 December 2013, the Cydia package went live to saurik's repo.

== Controversy ==
The release of evasi0n7 was met with sharp criticism. It came without advance notice, much to the dismay of jailbreak developers, including [[saurik]].<ref>https://twitter.com/saurik/status/414743665362231296</ref> It is believed that this was done in response to [[User:Geohot|Geohot]] trying to sell the jailbreak,<ref>https://twitter.com/superMTW/status/414821856534081536</ref> a claim which [[User:Geohot|Geohot]] later brushed off. In addition, if the user's language was set to Chinese, a different app store, the TaiG app store would be installed by default. This store contained cracked versions of [[App Store]] apps and [[Cydia]] apps.<ref>https://twitter.com/saurik/status/414810297937838080</ref><ref>https://twitter.com/chpwn/status/414879769872703488</ref> The [[evad3rs]] were reportedly unaware of the included piracy when they formed the deal, and remotely disabled that store's installation several hours later<ref>https://twitter.com/pod2g/status/414942393830756352</ref>. The evad3rs put out letters to the community during this - [http://evasi0n.com/l.html Part 1] and [http://evasi0n.com/l2.html Part 2].

== Supported Devices ==
The only unsupported devices are those of the [[List of Apple TVs|Apple TV]] family. All other devices capable of running [[iOS]] 7 are supported.

=== Apple TV's ===
*evasi0n7 is not capable of jailbreaking the Apple TV's. According to nitoTV, in his "Why isn't the Apple TV 3 jailbroken?" [[WWJC]] 2014 talk ([https://www.youtube.com/watch?v=gaan3m8tt-c&t=15m35s&list=PLznXKK7IvpwdqQ6WZIS68yZymkGYYHNO4 video]), evasi0n7 would have been able to jailbreak the Apple TV 2G but was never updated to properly support it.

== Download ==
{| class="wikitable"
! Version
! OS
! SHA-1 Hash
! colspan="3" | Download
! Changes
|-
! rowspan="2" | 1.0.0
| [[wikipedia:OS X|OS X]]
| <code>6b22e1d94988a76244d08a5592576f61a0cb5ffb</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/q4xydmi2qzgqdhqr35i0 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!gp9z2RTJ!VWcrCkGWqGp-0Ijk4mKRQzE_ZdU1F0ojA5aKO7Ki7jo MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-mac-1.0.0-5fbc5de0c23654546ad78bd75a703a5724e15d39.dmg iClarified]
| rowspan="2" | Initial release
|-
| [[wikipedia:Microsoft Windows|Windows]]
| <code>8a4e1fcd7b1fc0084366c182cbcf850dfc45d59f</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/hzapsnk73mbrs770z50y Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!Al0lEAzA!CEbvejP3cU2cstBT9w2apzLEMYAKFy8qu0K3Z6mjShA MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-win-1.0.0-5fbc5de0c23654546ad78bd75a703a5724e15d39.zip iClarified]
|-
! rowspan="2" | 1.0.1
| OS X
| <code>12b98c49046157b6206d1c099fe872d6c5e79fb1</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/gux5ojfn1sbztkkf9u9g Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Q4d2GByI!D1lW_kLGtmH0sMgb7vdxFQMtQfEfeBPhykyJzcug3D4 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-mac-1.0.1-fd124e163760f584f5e02f2d0b178291bbf27e33.dmg iClarified]
| rowspan="2" | TaiG is not bundled and not installed anymore with evasi0n7 in Chinese language operating systems
|-
| Windows
| <code>52367f1fb3b71b38ad9ba3ac427a771a498790ad</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/u9ucoter5usl2at7ax29 Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!U09F0LaL!NP9vXy72p652fFWBcR_4LiqX-t1HnG4qdHDcHUH2rGY MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-win-1.0.1-fd124e163760f584f5e02f2d0b178291bbf27e33.zip iClarified]
|-
! rowspan="2" | 1.0.2
| OS X
| <code>da8d03d9e678f5866af0babe1882fa27cd236bad</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s//d3rjztbj6ism1067j3iz Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!FtNw0CYa!XCgwIH7dBb4CJf5VLHM5KTFfZb9ms8iUYb1AlA4iGlc MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-mac-1.0.2-e5de0795c261aed1746777ea67ea8ad7d88ed70c.dmg iClarified]
| rowspan="2" | Fix for [[K93AP|iPad 2 (iPad2,1)]] boot loop issues.
|-
| Windows
| <code>d61c8cbb565efa7d651e3c6cdc8429e2446396d1</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/tlr9ruitbfdqt3nxv3li Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!h5NmUR7I!bopScAVdGqXD57cpkFI4J16KKEcCi76VxV4t4Plw4wE MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-win-1.0.2-e5de0795c261aed1746777ea67ea8ad7d88ed70c.zip iClarified]
|-
! rowspan="2" | 1.0.3
| OS X
| <code>da50834734eb013982de5e6f7dda79660f655c18</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/nb6hq1wol2mrjbfuzkbv Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!F4M1zT5R!OgcsCUwMbIjxdHniB321Bg787zkE60Q9hxFDLi8dc-c MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-mac-1.0.3-f2414a5b6f59f8c4001d463867da66b60cef4198.dmg iClarified]
| rowspan="2" | Updated bundled Cydia Now double checking HFS modifications (for the [[J86AP|iPad mini 2 (iPad4,5)]] reboot loop issue) Support for iOS 7.1 beta 3
|-
| Windows
| <code>57e94aadcc30fc778dc0478ac6e89f19904adcf6</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/27bu5nlp7cvxd2eny86d Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!clEhBAZC!XG4Va2R4dHXj8sMddcJSNGgwkkRqHxgk73_n-FXC8KM MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-win-1.0.3-f2414a5b6f59f8c4001d463867da66b60cef4198.zip iClarified]
|-
! rowspan="2" | 1.0.4
| OS X
| <code>879060a10942011da7ad5697e65122de6e25a3a1</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/w5d8jf1pjbsvcu6b5i49 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!ktMTkSwZ!fxcFv2wDaDTpHBBmXRAZ-3NlwAJgPNqa3Gi-WDe0O7M MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-mac-1.0.4-6a3dfa1f9478caea5da8b3e4e1e6baeb7768bbe4.dmg iClarified]
| rowspan="2" | Security fix: kernel payload now restores <code>sysent</code> table Security fix: code fix for bootstrap Cydia tar files verification
|-
| Windows
| <code>3ef7cb618288a9ff1220a71a2f887e21779c3a16</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/w71wg4tv9s2m54ivzsfr Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!xtUw3QaC!DtaNWFLUr9SroeG6OWg5t2s9a6EkD-qNqsb4amiRX3o MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-win-1.0.4-6a3dfa1f9478caea5da8b3e4e1e6baeb7768bbe4.zip iClarified]
|-
! rowspan="2" | 1.0.5
| OS X
| <code>a81a7128113a7610371a2f9f99933a1dbd153c42</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/gxbuuu3bax7hqvca4th5 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!0oMFBTJS!YbZUVe6mRN039O5EnFbtkEWsm6wJc-8b_1LMWIoKIVY MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-mac-1.0.5-944439a896e8bb7b2a22a0b1fa72454762cd5d01.dmg iClarified]
| rowspan="2" | Support for [[iOS]] 7.0.5
|-
| Windows
| <code>5e09dfac4b4a0361492961109da72f6f18020d59</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ntgvz5os907szqm8wrm2 Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!5oViQCwY!bojgnL1AvGBpJzySFHtdfBg17d6HBk5nWj4RJKjWj40 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-win-1.0.5-944439a896e8bb7b2a22a0b1fa72454762cd5d01.zip iClarified]
|-
! rowspan="2" | 1.0.6
| OS X
| <code>f77a75a092dbbeb483e3138392253413355e2e17</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/4r8pbr815z75xn180w29 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!9kliwbLa!2fQKM0WmVZuCDTKC4N5u6v_bROaluqU8NSUbpOu0ifs MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-mac-1.0.6-01f65fec4d42d76b3f35eda49f7450b2cfa88ff7.dmg iClarified]
| rowspan="2" | Support for [[iOS]] 7.0.6
|-
| Windows
| <code>5bda570b03aebad86286dd446bb4a1edf015b051</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/6gkfbxr0d1cmxls4gdkl Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!o1FAUIzD!9byg8ik89yxSCkT5VTK8Xqhw_SYDKVIo41zO5_gOTJ0 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-win-1.0.6-01f65fec4d42d76b3f35eda49f7450b2cfa88ff7.zip iClarified]
|-
! rowspan="2" | 1.0.7
| OS X
| <code>cca338007dc37a456a0f2b2f3bf1cf015a4222c0</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/gu7bfneoh85aajgic0xp Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!5otk0TpR!TFbHcJAlEt534D3EUzhc82xQ4OG5MVlD7snvkAxQdGM MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-mac-1.0.7-633a643e10531c58e7ce18018986b6d14774102d.dmg iClarified]
| rowspan="2" | Fix problem where bundled repository package information could not be refreshed/updated by Cydia Updated bundled Cydia package lists
|-
| Windows
| <code>3ac4deefadc76122c33f3181135f01217aeb3777</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/7pbgathisei8f6pf6h30 Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!MpU1RLSQ!weiXBk35QlkGgwhc1cb_puzZZoMGRQ8KtUOhYr8ex1k MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n7-win-1.0.7-633a643e10531c58e7ce18018986b6d14774102d.zip iClarified]
|-
! rowspan="2" | 1.0.8
| OS X
| <code>19c9cfaf2754f024648fee25540ae57647176ade</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/1233z8ovhgcs8ada1l9r Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!4tczCCyK!zPxv-f_VQ4-pxMAATSIbWiuo2S2iPBTdtJ-Kjo58HKQ MEGA]
| rowspan="2" {{n/a}}
| rowspan="2" | Support for iOS 7.0 (11A466) that shipped with some iPhone 5s and iPhone 5c
|-
| Windows
| <code>c04822c26f84f20107f9b88c1888b3b34f349621</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/qsofcnoz02cttuttquac Box]
| class="nobrradiusplz rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!Iw1xiK5Q!04tOvK_XNTkivLKy2Ej_6FzOmrSmBaf16n-1Hgj_WZY MEGA]
|}

'''Note:''' evasi0n7 1.0.8 is known to cause boot loops. 1.0.8 has since been taken down from the evad3rs' website, and users are advised to use 1.0.7 unless you have an iPhone 5s/iPhone 5c running iOS 7.0 (build 11A466).

== Research ==

=== Mach-O (OS X binary) ===

evasi0n7 is a single architecture (i386) unsigned binary. The app is self-contained, meaning it packages all of its resources into the Mach-O. Using [http://www.newosxbook.com/files/jtool.tar jtool] to inspect the Mach-O header of the binary shows that there is some added sections in the <code>__DATA</code> segment.

bash$ jtool -l ./evasi0n\ 7.app/Contents/MacOS/evasi0n7
...
LC 02: LC_SEGMENT Mem: 0x00170000-0x01d09000 __DATA
Mem: 0x00170000-0x00170008 __DATA.__dyld
Mem: 0x00170008-0x00170060 __DATA.__nl_symbol_ptr (Non-Lazy Symbol Ptrs)
Mem: 0x00170060-0x001703d4 __DATA.__la_symbol_ptr (Lazy Symbol Ptrs)
Mem: 0x001703d4-0x001703d8 __DATA.__mod_init_func (Module Init Function Ptrs)
Mem: 0x001703d8-0x001705d0 __DATA.__const
Mem: 0x001705d0-0x00171c14 __DATA.__data
Mem: 0x00171c14-0x00171c64 __DATA.__cfstring
 Mem: 0x00171c64-0x001a942d __DATA.data_3
Mem: 0x001a942d-0x0087b92c __DATA.data_4
Mem: 0x0087b92c-0x0087be18 __DATA.data_5
Mem: 0x0087be18-0x0087c2f8 __DATA.data_6
Mem: 0x0087c2f8-0x008fb944 __DATA.data_7
Mem: 0x008fb944-0x008fba7f __DATA.data_8
Mem: 0x008fba7f-0x008fbeac __DATA.data_9
Mem: 0x008fbeac-0x0160f3a1 __DATA.data_10
Mem: 0x0160f3a1-0x016101ac __DATA.data_11
Mem: 0x016101ac-0x01d083dd __DATA.data_12 
Mem: 0x01d08400-0x01d084cc __DATA.__common (Zero Fill)
Mem: 0x01d084cc-0x01d0866c __DATA.__bss (Zero Fill)

...

The Mach-O ABI<ref>https://developer.apple.com/library/mac/documentation/DeveloperTools/Conceptual/MachORuntime/Reference/reference.html#//apple_ref/doc/uid/TP40000895-CH248-95693</ref> describes the __DATA segment as:
<blockquote>The __DATA segment contains writable data. The static linker sets the virtual memory permissions of this segment to allow both reading and writing. Because it is writable, the __DATA segment of a framework or other shared library is logically copied for each process linking with the library. When memory pages such as those making up the __DATA segment are readable and writable, the kernel marks them copy-on-write; therefore when a process writes to one of these pages, that process receives its own private copy of the page.</blockquote>
This means additional sections can be added using compiler flags, and these will be treated as raw data and added to the header and binary contents. Specifically they were called '''data_3''' through '''data_12''', and this is where the payloads used for jailbreak process are stored. At runtime, the evasi0n app was loading these data segments into memory to prepare to use them when jailbreaking.

=== Payload Extraction ===
The locations of the payloads have been identified, and they can be extracted and examined. To extract the payloads from the binary and dump the data into a file that can be examined:

bash$ jtool -e __DATA.data_3 ./evasi0n\ 7.app/Contents/MacOS/evasi0n7
Requested section found at Offset 1510500
Extracting __DATA.data_3 at 1510500, 227273 (377c9) bytes into evasi0n7.__DATA.data_3

=== Payload Format ===

Before examining the dumped payload files, some information can be gathered from other parts of the Mach-O binary. By dumping the symbol table from the binary, it is possible to see the names of functions used in the binary that are linked to in external libraries. Something that stands out in the evasi0n binary is the usage of the gzip library.

bash $ dsymutil -s ./evasi0n\ 7.app/Contents/MacOS/evasi0n7
----------------------------------------------------------------------
Symbol table for: './evasi0n 7.app/Contents/MacOS/evasi0n7' (i386)
----------------------------------------------------------------------
Index n_strx n_type n_sect n_desc n_value
======== -------- ------------------ ------ ------ ----------------
...
[ 164] 00000ab1 01 ( UNDF EXT) 00 0a00 0000000000000000 '_getcwd'
[ 165] 00000ab9 01 ( UNDF EXT) 00 0a00 0000000000000000 '_getsectdata'
"_getsectdata" Suggests it is used to get the data from a particular data section from the Mach-O header
[ 166] 00000ac6 01 ( UNDF EXT) 00 0100 0000000000000000 '_gzclose'
[ 167] 00000acf 01 ( UNDF EXT) 00 0100 0000000000000000 '_gzopen'
[ 168] 00000ad7 01 ( UNDF EXT) 00 0100 0000000000000000 '_gzread'
[ 169] 00000adf 01 ( UNDF EXT) 00 0100 0000000000000000 '_gzseek'
[ 170] 00000ae7 01 ( UNDF EXT) 00 0100 0000000000000000 '_inflate'
[ 171] 00000af0 01 ( UNDF EXT) 00 0100 0000000000000000 '_inflateEnd'
[ 172] 00000afc 01 ( UNDF EXT) 00 0100 0000000000000000 '_inflateInit2_'
...

From that, it can be deduced that the payloads that were extracted are compressed using gzip. This can be verified by running the command <code>file</code> on the extracted payloads.

bash $ file ./evasi0n7.__DATA.data_3 
evasi0n7.__DATA.data_3: gzip compressed data, from Unix, last modified: Sun Dec 22 05:54:11 2013

After decompressing the gzip file there is a new file, again test that with <code>file</code>.

bash $ mv ./evasi0n7.__DATA.data_3 ./evasi0n7.__DATA.data_3.gz
bash $ gunzip ./evasi0n7.__DATA.data_3.gz
bash $ file ./evasi0n7.__DATA.data_3
evasi0n7.__DATA.data_3: POSIX tar archive

Seems that the payloads were stored as simply <code>.tar.gz</code> files dumped directly into the Mach-O header of the binary.

=== Payload Contents ===

Now having an understanding of how the payloads were supposed to be used and packaged, their contents can be examined in detail to see what they are used for.

bash $ tar ztvf ./evasi0n7.__DATA.data_3 
drwxr-xr-x 0 planetbeing staff 0 Dec 22 00:20 ./
drwxr-xr-x 0 planetbeing staff 0 Dec 17 18:27 ./Applications/
drwxr-xr-x 0 planetbeing staff 0 Dec 21 07:25 ./etc/
drwxr-xr-x 0 planetbeing staff 0 Dec 18 18:34 ./private/
drwxr-xr-x 0 planetbeing staff 0 Dec 18 18:57 ./usr/
drwxr-xr-x 0 planetbeing staff 0 Dec 19 04:18 ./usr/bin/
drwxr-xr-x 0 planetbeing staff 0 Oct 31 23:14 ./usr/libexec/
drwxr-xr-x 0 planetbeing staff 0 Dec 18 19:11 ./usr/libexec/cydia/
-rwxr-xr-x 0 planetbeing staff 3363 Dec 18 23:59 ./usr/libexec/cydia/firmware.sh
-rwxr-xr-x 0 planetbeing staff 228 Dec 17 20:43 ./usr/libexec/cydia/free.sh
-rwxr-xr-x 0 planetbeing staff 132848 Dec 18 18:57 ./usr/bin/gssc
-rwxr-xr-x 0 planetbeing staff 200352 Dec 19 04:18 ./usr/bin/uicache
drwxr-xr-x 0 planetbeing staff 0 Dec 18 18:34 ./private/var/
drwxr-xr-x 0 planetbeing staff 0 Dec 18 18:34 ./private/var/lib/
drwxr-xr-x 0 planetbeing staff 0 Dec 18 18:34 ./private/var/lib/dpkg/
drwxr-xr-x 0 planetbeing staff 0 Dec 22 00:12 ./private/var/lib/dpkg/info/
-rw-r--r-- 0 planetbeing staff 393 Dec 18 18:40 ./private/var/lib/dpkg/info/com.evad3rs.evasi0n7.list
-rwxr-xr-x 0 planetbeing staff 678 Dec 18 18:52 ./private/var/lib/dpkg/info/com.evad3rs.evasi0n7.prerm
-rw-r--r-- 0 planetbeing staff 5137 Dec 22 00:12 ./private/var/lib/dpkg/info/cydia.list
drwxr-xr-x 0 planetbeing staff 0 Dec 21 23:31 ./Applications/Cydia.app/
-rwxr-xr-x 0 planetbeing staff 211 Dec 21 22:52 ./Applications/Cydia.app/Cydia
-rwsr-sr-x 0 planetbeing staff 131824 Dec 22 00:00 ./Applications/Cydia.app/CydiaWrapper
-rwsr-sr-x 0 planetbeing staff 382608 Dec 17 20:50 ./Applications/Cydia.app/MobileCydia
-rwxr-xr-x 0 planetbeing staff 66960 Dec 22 00:04 ./Applications/Cydia.app/udidfix.dylib

* __data3 contains Cydia.
* __data4 contains Cydia subsystems (/bin, /usr/bin) and their supported libraries (/usr/lib) 
* __data5 contains a Mach-O universal binary (ARMv7/ARMv7s,ARMv8) which is installed in the root file system 
* __data6 contains a dylib (likely game over.dyliib) which exports the same symbols as libmis.dylib (used by amfid for code signature verification), but overrides them to return true 
* __data7 contains another Mach-O binary (ARMv7/ARMv8), likely evasi0n7, which is installed in the root filesystem during the jailbreak 
* __data8 contains the plist (property list) file used by evasion to register as a launchDaemon 
* __data9 contains a dylib which overrides the sandbox dylib (similar to __data6, but to enable evasion to avoid the sandbox) 
* __data10 contained the TaiG app and subsystems (similar to Cydia) - removed in 1.01 due to negative backlash
* __data11 contains a binary plist of strings used by the evasion binary 
* __data12 contains the Cydia repo list

=== Network Access ===

Noteably, when attempting to run the evasi0n.app without an active or accessible network connection, it will display a prompt that says it requires a network connection to be used. This is very true, as it needs to download the WWDC app as part of the exploit. However the app doesn't exhibit any of the typical commands for network access via Cocoa or CF APIs. Examining the symbol table we do see that there are references to "send", "recv", and other C-socket calls, however they appear to be used exclusively for the unix socket to communicate directly with the iOS device.

Examining the list of libraries linked to the binary gives some insight to how it was checking for a network connection.

bash $ otool -L ./evasi0n\ 7.app/Contents/MacOS/evasi0n7 
./evasi0n 7.app/Contents/MacOS/evasi0n7:
/usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.5)
/usr/lib/libxml2.2.dylib (compatibility version 10.0.0, current version 10.9.0)
/usr/lib/libssl.0.9.8.dylib (compatibility version 0.9.8, current version 50.0.0)
/usr/lib/libcrypto.0.9.8.dylib (compatibility version 0.9.8, current version 50.0.0)
/usr/lib/libcurl.4.dylib (compatibility version 7.0.0, current version 8.0.0)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 855.11.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
/System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa (compatibility version 1.0.0, current version 20.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1197.1.1)
/usr/lib/libstdc++.6.dylib (compatibility version 7.0.0, current version 60.0.0)
/usr/lib/libgcc_s.1.dylib (compatibility version 1.0.0, current version 2577.0.0)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 1265.0.0)
/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (compatibility version 300.0.0, current version 1056.0.0)

This stands out due to the compatibility version listed being higher than the version OS X 10.6.8, which was oldest version of OS X that evasi0n.app claimed to support. Checking the symbol table again evidence of how <code>libcurl</code> can be seen.

bash $ dsymutil -s ./evasi0n\ 7.app/Contents/MacOS/evasi0n7 
----------------------------------------------------------------------
Symbol table for: './evasi0n 7.app/Contents/MacOS/evasi0n7' (i386)
----------------------------------------------------------------------
Index n_strx n_type n_sect n_desc n_value
======== -------- ------------------ ------ ------ ----------------
...
[ 133] 00000938 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_easy_cleanup'
[ 134] 0000094b 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_easy_getinfo'
[ 135] 0000095e 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_easy_init'
[ 136] 0000096e 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_easy_perform'
[ 137] 00000981 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_easy_setopt'
[ 138] 00000993 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_easy_strerror'
[ 139] 000009a7 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_global_cleanup'
[ 140] 000009bc 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_global_init'
[ 141] 000009ce 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_slist_append'
[ 142] 000009e1 01 ( UNDF EXT) 00 0500 0000000000000000 '_curl_slist_free_all'
...

Digging into the code in the binary, it appears as these commands are used to do a check against the address <code>http://evasi0n.com/ex.plistx</code>. This appears to be a binary file that dictates the internal operation of the evasi0n7.app. Specifically it is known to be able to enable and disable ability to install the TaiG payloads.

=== Language Checks ===

The major controversy surrounding this release was that the evasi0n7.app would do a check against the locale and language settings of the computer being run on to see if it was set to Chinese. If this check was successful, it would install the TaiG app store by default instead of Cydia, and present Cydia as a secondary option. This was quickly discovered and patched to remove this functionally by both TaiG and [https://twitter.com/Dirk_Gently @Dirk_Gently].

{| class="wikitable"
! Version
! OS
! Offset
! Changes
! Result
|-
| rowspan="2" | 1.0.0 (evad3rs)
| [[wikipedia:OS X|Mac OS X]]
| 0xb0947
| Modify String "zh" to "xx"
| rowspan="3" | Check always fails
|-
| rowspan="2" | [[wikipedia:Microsoft Windows|Windows]]
| rowspan="2" | 0x2e5f8
| class="nobrradiusplz rborderplz" | Replace "E8C30000008A00" with "9090909090B000"
|-
| 1.0.0 (TaiG)
| class="nobrradiusplz rborderplz" | Replace "9090909090B001" with "9090909090B000"
|}

== Exploit Breakdowns ==

=== [http://pastebin.com/mT2n7uyj Write-up by Braden Thomas] ===

* WWDC.app is downloaded from app store and uploaded over AFC to ~/Media/Downloads

* An IPA containing WWDC.app is uploaded and installed using MobileInstall, but first, the Info.plist in the WWDC app in the IPA is changed so that CFBundleExecutable points to the untouched copy of the app in Downloads

* when MobileInstall installs the app, it signature checks the copy in Downloads, signature check passes and app is installed

* WWDC.app/WWDC is overwritten using AFC with a #! script to point to afcd the command line in #! will expose the entire / over afc port 8888

* a dylib (gameover) is uploaded which uses a CS bypass (vmsize 0) to neuter sandboxing in afcd using LINKEDIT section (afcd starts its sandbox at runtime using sandbox_init*)
* a LaunchServices bug is used to make that app load that library when it runs the device reboots and the user is instructed to run the app

* when the app runs, afcd runs exposing /, and the sandbox is neutered, allowing access everywhere however, iOS 7 kernel still prevents remapping / as writable so it's still just readonly

* at this point, /var/mobile/Library/Logs/AppleSupport is symlinked to /dev/rdisk0s1 the device is rebooted, and something early in boot (i believe ReportCrash) will chown that path to mobile which chowns rdisk

* they have an HFS library that has an AFC backend, so they're able to virtually mount the entire system partition via AFC by seeking around on the rdisk using AFC commands. so using that, they modify the system partition the changes to the system partition are adding an executable which is signed with a self-signed cert at /evasi0n7 and a launchd plist to run it at boot

* they use the same CS bypass used before to modify libmis.dylib which is loaded by amfid (which checks code signatures) to neuter the amfi checks and always return true (i.e. to MISValidateSignature)

* so evasi0n will run fine, and at that point it does the kernel portion

* they also have to do this trick involving another codeless library containing this xpcd_cache blob to bypass a change in iOS 7 (or was it 6) where launchctl will only load plists from signed libraries

See followups at [https://twitter.com/drspringfield @drspringfield].

=== [http://geohot.com/e7writeup.html Write-up by geohot] ===
[[geohot]] presented an evasi0n7 writeup on his website [http://geohot.com/e7writeup.html here].

=== Write-up by p0sixninja ===

The vulnerability is an out of bounds array in the _state.pis_ioctl_list array by specifying an overly large minor device node number. By placing data in a known location past the array it's possible to hijack the tty structure and special read and write data from ioctl calls, and control function pointers to control execution.

The exploit is actually quite simple to trigger. I discovered this with a simple fuzzing script to test out every single device node. Here's a small sample script that should crash the latest maverick update. please run this as root.

#!/bin/bash

for i in `seq 1 255`; do
echo "Node $i";
mknod /dev/crash c 16 $i;
echo "Hello World" >/dev/crash;
rm -rf /dev/crash;
done;

The 16 major device node actually is mapped to the ptmx/ptsd pseudo terminal system. It seems that only 16 spaces are allocated for these terminals and if you make a device node with major 16 and minor larger that 16 you start getting out of bounds of the array. The maximum size of device nodes are about 0x600000 giving to the ability to offset your pointer into a crafted structure very large. The only hard part is finding which zones are ahead of your array you can index into. The exploit itself is in the bsd/kernel/tty_ptmx.c file in XNU kernel. The crash happens in…

int ptsd_open(dev_t dev, int flag, __unused int devtype, __unused proc_t p);

The problem is they lack the check to see if the minor number is higher than the number of spots allocated. The problem comes down to this, I'll try to comment code as I go through it...

FREE_BSDSTATIC int
ptsd_open(dev_t dev, int flag, __unused int devtype, __unused proc_t p)
{
struct tty *tp;
struct ptmx_ioctl *pti;
int error;

/*
* The dev_t structure holds the bits extracted and used to offset
* in an array
*/

// We'll check this function out first, check below
if ((pti = ptmx_get_ioctl(minor(dev), 0)) == NULL) {
return (ENXIO);
}

// Here's where the crash happens
if (!(pti->pt_flags & PF_UNLOCKED)) {
return (EAGAIN);
}

// This is the pointer we want to control
tp = pti->pt_tty;
tty_lock(tp);

if ((tp->t_state & TS_ISOPEN) == 0) {
termioschars(&tp->t_termios); /* Set up default chars */
tp->t_iflag = TTYDEF_IFLAG;
tp->t_oflag = TTYDEF_OFLAG;
tp->t_lflag = TTYDEF_LFLAG;
tp->t_cflag = TTYDEF_CFLAG;
tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
ttsetwater(tp); /* would be done in xxparam() */
} else if (tp->t_state&TS_XCLUDE && suser(kauth_cred_get(), NULL)) {
error = EBUSY;
goto out;
}
if (tp->t_oproc) /* Ctrlr still around. */
(void)(*linesw[tp->t_line].l_modem)(tp, 1);
while ((tp->t_state & TS_CARR_ON) == 0) {
if (flag&FNONBLOCK)
break;
error = ttysleep(tp, TSA_CARR_ON(tp), TTIPRI | PCATCH,
"ptsd_opn", 0);
if (error)
goto out;
}
error = (*linesw[tp->t_line].l_open)(dev, tp);
/* Successful open; mark as open by the slave */
pti->pt_flags |= PF_OPEN_S;
CLR(tp->t_state, TS_IOCTL_NOT_OK);
if (error == 0)
ptmx_wakeup(tp, FREAD|FWRITE);
out:
tty_unlock(tp);
return (error);
}

/*
* Given a minor number, return the corresponding structure for that minor
* number. If there isn't one, and the create flag is specified, we create
* one if possible.
*
* Parameters: minor Minor number of ptmx device
* open_flag PF_OPEN_M First open of master
* PF_OPEN_S First open of slave
* 0 Just want ioctl struct
*
* Returns: NULL Did not exist/could not create
* !NULL structure corresponding minor number
*
* Locks: tty_lock() on ptmx_ioctl->pt_tty NOT held on entry or exit.
*/
static struct ptmx_ioctl *
ptmx_get_ioctl(int minor, int open_flag)
{
struct ptmx_ioctl *new_ptmx_ioctl;

// For normal open() syscalls this flag is never set
if (open_flag & PF_OPEN_M) {

/*
* If we are about to allocate more memory, but we have
* already hit the administrative limit, then fail the
* operation.
*
* Note: Subtract free from total when making this
* check to allow unit increments, rather than
* snapping to the nearest PTMX_GROW_VECTOR...
*/
if ((_state.pis_total - _state.pis_free) >= ptmx_max) {
return (NULL);
}

MALLOC(new_ptmx_ioctl, struct ptmx_ioctl *, sizeof(struct ptmx_ioctl), M_TTYS, M_WAITOK|M_ZERO);
if (new_ptmx_ioctl == NULL) {
return (NULL);
}

if ((new_ptmx_ioctl->pt_tty = ttymalloc()) == NULL) {
FREE(new_ptmx_ioctl, M_TTYS);
return (NULL);
}

/*
* Hold the DEVFS_LOCK() over this whole operation; devfs
* itself does this over malloc/free as well, so this should
* be safe to do. We hold it longer than we want to, but
* doing so avoids a reallocation race on the minor number.
*/
DEVFS_LOCK();
/* Need to allocate a larger vector? */
if (_state.pis_free == 0) {
struct ptmx_ioctl **new_pis_ioctl_list;
struct ptmx_ioctl **old_pis_ioctl_list = NULL;

/* Yes. */
MALLOC(new_pis_ioctl_list, struct ptmx_ioctl **, sizeof(struct ptmx_ioctl *) * (_state.pis_total + PTMX_GROW_VECTOR), M_TTYS, M_WAITOK|M_ZERO);
if (new_pis_ioctl_list == NULL) {
ttyfree(new_ptmx_ioctl->pt_tty);
DEVFS_UNLOCK();
FREE(new_ptmx_ioctl, M_TTYS);
return (NULL);
}

/* If this is not the first time, copy the old over */
bcopy(_state.pis_ioctl_list, new_pis_ioctl_list, sizeof(struct ptmx_ioctl *) * _state.pis_total);
old_pis_ioctl_list = _state.pis_ioctl_list;
_state.pis_ioctl_list = new_pis_ioctl_list;
_state.pis_free += PTMX_GROW_VECTOR;
_state.pis_total += PTMX_GROW_VECTOR;
if (old_pis_ioctl_list)
FREE(old_pis_ioctl_list, M_TTYS);
}

if (_state.pis_ioctl_list[minor] != NULL) {
ttyfree(new_ptmx_ioctl->pt_tty);
DEVFS_UNLOCK();
FREE(new_ptmx_ioctl, M_TTYS);

/* Special error value so we know to redrive the open, we've been raced */
return (struct ptmx_ioctl*)-1;

}

/* Vector is large enough; grab a new ptmx_ioctl */

/* Now grab a free slot... */
_state.pis_ioctl_list[minor] = new_ptmx_ioctl;

/* reduce free count */
_state.pis_free--;

_state.pis_ioctl_list[minor]->pt_flags |= PF_OPEN_M;
DEVFS_UNLOCK();

/* Create the /dev/ttysXXX device {<major>,XXX} */
_state.pis_ioctl_list[minor]->pt_devhandle = devfs_make_node(
makedev(ptsd_major, minor),
DEVFS_CHAR, UID_ROOT, GID_TTY, 0620,
PTSD_TEMPLATE, minor);
if (_state.pis_ioctl_list[minor]->pt_devhandle == NULL) {
printf("devfs_make_node() call failed for ptmx_get_ioctl()!!!!\n");
}
} else if (open_flag & PF_OPEN_S) {
DEVFS_LOCK();
_state.pis_ioctl_list[minor]->pt_flags |= PF_OPEN_S;
DEVFS_UNLOCK();
}

// No else statement to catch errors just return the index to the array faithfully.
return (_state.pis_ioctl_list[minor]);
}

First notice the (open_flag & PF_OPEN_M), if this is not true a lot of code will be skipped. on the ptmx devices, this isn't set so all this is complete skipped and we can skip to the end of the the code since there is no all catching else clause to handle most connections. It just automatically returns this array indexed with a user controllable value. Crash but true, let's look more into this structure we can control if we create a large minor number.

static struct _ptmx_ioctl_state {
struct ptmx_ioctl **pis_ioctl_list; /* pointer vector */
int pis_total; /* total slots */
int pis_free; /* free slots */
} _state;

This just contains a pointer vector of ptmx_ioctl structures, let's look at the structure which should be contained in the minor number offset.

/*
* ptmx_ioctl is a pointer to a list of pointers to tty structures which is
* grown, as necessary, copied, and replaced, but never shrunk. The ioctl
* structures themselves pointed to from this list come and go as needed.
*/
struct ptmx_ioctl {
struct tty *pt_tty; /* pointer to ttymalloc()'ed data */
int pt_flags;
struct selinfo pt_selr;
struct selinfo pt_selw;
u_char pt_send;
u_char pt_ucntl;
void *pt_devhandle; /* cloned slave device handle */
};

The first pointer in this structure is a pointer to a tty structure. This structure is easily readable and writable using using user land APIS. It also includes some function pointers in there which can be triggered to gain

struct tty {
lck_mtx_t t_lock; /* Per tty lock */

struct clist t_rawq; /* Device raw input queue. */
long t_rawcc; /* Raw input queue statistics. */
struct clist t_canq; /* Device canonical queue. */
long t_cancc; /* Canonical queue statistics. */
struct clist t_outq; /* Device output queue. */
long t_outcc; /* Output queue statistics. */
int t_line; /* Interface to device drivers. */
dev_t t_dev; /* Device. */
int t_state; /* Device and driver (TS*) state. */
int t_flags; /* Tty flags. */
int t_timeout; /* Timeout for ttywait() */
struct pgrp *t_pgrp; /* Foreground process group. */
struct session *t_session; /* Enclosing session. */
struct selinfo t_rsel; /* Tty read/oob select. */
struct selinfo t_wsel; /* Tty write select. */
struct termios t_termios; /* Termios state. */
struct winsize t_winsize; /* Window size. */
/* Start output. */
void (*t_oproc)(struct tty *);
/* Stop output. */
void (*t_stop)(struct tty *, int);
/* Set hardware state. */
int (*t_param)(struct tty *, struct termios *);
void *t_sc; /* XXX: net/if_sl.c:sl_softc. */
int t_column; /* Tty output column. */
int t_rocount, t_rocol; /* Tty. */
int t_hiwat; /* High water mark. */
int t_lowat; /* Low water mark. */
int t_gen; /* Generation number. */
void *t_iokit; /* IOKit management */
int t_refcnt; /* reference count */
};

You can imagine all the power you could do if you can control all these structures carefully. That will be the difficulty when trying to exploit. You need to find a kernel zone past this array and allocate your data into it in a way you always know the offset. shouldn't be too hard.

Here's what the crash looks like once triggered.

bash-3.2# for i in `seq 1 255`;do echo $i; mknod /dev/crash c 16 $i;echo "Hello" >/dev/crash;rm -rf /dev/crash;done

in gdb remote kernel debugger…

gdb$ bt
#0 0xffffff8024f35fbc in ptsd_open (dev=0x10000010, flag=0x402, devtype=0x2000, p=0xffffff803655a3f8) at /SourceCache/xnu_debug/xnu-2422.1.72/bsd/kern/tty_ptmx.c:571
#1 0xffffff8024bdd93f in spec_open (ap=0xffffff8225cb3928) at /SourceCache/xnu_debug/xnu-2422.1.72/bsd/miscfs/specfs/spec_vnops.c:325
#2 0xffffff8024bc43c9 in VNOP_OPEN (vp=0xffffff803809c110, mode=0x402, ctx=0xffffff8035bcdd08) at /SourceCache/xnu_debug/xnu-2422.1.72/bsd/vfs/kpi_vfs.c:3015
#3 0xffffff8024bb4eab in vn_open_auth (ndp=0xffffff8225cb3b70, fmodep=0xffffff8225cb3adc, vap=0xffffff8225cb3d08) at /SourceCache/xnu_debug/xnu-2422.1.72/bsd/vfs/vfs_vnops.c:591
#4 0xffffff8024b9d8db in open1 (ctx=0xffffff8035bcdd08, ndp=0xffffff8225cb3b70, uflags=0x601, vap=0xffffff8225cb3d08, fp_zalloc=0xffffff8024ecf0b0 <fileproc_alloc_init>, cra=0x0, retval=0xffffff8035bcdc18) at /SourceCache/xnu_debug/xnu-2422.1.72/bsd/vfs/vfs_syscalls.c:3067
#5 0xffffff8024b9e684 in open_nocancel (p=0xffffff803655a3f8, uap=0xffffff8035c3a920, retval=0xffffff8035bcdc18) at /SourceCache/xnu_debug/xnu-2422.1.72/bsd/vfs/vfs_syscalls.c:3345
#6 0xffffff8024b9e4fc in open (p=0xffffff803655a3f8, uap=0xffffff8035c3a920, retval=0xffffff8035bcdc18) at /SourceCache/xnu_debug/xnu-2422.1.72/bsd/vfs/vfs_syscalls.c:3326
#7 0xffffff8024fa3828 in unix_syscall64 (state=0xffffff8035c3a910) at /SourceCache/xnu_debug/xnu-2422.1.72/bsd/dev/i386/systemcalls.c:370

gdb$ i r
rax 0xdeadbeefdeadbeef 0xdeadbeefdeadbeef
rbx 0xffffff80367ea168 0xffffff80367ea168
rcx 0xffffff8033ec8788 0xffffff8033ec8788
rdx 0x10 0x10
rsi 0x0 0x0
rdi 0x10 0x10
rbp 0xffffff8225cb3870 0xffffff8225cb3870
rsp 0xffffff8225cb3840 0xffffff8225cb3840
r8 0x402 0x402
r9 0x1 0x1
r10 0xffffff80327c6220 0xffffff80327c6220
r11 0x0 0x0
r12 0xffffff8225cb3fc0 0xffffff8225cb3fc0
r13 0x7f9190c045b0 0x7f9190c045b0
r14 0xffffffff 0xffffffff
r15 0xffffff8035c3a910 0xffffff8035c3a910
rip 0xffffff8024f35fbc 0xffffff8024f35fbc <ptsd_open+76>
eflags 0x10282 0x10282
cs 0x8 0x8
ss 0x0 0x0
ds 0x0 0x0
es 0x0 0x0
fs 0xdead0000 0xdead0000
gs 0xdead0000 0xdead0000

it was trying to read in the value of _state.pis_ioctl_list[10].

gdb$ print _state.pis_ioctl_list[10]
$1 = (struct ptmx_ioctl *) 0xdeadbeefdeadbeef

gdb$ print pti
$2 = (struct ptmx_ioctl *) 0xdeadbeefdeadbeef

It crashes here before dereferenceing the tty structure at the beginning of the ptmx_ioctl structure. We must know it's an address, but we also leak a bit near the address if it is an address. We should also be able to retrieve the value of all these state variables it sets from variable bits wherever the pointer is at to see if it's the correct pointer or not.

571 * if (!(pti->pt_flags & PF_UNLOCKED)) {
572 return (EAGAIN);
573 }
574
575 tp = pti->pt_tty;
576 tty_lock(tp);
577
578 if ((tp->t_state & TS_ISOPEN) == 0) {
579 termioschars(&tp->t_termios); /* Set up default chars */

Examine the read, write, and select apis for these terminals to learn all you can do. ioctl calls might also be interesting. Also since it uses the tty zone for allocating this devices, it might be a very predictable zone if we can control all the pseudo terminals. Also checking out return values based on flags in structs can be a good way to feel around in memory.

New in iOS 7.0 security protections, you are now no longer allowed to remount the root partition as readable/writeable. Before we just change the /etc/fstab file to remount the filesystems, but now there is a special kernel check preventing root filesystem from being remounted. Also the user filesystem containing all the data is mounted to disallow super user files, and device nodes. Luckily, if we can remount the user filesystem to reallow superuser and device node files we can create this device node and launch the kernel exploit on iOS7.

== See Also ==
* [[evad3rs]]
* [[evasi0n]]

== References ==
<references />

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]
[[Category:Cydia Packages]]

Evasi0n

2017-03-07T06:13:52Z

IApeiron: /* Download */ fixed "colspan"

{{lowercase}}
{{about|the untethered jailbreak for iOS 6.0-6.1.2|the untethered jailbreak for iOS 7.0.x|evasi0n7}}
{{Infobox software
| name = evasi0n
| title = evasi0n
| logo = [[File:Evasi0n.png|128px]]
| author = [[evad3rs]]
| developer = evad3rs
| released = {{date|2013|02|04}}
| discontinued =
| latest release version = 1.5.3
| latest release date = {{date|2013|03|12}}
| programming language = C
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]] / [[wikipedia:Linux|Linux]]
| size = Windows: 9.974 MiB [ZIP] OS X: 9.481 MiB [DMG] Linux: 9.405 MiB [TAR.LZMA]
| platform =
| language = [[wikipedia:English|English]]
| status = Deprecated
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://evasi0n.com/iOS6 evasi0n.com/iOS6]
}}
'''evasi0n''' is a [[jailbreak]] tool that can perform an [[untethered jailbreak]] on [[iOS]] 6.0-6.1.2 for all [[#Supported Devices|supported devices]], excluding both [[Apple TV 3G]] revisions. It was first released on 4 February 2013 by [[evad3rs]], and is available for Windows, Mac OS X, and Linux (x86 and x86_64). There is also a [[Cydia.app|Cydia]] package called "evasi0n [[iOS]] 6.0-6.1.2 [[untethered jailbreak|untether]]" which can untether an existing [[tethered jailbreak]] without the need to restore and use the desktop tool. It is a [[userland]] [[jailbreak]].

== Supported Devices ==
As of evasi0n's release, the only unsupported devices are the [[Apple TV 3G]] revisions, since the [[kernel]]s on these devices lack an injection vector to run unsigned code. All other devices running [[iOS]] 6.0-6.1.2 are supported (including iOS 5.2 for the [[K66AP|Apple TV 2G]]).

== Cydia Package ==
The Cydia package contains just three files:
/private/var/evasi0n/amfi.dylib
/private/var/evasi0n/evasi0n
/usr/libexec/dirhelper

It also includes three Debian maintenance scripts: <code>prerm</code> (a bash script that cancels uninstallation if the device is not vulnerable to [[Limera1n Exploit|limera1n]]), as well as <code>postrm</code> and <code>extrainst_</code> binaries.

== Version History ==
{| class="wikitable"
! Version
! Cydia Package Version
! Release Date
! #
! SHA-1 of evasi0n binary
! Changes
|-
! 1.0
| style="text-align:center;" | 0.1-1
| {{date|2013|02|04}}
| 1
| <code>f16f4592e5d65927faf98a25bce51b22ee9bc831</code>
|
* Initial Release
|-
! 1.1
| style="text-align:center;" | 0.2-3
| {{date|2013|02|06}}
| 2
| <code>301003d8aa58a0a2e1bf7030bb903ca42a89c851</code>
|
* Prevents Weather app from appearing on [[List of iPads|iPads]]
* Mitigated the long reboot issue
* Fixed freezing issue with after connecting multiple devices
* Fixed blinking of the jailbreak instructions on OS X.
* OS X app is now codesigned.
|-
! 1.2
| style="text-align:center;" | 0.3-1
| {{date|2013|02|08}}
| 3
| <code>75d140c53bdd615cc279932f843ab3af584086a5</code>
|
* Disables [[OTA Updates|OTA updates]].
* Correct timezone issue in evasi0n binary if client fails to correct it.
|-
! 1.3
| style="text-align:center;" | 0.3-2
| {{date|2013|02|11}}
| 4
| <code>ff5a5e767acb4c9acf9a25555ae172ad254e596a</code>
|
* Adds support for the [[N94AP|iPhone 4S]] on [[iOS]] 6.1.1.
|-
! 1.4
| style="text-align:center;" | 0.3-3
| {{date|2013|02|19}}
| 5
| <code>3b2cc5e2d7be397c09d369e83ea52094250d86e9</code>
|
* Added support for iOS 6.1.2
|-
! 1.5
| rowspan="2" style="text-align:center;" | 0.4-1
| {{date|2013|02|23}}
| 6
| <code>cd5a71b4d0b2767294049cc6b3b2ce3e09d68445</code>
|
* Improved boot time.
* Updated included Cydia package list.
|-
! 1.5.1
| {{date|2013|03|05}}
| 7
| <code>1a826416932e77f24c94da17884e48ccfe7cdbf6</code>
|
* Updated included Cydia package list.
|-
! 1.5.2
| rowspan="2" style="text-align:center;" | 0.4.1-1
| {{date|2013|03|11}}
| 8
| <code>3e89337956189e6654cd359995ac550f0372ac8b</code>
|
* Added French translation.
* Added Chinese translation.
* Added German translation.
* Updated bundled Cydia with localization fixes.
|-
! 1.5.3
| {{date|2013|03|12}}
| 9
| <code>3e89337956189e6654cd359995ac550f0372ac8b</code>
|
* Fixes Windows bugs.
|}

== Download ==
{| class="wikitable" style="white-space:nowrap;"
! Version
! OS
! SHA-1 Hash
! colspan="5" | Download
|-
! rowspan="3" | 1.0
| [[wikipedia:Linux|GNU/Linux]]
| <code>c9e4b15a161b89f0e412721f471c5f8559b6054f</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/5dped2c9ejnk5r6ahfpg Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!0kUkXBLC!Q8e53kQZpLbGL7PquHWgQFhMU9Ru3WJWxBuzEdkiMJo MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2561828874/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma iClarified]
|-
| [[wikipedia:OS X|Mac OS X]]
| <code>23f99a0d65e71fd79ff072b227f0ecb176f0ffa8</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/du66n0g9wl1j4ta57hpx Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!5h0BwQoa!KdRLFwNJ3OjMS-7Zs2YGQnsvPxAKEsaAjabY__8pNtY MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3010870584/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg iClarified]
|-
| [[wikipedia:Microsoft Windows|Windows]]
| <code>2ff288e1798b4711020e9dd7f26480e57704d8b2</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/tg1t0cz7oakvq7hsv0bd Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!d9ciUApQ!AkwevVU1OtUrEUU7U4fE-V8qqM9aINTAGgjkukShihE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3503186483/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip iClarified]
|-
! rowspan="3" | 1.1
| GNU/Linux
| <code>6c06a6be87e003eee470eb749b42ffbaafcc9e62</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/8smyi2ud2ts41icmtf50 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Qw9wwJpC!IE3ZcRv9-yCc-w12Ktmd_AQbVV84xCdIycB7W0OyW8g MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/330748775/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>ae9d20bc927976a1f55089cd80afca48de0f7a2e</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ydz8ctzuvyjuqb7y0oj5 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!I0FmTK7Q!YTBYg3e9oEFYIFwFN56XfVqcHAdh1YacWW0OkFE1dHo MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2540645295/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg iClarified]
|-
| Windows
| <code>4225b01afd4a4fd1277565954964bd3310ad8b5f</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/velx0yh66mmw4jlf4igm Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!1x9EzajI!CqMhmQ8rl6NODx6S4lOZVRNHyBJ9Dgt3TtRBl4_l2NA MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2426342155/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip iClarified]
|-
! rowspan="3" | 1.2
| GNU/Linux
| <code>2e1d1f6c7e6ca775860df03298dce3b0d798658a</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/jcerfiaug4ke7f4q6z15 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Ak12CQIJ!Mf6_W1l9xPQKvQUYOZEl9w_4yB0HbfqrTRWZ6BJKSjg MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/1511098224/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>8f91aba478ad28bda800dc5c303be1699fcfb800</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/qogbw1s82xi8ogdfk1co Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!wxMFAZhR!KIMDnVwbvscogces8L2z7j1aQIgxPZgsBygLou69gfk MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3161324199/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg iClarified]
|-
| Windows
| <code>9942559caf779da6526b9fd0e207d21554a8a9cf</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ld4e7c2ckrjyaj1cym8g Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!9k0iQICT!M_gOkBSyYO5c86LqXX9UUWF-twF-wJMhH9ScPwd1CFE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2387451293/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip iClarified]
|-
! rowspan="3" | 1.3
| GNU/Linux
| <code>d93bc45653345e62a315e0a0aaa1b709aacd26c4</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/yu314zif091koehui5pb Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Rg0kyRIK!T-_u6CMAgTc1lFl0XMdjwjD3sBcAnOlIUK0GdR-Nh-s MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2098837020/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>c239da3fd4e312c8468cdca967c86962b2cbd3f9</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/cfbxzbn3p9gmj24tslwc Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!wgdgHCLb!AHLWLhCqoTQR-qWceDld_nODFZAo-MiMJbDug3my2iE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2824336729/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg iClarified]
|-
| Windows
| <code>92bbe23f125f3b0155334f1925943624e24ce130</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/spd5uii8p86ko6ypad1l Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Uh0gVLbQ!YP63Pk2qb300H_bI17i8i3z7868m5aQPJEWaDob5Qe8 MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2063191667/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip iClarified]
|-
! rowspan="3" | 1.4
| GNU/Linux
| <code>95c34e7a7220d2dab2e93cf9bb62beb49aef8996</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/f6llokbz8k2a3ag08d54 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!B5FGyQLY!QoSdQFK-8yWmXbwhBjr0YhXeFW5YQGih2ZUOzGIO9SA MEGA]
| rowspan="9" {{n/a}}
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>96b62f303e335bb5c6b78034027606fee5fc93c3</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/flvifqy9csegg2dyk79n Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!10dgUABL!R8uxsTBRPD58gE6K7cF22QI2xtp0k6OAYcD6L6d-9g4 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.dmg iClarified]
|-
| Windows
| <code>36adf9ccf62aaf770163666e757c7a89e9ba3a55</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/eesitqovp4ac444txvau Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!04ljSZQJ!F9kaThdAaXyYiOINpn63WA1kEARYujnUh6SRl4gp7Ok MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.zip iClarified]
|-
! rowspan="3" | 1.5
| GNU/Linux
| <code>923db21a9045df6aaaff27670be92330f4855a21</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/0uhcxb83r30519x59avl Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!5odg2TBQ!M_csICuu8BazHC16H5Y_zlv6hqw7ZFsz-rOoYkrXdeg MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>cccf7e5b4a83df8c05dcfed98b9627533c018541</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ip3yvihmkkp9qh3arixs Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!YpdiWJpZ!GDrEaV5xwMI8XUv2gKER6EstsD1MMgKJD-MkTo41MLM MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.dmg iClarified]
|-
| Windows
| <code>25799bbeea3733c26fb010e6aca432d686fd8f9f</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/tnez6rzlyka0yovc59fu Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!M4En0DqT!TLDb1TO0bnRYxnvd53pcP31Yf0RoD50oeEN9nsERi9o MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.zip iClarified]
|-
! rowspan="3" | 1.5.1
| GNU/Linux
| <code>cc0bd166a1480c2a838584b201981db1e45ca411</code>
| rowspan="9" {{n/a}}
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/q9kxt1rx26jtsp5t23jf Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!A9cGhJ7R!WBD8mEP44G8xto1QE6buXV8wVr9JjwE8ZzXR1GETZwA MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>4a0e9fb8b5f83fbee5e26d1d7db876cefd09832a</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/jz8730nj3fqhe4u16um0 Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!Jh8VBYwb!E2MPwwr6qlaljNAS_4A2AAN6iS0KZzxEjCaeW84tbM4 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.dmg iClarified]
|-
| Windows
| <code>a220bb5fb1ccf5cf1cb666dc03e20ac54890835d</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/51vgle3imzdvero2krja Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!M5FVzIxZ!ExWD6iJVoIO_vmJYuBvFrk0bW7MYmXfYnjDUea2Nhbc MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.zip iClarified]
|-
! rowspan="3" | 1.5.2
| GNU/Linux
| <code>97fbeb932dd3cb22ec339ec4c2f95a17d570d30c</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/4t8gg74ybfmm0q6ca617 Box]
| rowspan="3" {{n/a}}
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2315522066/evasi0n-linux-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>051079f808f5c31f32ba09c6a39f09a8c3479157</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/umd13tz9eunklq0dp0pt Box]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2207200894/evasi0n-mac-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.dmg iClarified]
|-
| Windows
| <code>30d34e23f860eae28d4ae6513edc46ef8aa2042c</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/18ia7rds8ka8rc112inh Box]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3354239509/evasi0n-win-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.zip iClarified]
|-
! rowspan="3" class="blradiusplz" | 1.5.3
| GNU/Linux
| <code>620dcb7996b1f3497827b11876bf0c2fae069ecf</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/2wk6dtc31bw74j514d40 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!klVWRThY!alwqx8rzv_v6xFH5wgnMCT2R9hDVRSxoWshFmMHvesU MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/496420809/evasi0n-linux-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>54827d78cb45b7dae4e7566b9ed5c1b833d68850</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/1dtxycfpsyvp0katitwk Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!IlE33IJT!tk0UOjL8Wt7Np8UYi5LjQ3WKPnwqwWK-IY8HOzxsrsY MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/478466150/evasi0n-mac-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.dmg iClarified]
|-
| Windows
| <code>2f8c2f111a6afefd099ecb0ce5aab63f160940b8</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/mh5vk7hpa7r3ymhnyjsz Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!lscBQKST!88XCNjSPj0FYFlu1v3WApcrwW2XnHD_IEPKRef1RiWk MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/1014635071/evasi0n-win-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.3-release.zip iClarified]
|}

== Exploits and Vulnerabilities ==
evasi0n takes advantage of several vulnerabilities:
* [[Symbolic Link Vulnerability]]
* [[Malformed PairRequest]]
* [[Timezone Vulnerability]] (CVE-2013-0979)
* [[Shebang Trick]]
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] (CVE-2013-0981)
* [[ARM Exception Vector Info Leak]] (CVE-2013-0978)
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] (CVE-2013-0977)

== Symbols in Untether code ==
{| class="wikitable" style="text-align:left;"
! Symbol
! v1
! v2
! v3
! v4
! v5
! v6
! v7
! v8/9
|-
| start
| 020B0
| 02EF8
| 02BFC
| 02BFC
| 02BFC
| 02E30
| ?
| 02A80
|-
| find_memmove_arm#search
| ?
| ?
| ?
| ?
| ?
| 0AFA0
| ?
| ?
|-
| find_memmove_thumb#search
| ?
| ?
| ?
| ?
| ?
| 0AFD0
| ?
| ?
|-
| find_memmove
| ?
| ?
| ?
| ?
| ?
| 0571C
| ?
| ?
|-
| find_memmove#exit
| ?
| ?
| ?
| ?
| ?
| 05762
| ?
| ?
|-
| _catch_exception_raise_state_identity
| ?
| ?
| ?
| ?
| ?
| ?
| ?
| 065B8
|}

== See Also ==
* [[evad3rs]]
* [[Patchfinder]]

== External Links ==
* [http://blog.accuvant.com/bthomasaccuvant/evasi0n-jailbreaks-userland-component/ Accuvant Labs analysis]
* [http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html Analysis by kernelpool]
* [http://www.nislab.no/content/download/38610/481190/file/NISlecture201303.pdf kernelpool presentation at NISlab: slides]
* [http://forelesning.hig.no/publish/1363953611-9b560e3de8f2/combined.mp4 kernelpool presentation at NISlab: video]
* [http://www.forbes.com/sites/andygreenberg/2013/02/05/inside-evasi0n-the-most-elaborate-jailbreak-to-ever-hack-your-iphone/ Explanation by planetbeing in Forbes]
* [https://github.com/NetsourceLabs/HopperScripts Hopper Script to demangle evasi0n strings] for Mac client of evasi0n, use in Hopper disassembler
* [http://support.apple.com/kb/HT5704 Apple Response: iOS 6.1.3 Security Fixes]
* [http://support.apple.com/kb/HT5702 Apple Response: iOS 5.2.1 (Apple TV) Security Fixes]
* [http://conference.hitb.org/hitbsecconf2013ams/materials/D2T1%20-%20Pod2g,%20Planetbeing,%20Musclenerd%20and%20Pimskeks%20aka%20Evad3rs%20-%20Swiping%20Through%20Modern%20Security%20Features.pdf Slides from HITB presentation in Amsterdam 2013]
* [http://www.quarkslab.com/en-blog+read+38 Quarkslab blog post describing how evasi0n bypasses code signing]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]
[[Category:Cydia Packages]]

Evasi0n

2017-03-07T01:30:29Z

IApeiron: /* Download */ Re-adding iClarified mirrors after exemption from Dialexio

{{lowercase}}
{{about|the untethered jailbreak for iOS 6.0-6.1.2|the untethered jailbreak for iOS 7.0.x|evasi0n7}}
{{Infobox software
| name = evasi0n
| title = evasi0n
| logo = [[File:Evasi0n.png|128px]]
| author = [[evad3rs]]
| developer = evad3rs
| released = {{date|2013|02|04}}
| discontinued =
| latest release version = 1.5.3
| latest release date = {{date|2013|03|12}}
| programming language = C
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]] / [[wikipedia:Linux|Linux]]
| size = Windows: 9.974 MiB [ZIP] OS X: 9.481 MiB [DMG] Linux: 9.405 MiB [TAR.LZMA]
| platform =
| language = [[wikipedia:English|English]]
| status = Deprecated
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://evasi0n.com/iOS6 evasi0n.com/iOS6]
}}
'''evasi0n''' is a [[jailbreak]] tool that can perform an [[untethered jailbreak]] on [[iOS]] 6.0-6.1.2 for all [[#Supported Devices|supported devices]], excluding both [[Apple TV 3G]] revisions. It was first released on 4 February 2013 by [[evad3rs]], and is available for Windows, Mac OS X, and Linux (x86 and x86_64). There is also a [[Cydia.app|Cydia]] package called "evasi0n [[iOS]] 6.0-6.1.2 [[untethered jailbreak|untether]]" which can untether an existing [[tethered jailbreak]] without the need to restore and use the desktop tool. It is a [[userland]] [[jailbreak]].

== Supported Devices ==
As of evasi0n's release, the only unsupported devices are the [[Apple TV 3G]] revisions, since the [[kernel]]s on these devices lack an injection vector to run unsigned code. All other devices running [[iOS]] 6.0-6.1.2 are supported (including iOS 5.2 for the [[K66AP|Apple TV 2G]]).

== Cydia Package ==
The Cydia package contains just three files:
/private/var/evasi0n/amfi.dylib
/private/var/evasi0n/evasi0n
/usr/libexec/dirhelper

It also includes three Debian maintenance scripts: <code>prerm</code> (a bash script that cancels uninstallation if the device is not vulnerable to [[Limera1n Exploit|limera1n]]), as well as <code>postrm</code> and <code>extrainst_</code> binaries.

== Version History ==
{| class="wikitable"
! Version
! Cydia Package Version
! Release Date
! #
! SHA-1 of evasi0n binary
! Changes
|-
! 1.0
| style="text-align:center;" | 0.1-1
| {{date|2013|02|04}}
| 1
| <code>f16f4592e5d65927faf98a25bce51b22ee9bc831</code>
|
* Initial Release
|-
! 1.1
| style="text-align:center;" | 0.2-3
| {{date|2013|02|06}}
| 2
| <code>301003d8aa58a0a2e1bf7030bb903ca42a89c851</code>
|
* Prevents Weather app from appearing on [[List of iPads|iPads]]
* Mitigated the long reboot issue
* Fixed freezing issue with after connecting multiple devices
* Fixed blinking of the jailbreak instructions on OS X.
* OS X app is now codesigned.
|-
! 1.2
| style="text-align:center;" | 0.3-1
| {{date|2013|02|08}}
| 3
| <code>75d140c53bdd615cc279932f843ab3af584086a5</code>
|
* Disables [[OTA Updates|OTA updates]].
* Correct timezone issue in evasi0n binary if client fails to correct it.
|-
! 1.3
| style="text-align:center;" | 0.3-2
| {{date|2013|02|11}}
| 4
| <code>ff5a5e767acb4c9acf9a25555ae172ad254e596a</code>
|
* Adds support for the [[N94AP|iPhone 4S]] on [[iOS]] 6.1.1.
|-
! 1.4
| style="text-align:center;" | 0.3-3
| {{date|2013|02|19}}
| 5
| <code>3b2cc5e2d7be397c09d369e83ea52094250d86e9</code>
|
* Added support for iOS 6.1.2
|-
! 1.5
| rowspan="2" style="text-align:center;" | 0.4-1
| {{date|2013|02|23}}
| 6
| <code>cd5a71b4d0b2767294049cc6b3b2ce3e09d68445</code>
|
* Improved boot time.
* Updated included Cydia package list.
|-
! 1.5.1
| {{date|2013|03|05}}
| 7
| <code>1a826416932e77f24c94da17884e48ccfe7cdbf6</code>
|
* Updated included Cydia package list.
|-
! 1.5.2
| rowspan="2" style="text-align:center;" | 0.4.1-1
| {{date|2013|03|11}}
| 8
| <code>3e89337956189e6654cd359995ac550f0372ac8b</code>
|
* Added French translation.
* Added Chinese translation.
* Added German translation.
* Updated bundled Cydia with localization fixes.
|-
! 1.5.3
| {{date|2013|03|12}}
| 9
| <code>3e89337956189e6654cd359995ac550f0372ac8b</code>
|
* Fixes Windows bugs.
|}

== Download ==
{| class="wikitable" style="white-space:nowrap;"
! Version
! OS
! SHA-1 Hash
! colspan="4" | Download
|-
! rowspan="3" | 1.0
| [[wikipedia:Linux|GNU/Linux]]
| <code>c9e4b15a161b89f0e412721f471c5f8559b6054f</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/5dped2c9ejnk5r6ahfpg Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!0kUkXBLC!Q8e53kQZpLbGL7PquHWgQFhMU9Ru3WJWxBuzEdkiMJo MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2561828874/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma iClarified]
|-
| [[wikipedia:OS X|Mac OS X]]
| <code>23f99a0d65e71fd79ff072b227f0ecb176f0ffa8</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/du66n0g9wl1j4ta57hpx Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!5h0BwQoa!KdRLFwNJ3OjMS-7Zs2YGQnsvPxAKEsaAjabY__8pNtY MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3010870584/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg iClarified]
|-
| [[wikipedia:Microsoft Windows|Windows]]
| <code>2ff288e1798b4711020e9dd7f26480e57704d8b2</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/tg1t0cz7oakvq7hsv0bd Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!d9ciUApQ!AkwevVU1OtUrEUU7U4fE-V8qqM9aINTAGgjkukShihE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3503186483/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip iClarified]
|-
! rowspan="3" | 1.1
| GNU/Linux
| <code>6c06a6be87e003eee470eb749b42ffbaafcc9e62</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/8smyi2ud2ts41icmtf50 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Qw9wwJpC!IE3ZcRv9-yCc-w12Ktmd_AQbVV84xCdIycB7W0OyW8g MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/330748775/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>ae9d20bc927976a1f55089cd80afca48de0f7a2e</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ydz8ctzuvyjuqb7y0oj5 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!I0FmTK7Q!YTBYg3e9oEFYIFwFN56XfVqcHAdh1YacWW0OkFE1dHo MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2540645295/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg iClarified]
|-
| Windows
| <code>4225b01afd4a4fd1277565954964bd3310ad8b5f</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/velx0yh66mmw4jlf4igm Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!1x9EzajI!CqMhmQ8rl6NODx6S4lOZVRNHyBJ9Dgt3TtRBl4_l2NA MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2426342155/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip iClarified]
|-
! rowspan="3" | 1.2
| GNU/Linux
| <code>2e1d1f6c7e6ca775860df03298dce3b0d798658a</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/jcerfiaug4ke7f4q6z15 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Ak12CQIJ!Mf6_W1l9xPQKvQUYOZEl9w_4yB0HbfqrTRWZ6BJKSjg MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/1511098224/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>8f91aba478ad28bda800dc5c303be1699fcfb800</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/qogbw1s82xi8ogdfk1co Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!wxMFAZhR!KIMDnVwbvscogces8L2z7j1aQIgxPZgsBygLou69gfk MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3161324199/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg iClarified]
|-
| Windows
| <code>9942559caf779da6526b9fd0e207d21554a8a9cf</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ld4e7c2ckrjyaj1cym8g Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!9k0iQICT!M_gOkBSyYO5c86LqXX9UUWF-twF-wJMhH9ScPwd1CFE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2387451293/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip iClarified]
|-
! rowspan="3" | 1.3
| GNU/Linux
| <code>d93bc45653345e62a315e0a0aaa1b709aacd26c4</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/yu314zif091koehui5pb Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Rg0kyRIK!T-_u6CMAgTc1lFl0XMdjwjD3sBcAnOlIUK0GdR-Nh-s MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2098837020/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>c239da3fd4e312c8468cdca967c86962b2cbd3f9</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/cfbxzbn3p9gmj24tslwc Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!wgdgHCLb!AHLWLhCqoTQR-qWceDld_nODFZAo-MiMJbDug3my2iE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2824336729/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg iClarified]
|-
| Windows
| <code>92bbe23f125f3b0155334f1925943624e24ce130</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/spd5uii8p86ko6ypad1l Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Uh0gVLbQ!YP63Pk2qb300H_bI17i8i3z7868m5aQPJEWaDob5Qe8 MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2063191667/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip iClarified]
|-
! rowspan="3" | 1.4
| GNU/Linux
| <code>95c34e7a7220d2dab2e93cf9bb62beb49aef8996</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/f6llokbz8k2a3ag08d54 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!B5FGyQLY!QoSdQFK-8yWmXbwhBjr0YhXeFW5YQGih2ZUOzGIO9SA MEGA]
| rowspan="9" {{n/a}}
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>96b62f303e335bb5c6b78034027606fee5fc93c3</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/flvifqy9csegg2dyk79n Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!10dgUABL!R8uxsTBRPD58gE6K7cF22QI2xtp0k6OAYcD6L6d-9g4 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.dmg iClarified]
|-
| Windows
| <code>36adf9ccf62aaf770163666e757c7a89e9ba3a55</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/eesitqovp4ac444txvau Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!04ljSZQJ!F9kaThdAaXyYiOINpn63WA1kEARYujnUh6SRl4gp7Ok MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.zip iClarified]
|-
! rowspan="3" | 1.5
| GNU/Linux
| <code>923db21a9045df6aaaff27670be92330f4855a21</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/0uhcxb83r30519x59avl Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!5odg2TBQ!M_csICuu8BazHC16H5Y_zlv6hqw7ZFsz-rOoYkrXdeg MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>cccf7e5b4a83df8c05dcfed98b9627533c018541</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ip3yvihmkkp9qh3arixs Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!YpdiWJpZ!GDrEaV5xwMI8XUv2gKER6EstsD1MMgKJD-MkTo41MLM MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.dmg iClarified]
|-
| Windows
| <code>25799bbeea3733c26fb010e6aca432d686fd8f9f</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/tnez6rzlyka0yovc59fu Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!M4En0DqT!TLDb1TO0bnRYxnvd53pcP31Yf0RoD50oeEN9nsERi9o MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.zip iClarified]
|-
! rowspan="3" | 1.5.1
| GNU/Linux
| <code>cc0bd166a1480c2a838584b201981db1e45ca411</code>
| rowspan="9" {{n/a}}
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/q9kxt1rx26jtsp5t23jf Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!A9cGhJ7R!WBD8mEP44G8xto1QE6buXV8wVr9JjwE8ZzXR1GETZwA MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>4a0e9fb8b5f83fbee5e26d1d7db876cefd09832a</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/jz8730nj3fqhe4u16um0 Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!Jh8VBYwb!E2MPwwr6qlaljNAS_4A2AAN6iS0KZzxEjCaeW84tbM4 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.dmg iClarified]
|-
| Windows
| <code>a220bb5fb1ccf5cf1cb666dc03e20ac54890835d</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/51vgle3imzdvero2krja Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!M5FVzIxZ!ExWD6iJVoIO_vmJYuBvFrk0bW7MYmXfYnjDUea2Nhbc MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.zip iClarified]
|-
! rowspan="3" | 1.5.2
| GNU/Linux
| <code>97fbeb932dd3cb22ec339ec4c2f95a17d570d30c</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/4t8gg74ybfmm0q6ca617 Box]
| rowspan="3" {{n/a}}
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2315522066/evasi0n-linux-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>051079f808f5c31f32ba09c6a39f09a8c3479157</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/umd13tz9eunklq0dp0pt Box]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2207200894/evasi0n-mac-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.dmg iClarified]
|-
| Windows
| <code>30d34e23f860eae28d4ae6513edc46ef8aa2042c</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/18ia7rds8ka8rc112inh Box]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3354239509/evasi0n-win-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.zip iClarified]
|-
! rowspan="3" class="blradiusplz" | 1.5.3
| GNU/Linux
| <code>620dcb7996b1f3497827b11876bf0c2fae069ecf</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/2wk6dtc31bw74j514d40 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!klVWRThY!alwqx8rzv_v6xFH5wgnMCT2R9hDVRSxoWshFmMHvesU MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/496420809/evasi0n-linux-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>54827d78cb45b7dae4e7566b9ed5c1b833d68850</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/1dtxycfpsyvp0katitwk Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!IlE33IJT!tk0UOjL8Wt7Np8UYi5LjQ3WKPnwqwWK-IY8HOzxsrsY MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/478466150/evasi0n-mac-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.dmg iClarified]
|-
| Windows
| <code>2f8c2f111a6afefd099ecb0ce5aab63f160940b8</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/mh5vk7hpa7r3ymhnyjsz Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!lscBQKST!88XCNjSPj0FYFlu1v3WApcrwW2XnHD_IEPKRef1RiWk MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/1014635071/evasi0n-win-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.3-release.zip iClarified]
|}

== Exploits and Vulnerabilities ==
evasi0n takes advantage of several vulnerabilities:
* [[Symbolic Link Vulnerability]]
* [[Malformed PairRequest]]
* [[Timezone Vulnerability]] (CVE-2013-0979)
* [[Shebang Trick]]
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] (CVE-2013-0981)
* [[ARM Exception Vector Info Leak]] (CVE-2013-0978)
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] (CVE-2013-0977)

== Symbols in Untether code ==
{| class="wikitable" style="text-align:left;"
! Symbol
! v1
! v2
! v3
! v4
! v5
! v6
! v7
! v8/9
|-
| start
| 020B0
| 02EF8
| 02BFC
| 02BFC
| 02BFC
| 02E30
| ?
| 02A80
|-
| find_memmove_arm#search
| ?
| ?
| ?
| ?
| ?
| 0AFA0
| ?
| ?
|-
| find_memmove_thumb#search
| ?
| ?
| ?
| ?
| ?
| 0AFD0
| ?
| ?
|-
| find_memmove
| ?
| ?
| ?
| ?
| ?
| 0571C
| ?
| ?
|-
| find_memmove#exit
| ?
| ?
| ?
| ?
| ?
| 05762
| ?
| ?
|-
| _catch_exception_raise_state_identity
| ?
| ?
| ?
| ?
| ?
| ?
| ?
| 065B8
|}

== See Also ==
* [[evad3rs]]
* [[Patchfinder]]

== External Links ==
* [http://blog.accuvant.com/bthomasaccuvant/evasi0n-jailbreaks-userland-component/ Accuvant Labs analysis]
* [http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html Analysis by kernelpool]
* [http://www.nislab.no/content/download/38610/481190/file/NISlecture201303.pdf kernelpool presentation at NISlab: slides]
* [http://forelesning.hig.no/publish/1363953611-9b560e3de8f2/combined.mp4 kernelpool presentation at NISlab: video]
* [http://www.forbes.com/sites/andygreenberg/2013/02/05/inside-evasi0n-the-most-elaborate-jailbreak-to-ever-hack-your-iphone/ Explanation by planetbeing in Forbes]
* [https://github.com/NetsourceLabs/HopperScripts Hopper Script to demangle evasi0n strings] for Mac client of evasi0n, use in Hopper disassembler
* [http://support.apple.com/kb/HT5704 Apple Response: iOS 6.1.3 Security Fixes]
* [http://support.apple.com/kb/HT5702 Apple Response: iOS 5.2.1 (Apple TV) Security Fixes]
* [http://conference.hitb.org/hitbsecconf2013ams/materials/D2T1%20-%20Pod2g,%20Planetbeing,%20Musclenerd%20and%20Pimskeks%20aka%20Evad3rs%20-%20Swiping%20Through%20Modern%20Security%20Features.pdf Slides from HITB presentation in Amsterdam 2013]
* [http://www.quarkslab.com/en-blog+read+38 Quarkslab blog post describing how evasi0n bypasses code signing]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]
[[Category:Cydia Packages]]

Evasi0n

2017-03-05T21:51:05Z

IApeiron: /* Download */ Added iClarified mirrors for Evasi0n: All versions

{{lowercase}}
{{about|the untethered jailbreak for iOS 6.0-6.1.2|the untethered jailbreak for iOS 7.0.x|evasi0n7}}
{{Infobox software
| name = evasi0n
| title = evasi0n
| logo = [[File:Evasi0n.png|128px]]
| author = [[evad3rs]]
| developer = evad3rs
| released = {{date|2013|02|04}}
| discontinued =
| latest release version = 1.5.3
| latest release date = {{date|2013|03|12}}
| programming language = C
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]] / [[wikipedia:Linux|Linux]]
| size = Windows: 9.974 MiB [ZIP] OS X: 9.481 MiB [DMG] Linux: 9.405 MiB [TAR.LZMA]
| platform =
| language = [[wikipedia:English|English]]
| status = Deprecated
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://evasi0n.com/iOS6 evasi0n.com/iOS6]
}}
'''evasi0n''' is a [[jailbreak]] tool that can perform an [[untethered jailbreak]] on [[iOS]] 6.0-6.1.2 for all [[#Supported Devices|supported devices]], excluding both [[Apple TV 3G]] revisions. It was first released on 4 February 2013 by [[evad3rs]], and is available for Windows, Mac OS X, and Linux (x86 and x86_64). There is also a [[Cydia.app|Cydia]] package called "evasi0n [[iOS]] 6.0-6.1.2 [[untethered jailbreak|untether]]" which can untether an existing [[tethered jailbreak]] without the need to restore and use the desktop tool. It is a [[userland]] [[jailbreak]].

== Supported Devices ==
As of evasi0n's release, the only unsupported devices are the [[Apple TV 3G]] revisions, since the [[kernel]]s on these devices lack an injection vector to run unsigned code. All other devices running [[iOS]] 6.0-6.1.2 are supported (including iOS 5.2 for the [[K66AP|Apple TV 2G]]).

== Cydia Package ==
The Cydia package contains just three files:
/private/var/evasi0n/amfi.dylib
/private/var/evasi0n/evasi0n
/usr/libexec/dirhelper

It also includes three Debian maintenance scripts: <code>prerm</code> (a bash script that cancels uninstallation if the device is not vulnerable to [[Limera1n Exploit|limera1n]]), as well as <code>postrm</code> and <code>extrainst_</code> binaries.

== Version History ==
{| class="wikitable"
! Version
! Cydia Package Version
! Release Date
! #
! SHA-1 of evasi0n binary
! Changes
|-
! 1.0
| style="text-align:center;" | 0.1-1
| {{date|2013|02|04}}
| 1
| <code>f16f4592e5d65927faf98a25bce51b22ee9bc831</code>
|
* Initial Release
|-
! 1.1
| style="text-align:center;" | 0.2-3
| {{date|2013|02|06}}
| 2
| <code>301003d8aa58a0a2e1bf7030bb903ca42a89c851</code>
|
* Prevents Weather app from appearing on [[List of iPads|iPads]]
* Mitigated the long reboot issue
* Fixed freezing issue with after connecting multiple devices
* Fixed blinking of the jailbreak instructions on OS X.
* OS X app is now codesigned.
|-
! 1.2
| style="text-align:center;" | 0.3-1
| {{date|2013|02|08}}
| 3
| <code>75d140c53bdd615cc279932f843ab3af584086a5</code>
|
* Disables [[OTA Updates|OTA updates]].
* Correct timezone issue in evasi0n binary if client fails to correct it.
|-
! 1.3
| style="text-align:center;" | 0.3-2
| {{date|2013|02|11}}
| 4
| <code>ff5a5e767acb4c9acf9a25555ae172ad254e596a</code>
|
* Adds support for the [[N94AP|iPhone 4S]] on [[iOS]] 6.1.1.
|-
! 1.4
| style="text-align:center;" | 0.3-3
| {{date|2013|02|19}}
| 5
| <code>3b2cc5e2d7be397c09d369e83ea52094250d86e9</code>
|
* Added support for iOS 6.1.2
|-
! 1.5
| rowspan="2" style="text-align:center;" | 0.4-1
| {{date|2013|02|23}}
| 6
| <code>cd5a71b4d0b2767294049cc6b3b2ce3e09d68445</code>
|
* Improved boot time.
* Updated included Cydia package list.
|-
! 1.5.1
| {{date|2013|03|05}}
| 7
| <code>1a826416932e77f24c94da17884e48ccfe7cdbf6</code>
|
* Updated included Cydia package list.
|-
! 1.5.2
| rowspan="2" style="text-align:center;" | 0.4.1-1
| {{date|2013|03|11}}
| 8
| <code>3e89337956189e6654cd359995ac550f0372ac8b</code>
|
* Added French translation.
* Added Chinese translation.
* Added German translation.
* Updated bundled Cydia with localization fixes.
|-
! 1.5.3
| {{date|2013|03|12}}
| 9
| <code>3e89337956189e6654cd359995ac550f0372ac8b</code>
|
* Fixes Windows bugs.
|}

== Download ==
{| class="wikitable" style="white-space:nowrap;"
! Version
! OS
! SHA-1 Hash
! colspan="4" | Download
|-
! rowspan="3" | 1.0
| [[wikipedia:Linux|GNU/Linux]]
| <code>c9e4b15a161b89f0e412721f471c5f8559b6054f</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/5dped2c9ejnk5r6ahfpg Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!0kUkXBLC!Q8e53kQZpLbGL7PquHWgQFhMU9Ru3WJWxBuzEdkiMJo MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2561828874/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma iClarified]
|-
| [[wikipedia:OS X|Mac OS X]]
| <code>23f99a0d65e71fd79ff072b227f0ecb176f0ffa8</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/du66n0g9wl1j4ta57hpx Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!5h0BwQoa!KdRLFwNJ3OjMS-7Zs2YGQnsvPxAKEsaAjabY__8pNtY MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3010870584/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg iClarified]
|-
| [[wikipedia:Microsoft Windows|Windows]]
| <code>2ff288e1798b4711020e9dd7f26480e57704d8b2</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/tg1t0cz7oakvq7hsv0bd Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!d9ciUApQ!AkwevVU1OtUrEUU7U4fE-V8qqM9aINTAGgjkukShihE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3503186483/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip iClarified]
|-
! rowspan="3" | 1.1
| GNU/Linux
| <code>6c06a6be87e003eee470eb749b42ffbaafcc9e62</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/8smyi2ud2ts41icmtf50 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Qw9wwJpC!IE3ZcRv9-yCc-w12Ktmd_AQbVV84xCdIycB7W0OyW8g MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/330748775/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>ae9d20bc927976a1f55089cd80afca48de0f7a2e</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ydz8ctzuvyjuqb7y0oj5 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!I0FmTK7Q!YTBYg3e9oEFYIFwFN56XfVqcHAdh1YacWW0OkFE1dHo MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2540645295/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.dmg iClarified]
|-
| Windows
| <code>4225b01afd4a4fd1277565954964bd3310ad8b5f</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/velx0yh66mmw4jlf4igm Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!1x9EzajI!CqMhmQ8rl6NODx6S4lOZVRNHyBJ9Dgt3TtRBl4_l2NA MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2426342155/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.1-baad71faf69b65b5d97f8fc1391846d5778b289d-release.zip iClarified]
|-
! rowspan="3" | 1.2
| GNU/Linux
| <code>2e1d1f6c7e6ca775860df03298dce3b0d798658a</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/jcerfiaug4ke7f4q6z15 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Ak12CQIJ!Mf6_W1l9xPQKvQUYOZEl9w_4yB0HbfqrTRWZ6BJKSjg MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/1511098224/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>8f91aba478ad28bda800dc5c303be1699fcfb800</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/qogbw1s82xi8ogdfk1co Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!wxMFAZhR!KIMDnVwbvscogces8L2z7j1aQIgxPZgsBygLou69gfk MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3161324199/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.dmg iClarified]
|-
| Windows
| <code>9942559caf779da6526b9fd0e207d21554a8a9cf</code>
| style="text-decoration: line-through;" | [https://sites.google.com/site/evad3rs/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ld4e7c2ckrjyaj1cym8g Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!9k0iQICT!M_gOkBSyYO5c86LqXX9UUWF-twF-wJMhH9ScPwd1CFE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2387451293/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.2-54502235236cbca6b1fcdbce5694ae2e4c5eb703-release.zip iClarified]
|-
! rowspan="3" | 1.3
| GNU/Linux
| <code>d93bc45653345e62a315e0a0aaa1b709aacd26c4</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/yu314zif091koehui5pb Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Rg0kyRIK!T-_u6CMAgTc1lFl0XMdjwjD3sBcAnOlIUK0GdR-Nh-s MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2098837020/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>c239da3fd4e312c8468cdca967c86962b2cbd3f9</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/cfbxzbn3p9gmj24tslwc Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!wgdgHCLb!AHLWLhCqoTQR-qWceDld_nODFZAo-MiMJbDug3my2iE MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2824336729/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.dmg iClarified]
|-
| Windows
| <code>92bbe23f125f3b0155334f1925943624e24ce130</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/spd5uii8p86ko6ypad1l Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!Uh0gVLbQ!YP63Pk2qb300H_bI17i8i3z7868m5aQPJEWaDob5Qe8 MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2063191667/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.3-1cb32faf1e4f4f6c890e6fcbeb004cb694c386f5-release.zip iClarified]
|-
! rowspan="3" | 1.4
| GNU/Linux
| <code>95c34e7a7220d2dab2e93cf9bb62beb49aef8996</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/f6llokbz8k2a3ag08d54 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!B5FGyQLY!QoSdQFK-8yWmXbwhBjr0YhXeFW5YQGih2ZUOzGIO9SA MEGA]
| rowspan="9" {{n/a}}
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>96b62f303e335bb5c6b78034027606fee5fc93c3</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/flvifqy9csegg2dyk79n Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!10dgUABL!R8uxsTBRPD58gE6K7cF22QI2xtp0k6OAYcD6L6d-9g4 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.dmg iClarified]
|-
| Windows
| <code>36adf9ccf62aaf770163666e757c7a89e9ba3a55</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/eesitqovp4ac444txvau Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!04ljSZQJ!F9kaThdAaXyYiOINpn63WA1kEARYujnUh6SRl4gp7Ok MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.4-91fc5a30e4caf41b22e85427e1b3b738f5158d8e-release.zip iClarified]
|-
! rowspan="3" | 1.5
| GNU/Linux
| <code>923db21a9045df6aaaff27670be92330f4855a21</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.tar.lzma Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/0uhcxb83r30519x59avl Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!5odg2TBQ!M_csICuu8BazHC16H5Y_zlv6hqw7ZFsz-rOoYkrXdeg MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>cccf7e5b4a83df8c05dcfed98b9627533c018541</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.dmg Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/ip3yvihmkkp9qh3arixs Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!YpdiWJpZ!GDrEaV5xwMI8XUv2gKER6EstsD1MMgKJD-MkTo41MLM MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.dmg iClarified]
|-
| Windows
| <code>25799bbeea3733c26fb010e6aca432d686fd8f9f</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.zip Google Sites]
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/tnez6rzlyka0yovc59fu Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!M4En0DqT!TLDb1TO0bnRYxnvd53pcP31Yf0RoD50oeEN9nsERi9o MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5-9cde20f28818ac84a776f2db463c265db00c1021-release.zip iClarified]
|-
! rowspan="3" | 1.5.1
| GNU/Linux
| <code>cc0bd166a1480c2a838584b201981db1e45ca411</code>
| rowspan="9" {{n/a}}
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/q9kxt1rx26jtsp5t23jf Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!A9cGhJ7R!WBD8mEP44G8xto1QE6buXV8wVr9JjwE8ZzXR1GETZwA MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>4a0e9fb8b5f83fbee5e26d1d7db876cefd09832a</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/jz8730nj3fqhe4u16um0 Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!Jh8VBYwb!E2MPwwr6qlaljNAS_4A2AAN6iS0KZzxEjCaeW84tbM4 MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.dmg iClarified]
|-
| Windows
| <code>a220bb5fb1ccf5cf1cb666dc03e20ac54890835d</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/51vgle3imzdvero2krja Box]
| class="rborderplz" style="text-decoration: line-through;" | [https://mega.co.nz/#!M5FVzIxZ!ExWD6iJVoIO_vmJYuBvFrk0bW7MYmXfYnjDUea2Nhbc MEGA]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.1-4e748c808f9d38c262b0916f87ef5b0e8124fc5f-release.zip iClarified]
|-
! rowspan="3" | 1.5.2
| GNU/Linux
| <code>97fbeb932dd3cb22ec339ec4c2f95a17d570d30c</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/4t8gg74ybfmm0q6ca617 Box]
| rowspan="3" {{n/a}}
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2315522066/evasi0n-linux-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>051079f808f5c31f32ba09c6a39f09a8c3479157</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/umd13tz9eunklq0dp0pt Box]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/2207200894/evasi0n-mac-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.dmg iClarified]
|-
| Windows
| <code>30d34e23f860eae28d4ae6513edc46ef8aa2042c</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/18ia7rds8ka8rc112inh Box]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/3354239509/evasi0n-win-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.2-7ef0895fb6c0ba200b952906c3d36594ace7bf84-release.zip iClarified]
|-
! rowspan="3" class="blradiusplz" | 1.5.3
| GNU/Linux
| <code>620dcb7996b1f3497827b11876bf0c2fae069ecf</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/2wk6dtc31bw74j514d40 Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!klVWRThY!alwqx8rzv_v6xFH5wgnMCT2R9hDVRSxoWshFmMHvesU MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/496420809/evasi0n-linux-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.tar.lzma RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-linux-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.tar.lzma iClarified]
|-
| Mac OS X
| <code>54827d78cb45b7dae4e7566b9ed5c1b833d68850</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/1dtxycfpsyvp0katitwk Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!IlE33IJT!tk0UOjL8Wt7Np8UYi5LjQ3WKPnwqwWK-IY8HOzxsrsY MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/478466150/evasi0n-mac-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.dmg RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-mac-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.dmg iClarified]
|-
| Windows
| <code>2f8c2f111a6afefd099ecb0ce5aab63f160940b8</code>
| style="text-decoration: line-through;" | [https://evad3rs.app.box.com/s/mh5vk7hpa7r3ymhnyjsz Box]
| style="text-decoration: line-through;" | [https://mega.co.nz/#!lscBQKST!88XCNjSPj0FYFlu1v3WApcrwW2XnHD_IEPKRef1RiWk MEGA]
| style="text-decoration: line-through;" | [http://rapidshare.com/files/1014635071/evasi0n-win-1.5.3-f284166e164e33735163af64b0af4e6336654345-release.zip RapidShare]
| [http://www.iclarified.com/files/evasi0n/evasi0n-win-1.5.3-release.zip iClarified]
|}

== Exploits and Vulnerabilities ==
evasi0n takes advantage of several vulnerabilities:
* [[Symbolic Link Vulnerability]]
* [[Malformed PairRequest]]
* [[Timezone Vulnerability]] (CVE-2013-0979)
* [[Shebang Trick]]
* [[AMFID code signing evasion]]
* [[launchd.conf untether]]
* [[IOUSBDeviceFamily Vulnerability]] (CVE-2013-0981)
* [[ARM Exception Vector Info Leak]] (CVE-2013-0978)
* [[dynamic memmove() locating]]
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]
* [[kernel memory write via ROP gadget]]
* [[Overlapping Segment Attack]] (CVE-2013-0977)

== Symbols in Untether code ==
{| class="wikitable" style="text-align:left;"
! Symbol
! v1
! v2
! v3
! v4
! v5
! v6
! v7
! v8/9
|-
| start
| 020B0
| 02EF8
| 02BFC
| 02BFC
| 02BFC
| 02E30
| ?
| 02A80
|-
| find_memmove_arm#search
| ?
| ?
| ?
| ?
| ?
| 0AFA0
| ?
| ?
|-
| find_memmove_thumb#search
| ?
| ?
| ?
| ?
| ?
| 0AFD0
| ?
| ?
|-
| find_memmove
| ?
| ?
| ?
| ?
| ?
| 0571C
| ?
| ?
|-
| find_memmove#exit
| ?
| ?
| ?
| ?
| ?
| 05762
| ?
| ?
|-
| _catch_exception_raise_state_identity
| ?
| ?
| ?
| ?
| ?
| ?
| ?
| 065B8
|}

== See Also ==
* [[evad3rs]]
* [[Patchfinder]]

== External Links ==
* [http://blog.accuvant.com/bthomasaccuvant/evasi0n-jailbreaks-userland-component/ Accuvant Labs analysis]
* [http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html Analysis by kernelpool]
* [http://www.nislab.no/content/download/38610/481190/file/NISlecture201303.pdf kernelpool presentation at NISlab: slides]
* [http://forelesning.hig.no/publish/1363953611-9b560e3de8f2/combined.mp4 kernelpool presentation at NISlab: video]
* [http://www.forbes.com/sites/andygreenberg/2013/02/05/inside-evasi0n-the-most-elaborate-jailbreak-to-ever-hack-your-iphone/ Explanation by planetbeing in Forbes]
* [https://github.com/NetsourceLabs/HopperScripts Hopper Script to demangle evasi0n strings] for Mac client of evasi0n, use in Hopper disassembler
* [http://support.apple.com/kb/HT5704 Apple Response: iOS 6.1.3 Security Fixes]
* [http://support.apple.com/kb/HT5702 Apple Response: iOS 5.2.1 (Apple TV) Security Fixes]
* [http://conference.hitb.org/hitbsecconf2013ams/materials/D2T1%20-%20Pod2g,%20Planetbeing,%20Musclenerd%20and%20Pimskeks%20aka%20Evad3rs%20-%20Swiping%20Through%20Modern%20Security%20Features.pdf Slides from HITB presentation in Amsterdam 2013]
* [http://www.quarkslab.com/en-blog+read+38 Quarkslab blog post describing how evasi0n bypasses code signing]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]
[[Category:Cydia Packages]]

Redsn0w

2016-09-25T18:35:13Z

IApeiron: /* External Links */ added link to archived official torrents

{{lowercase}}
{{float toc|left}}
[[File:Redsn0w.png|thumb|redsn0w on OS X]]
'''redsn0w''' is an [[iDevice]] [[jailbreak]]ing tool for OS X and Windows. Originally called [[QuickPwn]], but due to exploitation of the name by <code>www.quickpwn.com</code>, version 0.7 was renamed to redsn0w and added [[unlock]]ing of supported [[iDevice|devices]].

Version 0.8 added support for jailbreaking the [[N88AP|iPhone 3GS]].

Version 0.9b3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the [[N18AP|iPod touch 3G]], and supports a [[tethered jailbreak]] on [[N88AP|iPhone 3GS]] units and [[N72AP|iPod touch 2G]] units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup.

Version [http://wikee.iphwn.org/howto:rs9 0.9.2] supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on [[S5L8900]] devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early [[N72AP|iPod touch 2G]] with iOS 3.1.3.

Version [http://wikee.iphwn.org/howto:rsbeta 0.9.5b5-5] supports jailbreaking the [[N82AP|iPhone 3G]] and [[N72AP|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]) with iOS 4.0 on Windows and Mac OS X.

Version [http://blog.iphone-dev.org/post/1718400992 0.9.6b6] supports jailbreaking iOS 3.2.2, 4.1, and 4.2.1 for every device that supports those versions (except Apple TV 2G), on Windows and Mac OS X.

Version [http://blog.iphone-dev.org/post/14857834236 0.9.10b1] adds support for iOS 4.2.6 through 5.0.1 (though iOS 4.2.9, 4.2.10, 4.3.4, 4.3.5, and 5.0 are tethered on devices invulnerable to the [[0x24000 Segment Overflow]]). This build of redsn0w is not capable of jailbreaking [[S5L8940]] or newer devices.
{{clear}}

== Credit ==
[[iPhone Dev Team]]

== Versions ==
===Initial releases===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! Lite
| Unknown
| {{yes}}
| {{yes}}
|
* Tethered jailbreak for [[N72AP|iPod touch 2G]] on iOS 2.1.1 with [[ARM7 Go]]
|-
! 0.3
| Unknown
| {{yes}}
| {{yes}}
|
* Untethered jailbreak for the [[N72AP|iPod touch 2G]] on iOS 2.2.1 with [[ARM7 Go]] and [[0x24000 Segment Overflow]]
|}
===0.7.x series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.7
| Unknown
| {{yes}}
| {{yes}}
| style="white-space: nowrap;" |
* Untethered jailbreak for all devices but [[N88AP|iPhone 3GS]]
|-
! 0.7.1
| Unknown
| {{yes}}
| {{yes}}
| Bug fixes for versions 0.7
|-
! 0.7.2
| Unknown
| {{yes}}
| {{yes}}
| Bug fixes for versions 0.7
|}

===0.8.x series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.8
| {{date|2009|07|07}}
| {{yes}}
| {{yes}}
|
* Performs an [[untethered jailbreak]] on iOS 3.0/3.0.1 (when pointed at 3.0) for all devices supported by those firmware.
|-
|}

===0.9.0-0.9.4 releases===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.2
| Unknown
| {{yes}}
| {{yes}}
|
* Supports 3.0-3.1.2 on all iPhones and iPod touches ([[tethered jailbreak|tethered]] for newer devices with [[0x24000 Segment Overflow]] closed)
|-
! 0.9.3
| Unknown
| {{yes}}
| {{yes}}
|
* Contains the IPCC hack to enable tethering on the iPhone 3G and 3GS.
|-
! 0.9.4
| Unknown
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 3.1.3 on [[M68AP|iPhone]], [[N82AP|iPhone 3G]], [[N45AP|iPod touch]], [[N72AP|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]])
|-
|}

===0.9.5 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.5b3
| 21 Jun 2010
| {{yes}}
| {{no}}
|
* Supports jailbreaking iOS 4.0 on [[N82AP|iPhone 3G]] and [[N72AP|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]])
|-
! 0.9.5b4
| Unknown
| {{yes}}
| {{no}}
|
* Resolved a problem with iBooks.
|-
! 0.9.5b5
| Unknown
| {{yes}}
| {{no}}
|
* Supposed to fix any APN or MMS issues that users were seeing.
|-
|}

===0.9.6 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.6b1
| {{date|2010|09|21}}
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 4.0-4.1 on [[N82AP|iPhone 3G]] and [[N72AP|iPod touch 2G]] ([[tethered jailbreak|tethered]] on [[Bootrom 240.5.1|new bootrom]])
|-
! 0.9.6b2
| {{date|2010|10|31}}
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 3.2.2 and 4.0-4.1 on every device that supports those firmwares (except [[N72AP|iPod touch 2G]] with [[Bootrom 240.5.1|new bootrom]]) .
** The [[N82AP|iPhone 3G]], [[N72AP|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]), and [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) can also have custom boot logos.
* The Windows version also includes a function that permits users to restore to a custom [[IPSW File Format|IPSW]], akin to [[PwnageTool]]'s DFU button.
|-
! 0.9.6b3
| {{date|2010|11|21}}
| {{yes}}
| {{yes}}
|
* Supports the installation of custom bundles
|-
! 0.9.6b4
| {{date|2010|11|23}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 4.1-4.2.1 on all compatible devices.
** [[Tethered jailbreak]] on devices that are not vulnerable to [[Pwnage 2.0]] or [[0x24000 Segment Overflow]].
|-
! 0.9.6b5
| {{date|2010|11|28}}
| {{yes}}
| {{yes}}
|
* Can update the baseband on the [[X-Gold 608]] to [[06.15.00]], allowing the reuse of the [[AT+XAPP Vulnerability]]
|-
! 0.9.6b6
| {{date|2010|12|01}}
| {{yes}}
| {{yes}}
|
* Allows you to "deactivate" a hacktivated phone, so sbinger's [http://www.bingner.com/SAM.html Subscriber Artificial Module] (SAM) can trick your iPhone and [[iTunes]] into creating legitimate activation tickets.
|-
! 0.9.6 release candidate 7
| {{date|2011|01|02}}
| {{yes}}
| {{yes}}
|
* Introduced command-line arguments to bypass some screens.
** -b <filename> to specify your own boot logo PNG
** -i <filename> to specify your reference IPSW
** -j to ask redsn0w to “Just boot now tethered for now”
** -o for [[N88AP|iPhone 3GS]] and [[N72AP|iPod touch 2G]] units vulnerable to [[0x24000 Segment Overflow]].
|-
! 0.9.6 release candidate 8
| {{date|2011|01|05}}
| {{yes}}
| {{yes}}
|
* Informs users if a boot logo PNG is invalid, and why.
* Introduced the "-a" command-line argument to eliminate clicking.
|-
! 0.9.6 release candidate 9
| {{date|2011|04|03}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.1 on all compatible devices except the [[iPad 2]] and [[K66AP|Apple TV 2G]].
* New command line parameters k and d [http://twitpic.com/4gg8n1]:
** -k --kernelcache=<str> use specified kernelcache (advanced)
** -d --devicetree=<str> use specified devicetree (advanced)
|-
! 0.9.6 release candidate 10
| {{date|2011|04|07}}
| {{yes}}
| {{yes}}
|
* Added boot animations
* Removed misleading Settings
|-
! 0.9.6 release candidate 11
| {{date|2011|04|07}}
| {{yes}}
| {{yes}}
|
* Makes the boot animation a bit more robust
|-
! 0.9.6 release candidate 12
| {{date|2011|04|08}}
| {{yes}}
| {{yes}}
|
* Fix any lingering issues with the boot animation
|-
! 0.9.6 release candidate 13
| {{date|2011|04|19}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.2 on all compatible devices except the [[iPad 2]].
** A bug existed that prevented the [[N90AP|iPhone 4 (iPhone3,1)]] from being jailbroken on iOS 4.3.2.
|-
! 0.9.6 release candidate 14
| {{date|2011|04|19}}
| {{yes}}
| {{yes}}
|
* Fixes an issue that prevented the [[N90AP|iPhone 4 (iPhone3,1)]] from being jailbroken.
|-
! 0.9.6 release candidate 15
| {{date|2011|05|06}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.3 on all compatible devices except the [[iPad 2]].
|-
! 0.9.6 release candidate 16
| {{date|2011|05|16}}
| {{yes}}
| {{yes}}
|
* Fixes the [[N88AP|iPhone 3GS]]/[[N90AP|iPhone 4 (iPhone3,1)]] side switch vibration issue found in jailbroken installations of iOS 4.3.3.
|-
! 0.9.6 release candidate 17
| {{date|2011|05|20}}
| {{yes}}
| {{yes}}
|
* Adds advanced command line options for kernel hackers.
|-
! 0.9.6 release candidate 18
| {{date|2011|06|14}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.2.8 on the [[N92AP|iPhone 4 (iPhone3,3)]].
|-
! 0.9.6 release candidate 19
| {{date|2011|07|12}}
| {{yes}}
| {{yes}}
|
* When a custom bundle is applied, most of the normal jailbreak steps (like stashing and untethering) are skipped.
|}

===0.9.7 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.7b1
| {{date|2010|12|26}}
| {{yes}}
| {{no}}
|
* Jailbreaks iOS 4.1-4.2.1 on all compatible devices.
** Able to achieve an [[untethered jailbreak]] on 4.2.1, provided the user has 4.2b3 [[SHSH]]s and the 4.2b3 [[IPSW File Format|IPSW]].
*** This version of "Jailbreak Monte" has quite a number of bugs, particularly app switcher crashes and disabled [[Bluetooth]].
|-
! 0.9.7b2
| {{date|2010|12|26}}
| {{yes}}
| {{no}}
|
* Fixes crashing bugs on GUI apps.
|-
! 0.9.7b3
| {{date|2010|12|27}}
| {{yes}}
| {{no}}
|
* Fixes crashing bugs completely.
|-
! 0.9.7b4
| {{date|2010|12|31}}
| {{yes}}
| {{no}}
|
* ubsmuxd integrated.
|-
! 0.9.7b5
| {{date|2011|01|08}}
| {{yes}}
| {{no}}
|
* Issues related to [[Bluetooth]] and the sandbox are resolved.
|-
! 0.9.7b6
| {{date|2011|01|10}}
| {{yes}}
| {{no}}
|
* fixes Skype
|}

===0.9.8 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.8b1
| {{date|2011|06|10}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b and 5.0b2 (when pointed at the beta IPSW) on all compatible devices except the [[iPad 2]].
|-
! 0.9.8b2
| {{date|2011|07|11}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, and 5.0b3 on all compatible device except the [[iPad 2]].
* Fixes the iOS 5.0b3 sandbox issues present in the previous version.
|-
! 0.9.8b3
| {{date|2011|07|16}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 4.3.4 and iOS 5.0b, 5.0b2, and 5.0b3.
|-
! 0.9.8b4
| {{date|2011|07|23}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, and 5.0b4.
|-
! 0.9.8b5
| {{date|2011|08|09}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4 and 5.0b5.
|-
! 0.9.8b6
| {{date|2011|08|23}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4, 5.0b5, and 5.0b6.
|-
! 0.9.8b7
| {{date|2011|08|31}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4, 5.0b5 and 5.0b6.
* Performs a [[tethered jailbreak]] of iOS 4.3.5 and 4.2.10 without pointing at an older IPSW.
* Performs a [[tethered jailbreak]] of iOS 5.0b6 on a new, silently changed (by Apple) [[K48AP|iPad]] IPSW.
* Fixes a bug in the 4.2.10 jailbreak on the [[N92AP|iPhone 4 (iPhone3,3)]] [[tethered jailbreak]].
|-
! 0.9.8b7b
| {{date|2011|09|02}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] for [[iOS]] 4.3.4, 4.3.5, 4.2.9, 4.2.10 on all supported devices except the [[N88AP|iPhone 3GS]] (old bootrom) and the [[iPad 2]]
* Performs an [[untethered jailbreak]] on [[iOS]] 4.1-4.3.3 on all supported devices except the [[iPad 2]]
* Performs a [[tethered jailbreak]] on [[iOS]] 5.0b - 5.0b7 on all supported devices except the [[N88AP|iPhone 3GS]] (old bootrom) and [[iPad 2]]
* Performs an [[untethered jailbreak]] on [[N88AP|Phone 3GS]] (old bootrom) on [[iOS]] 4.1-4.3.5 and 5.0b7
* Fixed lingering issues with the [[N92AP|iPhone 4 (iPhone3,3)]] 4.2.10 [[tethered jailbreak]]
|-
! 0.9.8b7c
| {{date|2011|09|06}}
| {{yes}}
| {{yes}}
|
* Same as 0.9.8b7b on all devices but [[N88AP|iPhone 3GS]] with [[06.15.00]] baseband
* Fixes [[iTunes Errors#Error 1015|error 1015]] when restoring to stock 4.3.5 on [[N88AP|iPhone 3GS]] with [[06.15.00]] baseband.
|}

===0.9.9 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
!0.9.9b1
|{{date|2011|09|19}}
| {{yes}}
| {{yes}}
|
*Complete rewrite.
*No longer requires IPSWs when jailbreaking public builds. When jailbreaking beta/Golden master firmwares, need to specify IPSW once, then auto-recognizes it.
*Redsn0w now fetches SHSH from device, querys Cydia about saved blobs, stitches IPSWs with SHSH blobs (not for iPhones) and able to submit SHSH to cydia
*Includes Terminal shell commands into the GUI.
|-
!0.9.9b2
|{{date|2011|10|04}}
| {{yes}}
| {{yes}}
|
*Fixes Verizon iPhone 4 firmware detection
*Fixes 'Fix Recovery'
*Fixes for Stitching
*Fixes for blob processing
|-
!0.9.9b3
|{{date|2011|10|05}}
| {{yes}}
| {{yes}}
|
*Auto-detects the iOS 5.0 GM firmware now.
*Allows a jailbreak (albeit still tethered apart from [[N88AP|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) on iOS5 GM
|-
!0.9.9b3a
|{{date|2011|10|05}}
| {{no}}
| {{yes}}
|
*Fixes a Windows-only caching bug
*Allows Windows users to rename the redsn0w exe to anything containing 'boot' to jump straight to the tethered boot stage on load (thus adding one-click tethered boot to Windows redsn0w)
*0.9.9b3 still works fine for Mac users except they don't have the new 'boot' rename feature that this version has
|-
!0.9.9b4
|{{date|2011|10|12}}
| {{yes}}
| {{yes}}
|
*Now auto-recognizes iOS 5 and no longer requires IPSW submission on iOS 5 jailbreak
|-
!0.9.9b5
|{{date|2011|10|13}}
| {{yes}}
| {{no}}
|
*Custom IPSW feature (from PwnageTool) for Baseband preservation.

|-
!0.9.9b6
|{{date|2011|12|18}}
| {{yes}}
| {{yes}}
|
*Fixes location services issues for iPhone 3GS with [[06.15.00]] baseband

|-
!0.9.9b7
|{{date|2011|10|21}}
| {{yes}}
| {{yes}}
|
*You can now choose whether you want redsn0w or Cydia to Stash Applications (can shorten redsn0w session by 60%)
|-
!0.9.9b8
|{{date|2011|11|03}}
| {{yes}}
| {{yes}}
|
*Jailbreaks iOS 5.0.1b (9A402) tethered on devices vulnerable to [[limera1n exploit]].
**Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
|-
!0.9.9b9
|{{date|2011|12|19}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 5.0.1 tethered on devices vulnerable to [[limera1n exploit]].
** Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
* iBooks fix.
* Allows custom IPSW creation for [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) without SHSH blobs.
* Supports the 8 GB [[iPhone 4]].
* Allows stitched IPSW creation for iOS 5.x.
* Allows stitched IPSW creation for [[k94ap|iPad 2 (iPad2,2)]]s running iOS 4.3.x.
* Built-in version check.
|-
!0.9.9b9b
|{{date|2011|12|19}}
| {{yes}}
| {{yes}}
|
* Enables the “Custom” button in Windows to allow baseband preservation.
* Warns against flashing baseband [[06.15.00]] on newer iPhone 3GS devices (2011 week 35) more explicitly.
|-
!0.9.9b9c
|{{date|2011|12|19}}
| {{no}}
| {{yes}}
|
* Special build for Windows users encountering issues with the update check.
|-
!0.9.9b9d
|{{date|2011|12|20}}
| {{yes}}
| {{yes}}
|
* Addresses a problem with the [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) devices.
|}

===0.9.10 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.10b
| {{date|2011|12|27}}
| {{yes}}
| {{yes}}
|
* The jailbreak for iOS 5.0.1 is now untethered.
|-
! 0.9.10b2
| {{date|2011|12|27}}
| {{yes}}
| {{yes}}
|
* Fixes an issue with launchctl that the untether caused.
|-
! 0.9.10b3
| {{date|2011|12|28}}
| {{yes}}
| {{yes}}
|
* Fixes a problem where re-running redsn0w over an existing jailbreak would cause [[Mobile Substrate]]-based apps to stop running until Mobile Substrate was installed again.
|-
! 0.9.10b3 novcheck
| {{date|2011|12|29}}
| {{no}}
| {{yes}}
|
* ?
|-
! 0.9.10b4
| {{date|2012|01|15}}
| {{yes}}
| {{yes}}
|
* Includes a fix for [[iBooks]] on iOS 5.0.1.
* Addresses an issue where the launchctl fix didn't work sometimes.
|-
! 0.9.10b5
| {{date|2012|01|29}}
| {{yes}}
| {{yes}}
|
* Circumvents jailbreak detection in [[iBooks]] that caused ~10% of images to display properly.
|-
! 0.9.10b5b
| {{date|2012|02|01}}
| {{yes}}
| {{yes}}
|
* Fixes an issue with custom ramdisks on the [[N82AP|iPhone 3G]] and [[N72AP|iPod touch 2G]].
|-
! 0.9.10b5c
| {{date|2012|02|12}}
| {{yes}}
| {{yes}}
|
* Prevents redsn0w from crashing due to increasing ramdisk sizes.
|-
! 0.9.10b6
| {{date|2012|03|07}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 5.1 tethered on devices vulnerable to [[limera1n Exploit]].
** Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
* Automatically detects MC model [[N72AP|iPod touch 2G]] with [[User:pod2g|pod2g]]'s steaks4uce exploit.
|-
! 0.9.10b6b
| {{date|2012|03|11}}
| {{yes}}
| {{no}}
|
* Fixes small issues for Mac OS X v10.5.8 and earlier.
|-
! 0.9.10b7
| {{date|2012|04|20}}
| {{yes}}
| {{yes}}
|
* Implements the Corona A5 jailbreak for iPhone 4S and iPad 2 devices still at 5.0.1
* Can also re-install that jailbreak for those who accidentally uninstalled the untether
* When stitching an IPSW, it can now grab your blobs directly from Cydia.
* Now shows a lot more info about your device, for instance, whether your iPhone 3G has the vulnerable baseband bootloader, or whether your iPhone 3GS has the old exploitable bootrom
|-
! 0.9.10b8
| {{date|2012|04|23}}
| {{yes}}
| {{yes}}
|
* Can backup those priceless activation tickets many are grabbing today
* Adds ability to backup arbitrary directories or files from your device into a ZIP file on your Mac or PC
|-
! 0.9.10b8b
| {{date|2012|04|23}}
| {{yes}}
| {{yes}}
|
* Makes the ZIP files compatible with the native Windows Explorer.
|}

===0.9.11 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.11b1
| {{date|2012|05|11}}
| {{yes}}
| {{yes}}
|
* Newer devices ([[iPad 2]], [[iPad 3]], and [[N94AP|iPhone 4S]]) are able downgrade as well. In a radical departure from previous versions of [[redsn0w]], it now directly supports restoring [[IPSW File Format|IPSW]]s to your device.
|-
! 0.9.11b2
| {{date|2012|05|12}}
| {{yes}}
| {{yes}}
|
* Adds support for downgrading to [[Telluride 9A406 (iPhone4,1)|iOS 5.0.1 build 9A406]] for the [[N94AP|iPhone 4S]].
|-
! 0.9.11b3
| {{date|2012|05|14}}
| {{yes}}
| {{yes}}
|
* This release should fix the "Restore failed" messages people were sometimes getting.
* Behaves better with nearby devices that have Wi-Fi syncing enabled.
|-
! 0.9.11b4
| {{date|2012|05|14}}
| {{yes}}
| {{yes}}
|
* Completes the tethered jailbreak support for iOS 5.1.1 on A4 devices and earlier, including proper "Stitching" and "Custom" creation of NO_BB [[IPSW File Format|IPSW]]s
|}

===0.9.12 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.12b
| {{date|2012|06|04}}
| {{yes}}
| {{yes}}
|
* Adds [[Rocky Racoon]] for all devices on iOS 5.1.1.
** On A4 devices and earlier, users can choose between the backup restore method (like [[Absinthe]]) or using a ramdisk-based jailbreak (how redsn0w usually works).
|-
! 0.9.12b2
| {{date|2012|06|08}}
| {{yes}}
| {{yes}}
|
* Users on iOS 5.1.1 are now explicitly asked if they wish to use the backup/restore method or the DFU ramdisk method for jailbreaking.
* Fixes iBooks problems on the iPhone 3GS (old bootrom).
* Provides more helpful error messages.
|}

===0.9.13 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.13 developer-only 1
| {{date|2012|06|13}}
| {{yes}}
| {{yes}}
|
* Jailbreaks [[iOS]] 6.0b.
|-
! 0.9.13 developer-only 2
| {{date|2012|06|15}}
| {{yes}}
| {{yes}}
|
* Fix the various SSH problems and crashes with apps that some have been seeing.
|-
! 0.9.13 developer-only 3
| {{date|2012|07|16}}
| {{yes}}
| {{yes}}
|
* Covers 6.0b3 release and also adds explicit support for 6.0b2.
|-
! 0.9.13 developer-only 4
| {{date|2012|09|13}}
| {{yes}}
| {{yes}}
|
* ???
|}

===0.9.14 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.14b1
| {{date|2012|06|18}}
| {{yes}}
| {{yes}}
|
* Add a baseband downgrade option in redsn0w for those who are using the iPad’s [[06.15.00]] baseband on the iPhone 3G or iPhone 3GS.
|-
! 0.9.14b2
| {{date|2012|07|04}}
| {{yes}}
| {{yes}}
|
* Improves the iPad baseband downgrade and should cover anyone who couldn’t downgrade with 0.9.14b1. Also simplified the process and added logging to help diagnose any remaining stubborn iPhones.
|}

===0.9.15 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.15b1
| {{date|2012|10|14}}
| {{yes}}
| {{yes}}
|
* Tethered jailbreak for iOS 6.0 on the [[K66AP|Apple TV 2G]], [[N88AP|iPhone 3GS]], [[iPhone 4]], and [[N81AP|iPod touch 4G]].
** Untethered for iPhone 3GS devices with the [[iBoot-359.3|old bootrom]].
* Allows devices with the A5 or newer to restore to iOS 5.x, as long as they have iOS 4.x or 5.x installed.
|-
! 0.9.15b2
| {{date|2012|10|15}}
| {{yes}}
| {{yes}}
|
* After restoring an [[N88AP|iPhone 3GS]], redsn0w keeps track of its bootrom version while it's still open.
* Fixes support for upgrading to/downgrading baseband [[06.15.00]].
|-
! 0.9.15b3
| {{date|2012|11|01}}
| {{yes}}
| {{yes}}
|
* Save iPad 4 and iPad Mini SHSH blobs.
* Fixes of error 14 when stitching blobs and error 2601 for windows users when restoring.
|}

== Exploits used ==
For [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]:
*[[Pwnage]]
*[[Pwnage 2.0]]

For [[N72AP|iPod touch 2G]]:
*[[0x24000 Segment Overflow]]
*[[ARM7 Go]] - used to upload the oversized [[LLB]] required to utilize the 0x24000 Segment Overflow.
*[[usb_control_msg(0xA1, 1) Exploit]] - used (in redsn0w 0.9.6b) to upload the oversized [[LLB]] to utilize the 0x24000 Segment Overflow, as well as a [[tethered jailbreak]] on units with the [[Bootrom 240.5.1|new bootrom]].

For [[N88AP|iPhone 3GS]]:
*[[0x24000 Segment Overflow]]
*[[iBoot Environment Variable Overflow]] - Exploit has a different implementation from [[User:geohot|geohot]]'s implementation in [[purplera1n]].
*[[usb_control_msg(0x21, 2) Exploit]]
*[[limera1n]] exploit

For [[N18AP|iPod touch 3G]]:
*[[usb_control_msg(0x21, 2) Exploit]]
*[[limera1n]] exploit

For [[iPhone 4]], [[N81AP|iPod touch 4G]], [[K48AP|iPad]] and [[K66AP|Apple TV 2G]]:
*[[limera1n]] exploit

For [[K48AP|iPad]], [[iPad 2]], [[iPad 3]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch 3G]] and [[N81AP|iPod touch 4G]]:
* [[Corona]]
* [[Racoon String Format Overflow Exploit]]
* [[ HFS Heap Overflow]]
* [[BackupAgent]]

== External Links ==
*[https://sites.google.com/a/iphone-dev.com/files/home/ Official redsn0w download links]
* [http://web.archive.org/web/20120112055850/http://thepiratebay.org/user/iphonedev Official iPhone Dev Team torrents]
*[http://blog.iphone-dev.org/tagged/redsn0w iPhone Dev Team blog with redsn0w information]
*[http://blog.iphone-dev.org/redsn0w-iOS5 redsn0w beta infos (outdated)]

[[Category:Hacking Software]]
[[Category:Jailbreaking]]
[[Category:Jailbreaks]]

PwnageTool

2016-09-25T18:34:45Z

IApeiron: /* External Links */ changed link title

'''PwnageTool''' is an [[iOS]] [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it for restore using [[iTunes]].

== Credit ==
[[iPhone Dev Team]]

==Exploits Used==
===Version 1.0===
* [[Pwnage]]
* [[Ramdisk Hack]]

===Version 2.0===
* [[Pwnage 2.0]]
* [[Pwnage]]

===Version 4.0===
* Bootrom exploit (used by [[limera1n]] and [[Greenpois0n (jailbreak)|greenpois0n]])

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[N82AP|iPhone 3G]]
| {{date|2008|07|19}}
|-
| [[N45AP|iPod touch 3GS]]
| {{date|2009|10|02}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|10|20}}
|-
| [[N18AP|iPod touch 3G]]
| {{date|2010|10|20}}
|-
| [[N81AP|iPod touch 4G]]
| {{date|2010|10|20}}
|-
| [[K48AP|iPad]]
| {{date|2010|10|20}}
|-
| [[K66AP|Apple TV 2G]]
| {{date|2010|10|20}}
|}
Please note that the [[iPad 2]] and the [[iPhone 4S]] are not yet supported, as there is no publicly available bootrom exploit (like [[Pwnage]], [[Pwnage 2.0]], [[limera1n]]) for the A5-Processor.

==Versions==

PwnageTool was released 3 April 2008 but largely unused until version 2.0 was released 19 July 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable"
! Version
! Release Date
! Features
|-
!1.0
| {{date|2008|04|03}}
|
*Initial release
* Supports iPod touch and iPhone.
* Includes 2 modes: iPwner and custom .ipsw
* Uses [[Ramdisk Hack]]+[[Pwnage]] in iPwner then creates the firmware.
|-
! 1.1
| {{date|2008|04|17}}
|
* Jailbreaks 1.1.4 firmware
* Supports iPod touch and iPhone.
* Custom boot logos can now be added
* Added Bootneuter integration
* Still uses iPwner and custom .ipsw
|-
|}

===2.x: Second major release of Pwnagetool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 2.0
| {{date|2008|07|19}}
|
* Added iPhone 3G support [http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! 2.0.1
| {{date|2008|08|04}}
|
* Jailbreaks 2.0.1 firmware
* Works for 2.0 and 2.0.1.
|-
! 2.0.2
| {{date|2008|08|21}}
|
* Jailbreaks 2.0.2 firmware [http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! 2.0.3
| {{date|2008|08|25}}
|
* Jailbreaks 2.0.2 firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! 2.1
| {{date|2008|09|13}}
|
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a valid Cydia source, and add them onto your custom IPSW.
|-
! 2.2
| {{date|2008|11|21}}
|
* Jailbreaks 2.2 firmware
|-
! 2.2.5
| {{date|2009|01|30}}
|
* Jailbreaks 2.2.1
* Not updated by [[iPhone Dev Team]] but made official.
|-
|}

===3.x: Third Major Release of PwnageTool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 3.0
| {{date|2009|06|19}}
|
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|-
! 3.1
| {{date|2009|09|15}}
| |
* Jailbreaks 3.1 firmware for iPhone and iPhone 3G
* Jailbreaks 3.1.1 firmware for iPod touch
|-
! 3.1.3
| {{date|2009|10|02}}
|
* Support for iPhone 3GS with [[Bootrom 359.3]] bootrom and iPod touch 2G with [[Bootrom 240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|-
! 3.1.4
| {{date|2009|10|13}}
| |
* Jailbreaks 3.1.2 firmware for iPhone, iPhone 3G, 3GS with [[Bootrom 359.3]] bootrom, iPod touch, iPod touch 2G with [[Bootrom 240.4]] bootrom
* iPod touch 3G not supported.
|-
! 3.1.5
| {{date|2010|02|07}}
|
* Jailbreaks 3.1.3 firmware for devices supported in 3.1.4.
|-
|}

=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 4.0
| {{date|2010|06|22}}
|
* Jailbreaks iOS 4.0 for devices supported in 3.1.4.
|-
! 4.01
| {{date|2010|06|23}}
|
* Fixes iBooks issue.
|-
! 4.1
| {{date|2010|10|20}}
|
* Jailbreaks iOS 4.1 for [[K66AP|Apple TV 2G]], [[K48AP|iPad]], [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] (both bootroms), [[N90AP|iPhone 4]], [[N18AP|iPod touch 3G]], and [[N81AP|iPod touch 4G]].
|-
! 4.1.1
| {{date|2010|10|22}}
|
* Fixes issues with Leopard.
|-
! 4.1.2
| {{date|2010|10|22}}
|
* Fixes more issues with Leopard.
|-
! 4.1.3
| {{date|2010|11|28}}
|
* Enables installing the [[06.15.00]] baseband on the [[N82AP|iPhone 3G]] and [[N88AP|iPhone 3GS]]
|-
! 4.2
| {{date|2011|02|15}}
|
* Support for iOS 4.2.1 on every device that is compatible, except for the [[N72AP|iPod touch 2G]].
|-
! 4.3
| {{date|2011|04|03}}
|
* Support for iOS 4.3.1 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.2
| {{date|2011|12|27}}
|
* Support for iOS 4.3.2 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3
| {{date|2011|06|08}}
|
* Support for iOS 4.3.3 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3.1
| {{date|2011|05|08}}
|
* includes a fix for the iPhone 3GS / iPhone 4 side switch vibration issue (only for 4.3.3)
|}

=== 5.x: Fifth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! Version
! Release date
! Features
|-
! 5.0.1
| {{date|2011|12|27}}
|
* Jailbreaks iOS 5.0.1 for non-[[S5L8940|A5]] devices.
|-
! 5.1.1
| {{date|2012|06|04}}
|
* Jailbreaks iOS 5.1.1 for non-A5(X) devices.
|}

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, [[BootNeuter]] ([[M68AP|iPhone]] software unlock), custom packages and boot logos. This method is usually less secure than the quick exploits such ([[redsn0w]], [[QuickPwn]], [[purplera1n]], [[blackra1n]], etc.).

==How to create Custom Firmware Bundles==
{{main|Making PwnageTool Bundles}}

==Problems==
This method does have negative aspects. The most common errors are the [[ITunes Errors#Errors 16xx|16xx range of errors]], which mean that the either the firmware file is corrupt or you didn't put it in the right mode (Recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common error is [[ITunes Errors#Error 1604|Error 1604]] which means that the firmware file is corrupted.

==Windows==
PwnageTool is expected to remain exclusive to Mac OS X. As of October 2009, [[User:ih8sn0w|iH8sn0w]], et. al. has announced that they made a project that will bring PwnageTool's functionality to Windows, called [[sn0wbreeze]]. [http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

==See also==
* [[redsn0w]]
* [[ultrasn0w]]

==External Links==
* [https://sites.google.com/a/ipad-dev.com/files/pwnagetool/ Official PwnageTool 5.0.1 and 5.1.1 links]
* [http://web.archive.org/web/20120112055850/http://thepiratebay.org/user/iphonedev Official iPhone Dev Team torrents]

[[Category:Hacking Software]]
[[Category:GUI Tools]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

WinPwn

2016-09-21T17:59:02Z

IApeiron: added links

[[Image:Winpwn_screen.PNG|thumb|right|350px|WinPwn 2.0.0.3 RC1, running on Windows XP]]
The Windows version of [[PwnageTool]], by [[cmw]]. WinPwn, [[QuickPwn]], [[XPwn]] and [[PwnageTool]] are currently the only programs capable of [[jailbreak|jailbreaking]] 2.0 firmware.

This software is now discontinued.

==External Links==
* [http://www.afterdawn.com/software/general/download.cfm/winpwn?mirror_id=0&version_id=12783&software_id=1795 WinPwn 2.5 beta 2]
* [http://www.afterdawn.com/software/general/download.cfm/winpwn?mirror_id=0&version_id=12182&software_id=1795 WinPwn 2.0.0.4 stable]

See [[sn0wbreeze]] for a WinPwn replacement.

[[Category:Hacking Software]]

ILiberty+

2016-09-19T23:02:10Z

IApeiron: /* External Links */ added link for Mac version

{{lowercase}}
A universal GUI tool to jailbreak, activate, as well as unlock firmwares 1.1.4 and earlier, it also has some extra functionalities.

iLiberty was first developed as a personal tool for [http://george.insideiphone.com/ George Zhu] himself, later it integrated iPlus (a CLI utility developed by AViegas) and became a public tool, its name was changed to iLiberty+. Features of iLiberty+ include:

* Full range of iPhone hacking, including but not limited to jailbreak, activation, unlocking, 3rd party application installation, etc.
* Fully script-driven, allow unlimited external payloads
* iPod touch support (jailbreak and application installation)
* Directly download missing payloads in GUI
* Proxy support for payloads download
* Support both Installer and Cydia
* Automatic online update

iLiberty+ is available on both Windows as well as Mac OS X (named iLibertyX), the main developers are George Zhu, AViegas, francis, and pepijin, with help from many people in the community.

==External Links==
* [https://web.archive.org/web/20120101122455/http://iliberty.insideiphone.com/Setup/iLibertySetup_1.3.0.113.exe iLiberty 1.3.0 for Windows]
* [http://modmyi.com/files/iLibertyX.dmg iLibertyX for Mac OSX hosted by modmyi]

[[Category:Hacking Software]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

PwnageTool

2016-09-19T22:26:24Z

IApeiron: typo fix

'''PwnageTool''' is an [[iOS]] [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it for restore using [[iTunes]].

== Credit ==
[[iPhone Dev Team]]

==Exploits Used==
===Version 1.0===
* [[Pwnage]]
* [[Ramdisk Hack]]

===Version 2.0===
* [[Pwnage 2.0]]
* [[Pwnage]]

===Version 4.0===
* Bootrom exploit (used by [[limera1n]] and [[Greenpois0n (jailbreak)|greenpois0n]])

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[N82AP|iPhone 3G]]
| {{date|2008|07|19}}
|-
| [[N45AP|iPod touch 3GS]]
| {{date|2009|10|02}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|10|20}}
|-
| [[N18AP|iPod touch 3G]]
| {{date|2010|10|20}}
|-
| [[N81AP|iPod touch 4G]]
| {{date|2010|10|20}}
|-
| [[K48AP|iPad]]
| {{date|2010|10|20}}
|-
| [[K66AP|Apple TV 2G]]
| {{date|2010|10|20}}
|}
Please note that the [[iPad 2]] and the [[iPhone 4S]] are not yet supported, as there is no publicly available bootrom exploit (like [[Pwnage]], [[Pwnage 2.0]], [[limera1n]]) for the A5-Processor.

==Versions==

PwnageTool was released 3 April 2008 but largely unused until version 2.0 was released 19 July 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable"
! Version
! Release Date
! Features
|-
!1.0
| {{date|2008|04|03}}
|
*Initial release
* Supports iPod touch and iPhone.
* Includes 2 modes: iPwner and custom .ipsw
* Uses [[Ramdisk Hack]]+[[Pwnage]] in iPwner then creates the firmware.
|-
! 1.1
| {{date|2008|04|17}}
|
* Jailbreaks 1.1.4 firmware
* Supports iPod touch and iPhone.
* Custom boot logos can now be added
* Added Bootneuter integration
* Still uses iPwner and custom .ipsw
|-
|}

===2.x: Second major release of Pwnagetool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 2.0
| {{date|2008|07|19}}
|
* Added iPhone 3G support [http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! 2.0.1
| {{date|2008|08|04}}
|
* Jailbreaks 2.0.1 firmware
* Works for 2.0 and 2.0.1.
|-
! 2.0.2
| {{date|2008|08|21}}
|
* Jailbreaks 2.0.2 firmware [http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! 2.0.3
| {{date|2008|08|25}}
|
* Jailbreaks 2.0.2 firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! 2.1
| {{date|2008|09|13}}
|
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a valid Cydia source, and add them onto your custom IPSW.
|-
! 2.2
| {{date|2008|11|21}}
|
* Jailbreaks 2.2 firmware
|-
! 2.2.5
| {{date|2009|01|30}}
|
* Jailbreaks 2.2.1
* Not updated by [[iPhone Dev Team]] but made official.
|-
|}

===3.x: Third Major Release of PwnageTool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 3.0
| {{date|2009|06|19}}
|
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|-
! 3.1
| {{date|2009|09|15}}
| |
* Jailbreaks 3.1 firmware for iPhone and iPhone 3G
* Jailbreaks 3.1.1 firmware for iPod touch
|-
! 3.1.3
| {{date|2009|10|02}}
|
* Support for iPhone 3GS with [[Bootrom 359.3]] bootrom and iPod touch 2G with [[Bootrom 240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|-
! 3.1.4
| {{date|2009|10|13}}
| |
* Jailbreaks 3.1.2 firmware for iPhone, iPhone 3G, 3GS with [[Bootrom 359.3]] bootrom, iPod touch, iPod touch 2G with [[Bootrom 240.4]] bootrom
* iPod touch 3G not supported.
|-
! 3.1.5
| {{date|2010|02|07}}
|
* Jailbreaks 3.1.3 firmware for devices supported in 3.1.4.
|-
|}

=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 4.0
| {{date|2010|06|22}}
|
* Jailbreaks iOS 4.0 for devices supported in 3.1.4.
|-
! 4.01
| {{date|2010|06|23}}
|
* Fixes iBooks issue.
|-
! 4.1
| {{date|2010|10|20}}
|
* Jailbreaks iOS 4.1 for [[K66AP|Apple TV 2G]], [[K48AP|iPad]], [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] (both bootroms), [[N90AP|iPhone 4]], [[N18AP|iPod touch 3G]], and [[N81AP|iPod touch 4G]].
|-
! 4.1.1
| {{date|2010|10|22}}
|
* Fixes issues with Leopard.
|-
! 4.1.2
| {{date|2010|10|22}}
|
* Fixes more issues with Leopard.
|-
! 4.1.3
| {{date|2010|11|28}}
|
* Enables installing the [[06.15.00]] baseband on the [[N82AP|iPhone 3G]] and [[N88AP|iPhone 3GS]]
|-
! 4.2
| {{date|2011|02|15}}
|
* Support for iOS 4.2.1 on every device that is compatible, except for the [[N72AP|iPod touch 2G]].
|-
! 4.3
| {{date|2011|04|03}}
|
* Support for iOS 4.3.1 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.2
| {{date|2011|12|27}}
|
* Support for iOS 4.3.2 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3
| {{date|2011|06|08}}
|
* Support for iOS 4.3.3 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3.1
| {{date|2011|05|08}}
|
* includes a fix for the iPhone 3GS / iPhone 4 side switch vibration issue (only for 4.3.3)
|}

=== 5.x: Fifth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! Version
! Release date
! Features
|-
! 5.0.1
| {{date|2011|12|27}}
|
* Jailbreaks iOS 5.0.1 for non-[[S5L8940|A5]] devices.
|-
! 5.1.1
| {{date|2012|06|04}}
|
* Jailbreaks iOS 5.1.1 for non-A5(X) devices.
|}

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, [[BootNeuter]] ([[M68AP|iPhone]] software unlock), custom packages and boot logos. This method is usually less secure than the quick exploits such ([[redsn0w]], [[QuickPwn]], [[purplera1n]], [[blackra1n]], etc.).

==How to create Custom Firmware Bundles==
{{main|Making PwnageTool Bundles}}

==Problems==
This method does have negative aspects. The most common errors are the [[ITunes Errors#Errors 16xx|16xx range of errors]], which mean that the either the firmware file is corrupt or you didn't put it in the right mode (Recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common error is [[ITunes Errors#Error 1604|Error 1604]] which means that the firmware file is corrupted.

==Windows==
PwnageTool is expected to remain exclusive to Mac OS X. As of October 2009, [[User:ih8sn0w|iH8sn0w]], et. al. has announced that they made a project that will bring PwnageTool's functionality to Windows, called [[sn0wbreeze]]. [http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

==See also==
* [[redsn0w]]
* [[ultrasn0w]]

==External Links==
* [https://sites.google.com/a/ipad-dev.com/files/pwnagetool/ Official PwnageTool 5.0.1 and 5.1.1 links]
* [http://web.archive.org/web/20120112055850/http://thepiratebay.org/user/iphonedev Official PwnageTool torrents]

[[Category:Hacking Software]]
[[Category:GUI Tools]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

PwnageTool

2016-09-19T22:25:45Z

IApeiron: added links

'''PwnageTool''' is an [[iOS]] [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it for restore using [[iTunes]].

== Credit ==
[[iPhone Dev Team]]

==Exploits Used==
===Version 1.0===
* [[Pwnage]]
* [[Ramdisk Hack]]

===Version 2.0===
* [[Pwnage 2.0]]
* [[Pwnage]]

===Version 4.0===
* Bootrom exploit (used by [[limera1n]] and [[Greenpois0n (jailbreak)|greenpois0n]])

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[N82AP|iPhone 3G]]
| {{date|2008|07|19}}
|-
| [[N45AP|iPod touch 3GS]]
| {{date|2009|10|02}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|10|20}}
|-
| [[N18AP|iPod touch 3G]]
| {{date|2010|10|20}}
|-
| [[N81AP|iPod touch 4G]]
| {{date|2010|10|20}}
|-
| [[K48AP|iPad]]
| {{date|2010|10|20}}
|-
| [[K66AP|Apple TV 2G]]
| {{date|2010|10|20}}
|}
Please note that the [[iPad 2]] and the [[iPhone 4S]] are not yet supported, as there is no publicly available bootrom exploit (like [[Pwnage]], [[Pwnage 2.0]], [[limera1n]]) for the A5-Processor.

==Versions==

PwnageTool was released 3 April 2008 but largely unused until version 2.0 was released 19 July 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable"
! Version
! Release Date
! Features
|-
!1.0
| {{date|2008|04|03}}
|
*Initial release
* Supports iPod touch and iPhone.
* Includes 2 modes: iPwner and custom .ipsw
* Uses [[Ramdisk Hack]]+[[Pwnage]] in iPwner then creates the firmware.
|-
! 1.1
| {{date|2008|04|17}}
|
* Jailbreaks 1.1.4 firmware
* Supports iPod touch and iPhone.
* Custom boot logos can now be added
* Added Bootneuter integration
* Still uses iPwner and custom .ipsw
|-
|}

===2.x: Second major release of Pwnagetool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 2.0
| {{date|2008|07|19}}
|
* Added iPhone 3G support [http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! 2.0.1
| {{date|2008|08|04}}
|
* Jailbreaks 2.0.1 firmware
* Works for 2.0 and 2.0.1.
|-
! 2.0.2
| {{date|2008|08|21}}
|
* Jailbreaks 2.0.2 firmware [http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! 2.0.3
| {{date|2008|08|25}}
|
* Jailbreaks 2.0.2 firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! 2.1
| {{date|2008|09|13}}
|
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a valid Cydia source, and add them onto your custom IPSW.
|-
! 2.2
| {{date|2008|11|21}}
|
* Jailbreaks 2.2 firmware
|-
! 2.2.5
| {{date|2009|01|30}}
|
* Jailbreaks 2.2.1
* Not updated by [[iPhone Dev Team]] but made official.
|-
|}

===3.x: Third Major Release of PwnageTool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 3.0
| {{date|2009|06|19}}
|
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|-
! 3.1
| {{date|2009|09|15}}
| |
* Jailbreaks 3.1 firmware for iPhone and iPhone 3G
* Jailbreaks 3.1.1 firmware for iPod touch
|-
! 3.1.3
| {{date|2009|10|02}}
|
* Support for iPhone 3GS with [[Bootrom 359.3]] bootrom and iPod touch 2G with [[Bootrom 240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|-
! 3.1.4
| {{date|2009|10|13}}
| |
* Jailbreaks 3.1.2 firmware for iPhone, iPhone 3G, 3GS with [[Bootrom 359.3]] bootrom, iPod touch, iPod touch 2G with [[Bootrom 240.4]] bootrom
* iPod touch 3G not supported.
|-
! 3.1.5
| {{date|2010|02|07}}
|
* Jailbreaks 3.1.3 firmware for devices supported in 3.1.4.
|-
|}

=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 4.0
| {{date|2010|06|22}}
|
* Jailbreaks iOS 4.0 for devices supported in 3.1.4.
|-
! 4.01
| {{date|2010|06|23}}
|
* Fixes iBooks issue.
|-
! 4.1
| {{date|2010|10|20}}
|
* Jailbreaks iOS 4.1 for [[K66AP|Apple TV 2G]], [[K48AP|iPad]], [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] (both bootroms), [[N90AP|iPhone 4]], [[N18AP|iPod touch 3G]], and [[N81AP|iPod touch 4G]].
|-
! 4.1.1
| {{date|2010|10|22}}
|
* Fixes issues with Leopard.
|-
! 4.1.2
| {{date|2010|10|22}}
|
* Fixes more issues with Leopard.
|-
! 4.1.3
| {{date|2010|11|28}}
|
* Enables installing the [[06.15.00]] baseband on the [[N82AP|iPhone 3G]] and [[N88AP|iPhone 3GS]]
|-
! 4.2
| {{date|2011|02|15}}
|
* Support for iOS 4.2.1 on every device that is compatible, except for the [[N72AP|iPod touch 2G]].
|-
! 4.3
| {{date|2011|04|03}}
|
* Support for iOS 4.3.1 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.2
| {{date|2011|12|27}}
|
* Support for iOS 4.3.2 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3
| {{date|2011|06|08}}
|
* Support for iOS 4.3.3 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3.1
| {{date|2011|05|08}}
|
* includes a fix for the iPhone 3GS / iPhone 4 side switch vibration issue (only for 4.3.3)
|}

=== 5.x: Fifth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! Version
! Release date
! Features
|-
! 5.0.1
| {{date|2011|12|27}}
|
* Jailbreaks iOS 5.0.1 for non-[[S5L8940|A5]] devices.
|-
! 5.1.1
| {{date|2012|06|04}}
|
* Jailbreaks iOS 5.1.1 for non-A5(X) devices.
|}

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, [[BootNeuter]] ([[M68AP|iPhone]] software unlock), custom packages and boot logos. This method is usually less secure than the quick exploits such ([[redsn0w]], [[QuickPwn]], [[purplera1n]], [[blackra1n]], etc.).

==How to create Custom Firmware Bundles==
{{main|Making PwnageTool Bundles}}

==Problems==
This method does have negative aspects. The most common errors are the [[ITunes Errors#Errors 16xx|16xx range of errors]], which mean that the either the firmware file is corrupt or you didn't put it in the right mode (Recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common error is [[ITunes Errors#Error 1604|Error 1604]] which means that the firmware file is corrupted.

==Windows==
PwnageTool is expected to remain exclusive to Mac OS X. As of October 2009, [[User:ih8sn0w|iH8sn0w]], et. al. has announced that they made a project that will bring PwnageTool's functionality to Windows, called [[sn0wbreeze]]. [http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

==See also==
* [[redsn0w]]
* [[ultrasn0w]]

==External Links==
* [https://sites.google.com/a/ipad-dev.com/files/pwnagetool/ Official PwnageTool 5.0.1 and 5.1.1 links]
* [http://web.archive.org/web/20120112055850/http://thepiratebay.org/user/iphonedev Offical PwnageTool torrents]

[[Category:Hacking Software]]
[[Category:GUI Tools]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

ILiberty+

2016-09-19T22:15:56Z

IApeiron: added link

{{lowercase}}
A universal GUI tool to jailbreak, activate, as well as unlock firmwares 1.1.4 and earlier, it also has some extra functionalities.

iLiberty was first developed as a personal tool for [http://george.insideiphone.com/ George Zhu] himself, later it integrated iPlus (a CLI utility developed by AViegas) and became a public tool, its name was changed to iLiberty+. Features of iLiberty+ include:

* Full range of iPhone hacking, including but not limited to jailbreak, activation, unlocking, 3rd party application installation, etc.
* Fully script-driven, allow unlimited external payloads
* iPod touch support (jailbreak and application installation)
* Directly download missing payloads in GUI
* Proxy support for payloads download
* Support both Installer and Cydia
* Automatic online update

iLiberty+ is available on both Windows as well as Mac OS X (named iLibertyX), the main developers are George Zhu, AViegas, francis, and pepijin, with help from many people in the community.

==External Links==
* [https://web.archive.org/web/20120101122455/http://iliberty.insideiphone.com/Setup/iLibertySetup_1.3.0.113.exe iLiberty 1.3.0 for Windows]

[[Category:Hacking Software]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

ZiPhone

2016-09-19T22:13:49Z

IApeiron: added link to Mac version

[[Image:ZiPhone.png|thumb|right|350px|ZiPhone 3]]
[[User:Zibri|Zibri]]'s tool to [[unlock]], [[jailbreak]], and [[Activation|activate]]. It was found at ziphone.org, but the domain was sold off by Zibri.

It makes use of the [[Ramdisk Hack]] and uses [[User:Geohot|geohot]]'s [[Minus 0x20000 with Back Extend Erase|BL4.6 exploit]] to downgrade the [[Baseband Bootloader|baseband bootloader]] and subsequently [[unlock]] the [[Baseband Device|baseband]].

==External Links==
* [https://web.archive.org/web/20080319012009/http://ipluspwns.com/files/ZiPhoneOSX-2.6.tbz ZiPhone 2.6 for Mac OSX]

[[Category:Hacking Software]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Chronic Dev (team)

2016-09-19T19:42:12Z

IApeiron:

{{DISPLAYTITLE:Chronic Dev Team}}
'''Chronic Dev''' is a team of hackers, including loosely affiliated members and members who are in other teams as well (such as the collaborative effort called the [[Dream Team]]). Their projects have included [[iRecovery|iRecovery (libirecovery)]], [[Greenpois0n (toolkit)|greenpois0n]], and [[GenPass]].

== Official Members ==
*[[User:DHowett|DHowett]]
*[[User:Jaywalker|Jaywalker]]
*[[User:Semaphore|semaphore]]
*[[User:Westbaer|westbaer]]

== Former Members ==
*[[AriX]]
*[[User:ChronicDev|chronic]]
*[[CPICH]]
*[[pod2g]]
*[[User:posixninja|p0sixninja]]

== Associates ==
*[[bugout]]
*[[User:Bushing|bushing]]
*[[c1de0x]]
*[[User:Chpwn|chpwn]]
*[[User:Comex|comex]]
*[[User:Geohot|geohot]]
*[[ius]]
*[[User:Jan0|jan0]]
*[[User:lilstevie|Lilstevie]]
*[[User:MuscleNerd|MuscleNerd]]
*[[User:NerveGas|NerveGas]]
*[[pimskeks]]
*[[User:Planetbeing|planetbeing]]
*[[psp250]]
*[[User:Jan0|jan0]]
*[[User:pumpkin|pumpkin]]
*[[saurik]]

==Links==
*[http://greenpois0n.com/ Greenpois0n Blog]
*[http://chronic-dev.org/blog/ Chronic Dev Blog]
*[https://code.google.com/archive/p/chronicdev/wikis Chronic Dev Wiki]
*[https://github.com/Chronic-Dev GitHub]
*[http://chronicdev.googlecode.com/ Chronic Dev Google Code]
*[https://github.com/svn2github/chronicdev Chronic Dev Google Code mirror on GitHub]
*[http://twitter.com/chronicdevteam Chronic Dev Team on Twitter]
[[Category:Hackers]]
[[Category:Teams]]

Chronic Dev (team)

2016-09-19T19:41:45Z

IApeiron: added mirror for Google Code page

{{DISPLAYTITLE:Chronic Dev Team}}
'''Chronic Dev''' is a team of hackers, including loosely affiliated members and members who are in other teams as well (such as the collaborative effort called the [[Dream Team]]). Their projects have included [[iRecovery|iRecovery (libirecovery)]], [[Greenpois0n (toolkit)|greenpois0n]], and [[GenPass]].

== Official Members ==
*[[User:DHowett|DHowett]]
*[[User:Jaywalker|Jaywalker]]
*[[User:Semaphore|semaphore]]
*[[User:Westbaer|westbaer]]

== Former Members ==
*[[AriX]]
*[[User:ChronicDev|chronic]]
*[[CPICH]]
*[[pod2g]]
*[[User:posixninja|p0sixninja]]

== Associates ==
*[[bugout]]
*[[User:Bushing|bushing]]
*[[c1de0x]]
*[[User:Chpwn|chpwn]]
*[[User:Comex|comex]]
*[[User:Geohot|geohot]]
*[[ius]]
*[[User:Jan0|jan0]]
*[[User:lilstevie|Lilstevie]]
*[[User:MuscleNerd|MuscleNerd]]
*[[User:NerveGas|NerveGas]]
*[[pimskeks]]
*[[User:Planetbeing|planetbeing]]
*[[psp250]]
*[[User:Jan0|jan0]]
*[[User:pumpkin|pumpkin]]
*[[saurik]]

==Links==
*[http://greenpois0n.com/ Greenpois0n Blog]
*[http://chronic-dev.org/blog/ Chronic Dev Blog]
*[https://code.google.com/archive/p/chronicdev/wikis Chronic Dev Wiki]
*[https://github.com/Chronic-Dev GitHub]
*[http://chronicdev.googlecode.com/ Chronic Dev Google Code]
*[https://github.com/svn2github/chronicdev Chronic Dev Google Code mirror on Github
*[http://twitter.com/chronicdevteam Chronic Dev Team on Twitter]
[[Category:Hackers]]
[[Category:Teams]]

Geeksn0w

2016-09-19T19:31:26Z

IApeiron: /* How it works */ added link to SSH Ramdisk page

{{about|the semi-tethered jailbreak for iOS 7.1.x|the untethered jailbreak for iOS 7.1.x|Pangu}}
{{Infobox software
| title = Geeksn0w
| logo = [[File:Geeksn0w.png|75px]]
| screenshot = [[File:Geeksn0w_2.8.2.png|250px]]
| caption = Geeksn0w 2.8.2 on Windows 7
| author = [http://twitter.com/blackgeektuto BlackGeek]
| developer = [http://twitter.com/blackgeektuto BlackGeek]
| released =
| discontinued =
| latest release version = 2.9.1
| latest release date = {{Start date and age|2014|6|13|df=yes}}
| latest preview version = 1.0 beta (CLI)
| latest preview date = {{Start date and age|2014|5|1|df=yes}}
| programming language = .NET Visual Basic
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]]
| size =
| platform =
| language = [[wikipedia:English|English]]
| status = Active
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://Geeksn0w.it Geeksn0w.it]
}}

'''Geeksn0w''' is a [[jailbreak]] program that performs a semi-[[tethered jailbreak]] for the [[iPhone 4]] on iOS 7.1.x.

== Supported Devices and Requirements==
The only supported devices are those of the [[iPhone 4]]. This is because Geeksn0w uses the [[A4]]-dependant [[limera1n exploit]] and the [[iPhone 4]] is the only A4 device running [[iOS]] 7. Geeksn0w currently only supports Windows (unless you use BootCamp or another VM on your Mac to install Windows). Geeksn0w requires [http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html Java Development Kit for 32-bit PCs] and [http://www.microsoft.com/net .NET Framework] installed on your computer to be able to run. Unlike other jailbreak tools (such as [[evasi0n7]]), Geeksn0w does not need iTunes to be installed.

==Versions and Updates==
Geeksn0w originally performed a [[tethered jailbreak]] on [[iOS]] 7.0 on the [[iPhone 4]] until [[evasi0n7]] was released. BlackGeek then updated Geeksn0w to use the same exploits as [[evasi0n7]] for all devices. Versions 2.5 and above perform a tethered jailbreak on iOS 7.1 for the iPhone 4. Version 2.9 performs a semi-tethered jailbreak on iOS 7.1 and 7.1.1.
On May 1, 2014, BlackGeek released the Mac beta cli for OS X.

===Download===
{| class="wikitable" style="text-align:center;"
! Version
! OS
! Download
! Changelog
|-
! 2.5
| class="noborderplz" rowspan="8" | [[wikipedia:Microsoft Windows|Windows]]
| [https://www.mega.co.nz/#!cA0nRQZA!khTx3YZ-Q5nZq2nYaB0dJtLrp16OLaTmi-TUEaBjk0s MEGA]
| First release that jailbreaks iOS 7.1
|-
! 2.6
| [https://www.mega.co.nz#!YBcCmKTL!ViKwyAzB8k30nly_LBTVnzlH_KK7LUyvTgQMcBOENXs MEGA]
| Bug fixes
|-
! 2.7
| [https://www.mediafire.com/download/1j4q76u9bm24wc0/geeksn0w_win_2.7_ea343bc6ca7b07ad662e2c4b3e0cefa.zip MediaFire]
|
* Added official Cydia 1.1.9 build
* Fixed Mail, Safari, Calculator and Weather crash after doing a tethered boot (SandBox fix)
* Added auto-Hacktivation for locked iPhones
* Fixed a bug in the Progress Bar
* Added iDevice arch finder: now GeekSn0w can auto-detect your iPhone model
* Improved speed of root_fs mount
* Fixed mount.sh error
* Reduced the .exe size
* Speeded up the Jailbreak process
* Added AFC2 protocol (iFunBox, iExplorer)
|-
! 2.8
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8_7c148dc55660b4466dade25aa19bb.zip geeksn0w.it]
|
* Fixed a huge bug of GeekSn0w's dfuarch extension
|-
! 2.8.1
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8.1_0b65917a7fd23e279ac97763338ecf.zip geeksn0w.it]
|
* Removed "dfuarch", now GeekSn0w uses iRecovery to identify the iPhone model
* Fixed "New Curses" installation error
|-
! 2.8.2
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_2.8.2_win_c7e3b8f62934143a93e69042c9de96f.zip geeksn0w.it]
|
* Fixed an issue with iPhone 3,2 and 3,3 Jailbreak's process
|-
! 2.8.3
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8.3_3f17cffb2b38bc34a5d3dae91da8c2b.zip geeksn0w.it]
|
* Fixed an issue with New Curses installation
|-
! 2.9
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.9_6322a7e8d3b4bfefe9f585beb7d6d4a5.zip geeksn0w.it]
|
* Updated Jailbreak payload: GeekSn0w now executes a [[Tethered jailbreak|Semi-Tethered Jailbreak]]
* Updated .NET Framework version of some resources
* Removed Respring after any reboot: now all the hack stuff is executed during Apple Logo stage
* Supports iOS 7.1.1
|-
! 1.0 beta (cli)
| [[wikipedia:OS X|OS X]]
| [http://www.geeksn0w.it/GeekSn0w/Releases/Mac_cli/geeksn0w_cli_mac_1.0_d4bdaea1f30d353297d3d4293491f741.zip geeksn0w.it]
|
* First version for OS X.
|-
! 2.9.1
| Windows
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.9.1_c2d308ebe982521ba066a7299598372e.zip geeksn0w.it]
|
* Bundled with Cydia 1.1.12.
* Minor bug fixes
|}

==How it works==
Geeksn0w uses msftguy and DevBug's [[SSH Ramdisk]] tool which uses [[geohot]]'s [[limera1n exploit]] to obtain root access. It then installs Cydia and mounts the root filesystem. It then uses [[opensn0w]] to boot the [[iPhone 4]] tethered. Geeksn0w is technically a GUI of [[opensn0w]] and [[SSH Ramdisk|ssh_rd]].
===The Semi-Tether===
When the device is booted, it uses a LaunchDaemon to start a script in /gfix that reinstalls MobileSubstrate and PreferenceLoader from a local package and then kills the springboard and remounts the system partition as r/w. At installation time it sets the 'nvram' variable boot-args to true, which prevents [[Recovery Mode]]. However, it reinstalls MobileSubstrate and PreferenceLoader from a local package, which prevents [[saurik]] from updating it. It also kills the [[SpringBoard]] which adds additional boot time, and it remounts the fs after the first [[SpringBoard]] launch, which may cause other LaunchDaemons that needs r/w at boot time to fail. This is why many people have made their own SemiTether packages that use the 'dirhelper' which is being executed during the boot, to remount the fs and looping through /etc/rc.d and execute every binary there, just like [[evasi0n7]] does, which directly injects MobileSubstrate. They then use 'auto-boot' to prevent [[Recovery Mode]]. This resulting package boots faster and is far more efficient than the way it is currently used by. The reason that Geeksn0w is not an [[untethered jailbreak]], is that there is no kernal exploit. (Also call Semi-Untethered).

==The Semi-Tether==
*On April 21, 2014, BlackGeek announced on Twitter that he had achieved a [[Tethered_jailbreak#Using_a_tethered_(or_semi-tethered)_jailbreak|Semi-Tethered Jailbreak]] on the iPhone 4 on 7.1<ref>https://twitter.com/blackgeektuto/status/458283310100541441</ref>. On April 25, BlackGeek updated Geeksn0w to version 2.9 which achieved a semi-tethered jailbreak for 7.1 or 7.1.1. He also added the semi-tether package to his repo (http://geekrepo.beiphone.it) for people who had already jailbroken tethered on 7.1 and wanted to upgrade to Semi-Tethered.

==Exploits==
*[[geohot]]'s [[Limera1n exploit]] - Tethered

==See Also==
*[[Tethered jailbreak]]
*[[limera1n exploit]]
*[[opensn0w]]
*[http://twitter.com/blackgeektuto BlackGeek] on Twitter

==References==
<references/>

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

IPhoneInterface

2016-09-19T19:20:29Z

IApeiron: IApeiron moved page Iphoneinterface to IPhoneInterface: corrected capitalization

iPhoneInterface - an iPhone command shell (released July, 2007)

== Credit ==
*geohot, ixtli, nightwatch, warren, ziel, jaykk
*Mac support by nall and Operator

==See also==
* [[iPHUC]]

==External Links==
* [https://www.engadget.com/2007/07/06/iphoneinterface-hack-gets-you-inside-the-phone/ iPhoneInterface hack gets you inside the phone]
* [http://modmyi.com/forums/windows-specific-modding-discussion/589-iphoneinterface-hack-get-you-inside-iphone.html iPhoneInterface, modmyi forum]
* [https://web.archive.org/web/20070706214623/http://unlockediphoneforsale.com/2007/07/iphone-hacking-news-update-iphoneinterface-tool-nearly-out/ iPhone Hacking News Update: iPhoneInterface Tool is Out]
* [https://web.archive.org/web/20070709003153/http://unlockediphoneforsale.com/2007/07/iphone-hacking-news-update-noon-7607-something-big-coming/ Serial Access to the iPhone Console]
* [http://www.hackthatphone.com/downloads/iphoneinterface.zip iPhoneInterface v0.3.1 source package]
* [http://www.hackthatphone.com/downloads/jailbreak.zip iPhoneInterface compiled for Windows and Mac]

[[Category:Hacking Software]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Iphoneinterface

2016-09-19T19:20:29Z

IApeiron: IApeiron moved page Iphoneinterface to IPhoneInterface: corrected capitalization

#REDIRECT [[IPhoneInterface]]

SSH Ramdisk

2016-09-19T19:14:51Z

IApeiron: created initial short article with links to source code and info

{{DISPLAYTITLE:SSH Ramdisk}}
Also known as a Forensics Ramdisk, an SSH Ramdisk is versatile tool in iPhone research. Publicly available methods work on all devices vulnerable to [[limera1n]]

==Uses==
* retrieving data from a device
* setting up a bare-bones [[Jailbreak]], with [[AFC|AFC2]] access
* or even installing a full [[Jailbreak]], as [http://twitter.com/blackgeektuto BlackGeek] demonstrated with [[Geeksn0w]]

==See also==
[[File System Crypto]]

==External Links==
* [https://code.google.com/archive/p/iphone-dataprotection/ iPhone-dataprotection page on Google Code]
* [https://github.com/nabla-c0d3/iphone-dataprotection iPhone-dataprotection source code mirror on Github]
* [http://msftguy.blogspot.ca/2012/01/automatic-ssh-ramdisk-creation-and.html#more msftguy's blog on SSH Ramdisk creation]
* [https://github.com/msftguy/ssh-rd msftguy's SSH Ramdisk source code on Github]
* [https://sites.google.com/site/msftguy/file/ssh_rd_rev04b.jar msftguy's SSH Ramdisk JAR]
* [http://appadvice.com/appnn/2013/06/no-jailbreak-required-how-to-gain-full-root-access-on-iphone-4-running-ios-7-beta Guide to achieve bare-bones Jailbreak]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

IBrickr

2016-09-19T17:49:29Z

IApeiron: added links and information

{{DISPLAYTITLE:iBrickr}}
iBrickr was an application from [[Nate True]]. It was a [[jailbreak]] for iPhone OS 1.0.x, which utilized [[Restore Mode]] for the jailbreak. It was able to install PXL packages and custom ringtones. Version 0.9 introduced a feature to guide the user through a 1.1.1 to 1.0.2 [[Firmware downgrading|downgrade]].

iBrickr was later retooled for the initial 1.1.3 jailbreak, excluding the aforementioned features. This implementation of the [[Soft Upgrade]] jailbreak method required a jailbroken installation of iPhone OS 1.1.1 or 1.1.2 on an [[M68AP|iPhone]]. Nate True was kicked out of the [[iPhone Dev Team]] after its release.

==External Links==
* [https://web.archive.org/web/20090203191753/http://cre.ations.net/creation/ibrickr iBrickr info, with changelog up to v 0.91]
* [https://web.archive.org/web/20090203191753/http://ibrickr.com/downloads/ibrickr_v0.91.zip iBrickr 0.91]
* [https://web.archive.org/web/20090208193056/http://pxl.ibrickr.com/ iBrickr PXL repo]
* [http://web.archive.org/web/20100105110134/http://cre.ations.net/blog/post/iphone-113-jailbreak-released iBrickr 1.1.3 Jailbreak info]
* [https://web.archive.org/web/20141218041745/http://devices.natetrue.com/iphone/ibrickr-jb113.zip iBrickr 1.1.3 Jailbreak]
* [https://web.archive.org/web/20141218041753/http://devices.natetrue.com/iphone/jb113.dmg Mac 1.1.3 package maker]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

IPhoneInterface

2016-09-19T17:15:42Z

IApeiron:

IPhoneInterface

2016-09-19T07:47:39Z

IApeiron: created initial article with links

Cinject

2016-09-19T05:12:15Z

IApeiron: added links

{{lowercase}}
'''Cinject''' is a CLI tool by the [[iPhone Dev Team]] used to install the [[Rocky Racoon]] untethered jailbreak on iOS 5.1.1.

== External Links ==
*[https://sites.google.com/a/iphone-dev.com/files/home/cinject-readme.txt Cinject readme]
*[https://sites.google.com/a/iphone-dev.com/files/home/cinject-0.5.4.zip Cinject 0.5.4]

{{stub|jailbreaking}}

Redsn0w

2016-09-19T05:06:19Z

IApeiron: /* External Links */ added official download link

{{lowercase}}
{{float toc|left}}
[[File:Redsn0w.png|thumb|redsn0w on OS X]]
'''redsn0w''' is an [[iDevice]] [[jailbreak]]ing tool for OS X and Windows. Originally called [[QuickPwn]], but due to exploitation of the name by <code>www.quickpwn.com</code>, version 0.7 was renamed to redsn0w and added [[unlock]]ing of supported [[iDevice|devices]].

Version 0.8 added support for jailbreaking the [[N88AP|iPhone 3GS]].

Version 0.9b3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the [[N18AP|iPod touch 3G]], and supports a [[tethered jailbreak]] on [[N88AP|iPhone 3GS]] units and [[N72AP|iPod touch 2G]] units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup.

Version [http://wikee.iphwn.org/howto:rs9 0.9.2] supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on [[S5L8900]] devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early [[N72AP|iPod touch 2G]] with iOS 3.1.3.

Version [http://wikee.iphwn.org/howto:rsbeta 0.9.5b5-5] supports jailbreaking the [[N82AP|iPhone 3G]] and [[N72AP|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]) with iOS 4.0 on Windows and Mac OS X.

Version [http://blog.iphone-dev.org/post/1718400992 0.9.6b6] supports jailbreaking iOS 3.2.2, 4.1, and 4.2.1 for every device that supports those versions (except Apple TV 2G), on Windows and Mac OS X.

Version [http://blog.iphone-dev.org/post/14857834236 0.9.10b1] adds support for iOS 4.2.6 through 5.0.1 (though iOS 4.2.9, 4.2.10, 4.3.4, 4.3.5, and 5.0 are tethered on devices invulnerable to the [[0x24000 Segment Overflow]]). This build of redsn0w is not capable of jailbreaking [[S5L8940]] or newer devices.
{{clear}}

== Credit ==
[[iPhone Dev Team]]

== Versions ==
===Initial releases===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! Lite
| Unknown
| {{yes}}
| {{yes}}
|
* Tethered jailbreak for [[N72AP|iPod touch 2G]] on iOS 2.1.1 with [[ARM7 Go]]
|-
! 0.3
| Unknown
| {{yes}}
| {{yes}}
|
* Untethered jailbreak for the [[N72AP|iPod touch 2G]] on iOS 2.2.1 with [[ARM7 Go]] and [[0x24000 Segment Overflow]]
|}
===0.7.x series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.7
| Unknown
| {{yes}}
| {{yes}}
| style="white-space: nowrap;" |
* Untethered jailbreak for all devices but [[N88AP|iPhone 3GS]]
|-
! 0.7.1
| Unknown
| {{yes}}
| {{yes}}
| Bug fixes for versions 0.7
|-
! 0.7.2
| Unknown
| {{yes}}
| {{yes}}
| Bug fixes for versions 0.7
|}

===0.8.x series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.8
| {{date|2009|07|07}}
| {{yes}}
| {{yes}}
|
* Performs an [[untethered jailbreak]] on iOS 3.0/3.0.1 (when pointed at 3.0) for all devices supported by those firmware.
|-
|}

===0.9.0-0.9.4 releases===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.2
| Unknown
| {{yes}}
| {{yes}}
|
* Supports 3.0-3.1.2 on all iPhones and iPod touches ([[tethered jailbreak|tethered]] for newer devices with [[0x24000 Segment Overflow]] closed)
|-
! 0.9.3
| Unknown
| {{yes}}
| {{yes}}
|
* Contains the IPCC hack to enable tethering on the iPhone 3G and 3GS.
|-
! 0.9.4
| Unknown
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 3.1.3 on [[M68AP|iPhone]], [[N82AP|iPhone 3G]], [[N45AP|iPod touch]], [[N72AP|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]])
|-
|}

===0.9.5 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.5b3
| 21 Jun 2010
| {{yes}}
| {{no}}
|
* Supports jailbreaking iOS 4.0 on [[N82AP|iPhone 3G]] and [[N72AP|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]])
|-
! 0.9.5b4
| Unknown
| {{yes}}
| {{no}}
|
* Resolved a problem with iBooks.
|-
! 0.9.5b5
| Unknown
| {{yes}}
| {{no}}
|
* Supposed to fix any APN or MMS issues that users were seeing.
|-
|}

===0.9.6 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.6b1
| {{date|2010|09|21}}
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 4.0-4.1 on [[N82AP|iPhone 3G]] and [[N72AP|iPod touch 2G]] ([[tethered jailbreak|tethered]] on [[Bootrom 240.5.1|new bootrom]])
|-
! 0.9.6b2
| {{date|2010|10|31}}
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 3.2.2 and 4.0-4.1 on every device that supports those firmwares (except [[N72AP|iPod touch 2G]] with [[Bootrom 240.5.1|new bootrom]]) .
** The [[N82AP|iPhone 3G]], [[N72AP|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]), and [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) can also have custom boot logos.
* The Windows version also includes a function that permits users to restore to a custom [[IPSW File Format|IPSW]], akin to [[PwnageTool]]'s DFU button.
|-
! 0.9.6b3
| {{date|2010|11|21}}
| {{yes}}
| {{yes}}
|
* Supports the installation of custom bundles
|-
! 0.9.6b4
| {{date|2010|11|23}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 4.1-4.2.1 on all compatible devices.
** [[Tethered jailbreak]] on devices that are not vulnerable to [[Pwnage 2.0]] or [[0x24000 Segment Overflow]].
|-
! 0.9.6b5
| {{date|2010|11|28}}
| {{yes}}
| {{yes}}
|
* Can update the baseband on the [[X-Gold 608]] to [[06.15.00]], allowing the reuse of the [[AT+XAPP Vulnerability]]
|-
! 0.9.6b6
| {{date|2010|12|01}}
| {{yes}}
| {{yes}}
|
* Allows you to "deactivate" a hacktivated phone, so sbinger's [http://www.bingner.com/SAM.html Subscriber Artificial Module] (SAM) can trick your iPhone and [[iTunes]] into creating legitimate activation tickets.
|-
! 0.9.6 release candidate 7
| {{date|2011|01|02}}
| {{yes}}
| {{yes}}
|
* Introduced command-line arguments to bypass some screens.
** -b <filename> to specify your own boot logo PNG
** -i <filename> to specify your reference IPSW
** -j to ask redsn0w to “Just boot now tethered for now”
** -o for [[N88AP|iPhone 3GS]] and [[N72AP|iPod touch 2G]] units vulnerable to [[0x24000 Segment Overflow]].
|-
! 0.9.6 release candidate 8
| {{date|2011|01|05}}
| {{yes}}
| {{yes}}
|
* Informs users if a boot logo PNG is invalid, and why.
* Introduced the "-a" command-line argument to eliminate clicking.
|-
! 0.9.6 release candidate 9
| {{date|2011|04|03}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.1 on all compatible devices except the [[iPad 2]] and [[K66AP|Apple TV 2G]].
* New command line parameters k and d [http://twitpic.com/4gg8n1]:
** -k --kernelcache=<str> use specified kernelcache (advanced)
** -d --devicetree=<str> use specified devicetree (advanced)
|-
! 0.9.6 release candidate 10
| {{date|2011|04|07}}
| {{yes}}
| {{yes}}
|
* Added boot animations
* Removed misleading Settings
|-
! 0.9.6 release candidate 11
| {{date|2011|04|07}}
| {{yes}}
| {{yes}}
|
* Makes the boot animation a bit more robust
|-
! 0.9.6 release candidate 12
| {{date|2011|04|08}}
| {{yes}}
| {{yes}}
|
* Fix any lingering issues with the boot animation
|-
! 0.9.6 release candidate 13
| {{date|2011|04|19}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.2 on all compatible devices except the [[iPad 2]].
** A bug existed that prevented the [[N90AP|iPhone 4 (iPhone3,1)]] from being jailbroken on iOS 4.3.2.
|-
! 0.9.6 release candidate 14
| {{date|2011|04|19}}
| {{yes}}
| {{yes}}
|
* Fixes an issue that prevented the [[N90AP|iPhone 4 (iPhone3,1)]] from being jailbroken.
|-
! 0.9.6 release candidate 15
| {{date|2011|05|06}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.3 on all compatible devices except the [[iPad 2]].
|-
! 0.9.6 release candidate 16
| {{date|2011|05|16}}
| {{yes}}
| {{yes}}
|
* Fixes the [[N88AP|iPhone 3GS]]/[[N90AP|iPhone 4 (iPhone3,1)]] side switch vibration issue found in jailbroken installations of iOS 4.3.3.
|-
! 0.9.6 release candidate 17
| {{date|2011|05|20}}
| {{yes}}
| {{yes}}
|
* Adds advanced command line options for kernel hackers.
|-
! 0.9.6 release candidate 18
| {{date|2011|06|14}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.2.8 on the [[N92AP|iPhone 4 (iPhone3,3)]].
|-
! 0.9.6 release candidate 19
| {{date|2011|07|12}}
| {{yes}}
| {{yes}}
|
* When a custom bundle is applied, most of the normal jailbreak steps (like stashing and untethering) are skipped.
|}

===0.9.7 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.7b1
| {{date|2010|12|26}}
| {{yes}}
| {{no}}
|
* Jailbreaks iOS 4.1-4.2.1 on all compatible devices.
** Able to achieve an [[untethered jailbreak]] on 4.2.1, provided the user has 4.2b3 [[SHSH]]s and the 4.2b3 [[IPSW File Format|IPSW]].
*** This version of "Jailbreak Monte" has quite a number of bugs, particularly app switcher crashes and disabled [[Bluetooth]].
|-
! 0.9.7b2
| {{date|2010|12|26}}
| {{yes}}
| {{no}}
|
* Fixes crashing bugs on GUI apps.
|-
! 0.9.7b3
| {{date|2010|12|27}}
| {{yes}}
| {{no}}
|
* Fixes crashing bugs completely.
|-
! 0.9.7b4
| {{date|2010|12|31}}
| {{yes}}
| {{no}}
|
* ubsmuxd integrated.
|-
! 0.9.7b5
| {{date|2011|01|08}}
| {{yes}}
| {{no}}
|
* Issues related to [[Bluetooth]] and the sandbox are resolved.
|-
! 0.9.7b6
| {{date|2011|01|10}}
| {{yes}}
| {{no}}
|
* fixes Skype
|}

===0.9.8 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.8b1
| {{date|2011|06|10}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b and 5.0b2 (when pointed at the beta IPSW) on all compatible devices except the [[iPad 2]].
|-
! 0.9.8b2
| {{date|2011|07|11}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, and 5.0b3 on all compatible device except the [[iPad 2]].
* Fixes the iOS 5.0b3 sandbox issues present in the previous version.
|-
! 0.9.8b3
| {{date|2011|07|16}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 4.3.4 and iOS 5.0b, 5.0b2, and 5.0b3.
|-
! 0.9.8b4
| {{date|2011|07|23}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, and 5.0b4.
|-
! 0.9.8b5
| {{date|2011|08|09}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4 and 5.0b5.
|-
! 0.9.8b6
| {{date|2011|08|23}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4, 5.0b5, and 5.0b6.
|-
! 0.9.8b7
| {{date|2011|08|31}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4, 5.0b5 and 5.0b6.
* Performs a [[tethered jailbreak]] of iOS 4.3.5 and 4.2.10 without pointing at an older IPSW.
* Performs a [[tethered jailbreak]] of iOS 5.0b6 on a new, silently changed (by Apple) [[K48AP|iPad]] IPSW.
* Fixes a bug in the 4.2.10 jailbreak on the [[N92AP|iPhone 4 (iPhone3,3)]] [[tethered jailbreak]].
|-
! 0.9.8b7b
| {{date|2011|09|02}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] for [[iOS]] 4.3.4, 4.3.5, 4.2.9, 4.2.10 on all supported devices except the [[N88AP|iPhone 3GS]] (old bootrom) and the [[iPad 2]]
* Performs an [[untethered jailbreak]] on [[iOS]] 4.1-4.3.3 on all supported devices except the [[iPad 2]]
* Performs a [[tethered jailbreak]] on [[iOS]] 5.0b - 5.0b7 on all supported devices except the [[N88AP|iPhone 3GS]] (old bootrom) and [[iPad 2]]
* Performs an [[untethered jailbreak]] on [[N88AP|Phone 3GS]] (old bootrom) on [[iOS]] 4.1-4.3.5 and 5.0b7
* Fixed lingering issues with the [[N92AP|iPhone 4 (iPhone3,3)]] 4.2.10 [[tethered jailbreak]]
|-
! 0.9.8b7c
| {{date|2011|09|06}}
| {{yes}}
| {{yes}}
|
* Same as 0.9.8b7b on all devices but [[N88AP|iPhone 3GS]] with [[06.15.00]] baseband
* Fixes [[iTunes Errors#Error 1015|error 1015]] when restoring to stock 4.3.5 on [[N88AP|iPhone 3GS]] with [[06.15.00]] baseband.
|}

===0.9.9 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
!0.9.9b1
|{{date|2011|09|19}}
| {{yes}}
| {{yes}}
|
*Complete rewrite.
*No longer requires IPSWs when jailbreaking public builds. When jailbreaking beta/Golden master firmwares, need to specify IPSW once, then auto-recognizes it.
*Redsn0w now fetches SHSH from device, querys Cydia about saved blobs, stitches IPSWs with SHSH blobs (not for iPhones) and able to submit SHSH to cydia
*Includes Terminal shell commands into the GUI.
|-
!0.9.9b2
|{{date|2011|10|04}}
| {{yes}}
| {{yes}}
|
*Fixes Verizon iPhone 4 firmware detection
*Fixes 'Fix Recovery'
*Fixes for Stitching
*Fixes for blob processing
|-
!0.9.9b3
|{{date|2011|10|05}}
| {{yes}}
| {{yes}}
|
*Auto-detects the iOS 5.0 GM firmware now.
*Allows a jailbreak (albeit still tethered apart from [[N88AP|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) on iOS5 GM
|-
!0.9.9b3a
|{{date|2011|10|05}}
| {{no}}
| {{yes}}
|
*Fixes a Windows-only caching bug
*Allows Windows users to rename the redsn0w exe to anything containing 'boot' to jump straight to the tethered boot stage on load (thus adding one-click tethered boot to Windows redsn0w)
*0.9.9b3 still works fine for Mac users except they don't have the new 'boot' rename feature that this version has
|-
!0.9.9b4
|{{date|2011|10|12}}
| {{yes}}
| {{yes}}
|
*Now auto-recognizes iOS 5 and no longer requires IPSW submission on iOS 5 jailbreak
|-
!0.9.9b5
|{{date|2011|10|13}}
| {{yes}}
| {{no}}
|
*Custom IPSW feature (from PwnageTool) for Baseband preservation.

|-
!0.9.9b6
|{{date|2011|12|18}}
| {{yes}}
| {{yes}}
|
*Fixes location services issues for iPhone 3GS with [[06.15.00]] baseband

|-
!0.9.9b7
|{{date|2011|10|21}}
| {{yes}}
| {{yes}}
|
*You can now choose whether you want redsn0w or Cydia to Stash Applications (can shorten redsn0w session by 60%)
|-
!0.9.9b8
|{{date|2011|11|03}}
| {{yes}}
| {{yes}}
|
*Jailbreaks iOS 5.0.1b (9A402) tethered on devices vulnerable to [[limera1n exploit]].
**Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
|-
!0.9.9b9
|{{date|2011|12|19}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 5.0.1 tethered on devices vulnerable to [[limera1n exploit]].
** Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
* iBooks fix.
* Allows custom IPSW creation for [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) without SHSH blobs.
* Supports the 8 GB [[iPhone 4]].
* Allows stitched IPSW creation for iOS 5.x.
* Allows stitched IPSW creation for [[k94ap|iPad 2 (iPad2,2)]]s running iOS 4.3.x.
* Built-in version check.
|-
!0.9.9b9b
|{{date|2011|12|19}}
| {{yes}}
| {{yes}}
|
* Enables the “Custom” button in Windows to allow baseband preservation.
* Warns against flashing baseband [[06.15.00]] on newer iPhone 3GS devices (2011 week 35) more explicitly.
|-
!0.9.9b9c
|{{date|2011|12|19}}
| {{no}}
| {{yes}}
|
* Special build for Windows users encountering issues with the update check.
|-
!0.9.9b9d
|{{date|2011|12|20}}
| {{yes}}
| {{yes}}
|
* Addresses a problem with the [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) devices.
|}

===0.9.10 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.10b
| {{date|2011|12|27}}
| {{yes}}
| {{yes}}
|
* The jailbreak for iOS 5.0.1 is now untethered.
|-
! 0.9.10b2
| {{date|2011|12|27}}
| {{yes}}
| {{yes}}
|
* Fixes an issue with launchctl that the untether caused.
|-
! 0.9.10b3
| {{date|2011|12|28}}
| {{yes}}
| {{yes}}
|
* Fixes a problem where re-running redsn0w over an existing jailbreak would cause [[Mobile Substrate]]-based apps to stop running until Mobile Substrate was installed again.
|-
! 0.9.10b3 novcheck
| {{date|2011|12|29}}
| {{no}}
| {{yes}}
|
* ?
|-
! 0.9.10b4
| {{date|2012|01|15}}
| {{yes}}
| {{yes}}
|
* Includes a fix for [[iBooks]] on iOS 5.0.1.
* Addresses an issue where the launchctl fix didn't work sometimes.
|-
! 0.9.10b5
| {{date|2012|01|29}}
| {{yes}}
| {{yes}}
|
* Circumvents jailbreak detection in [[iBooks]] that caused ~10% of images to display properly.
|-
! 0.9.10b5b
| {{date|2012|02|01}}
| {{yes}}
| {{yes}}
|
* Fixes an issue with custom ramdisks on the [[N82AP|iPhone 3G]] and [[N72AP|iPod touch 2G]].
|-
! 0.9.10b5c
| {{date|2012|02|12}}
| {{yes}}
| {{yes}}
|
* Prevents redsn0w from crashing due to increasing ramdisk sizes.
|-
! 0.9.10b6
| {{date|2012|03|07}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 5.1 tethered on devices vulnerable to [[limera1n Exploit]].
** Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
* Automatically detects MC model [[N72AP|iPod touch 2G]] with [[User:pod2g|pod2g]]'s steaks4uce exploit.
|-
! 0.9.10b6b
| {{date|2012|03|11}}
| {{yes}}
| {{no}}
|
* Fixes small issues for Mac OS X v10.5.8 and earlier.
|-
! 0.9.10b7
| {{date|2012|04|20}}
| {{yes}}
| {{yes}}
|
* Implements the Corona A5 jailbreak for iPhone 4S and iPad 2 devices still at 5.0.1
* Can also re-install that jailbreak for those who accidentally uninstalled the untether
* When stitching an IPSW, it can now grab your blobs directly from Cydia.
* Now shows a lot more info about your device, for instance, whether your iPhone 3G has the vulnerable baseband bootloader, or whether your iPhone 3GS has the old exploitable bootrom
|-
! 0.9.10b8
| {{date|2012|04|23}}
| {{yes}}
| {{yes}}
|
* Can backup those priceless activation tickets many are grabbing today
* Adds ability to backup arbitrary directories or files from your device into a ZIP file on your Mac or PC
|-
! 0.9.10b8b
| {{date|2012|04|23}}
| {{yes}}
| {{yes}}
|
* Makes the ZIP files compatible with the native Windows Explorer.
|}

===0.9.11 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.11b1
| {{date|2012|05|11}}
| {{yes}}
| {{yes}}
|
* Newer devices ([[iPad 2]], [[iPad 3]], and [[N94AP|iPhone 4S]]) are able downgrade as well. In a radical departure from previous versions of [[redsn0w]], it now directly supports restoring [[IPSW File Format|IPSW]]s to your device.
|-
! 0.9.11b2
| {{date|2012|05|12}}
| {{yes}}
| {{yes}}
|
* Adds support for downgrading to [[Telluride 9A406 (iPhone4,1)|iOS 5.0.1 build 9A406]] for the [[N94AP|iPhone 4S]].
|-
! 0.9.11b3
| {{date|2012|05|14}}
| {{yes}}
| {{yes}}
|
* This release should fix the "Restore failed" messages people were sometimes getting.
* Behaves better with nearby devices that have Wi-Fi syncing enabled.
|-
! 0.9.11b4
| {{date|2012|05|14}}
| {{yes}}
| {{yes}}
|
* Completes the tethered jailbreak support for iOS 5.1.1 on A4 devices and earlier, including proper "Stitching" and "Custom" creation of NO_BB [[IPSW File Format|IPSW]]s
|}

===0.9.12 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.12b
| {{date|2012|06|04}}
| {{yes}}
| {{yes}}
|
* Adds [[Rocky Racoon]] for all devices on iOS 5.1.1.
** On A4 devices and earlier, users can choose between the backup restore method (like [[Absinthe]]) or using a ramdisk-based jailbreak (how redsn0w usually works).
|-
! 0.9.12b2
| {{date|2012|06|08}}
| {{yes}}
| {{yes}}
|
* Users on iOS 5.1.1 are now explicitly asked if they wish to use the backup/restore method or the DFU ramdisk method for jailbreaking.
* Fixes iBooks problems on the iPhone 3GS (old bootrom).
* Provides more helpful error messages.
|}

===0.9.13 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.13 developer-only 1
| {{date|2012|06|13}}
| {{yes}}
| {{yes}}
|
* Jailbreaks [[iOS]] 6.0b.
|-
! 0.9.13 developer-only 2
| {{date|2012|06|15}}
| {{yes}}
| {{yes}}
|
* Fix the various SSH problems and crashes with apps that some have been seeing.
|-
! 0.9.13 developer-only 3
| {{date|2012|07|16}}
| {{yes}}
| {{yes}}
|
* Covers 6.0b3 release and also adds explicit support for 6.0b2.
|-
! 0.9.13 developer-only 4
| {{date|2012|09|13}}
| {{yes}}
| {{yes}}
|
* ???
|}

===0.9.14 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.14b1
| {{date|2012|06|18}}
| {{yes}}
| {{yes}}
|
* Add a baseband downgrade option in redsn0w for those who are using the iPad’s [[06.15.00]] baseband on the iPhone 3G or iPhone 3GS.
|-
! 0.9.14b2
| {{date|2012|07|04}}
| {{yes}}
| {{yes}}
|
* Improves the iPad baseband downgrade and should cover anyone who couldn’t downgrade with 0.9.14b1. Also simplified the process and added logging to help diagnose any remaining stubborn iPhones.
|}

===0.9.15 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.15b1
| {{date|2012|10|14}}
| {{yes}}
| {{yes}}
|
* Tethered jailbreak for iOS 6.0 on the [[K66AP|Apple TV 2G]], [[N88AP|iPhone 3GS]], [[iPhone 4]], and [[N81AP|iPod touch 4G]].
** Untethered for iPhone 3GS devices with the [[iBoot-359.3|old bootrom]].
* Allows devices with the A5 or newer to restore to iOS 5.x, as long as they have iOS 4.x or 5.x installed.
|-
! 0.9.15b2
| {{date|2012|10|15}}
| {{yes}}
| {{yes}}
|
* After restoring an [[N88AP|iPhone 3GS]], redsn0w keeps track of its bootrom version while it's still open.
* Fixes support for upgrading to/downgrading baseband [[06.15.00]].
|-
! 0.9.15b3
| {{date|2012|11|01}}
| {{yes}}
| {{yes}}
|
* Save iPad 4 and iPad Mini SHSH blobs.
* Fixes of error 14 when stitching blobs and error 2601 for windows users when restoring.
|}

== Exploits used ==
For [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]:
*[[Pwnage]]
*[[Pwnage 2.0]]

For [[N72AP|iPod touch 2G]]:
*[[0x24000 Segment Overflow]]
*[[ARM7 Go]] - used to upload the oversized [[LLB]] required to utilize the 0x24000 Segment Overflow.
*[[usb_control_msg(0xA1, 1) Exploit]] - used (in redsn0w 0.9.6b) to upload the oversized [[LLB]] to utilize the 0x24000 Segment Overflow, as well as a [[tethered jailbreak]] on units with the [[Bootrom 240.5.1|new bootrom]].

For [[N88AP|iPhone 3GS]]:
*[[0x24000 Segment Overflow]]
*[[iBoot Environment Variable Overflow]] - Exploit has a different implementation from [[User:geohot|geohot]]'s implementation in [[purplera1n]].
*[[usb_control_msg(0x21, 2) Exploit]]
*[[limera1n]] exploit

For [[N18AP|iPod touch 3G]]:
*[[usb_control_msg(0x21, 2) Exploit]]
*[[limera1n]] exploit

For [[iPhone 4]], [[N81AP|iPod touch 4G]], [[K48AP|iPad]] and [[K66AP|Apple TV 2G]]:
*[[limera1n]] exploit

For [[K48AP|iPad]], [[iPad 2]], [[iPad 3]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch 3G]] and [[N81AP|iPod touch 4G]]:
* [[Corona]]
* [[Racoon String Format Overflow Exploit]]
* [[ HFS Heap Overflow]]
* [[BackupAgent]]

== External Links ==
*[https://sites.google.com/a/iphone-dev.com/files/home/ Official redsn0w download links]
*[http://blog.iphone-dev.org/tagged/redsn0w iPhone Dev Team blog with redsn0w information]
*[http://blog.iphone-dev.org/redsn0w-iOS5 redsn0w beta infos (outdated)]

[[Category:Hacking Software]]
[[Category:Jailbreaking]]
[[Category:Jailbreaks]]

PwnageTool

2016-09-19T03:51:46Z

IApeiron:

'''PwnageTool''' is an [[iOS]] [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it for restore using [[iTunes]].

== Credit ==
[[iPhone Dev Team]]

==Exploits Used==
===Version 1.0===
* [[Pwnage]]
* [[Ramdisk Hack]]

===Version 2.0===
* [[Pwnage 2.0]]
* [[Pwnage]]

===Version 4.0===
* Bootrom exploit (used by [[limera1n]] and [[Greenpois0n (jailbreak)|greenpois0n]])

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[N82AP|iPhone 3G]]
| {{date|2008|07|19}}
|-
| [[N45AP|iPod touch 3GS]]
| {{date|2009|10|02}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|10|20}}
|-
| [[N18AP|iPod touch 3G]]
| {{date|2010|10|20}}
|-
| [[N81AP|iPod touch 4G]]
| {{date|2010|10|20}}
|-
| [[K48AP|iPad]]
| {{date|2010|10|20}}
|-
| [[K66AP|Apple TV 2G]]
| {{date|2010|10|20}}
|}
Please note that the [[iPad 2]] and the [[iPhone 4S]] are not yet supported, as there is no publicly available bootrom exploit (like [[Pwnage]], [[Pwnage 2.0]], [[limera1n]]) for the A5-Processor.

==Versions==

PwnageTool was released 3 April 2008 but largely unused until version 2.0 was released 19 July 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable"
! Version
! Release Date
! Features
|-
!1.0
| {{date|2008|04|03}}
|
*Initial release
* Supports iPod touch and iPhone.
* Includes 2 modes: iPwner and custom .ipsw
* Uses [[Ramdisk Hack]]+[[Pwnage]] in iPwner then creates the firmware.
|-
! 1.1
| {{date|2008|04|17}}
|
* Jailbreaks 1.1.4 firmware
* Supports iPod touch and iPhone.
* Custom boot logos can now be added
* Added Bootneuter integration
* Still uses iPwner and custom .ipsw
|-
|}

===2.x: Second major release of Pwnagetool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 2.0
| {{date|2008|07|19}}
|
* Added iPhone 3G support [http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! 2.0.1
| {{date|2008|08|04}}
|
* Jailbreaks 2.0.1 firmware
* Works for 2.0 and 2.0.1.
|-
! 2.0.2
| {{date|2008|08|21}}
|
* Jailbreaks 2.0.2 firmware [http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! 2.0.3
| {{date|2008|08|25}}
|
* Jailbreaks 2.0.2 firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! 2.1
| {{date|2008|09|13}}
|
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a valid Cydia source, and add them onto your custom IPSW.
|-
! 2.2
| {{date|2008|11|21}}
|
* Jailbreaks 2.2 firmware
|-
! 2.2.5
| {{date|2009|01|30}}
|
* Jailbreaks 2.2.1
* Not updated by [[iPhone Dev Team]] but made official.
|-
|}

===3.x: Third Major Release of PwnageTool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 3.0
| {{date|2009|06|19}}
|
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|-
! 3.1
| {{date|2009|09|15}}
| |
* Jailbreaks 3.1 firmware for iPhone and iPhone 3G
* Jailbreaks 3.1.1 firmware for iPod touch
|-
! 3.1.3
| {{date|2009|10|02}}
|
* Support for iPhone 3GS with [[Bootrom 359.3]] bootrom and iPod touch 2G with [[Bootrom 240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|-
! 3.1.4
| {{date|2009|10|13}}
| |
* Jailbreaks 3.1.2 firmware for iPhone, iPhone 3G, 3GS with [[Bootrom 359.3]] bootrom, iPod touch, iPod touch 2G with [[Bootrom 240.4]] bootrom
* iPod touch 3G not supported.
|-
! 3.1.5
| {{date|2010|02|07}}
|
* Jailbreaks 3.1.3 firmware for devices supported in 3.1.4.
|-
|}

=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 4.0
| {{date|2010|06|22}}
|
* Jailbreaks iOS 4.0 for devices supported in 3.1.4.
|-
! 4.01
| {{date|2010|06|23}}
|
* Fixes iBooks issue.
|-
! 4.1
| {{date|2010|10|20}}
|
* Jailbreaks iOS 4.1 for [[K66AP|Apple TV 2G]], [[K48AP|iPad]], [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] (both bootroms), [[N90AP|iPhone 4]], [[N18AP|iPod touch 3G]], and [[N81AP|iPod touch 4G]].
|-
! 4.1.1
| {{date|2010|10|22}}
|
* Fixes issues with Leopard.
|-
! 4.1.2
| {{date|2010|10|22}}
|
* Fixes more issues with Leopard.
|-
! 4.1.3
| {{date|2010|11|28}}
|
* Enables installing the [[06.15.00]] baseband on the [[N82AP|iPhone 3G]] and [[N88AP|iPhone 3GS]]
|-
! 4.2
| {{date|2011|02|15}}
|
* Support for iOS 4.2.1 on every device that is compatible, except for the [[N72AP|iPod touch 2G]].
|-
! 4.3
| {{date|2011|04|03}}
|
* Support for iOS 4.3.1 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.2
| {{date|2011|12|27}}
|
* Support for iOS 4.3.2 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3
| {{date|2011|06|08}}
|
* Support for iOS 4.3.3 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3.1
| {{date|2011|05|08}}
|
* includes a fix for the iPhone 3GS / iPhone 4 side switch vibration issue (only for 4.3.3)
|}

=== 5.x: Fifth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! Version
! Release date
! Features
|-
! 5.0.1
| {{date|2011|12|27}}
|
* Jailbreaks iOS 5.0.1 for non-[[S5L8940|A5]] devices.
|-
! 5.1.1
| {{date|2012|06|04}}
|
* Jailbreaks iOS 5.1.1 for non-A5(X) devices.
|}

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, [[BootNeuter]] ([[M68AP|iPhone]] software unlock), custom packages and boot logos. This method is usually less secure than the quick exploits such ([[redsn0w]], [[QuickPwn]], [[purplera1n]], [[blackra1n]], etc.).

==How to create Custom Firmware Bundles==
{{main|Making PwnageTool Bundles}}

==Problems==
This method does have negative aspects. The most common errors are the [[ITunes Errors#Errors 16xx|16xx range of errors]], which mean that the either the firmware file is corrupt or you didn't put it in the right mode (Recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common error is [[ITunes Errors#Error 1604|Error 1604]] which means that the firmware file is corrupted.

==Windows==
PwnageTool is expected to remain exclusive to Mac OS X. As of October 2009, [[User:ih8sn0w|iH8sn0w]], et. al. has announced that they made a project that will bring PwnageTool's functionality to Windows, called [[sn0wbreeze]]. [http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

==See also==
* [[redsn0w]]
* [[ultrasn0w]]

[[Category:Hacking Software]]
[[Category:GUI Tools]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

PwnageTool

2016-09-19T03:49:50Z

IApeiron: added credit and link to iPhone Dev Team

'''PwnageTool''' is an [[iOS]] [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it for restore using [[iTunes]].

== Credit ==
[[iPhone Dev Team]]

==Exploits Used==
===Version 1.0===
* [[Pwnage]]
* [[Ramdisk Hack]]

===Version 2.0===
* [[Pwnage 2.0]]
* [[Pwnage]]

===Version 4.0===
* Bootrom exploit (used by [[limera1n]] and [[Greenpois0n (jailbreak)|greenpois0n]])

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[N82AP|iPhone 3G]]
| {{date|2008|07|19}}
|-
| [[N45AP|iPod touch 3GS]]
| {{date|2009|10|02}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|10|20}}
|-
| [[N18AP|iPod touch 3G]]
| {{date|2010|10|20}}
|-
| [[N81AP|iPod touch 4G]]
| {{date|2010|10|20}}
|-
| [[K48AP|iPad]]
| {{date|2010|10|20}}
|-
| [[K66AP|Apple TV 2G]]
| {{date|2010|10|20}}
|}
Please note that the [[iPad 2]] and the [[iPhone 4S]] are not yet supported, as there is no publicly available bootrom exploit (like [[Pwnage]], [[Pwnage 2.0]], [[limera1n]]) for the A5-Processor.

==Versions==

PwnageTool was released 3 April 2008 but largely unused until version 2.0 was released 19 July 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable"
! Version
! Release Date
! Features
|-
!1.0
| {{date|2008|04|03}}
|
*Initial release
* Supports iPod touch and iPhone.
* Includes 2 modes: iPwner and custom .ipsw
* Uses [[Ramdisk Hack]]+[[Pwnage]] in iPwner then creates the firmware.
|-
! 1.1
| {{date|2008|04|17}}
|
* Jailbreaks 1.1.4 firmware
* Supports iPod touch and iPhone.
* Custom boot logos can now be added
* Added Bootneuter integration
* Still uses iPwner and custom .ipsw
|-
|}

===2.x: Second major release of Pwnagetool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 2.0
| {{date|2008|07|19}}
|
* Added iPhone 3G support [http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! 2.0.1
| {{date|2008|08|04}}
|
* Jailbreaks 2.0.1 firmware
* Works for 2.0 and 2.0.1.
|-
! 2.0.2
| {{date|2008|08|21}}
|
* Jailbreaks 2.0.2 firmware [http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! 2.0.3
| {{date|2008|08|25}}
|
* Jailbreaks 2.0.2 firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! 2.1
| {{date|2008|09|13}}
|
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a valid Cydia source, and add them onto your custom IPSW.
|-
! 2.2
| {{date|2008|11|21}}
|
* Jailbreaks 2.2 firmware
|-
! 2.2.5
| {{date|2009|01|30}}
|
* Jailbreaks 2.2.1
* Not updated by [[iPhone Dev Team]] but made official.
|-
|}

===3.x: Third Major Release of PwnageTool===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 3.0
| {{date|2009|06|19}}
|
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|-
! 3.1
| {{date|2009|09|15}}
| |
* Jailbreaks 3.1 firmware for iPhone and iPhone 3G
* Jailbreaks 3.1.1 firmware for iPod touch
|-
! 3.1.3
| {{date|2009|10|02}}
|
* Support for iPhone 3GS with [[Bootrom 359.3]] bootrom and iPod touch 2G with [[Bootrom 240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|-
! 3.1.4
| {{date|2009|10|13}}
| |
* Jailbreaks 3.1.2 firmware for iPhone, iPhone 3G, 3GS with [[Bootrom 359.3]] bootrom, iPod touch, iPod touch 2G with [[Bootrom 240.4]] bootrom
* iPod touch 3G not supported.
|-
! 3.1.5
| {{date|2010|02|07}}
|
* Jailbreaks 3.1.3 firmware for devices supported in 3.1.4.
|-
|}

=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable"
! Version
! Release date
! Features
|-
! 4.0
| {{date|2010|06|22}}
|
* Jailbreaks iOS 4.0 for devices supported in 3.1.4.
|-
! 4.01
| {{date|2010|06|23}}
|
* Fixes iBooks issue.
|-
! 4.1
| {{date|2010|10|20}}
|
* Jailbreaks iOS 4.1 for [[K66AP|Apple TV 2G]], [[K48AP|iPad]], [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] (both bootroms), [[N90AP|iPhone 4]], [[N18AP|iPod touch 3G]], and [[N81AP|iPod touch 4G]].
|-
! 4.1.1
| {{date|2010|10|22}}
|
* Fixes issues with Leopard.
|-
! 4.1.2
| {{date|2010|10|22}}
|
* Fixes more issues with Leopard.
|-
! 4.1.3
| {{date|2010|11|28}}
|
* Enables installing the [[06.15.00]] baseband on the [[N82AP|iPhone 3G]] and [[N88AP|iPhone 3GS]]
|-
! 4.2
| {{date|2011|02|15}}
|
* Support for iOS 4.2.1 on every device that is compatible, except for the [[N72AP|iPod touch 2G]].
|-
! 4.3
| {{date|2011|04|03}}
|
* Support for iOS 4.3.1 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.2
| {{date|2011|12|27}}
|
* Support for iOS 4.3.2 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3
| {{date|2011|06|08}}
|
* Support for iOS 4.3.3 on every device that is compatible, except for the [[iPad 2]].
|-
! 4.3.3.1
| {{date|2011|05|08}}
|
* includes a fix for the iPhone 3GS / iPhone 4 side switch vibration issue (only for 4.3.3)
|}

=== 5.x: Fifth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! Version
! Release date
! Features
|-
! 5.0.1
| {{date|2011|12|27}}
|
* Jailbreaks iOS 5.0.1 for non-[[S5L8940|A5]] devices.
|-
! 5.1.1
| {{date|2012|06|04}}
|
* Jailbreaks iOS 5.1.1 for non-A5(X) devices.
|}

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, [[BootNeuter]] ([[M68AP|iPhone]] software unlock), custom packages and boot logos. This method is usually less secure than the quick exploits such ([[redsn0w]], [[QuickPwn]], [[purplera1n]], [[blackra1n]], etc.).

==How to create Custom Firmware Bundles==
{{main|Making PwnageTool Bundles}}

==Problems==
This method does have negative aspects. The most common errors are the [[ITunes Errors#Errors 16xx|16xx range of errors]], which mean that the either the firmware file is corrupt or you didn't put it in the right mode (Recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common error is [[ITunes Errors#Error 1604|Error 1604]] which means that the firmware file is corrupted.

==Windows==
PwnageTool is expected to remain exclusive to Mac OS X. As of October 2009, [[User:ih8sn0w|iH8sn0w]], et. al. has announced that they made a project that will bring PwnageTool's functionality to Windows, called [[sn0wbreeze]]. [http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

[[Category:Hacking Software]]
[[Category:GUI Tools]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

IPhone Dev Team

2016-09-19T03:45:42Z

IApeiron: /* Blog */

{{DISPLAYTITLE:iPhone Dev Team}}
Team of hackers. Not the same as [[Chronic Dev (team)|Chronic Dev Team]].

==Projects==
[[redsn0w]]

==Blog==
*[http://wikee.iphwn.org iPhone Dev Team Portal]
*[http://blog.iphone-dev.org Dev Team blog]

==Current members==
* [[bgm]]
* [[bugout]]
* [[User:Bushing|bushing]]
* [[c1de0x]]
* [[chris]]
* [[User:Comex|comex]]
* [[CPICH]]
* [[ghost_000]]
* [[gray]]
* [[iZsh]]
* [[marcan]]
* [[User:MuscleNerd|MuscleNerd]]
* [[User:Planetbeing|planetbeing]]
* [[pumpkin]]
* [[pytey]]
* [[roxfan]]
* [[saurik]]
* [[Turbo]]
* [[w___]]
* [[wizdaz]]
* [[Zf]]

==Previous Members==
* [[asap18]]
* [[dinopio]]
* [[Fred_]]
* [[jim–]]
* [[netkas]]
* [[pr3d4t0r]]
* [[drudge]]
* [[User:Geohot|geohot]]
* [[gj]]
* [[kroo]]
* [[Nate True]]
* [[User:NerveGas|NerveGas]]
* [[sam]]
* [[Whiterat]]
* [[User:Zibri|Zibri]]

==See also==
* [[25C3 presentation "Hacking the iPhone"#Introduction (by pytey)|Self introduction at the 25C3 event]]
* [[PwnageTool]]
* [[pwnage]]
* [[pwnage 2.0]]
* [[yellowsn0w]]
* [[redsn0w]]
* [[ultrasn0w]]

[[Category:Hackers]]
[[Category:Teams]]

IPhone Dev Team

2016-09-19T03:45:08Z

IApeiron: /* Blog */ added link to iphwn.org portal

{{DISPLAYTITLE:iPhone Dev Team}}
Team of hackers. Not the same as [[Chronic Dev (team)|Chronic Dev Team]].

==Projects==
[[redsn0w]]

==Blog==
*[http://wikee.iphwn.org/ iPhone Dev Team Portal
*[http://blog.iphone-dev.org Dev Team blog]

==Current members==
* [[bgm]]
* [[bugout]]
* [[User:Bushing|bushing]]
* [[c1de0x]]
* [[chris]]
* [[User:Comex|comex]]
* [[CPICH]]
* [[ghost_000]]
* [[gray]]
* [[iZsh]]
* [[marcan]]
* [[User:MuscleNerd|MuscleNerd]]
* [[User:Planetbeing|planetbeing]]
* [[pumpkin]]
* [[pytey]]
* [[roxfan]]
* [[saurik]]
* [[Turbo]]
* [[w___]]
* [[wizdaz]]
* [[Zf]]

==Previous Members==
* [[asap18]]
* [[dinopio]]
* [[Fred_]]
* [[jim–]]
* [[netkas]]
* [[pr3d4t0r]]
* [[drudge]]
* [[User:Geohot|geohot]]
* [[gj]]
* [[kroo]]
* [[Nate True]]
* [[User:NerveGas|NerveGas]]
* [[sam]]
* [[Whiterat]]
* [[User:Zibri|Zibri]]

==See also==
* [[25C3 presentation "Hacking the iPhone"#Introduction (by pytey)|Self introduction at the 25C3 event]]
* [[PwnageTool]]
* [[pwnage]]
* [[pwnage 2.0]]
* [[yellowsn0w]]
* [[redsn0w]]
* [[ultrasn0w]]

[[Category:Hackers]]
[[Category:Teams]]

Chronic Dev (team)

2016-09-19T03:41:33Z

IApeiron: added Chronic-Dev Team wiki link

{{DISPLAYTITLE:Chronic Dev Team}}
'''Chronic Dev''' is a team of hackers, including loosely affiliated members and members who are in other teams as well (such as the collaborative effort called the [[Dream Team]]). Their projects have included [[iRecovery|iRecovery (libirecovery)]], [[Greenpois0n (toolkit)|greenpois0n]], and [[GenPass]].

== Official Members ==
*[[User:DHowett|DHowett]]
*[[User:Jaywalker|Jaywalker]]
*[[User:Semaphore|semaphore]]
*[[User:Westbaer|westbaer]]

== Former Members ==
*[[AriX]]
*[[User:ChronicDev|chronic]]
*[[CPICH]]
*[[pod2g]]
*[[User:posixninja|p0sixninja]]

== Associates ==
*[[bugout]]
*[[User:Bushing|bushing]]
*[[c1de0x]]
*[[User:Chpwn|chpwn]]
*[[User:Comex|comex]]
*[[User:Geohot|geohot]]
*[[ius]]
*[[User:Jan0|jan0]]
*[[User:lilstevie|Lilstevie]]
*[[User:MuscleNerd|MuscleNerd]]
*[[User:NerveGas|NerveGas]]
*[[pimskeks]]
*[[User:Planetbeing|planetbeing]]
*[[psp250]]
*[[User:Jan0|jan0]]
*[[User:pumpkin|pumpkin]]
*[[saurik]]

==Links==
*[http://greenpois0n.com/ Greenpois0n Blog]
*[http://chronic-dev.org/blog/ Chronic Dev Blog]
*[https://code.google.com/archive/p/chronicdev/wikis Chronic Dev Wiki]
*[https://github.com/Chronic-Dev GitHub]
*[http://chronicdev.googlecode.com/ Chronic Dev Google Code]
*[http://twitter.com/chronicdevteam Chronic Dev Team on Twitter]
[[Category:Hackers]]
[[Category:Teams]]

0wnboot

2016-09-19T03:35:14Z

IApeiron: added info, payload, and source links

0wnboot is a payload for the [[ARM7 Go]] exploit. The end result is an [[iBoot]] that has permissions, range checks, and signature verifications patched in order to run unsigned code and use several functions of [[iBoot]] that are normally protected.

==Source==
*Source code is available on [http://code.google.com/p/chronicdev/source/browse/trunk/0wnboot/0wnboot.S Google Code]
*chronicdev - [https://code.google.com/archive/p/chronicdev/wikis/0wnboot.wiki 0wnboot.wiki]
*0wnboot [https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/chronicdev/0wnboot.bin payload]
*Old leaked [http://www.se7ensins.com/forums/threads/0wnboot-v0-3-source.66466/ source code]

{{stub|jailbreaking}}
[[Category:Hacking Software]]

Cydia SHSH Server

2016-09-19T03:11:33Z

IApeiron: /* iOS 7 to 10.0.1 update */

[[saurik]] maintains servers that store [[SHSH]] blobs for devices that use Cydia's "on-file" feature. For more details see [[SHSH]] and [[TinyUmbrella]].

Before Cydia 1.1, Cydia included a "Make my life easier" option that, if opted into, would automatically save all available SHSH blobs for your device. As of Cydia 1.1, Cydia assumes your life should be made easier, and it saves any available SHSH blobs for your device automatically every time you open Cydia.

== Usage on iOS 4.x ==
To use this process, Cydia's servers must already have saved SHSH blobs on file for your device for the iOS version you want to restore to.

To use the Cydia server to restore to a firmware no longer being signed by Apple (e.g. 4.0.1), add the following line to [[/etc/hosts]] (Mac OS X/Linux) or C:\Windows\System32\drivers\etc\hosts (Windows XP+):

'''74.208.10.249 gs.apple.com'''

Make sure you open your text editor as an administrator. On OS X, you could use sudo, as in <code>sudo nano /etc/hosts</code>; on Windows you can right click any plain-text editor program such as Notepad and choose "Run as Administrator".

Then go along with the restore process. If the restore fails after "Verifying iPhone restore with Apple" with [[iTunes Errors#Error 3194|iTunes error 3194]] or something similar, you have not set it up correctly or saurik's server doesn't have your [[SHSH]] for that version.

=== How it works ===
It uses the [[wikipedia:hosts|hosts]] file to redirect the Apple firmware server to saurik's. His server has a ECID SHSH database, just like Apple's. When an older firmware request is sent to Apple, it will deny the SHSH request and error out. When it's requested at saurik's, if you've saved it, it finds the SHSH and continues with the restore.

== iOS 5 update ==

This simple replay process no longer works to restore to iOS 5.x. Instead, you have to download your SHSH blobs to your computer, stitch your SHSH blobs into custom firmware, and use that to restore. See the [http://www.jailbreakqa.com/questions/32462/frequently-asked-questions#94647 JailbreakQA guide to restoring to iOS 5.x using SHSH blobs].

== iOS 6 update ==

After [[iOS]] 6.0 - 6.1.2 Cydia-saved [[SHSH]] blobs were found to be corrupted, [[Saurik]] has moved this to a [[TSS Center]]. This now saves SHSH in a different way in order to save them correctly.

== iOS 7 to 10.0.1 update ==

As of September 2016 [[TSS Center]] List API has not been updated to show blobs newer than iOS 6.1.6. However, the Submit API and retrieval features are working correctly for all 32-bit device iOS versions up to and including iOS 10.0.1. A server side update would be required for Cydia to correctly cache [[APTicket|APTickets]] for 64-bit devices. See [[Odysseus]] for information about [[Firmware downgrading|downgrading]] 32-bit devices.

== API ==
There's an API to list and upload [[SHSH]] blobs. No official documentation exists yet, but there are some infos:
*[https://github.com/iH8sn0w/iFaith iFaith 1.2 on GitHub]
*[https://github.com/Neal/savethemblobs/blob/master/savethemblobs.py iNeal's savethemblobs script]
*[https://github.com/iApeiron/savethemblobs savethemblobs with List API removed, Cydia retrieval fixed]

=== List API, for available blobs on Cydia ===
To list all available blobs (up to iOS 6.1.6) on Cydia server, use this command:
<nowiki>http://cydia.saurik.com/tss@home/api/check/$ECID</nowiki>

=== Submit API, to cache blobs on Cydia's server ===
To submit a new blob to Cydia server, use this command:
<nowiki>http://cydia.saurik.com/tss@home/store/$CPID/$BDID/$ECID</nowiki>

== See also ==
*[[Cydia Application]]
*[[TinyUmbrella]]
*[[Odysseus]]
*[[TSS Center]]

Cydia SHSH Server

2016-09-15T06:14:52Z

IApeiron: /* iOS 7 to 10.0.1 update */

[[saurik]] maintains servers that store [[SHSH]] blobs for devices that use Cydia's "on-file" feature. For more details see [[SHSH]] and [[TinyUmbrella]].

Before Cydia 1.1, Cydia included a "Make my life easier" option that, if opted into, would automatically save all available SHSH blobs for your device. As of Cydia 1.1, Cydia assumes your life should be made easier, and it saves any available SHSH blobs for your device automatically every time you open Cydia.

== Usage on iOS 4.x ==
To use this process, Cydia's servers must already have saved SHSH blobs on file for your device for the iOS version you want to restore to.

To use the Cydia server to restore to a firmware no longer being signed by Apple (e.g. 4.0.1), add the following line to [[/etc/hosts]] (Mac OS X/Linux) or C:\Windows\System32\drivers\etc\hosts (Windows XP+):

'''74.208.10.249 gs.apple.com'''

Make sure you open your text editor as an administrator. On OS X, you could use sudo, as in <code>sudo nano /etc/hosts</code>; on Windows you can right click any plain-text editor program such as Notepad and choose "Run as Administrator".

Then go along with the restore process. If the restore fails after "Verifying iPhone restore with Apple" with [[iTunes Errors#Error 3194|iTunes error 3194]] or something similar, you have not set it up correctly or saurik's server doesn't have your [[SHSH]] for that version.

=== How it works ===
It uses the [[wikipedia:hosts|hosts]] file to redirect the Apple firmware server to saurik's. His server has a ECID SHSH database, just like Apple's. When an older firmware request is sent to Apple, it will deny the SHSH request and error out. When it's requested at saurik's, if you've saved it, it finds the SHSH and continues with the restore.

== iOS 5 update ==

This simple replay process no longer works to restore to iOS 5.x. Instead, you have to download your SHSH blobs to your computer, stitch your SHSH blobs into custom firmware, and use that to restore. See the [http://www.jailbreakqa.com/questions/32462/frequently-asked-questions#94647 JailbreakQA guide to restoring to iOS 5.x using SHSH blobs].

== iOS 6 update ==

After [[iOS]] 6.0 - 6.1.2 Cydia-saved [[SHSH]] blobs were found to be corrupted, [[Saurik]] has moved this to a [[TSS Center]]. This now saves SHSH in a different way in order to save them correctly.

== iOS 7 to 10.0.1 update ==

As of September 2016 [[TSS Center]] List API has not been updated to show blobs newer than iOS 6.1.6. However, the Submit API and retrieval features are working correctly for all 32-bit device iOS versions up to and iOS 10.0.1. A server side update would be required to for Cydia to correctly cache [[APTicket|APTickets]] for 64-bit devices. See [[Odysseus]] for information about [[Firmware downgrading|downgrading]] 32-bit devices.

== API ==
There's an API to list and upload [[SHSH]] blobs. No official documentation exists yet, but there are some infos:
*[https://github.com/iH8sn0w/iFaith iFaith 1.2 on GitHub]
*[https://github.com/Neal/savethemblobs/blob/master/savethemblobs.py iNeal's savethemblobs script]
*[https://github.com/iApeiron/savethemblobs savethemblobs with List API removed, Cydia retrieval fixed]

=== List API, for available blobs on Cydia ===
To list all available blobs (up to iOS 6.1.6) on Cydia server, use this command:
<nowiki>http://cydia.saurik.com/tss@home/api/check/$ECID</nowiki>

=== Submit API, to cache blobs on Cydia's server ===
To submit a new blob to Cydia server, use this command:
<nowiki>http://cydia.saurik.com/tss@home/store/$CPID/$BDID/$ECID</nowiki>

== See also ==
*[[Cydia Application]]
*[[TinyUmbrella]]
*[[Odysseus]]
*[[TSS Center]]

Cydia SHSH Server

2016-09-15T06:08:13Z

IApeiron:

[[saurik]] maintains servers that store [[SHSH]] blobs for devices that use Cydia's "on-file" feature. For more details see [[SHSH]] and [[TinyUmbrella]].

Before Cydia 1.1, Cydia included a "Make my life easier" option that, if opted into, would automatically save all available SHSH blobs for your device. As of Cydia 1.1, Cydia assumes your life should be made easier, and it saves any available SHSH blobs for your device automatically every time you open Cydia.

== Usage on iOS 4.x ==
To use this process, Cydia's servers must already have saved SHSH blobs on file for your device for the iOS version you want to restore to.

To use the Cydia server to restore to a firmware no longer being signed by Apple (e.g. 4.0.1), add the following line to [[/etc/hosts]] (Mac OS X/Linux) or C:\Windows\System32\drivers\etc\hosts (Windows XP+):

'''74.208.10.249 gs.apple.com'''

Make sure you open your text editor as an administrator. On OS X, you could use sudo, as in <code>sudo nano /etc/hosts</code>; on Windows you can right click any plain-text editor program such as Notepad and choose "Run as Administrator".

Then go along with the restore process. If the restore fails after "Verifying iPhone restore with Apple" with [[iTunes Errors#Error 3194|iTunes error 3194]] or something similar, you have not set it up correctly or saurik's server doesn't have your [[SHSH]] for that version.

=== How it works ===
It uses the [[wikipedia:hosts|hosts]] file to redirect the Apple firmware server to saurik's. His server has a ECID SHSH database, just like Apple's. When an older firmware request is sent to Apple, it will deny the SHSH request and error out. When it's requested at saurik's, if you've saved it, it finds the SHSH and continues with the restore.

== iOS 5 update ==

This simple replay process no longer works to restore to iOS 5.x. Instead, you have to download your SHSH blobs to your computer, stitch your SHSH blobs into custom firmware, and use that to restore. See the [http://www.jailbreakqa.com/questions/32462/frequently-asked-questions#94647 JailbreakQA guide to restoring to iOS 5.x using SHSH blobs].

== iOS 6 update ==

After [[iOS]] 6.0 - 6.1.2 Cydia-saved [[SHSH]] blobs were found to be corrupted, [[Saurik]] has moved this to a [[TSS Center]]. This now saves SHSH in a different way in order to save them correctly.

== iOS 7 to 10.0.1 update ==

As of September 2016 [[TSS Center]] List API has not been updated to show blobs newer than iOS 6.1.6. However, the Submit API and retrieval features are working correctly for all 32-bit device iOS versions up to and iOS 10.0.1. [[Firmware downgrading]] of 32-bit devices can achieve using the tool [[Odysseus]]. A server side update would be required to for Cydia to correctly cache [[APTicket|APTickets]] for 64-bit devices.

== API ==
There's an API to list and upload [[SHSH]] blobs. No official documentation exists yet, but there are some infos:
*[https://github.com/iH8sn0w/iFaith iFaith 1.2 on GitHub]
*[https://github.com/Neal/savethemblobs/blob/master/savethemblobs.py iNeal's savethemblobs script]
*[https://github.com/iApeiron/savethemblobs savethemblobs with List API removed, Cydia retrieval fixed]

=== List API, for available blobs on Cydia ===
To list all available blobs (up to iOS 6.1.6) on Cydia server, use this command:
<nowiki>http://cydia.saurik.com/tss@home/api/check/$ECID</nowiki>

=== Submit API, to cache blobs on Cydia's server ===
To submit a new blob to Cydia server, use this command:
<nowiki>http://cydia.saurik.com/tss@home/store/$CPID/$BDID/$ECID</nowiki>

== See also ==
*[[Cydia Application]]
*[[TinyUmbrella]]
*[[Odysseus]]
*[[TSS Center]]

TSS Center

2016-09-15T05:27:16Z

IApeiron: updated information about working API

[[File:TSS-Center.png|200px|thumb|right|TSS Center on Cydia.]]
This is the place that saves and stores [[SHSH]] blobs and [[APTicket|APTickets]] from iOS 6. This was introduced when it was discovered that the [[Cydia SHSH Server]] had corrupted [[iOS]] 6.0 - 6.1.2 [[SHSH]] blobs and [[APTicket|APTickets]]. A link to the '''TSS Center''' was onced featured on the [[Cydia.app|Cydia]] homepage, and can still be accessed using the List API:
<nowiki>http://cydia.saurik.com/tss@home/api/check/$ECID</nowiki>
SHSH only show up to (and including) iOS 6.1.6. SHSH blobs newer than this do not show up due to the List API needing updating for this.

TSS stands for [[Tatsu Signing Server]].

{{stub}}