The iPhone Wiki - User contributions [en]

Talk:Cydia SHSH Server

2012-05-31T13:21:13Z

Jacob:

=== Willing? ===
Anybody up for recreating sauriks SHSH server? I wanna do this badly! --[[User:Dylan Laws|Haifisch]] 23:52, 30 May 2012 (MDT)
:Why would you want to do this? His server is working fine and SHSHs are almost useless these days with the [[APTicket]]. --[[User:Http|http]] 00:44, 31 May 2012 (MDT)
::They aren't "useless", just takes more steps to make them useful. (like creating a custom firmware stitched with SHSH. I agree that no one should waste time on creating another SHSH server.--[[User:Jacob|Jacob]] 07:21, 31 May 2012 (MDT)

Unlock

2012-05-24T16:23:55Z

Jacob: MuscleNerd's HITB slides.

This is the process by which the iPhone is modified such that the baseband will accept the [[wikipedia: Subscriber Identity Module|SIM]] card of any GSM carrier. This is entirely different than a [[jailbreak]]. Contrary to popular thought, jailbreaking one's iPhone does not unlock it. A jailbreak is, however, required for all currently public, unofficial software unlocks (see "Official Unlock" below).

==Official Unlock==
[[Image:iTunesUnlock.png|thumb|Unlock in iTunes]]
At +0x400 in the [[seczone]], a token is stored encrypted with (NCK + NORID + HWID). Apple, knowing the [[NCK]], sends it using an [[activation token]] over iTunes. The phone receives an AT+CLCK="PN",0,"......NCK......" It decrypts the token with the generated [[Baseband_TEA_Keys|key]]. If that decryption, after deRSAing with Key 2, is a valid token for the phone, it is stored back to that flash with the token TEA, but not RSA decrypted. On startup, if the lockstate table says the phone is unlocked, it validates that RSA token.

This type of unlock does not require a jailbreak and is permanent, even surviving a restore (unless Apple or your carrier decides to re-lock the phone, something that has rarely happened [https://discussions.apple.com/thread/2779471]).

==Hardware Unlock==
It is not possible to hardware unlock current devices. The only way to mention here would be [[Gevey SIM]], which is actually not a hardware modification.
Back in the days of the original iPhone, it was possible to hardware unlock your iPhone. The instructions were on geohot's blog, which is currently private.

==Old AnySim Patch (1.0.x)==
This deprecated patch disabled signature checks. So the RSA signature would always validate, and the phone would always appear to be unlocked and every NCK would appear to be valid. This patch caused the locktables to be rewritten to the unlocked state which resulted in a cypto failure once the patch was removed during a baseband upgrade, causing the 0049 IMEI issue. The [[virginizer]] was written in response to this problem and allowed users to write locked, virgin locktables. This removed the crypto failure and allowed the application of the ignore MCC/MNC patch.

==New AnySIM Patch (1.1+)==
This patch, also know as the ignore MCC/MNC patch, makes every MCC/MNC pair appear valid. This patch is overwritten on a reflash of the baseband, and doesn't touch the seczone or the locktables at all. It must be reapplied for every baseband upgrade to maintain the unlock.

In addition, AnySIM 1.1 fixed the "Spamming AT" problems from [[iUnlock]] and earlier AnySIM versions.

==[[IPSF]]==
This exploit changed the lockstate table in the [[seczone]] to read unlocked and created a spoofed RSA token that was seen as valid by [[Baseband Bootloader|bootloader]] 3.9 (4.6 was ''not'' vulnerable to IPSF). It overwrote your previous token, which means the phone could nor longer be officially unlocked, unless a restore of the token was performed from a previously made backup. Since the token isn't modified in a baseband flash, this unlock survived a baseband downgrade or upgrade. Apple attempted to combat this by requiring AT+CLCK command to be sent every startup. In a officially unlocked iPhones, lockdownd does this. In a late version IPSF phone, signal.app does this.

== Cloning Officially Unlocked Phones ==
This has been suggested by many people, however it has been well investigated and virtually ruled out for these reasons:
# Replacing the [[Baseband Bootloader|baseband bootloader]] or [[Baseband Firmware|firmware]] of a locked phone with that of an officially unlocked phone does ''not'' unlock the phone, as the unlock information resides in a different flash area, known as the [[seczone]] and is unique to each phone.
# Cloning the [[seczone]] would duplicate [[wikipedia:International Mobile Equipment Identity|IMEIs]] which would be illegal in most places and would likely result in a ban of these.
# Phones with cloned [[seczone]]s would not even be unlocked by the [[NCK]]s of the phone they were cloned from as the [[CHIPID]] and [[NORID]] is concatenated with the [[NCK]] to produce the decryption key used on the RSA [[seczone]] token. The only way to make this work is to change the [[NORID]] and [[CHIPID]] which is not possible.

==Ultrasn0w==
After the S-Gold 2 days, user land exploits are used to unlock the current devices and basebands, which are usually exploit with [[ultrasn0w]], [[yellowsn0w]], [[PurpleSn0w]] or [[Blacksn0w]]. Those Softwares exploited several injunction vectors, such as [[AT+XAPP]], [[AT+XLOG]] or [[AT+XEMN]]

== External Links ==
*[http://caniunlock.com/ English Website from chpwn with overview of unlock status]
*[http://caniunlock.de/ Deutsche Website von pattyland mit einer Übersicht des Unlockstatus's]
*[http://www.slideshare.net/slides_luis/baseband-playground-10652487 "Baseband Playground" a presentation by Luis Miras about all current unlocks]
*[http://conference.hitb.org/hitbsecconf2012ams/materials/D1T2%20-%20MuscleNerd%20-%20Evolution%20of%20iPhone%20Baseband%20and%20Unlocks.pdf Evolution of the iPhone Baseband and unlocks by [[MuscleNerd]] ]

User:Jacob

2012-04-08T06:12:03Z

Jacob: Useless edit

This is my main [http://twitter.com/JacobVengeance Twitter]
==Devices==
[[N81ap|iPod touch 4G]]

Timeline

2012-04-08T05:58:38Z

Jacob: /* January */ Not a new iBooks, just an update to ibooks (though idk why we have this on the wiki)

{{float toc}}
== 2012 ==
=== March ===
* March 7 -- Apple releases iOS 5.1 and announces new devices: [[iPad 3]], [[J33ap|Apple TV 3G]], [[K93aap|iPad2,4?]]
=== January ===
* January 20 -- [[Absinthe]] was released to jailbreak and untether the A5 devices running iOS 5.0 and 5.0.1.
* January 18 -- Apple announces [[iBooks.app|iBooks version 2.0]].

== 2011 ==
=== December ===
* December 30 -- [[User:pod2g|pod2g]]'s untether for iOS 4.4.4 makes its way into a new version of [[Seas0nPass]] for [[k66ap|Apple TV 2G]] owners.
* December 27 -- [[User:pod2g|pod2g]]'s untether for iOS 5.0.1 is released in new versions of [[PwnageTool]] and [[redsn0w]], and as a Cydia package called [[Corona]] (by the [[Chronic Dev (team)|Chronic Dev Team]]) for devices already jailbroken on 5.0.1.
* December 15 -- Apple releases iOS 4.4.4 for the [[k66ap|Apple TV 2G]], as well as a minor update (5.0.1 build 9A406) for the [[n94ap|iPhone 4S]] to address SIM card issues.
* December 4 -- [[iFaith]] 1.4 is released, which can circumvent the APTicket [[nonce]] on devices vulnerable to [[limera1n]]'s exploit.

=== November ===
* November 9 -- iOS 5.0.1 is released in an attempt to fix battery-related issues.
=== October ===
* October 14 -- The [[n94ap|iPhone 4S]] is officially released, although some preorders were delivered early.
* October 12 -- [[iOS]] 5.0 is released.
* October 5 -- Steve Jobs passes away.
* October 4 -- Apple announces the new [[N94ap|iPhone 4S]].
=== September ===
* September 19 -- [[redsn0w]] 0.9.9 beta 1 is released, introducing a new UI and many features (like submitting SHSHs to the [[Cydia Server]].
* September 17 -- [[MyGreatFest]], first iCommunity and jailbreak centered convention was held.
=== July ===
*July 15 -- Apple releases iOS 4.2.9 and 4.3.4, patching all jailbreaking-related vulnerabilities (aside from those in the [[bootrom]]).
*July 6 -- [[User:Comex|comex]] releases [[Saffron]], the first public jailbreak for the [[iPad 2]].
*July 2 -- A beta version of the upcoming jailbreak from [[User:comex|comex]] for the [[iPad 2]], making use of a PDF exploit, was leaked. A hotfix by Apple is expected very soon.
=== June ===
*June 1 -- [[User:ih8sn0w|iH8sn0w]] releases [[iFaith]] to dump SHSH blobs from a device.
=== May ===
*May 6 -- [[PwnageTool]], [[redsn0w]], and [[sn0wbreeze]] are updated for iOS 4.3.3 support (and in the case of sn0wbreeze, iOS 4.2.8 support as well).
*May 3 -- Apple releases iOS 4.2.8 and 4.3.3 to address the location-tracking controversy. Once more, current untethering vulnerabilities remained unpatched.
=== April ===
*April 24 -- [[PwnageTool]], [[redsn0w]], and [[sn0wbreeze]] are updated for iOS 4.3.2 support (and in the case of sn0wbreeze, iOS 4.2.7 support as well).
*April 14 -- Apple releases iOS 4.2.7 and 4.3.2 to fix security issues and connection issues for [[K95ap|iPad 2 CDMA model]], but leaves untethering vulnerabilities unpatched.
*April 3 -- All major jailbreak tools ([[redsn0w]], [[PwnageTool]], [[sn0wbreeze]]) get updated to includes [[i0n1c]]'s untether code to jailbreak devices compatible with iOS 4.3.1 except the [[iPad 2]].
=== March ===
*March 25 -- Apple releases iOS 4.3.1, properly blocking [[User:comex|comex]]'s [[IOSurface Kernel Exploit|exploit]].
*March 13 -- [[User:Comex|comex]] shows a remotely jailbroken [[K95ap|iPad 2 CDMA]].
*March 11 -- Release of the [[iPad 2]] in the USA. The exploits for [[limera1n]] ([[User:Geohot|geohot]]), [[SHA-1 Image Segment Overflow|SHAtter]] ([[User:posixninja|p0sixninja]]), and [[comex]]'s [[kernel]] exploit were closed by Apple.
*March 9 -- Apple releases iOS 4.3, fixing the [[HFS Legacy Volume Name Stack Buffer Overflow]] vulnerability.
=== February ===
*February 15 -- New version of both [[PwnageTool]] and [[sn0wbreeze]] were released to support 4.2.1 and untethered using the [[feedface]] exploit.
*February 7 -- The [[Chronic Dev (team)|Chronic Dev Team]] release a version of [[greenpois0n (jailbreak)|greenpois0n]] to jailbreak the [[N92ap|iPhone 4 CDMA model]] using the [[HFS Legacy Volume Name Stack Buffer Overflow]].
*February 3 -- [[User:Jaywalker|Jaywalker]] of the [[Chronic Dev (team)|Chronic Dev Team]] posts [https://www.youtube.com/watch?v=T3NYPVT13xw a video] of custom boot using a soon to be released version of [[Greenpois0n (jailbreak)|greenpois0n]].
=== January ===
*January 12 -- Apple discontinues iOS support for [[N82ap|iPhone 3G]] and [[N72ap|iPod touch 2G]] since today's beta release of iOS 4.3. Also first time a beta iOS for [[K66ap|Apple TV 2G]] is released.
*January 11 -- Verizon announces [[N92ap|CDMA version of iPhone 4]].

== 2010 ==
=== November ===
*November 28 -- [[ultrasn0w]] 1.2 is released by the [[iPhone Dev Team]] to unlock [[N82ap|iPhone 3G]] and [[N88ap|iPhone 3GS]] on baseband 6.15.00
*November 22 -- Apple releases iOS 4.2.1 (respectively 4.2 for [[K66ap|Apple TV 2G]])
===October===
*October 31 -- The [[iPhone Dev Team|Dev Team]] releases [[redsn0w]] 0.9.6b2 which jailbreaks iOS 4.1, 4.2 and 3.2.2 on every device available at the time of release (except for iPT 2G MC). It also includes "DFU" button allowing to flash custom [[IPSW]] from Windows [http://blog.iphone-dev.org/post/1452044444/redsn0w-limera1n-fun (see blog post)].
*October 20 -- The [[iPhone Dev Team|Dev Team]] releases [[PwnageTool]] 4.1 which jailbreaks iOS 4.1 and 3.2.2 on every device available at the time of release. [http://blog.iphone-dev.org/post/1359246784/20102010-event (see blog post)]
*October 18 -- [[Chronic Dev (team)|Chronic Dev Team]] releases [[Greenpois0n (jailbreak)|greenpois0n]] RC4 which added support for iPod touch 2G (MC and MB) for an untethered jailbreak using [[User:comex|comex]]'s kernel exploit and the [[usb_control_msg(0xA1, 1) Exploit]].
*October 12 -- [[Chronic Dev (team)|Chronic Dev Team]] releases [[Greenpois0n (jailbreak)|greenpois0n]] after switching its exploit from [[SHA-1 Image Segment Overflow|SHAtter]] to [[limera1n]], in the hope that [[SHA-1 Image Segment Overflow|SHAtter]] remains for 5th generation devices. (The exploit [[limera1n]] uses was fixed in the [[iBoot (Bootloader)|iBoot]] revision found in iOS 4.2 beta 2, which means Apple knows about the vulnerability and the next [[bootrom]] revision may have it patched.)
*October 10 -- Following the first [[limera1n]] beta release, [[User:geohot|geohot]] released multiple versions, each fixing bugs affecting previous releases. [[Chronic Dev (team)|Chronic Dev Team]] officialy anounces that, in order to keep [[SHA-1 Image Segment Overflow|SHAtter]] undisclosed and possibly preserve it for 5th generation devices, [[Greenpois0n (jailbreak)|greenpois0n]] would be delayed in order to incorporate this new exploit [[limera1n]] uses.
*October 9 -- In order to push [[Chronic Dev (team)|Chronic Dev Team]] to change the exploit used on [[Greenpois0n (jailbreak)|greenpois0n]], [[User:geohot|geohot]] rushed out a beta version of [[limera1n]].
*October 8 -- [[User:Geohot|Geohot]] comes back to the scene with a new [[bootrom]] exploit believed to work on all devices, as shown on the resurrected [http://www.limera1n.com limera1n web site]. He prompts [[Chronic_Dev_(team)|Chronic Dev Team]] to use his exploit instead of [[SHA-1 Image Segment Overflow|SHAtter]], but, since [[Greenpois0n (jailbreak)|greenpois0n]] is already scheduled to October 10, it may be not possible. [[User:Geohot|Geohot]] ETA'd his [[limera1n]] release to October 11, if [[Greenpois0n (jailbreak)|greenpois0n]] can't be changed to use this new exploit. This decision, however, would burn 2 [[bootrom]] exploits: [[SHA-1 Image Segment Overflow|SHAtter]] itself and the one used by [[limera1n]], which is unpatchable by firmware updates.
*October 6 -- Chronic Dev Team issues expected ETA of [[Greenpois0n (jailbreak)|greenpois0n]] as October 10, featuring the new [[SHA-1 Image Segment Overflow|SHAtter]] exploit for devices with the [[S5L8930]].

===September===
*September 30 -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] posts [http://www.youtube.com/watch?v=adVp-IxcDHI the first video] of an [[K66ap|Apple TV 2G]] jailbroken via [[SHA-1 Image Segment Overflow|SHAtter]].
*September 27 -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] posts [http://www.youtube.com/watch?v=aoX1Q8ym2J8 the first video] of an [[N81ap|iPod touch 4G]] jailbroken via [[SHA-1 Image Segment Overflow|SHAtter]].
*September 20 -- [[User:pod2g|pod2g]] discloses details about the [[usb_control_msg(0xA1, 1) Exploit‎]] here at The iPhone Wiki. It was used in [[redsn0w]] the following day.
*September 9 -- The existence of [[SHA-1 Image Segment Overflow|SHAtter]] is revealed. Further details were not released, however.
*September 8 -- Apple releases the [[N81ap|iPod touch 4G]], and iOS 4.1, closing the [[AT+XAPP Vulnerability]].
*September 1 -- Apple event. They announced the new [[N81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]], iOS 4.1, and [[iTunes]] 10.

===August===
*August 12 -- [[Saurik]] releases the first version of PDF Patcher, which installs Apple's patch for the FreeType vulnerability (used in conjunction with other exploits by [[Star]]). It works on firmwares as far back as 2.x, and renders iOS 3.2.2 and 4.0.2 useless for jailbreakers. Jailbreaking and installing this patch is currently the only way for users of first generation iPod touches and iPhones to protect themselves against malicious use of the exploit.
*August 11 -- Apple releases iOS 4.0.2 for [[iPhone]]/[[iPod touch]] and iOS 3.2.2 for [[K48ap|iPad]] as a hotfix for [[Star]]'s exploits. [[Ultrasn0w]]'s exploit remains, since there's no [[Baseband Firmware|baseband]] update on those versions.
*August 3 -- Just before midnight in [[User:planetbeing|planetbeing]]'s timezone [[ultrasn0w]] has been released by the [[iPhone Dev Team]] to [[unlock]] the [[N90ap|iPhone 4]].
*August 1 -- [[User:Comex|comex]] releases [[Star]], a [[jailbreak]] for all iDevices with iOS 3.1.2 through 4.0.1.

===July===
*July 30 -- [[N90ap|iPhone 4]] is released in major countries (second wave).
*July 26 -- Jailbreaking is now officially legal in the U.S.A.: [http://www.eff.org/press/archives/2010/07/26 EFF Wins New Legal Protections for Cell Phone Jailbreakers and Unlockers]
*July 15 -- Apple releases iOS 3.2.1 and 4.0.1.

===June===
*June 24 -- [[N90ap|iPhone 4]] is launched.
*June 22 -- [[iPhone Dev Team]] releases [[PwnageTool]] 4.0 and later 4.0.1 for all devices on 4.0 except those with newer bootroms (some [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] devices, and all [[N18ap|iPod touch 3G]] and newer devices).
*June 21 -- [[iPhone Dev Team]] releases [[redsn0w]] 0.9.5 to jailbreak 4.0 on [[N82ap|iPhone 3G]] and [[N72ap|iPhone touch 2G]] ([[Bootrom 240.4|old bootrom]]).
*June 21 -- [[iPhone Dev Team]] releases [[ultrasn0w]] 0.93, an unlock for baseband firmwares [[4.26.08]], [[5.11.07]], [[5.12.01]], and [[5.13.04]].
*June 21 -- Apple releases iOS 4.0
*June 19 -- [[User:Geohot|geohot]] holds a speech at the [[Nuit du hack 2010|Nuit du Hack]]

===May===
*May 3 -- Windows version of [[Spirit]] has been updated to not require Windows 98 compatibility mode to run and fixed a photo deletion issue.
*May 2 -- [[User:Comex|comex]] releases [[Spirit]], an [[untethered jailbreak]] for all iDevices with iOS 3.1.2 through 3.2.

===April===
*April 3 -- Apple releases the [[K48ap|iPad]].

===Feb===
*Feb 12 -- [[User:sherif hashim|sherif_hashim]] discovers [[AT+XAPP Vulnerability]] and passes it to [[User:MuscleNerd|MuscleNerd]], an elite member of the [[iPhone Dev Team]]
*Feb 2 -- Apple releases iOS 3.1.3, closing [[usb_control_msg(0x21, 2) Exploit|usb_control_msg(0x21, 2)]] vulnerability used by [[blackra1n]], [[redsn0w]], et. al.

==2009==
===November===
*November 3 -- [[User:Geohot|geohot]] releases [[blackra1n]] RC3, a software jailbreak for all devices. Includes a new unlock for baseband [[5.11.07]] called [[blacksn0w]] and is also noticeably faster than previous versions.

===October===
*October 11 -- [[User:Geohot|geohot]] releases [[blackra1n]] RC1, a 30 second software jailbreak for all devices, including a [[tethered jailbreak]] for the [[N18ap|iPod touch 3G]], and [[N88ap|iPhone 3GS]] and [[N72ap|iPod touch 2G]] units with newer bootrom revisions.

===September===
* September 24 -- [[User:iH8sn0w|iH8sn0w]] discovers the [[AT+XEMN Heap Overflow|AT+XEMN]] crash independently.
* September 9 -- The [[N18ap|iPod touch 3G]] with [[S5L8922]] processor is released. [[N72ap|iPod touch 2G]] units continue shipping, but with [[Bootrom 240.5.1|a new bootrom]]. [[N88ap|iPhone 3GS]] units also begin shipping with [[Bootrom 359.3.2|a new bootrom]]. These are no longer vulnerable to the [[0x24000 Segment Overflow]].
* Apple releases iOS 3.1/3.1.1 (7C144/7C145), closing the [[iBoot Environment Variable Overflow]] and [[AT+XLOG Vulnerability|AT+XLOG]] + [[AT+FNS]] Baseband Exploits.

===July===
* July 14 -- [[User:Geohot|geohot]] releases [[purplesn0w]], a software unlock for the [[X-Gold 608]] using [[AT+XLOG Vulnerability|the same exploit as ultrasn0w]], but handled differently. Minutes later, an explanation and source code was posted.
* July 7 -- The [[iPhone Dev Team]] updates [[redsn0w]] and [[ultrasn0w]] to version 0.8, now with [[N88ap|iPhone 3GS]] support. Saurik also updates [[WinterBoard]] to support the [[N88ap|iPhone 3GS]].
* July 3 -- [[User:Geohot|geohot]] releases [[purplera1n]], a software jailbreak for the [[N88ap|iPhone 3GS]].

===June===
* June 28 -- [[User:Geohot|geohot]] posts pictures on his blog of the first fully jailbroken [[N88ap|iPhone 3GS]].
* June 25 -- It's discovered that [[N88ap|iPhone 3GS]] is vulnerable to the [[0x24000 Segment Overflow]].
* June 24 -- The [[iPhone Dev Team]] releases [[ultrasn0w]], an [[unlock]] for [[X-Gold 608]] thanks to [[AT+XLOG Vulnerability|a new exploit]] discovered by [[User:Oranav|Oranav]].
* June 23 -- [[User:Geohot|geohot]] announces he's found a new exploit in [[iBoot (Bootloader)|iBoot]] he calls [[purplera1n]].
* June 19 -- Release of [[N88ap|iPhone 3GS]] to the public and the release of [[PwnageTool]] 3.0 and [[redsn0w]] for jailbreaking devices running iOS 3.0
* June 17 -- Apple releases iOS 3.0.
* June 8 -- Apple announces the [[N88ap|iPhone 3GS]].

===March===
* March 10 -- Information about the [[0x24000 Segment Overflow]] exploit used for the [[N72ap|iPod touch 2G]] [[untethered jailbreak]] is released thanks to the combined work of [[chronic]], [[CPICH]], [[User:Posixninja|posixninja]], [[User:Pod2g|pod2g]], [[ius]], [[planetbeing]], [[User:MuscleNerd|MuscleNerd]], and co. after being leaked and sold by [[NitroKey]]. To prevent users wasting their money on a stolen exploit, the Hybrid DevTeam decided to release it immediately.

===January===
* January 31 -- The [[iPhone Dev Team]] released [[redsn0w Lite]], a [[tethered jailbreak|tethered]] [[N72ap|iPod touch 2G]] [[jailbreak]]. It combines the [[ARM7 Go]] vulnerability with the well-established [[pwnage]] flow for other Apple mobile devices. It was bundled in a way that allowed usage on iOS 2.2.1 by uploading [[iBoot (Bootloader)|iBoot]] from iOS 2.1.1, which is vulnerable to [[ARM7 Go]], to the device while in [[DFU Mode]].
* January 29 -- Apple releases iOS 2.2.1, closing the [[AT+stkprof]] exploit.
* January 25 -- [[0wnboot]] is released to [http://code.google.com/p/chronicdev/ chronicdev google code page], thanks to [[AriX]], [[User:ChronicDev|chronic]], [[CPICH]], [[westbaer]], [[ius]], [[User:Pod2g|pod2g]], the rest of the iPod devel crew on IRC, and to the #iphone-hax lab rats. Within days, [[AriX]] and the [[Chronic Dev (team)|Chronic Dev Team]] got a ramdisk booting for a [[tethered jailbreak]].
* January 17 -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] [https://twitter.com/MuscleNerd/status/1127346766 shows a video demo] of the first jailbroken [[N72ap|iPod touch 2G]].
* January 16 -- [[ARM7 Go]] vulnerability disclosed where else but here on The iPhone Wiki, for developers to poke and prod at.
* January 15 -- The [[iPhone Dev Team]] [https://twitter.com/iphone_dev/status/1120595069 tweets the VFDecrypt key] for iOS 2.2 on [[N72ap|iPod touch 2G]], demonstrating for the first time that unsigned code can now be run on that device.
* January 1 -- The [[iPhone Dev Team]] releases [[yellowsn0w]] 0.9 beta for baseband [[2.28.00]].

==2008==
===December===
* December 27 -- [[25C3 presentation "Hacking the iPhone"]]
* December 21 -- [[User:MuscleNerd|MuscleNerd]], of the [[iPhone Dev Team]] does a live demo of the 3G unlock, dubbed as [[yellowsn0w]]: http://qik.com/video/729275

===November===
* November 21 -- Apple releases iOS 2.2.

===September===
* September 9 -- Apple releases iOS 2.1. [[N72ap|iPod touch 2G]], which no longer had the [[Pwnage 2.0]] exploit, is revealed.

===August===
* August 18 -- Apple releases 2.0.2 fimware. [[iPhone Dev Team]] releases [http://wikee.iphwn.org/news:pwnage20announcement QuickPwn], a 2.x [[pwnage]]/ramdisk combination exploit that allows jailbreaking without needing to create custom IPSWs.
* August 4 -- Apple releases 2.0.1 fimware

===July===
* July 22 -- [[TA_Mobile]] hardware dumps the 3G baseband (bootloader 5.8 & FW 1.45.00) by desoldering the [[NOR]].
* July 19 -- [[iPhone Dev Team]] releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the [[M68ap|iPhone 2G]] and jailbreaking iOS 2.0 on the [[N82ap|iPhone 3G]] and [[N45ap|iPod touch]].
* July 15 -- Apple releases iOS 1.1.5, the last of the 1.x firmwares
* July 11 -- [[N82ap|iPhone 3G]] is released. Apple releases iOS 2.0 and MobileMe on the same date, resulting in server issues.

===June===
* June 9 - [[N82ap|iPhone 3G]] is announced at [[WWDC]] '08.

===April===
* April 3 -- [[iPhone Dev Team]] releases [[PwnageTool]] 1.0, making use of the [[pmdx exploit]] (to patch RSA checks out of the [[kernel]], to write unsigned to [[NOR]])

===March===
* March 12 -- [[iPhone Dev Team|Dev team]] releases dual-boot jailbreak method, only to be silently fixed in 2.0.
* March 4 -- [[User:N000b|George Zhu (n000b)]] releases [[iLiberty / iLiberty+]].

===February===
* February 28 -- [[Cydia Application|Cydia]] is released as an open-source alternative to [[Installer.app]], and prepares to take over the jailbreak application scene upon 2.0's release.
* February 26 -- Apple releases iOS 1.1.4.
* February 11 -- [[User:Zibri|Zibri]] leaks the [[Ramdisk Hack]] in [[ZiPhone]], the first all-in-one unlock, activate, jailbreak solution.
* February 8 -- [[User:Geohot|geohot]] releases software unlock for 4.6. Apple states 25% of phones were never activated with AT&T.

===January===
* January 28 -- [[iPhone Dev Team]] releases [[Soft Upgrade]] jailbreak for 1.1.3.
* January 24 -- [[Nate True]] releases a version of [[iBrickr]] that used the [[Soft Upgrade]] method to jailbreak 1.1.3 for [[M68ap|iPhones]].
* January 18 -- [[User:Geohot|Geohot]] and his friends [http://iphonejtag.blogspot.com/2008/01/112-otb-unlocked.html unlocked 1.1.2 OTB 4.6 by test point], the unbeatable version at that time.
* January 18 -- [[iPhone Dev Team]] posts YouTube video of a jailbroken 1.1.3, which was made possible by the dual boot jailbreak from [[bgm]].
* January 15 -- Apple releases iOS 1.1.3, closing the [[Mknod]] exploit. In addition, everything now runs as "mobile" instead of "root."

== 2007 ==
===November===
* November 15 -- [[Baseband Bootloader|Baseband bootloader]] 4.6 is found on new [[M68ap|iPhone]]s, which initially had no [[unlock]].
* November 12 -- Apple releases iOS 1.1.2, closing the [[LibTiff]] and [[Symlinks]] exploits.
* November 2 -- [[JailbreakMe|AppSnapp]] is released, bringing jailbreaking to the mainstream iPhone user.

===October===
* October 23 -- iPhone-Elite Team releases the [[Virginizer]].
* October 14 -- [[User:AriX|AriX]] releases iJailBreak, the first automated [[n45ap|iPod touch]] jailbreak for the Mac.
* October 12 -- [[User:planetbeing|planetbeing]] releases [[touchFree]], the first automated [[N45ap|iPod touch]] jailbreak.
* October 10 -- [[cmw]] (aka Niacin) and Dre release the LibTiff exploit to jailbreak the [[N45ap|iPod touch]], which is later adapted for use in [[JailbreakMe|AppSnapp]].

===September===
* September 27 -- Apple releases iOS 1.1.1.
* September 11 -- [[iPhone Dev Team]] releases [[iUnlock]], first free software unlock.
* September 10 -- [[IPSF]] releases first paid software unlock.
* September 9 -- Apple announces the [[N45ap|iPod touch]] at a media event.

===August===
* August 23 -- [[User:Geohot|geohot]] and team release [[hardware unlock]] method.
* August 21 -- [[Installer.app]] is released by Nullriver, first GUI apps are distributed.

===July===
* July 23 -- First phones are used with other carriers by means of [[SIM hacks]].
* July 20 -- nightwatch adapts a [[toolchain]] to the iPhone. The first apps are compiled.
* July 9 -- [[iPhone Dev Team]] releases a [[jailbreak]] method. The first use of this is ringtones.
* July 3 -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription.

===June===
* June 29 -- [[M68ap|iPhone]] is released. World's most hyped consumer product.
* June 26 -- The [[iPhone Dev Team]] was formed.

Cydia.app

2012-04-08T05:56:24Z

Jacob: /* Latest Version */ Might need to double check iPhone 2G version, sources might have had an issue preventing from showing updates.

{{float toc|left}}
== Summary ==
[[Image:Cydia.png|thumb|The icon for Cydia]]
Cydia is an open source application installer created by [[Saurik]] that uses the Debian APT system for package management. It is included with all [[iPhone Dev Team]] [[jailbreak]]s, and is found in every mainstream jailbreak tool (e.g [[redsn0w]], [[limera1n]], [[blackra1n]], [[PwnageTool]], [[sn0wbreeze]], [[greenpois0n (jailbreak)|greenpois0n]], [[Spirit]], [[Star]]) since iOS 2.0.
However, some jailbreak tools install lighter apps (such as [[Loader.app]] ([[greenpois0n (jailbreak)|greenpois0n]]) or [[blackra1n.app]] ([[blackra1n]] and [[limera1n]])) to download and install Cydia directly on the device, instead of having it installed at the same time as jailbreaking, making for a lighter download and jailbreak.

=== Latest Version ===
* 1.1.6 for [[N88ap|iPhone 3GS]], [[N18ap|iPod touch 3G]], [[K48ap|iPad]], [[N90ap|iPhone 4 GSM]], [[N81ap|iPod touch 4]], [[N92ap|iPhone 4 CDMA]]
* 1.1.6 for [[iPad 2]], [[N94ap|iPhone 4S]]
* 1.1.3 for [[M68ap|iPhone]], [[N45ap|iPod touch]], [[N82ap|iPhone 3G]] (S5L8900 devices)
* 1.1.6 for [[N72ap|iPod touch 2G]]
* There is no version for [[K66ap|Apple TV 2G]].

=== Installed Packages ===
With the [[Absinthe]] jailbreak, the following packages are installed by default with Cydia:
* APR (/usr/lib)
* APT 0.7 (apt-key)
* APT 0.7 Strict (lib)
* Base Structure
* Big Boss Icon Set
* Bourne-Again SHell
* bzip2
* Core Utilities (/bin)
* Corona 5.0.1 Untether
* Cydia Installer
* Cydia Translations
* Darwin Tools
* Debian Packager
* Debian Utilities
* Diff Utilities
* Find Utilities
* GNU Privacy Guard
* grep
* gzip
* LZMA Utils
* New Curses
* PAM (Apple)
* PAM Modules
* pcre
* Profile Directory
* readline
* sed
* shell-cmds
* system-cmds
* Tape Archive
* UI Kit Tools

=== See Also ===
* [http://svn.saurik.com/repos/menes/trunk/cydia/readme.txt Source code]
* [[Cydia Server]]
* [[:/|(Root)]]/[[/Applications|Applications]]

[[Category:Software]]

Talk:UDID

2012-03-18T20:50:51Z

Jacob:

Isn't the serial 12 characters long? --[[User:Rdqronos|rdqronos]] 18:14, 17 March 2012 (MDT)
:Yes. Actually looking at my old iPod and new one. The old device are 11 characters and the new are 12. I don't know when it started since I only own iPod touch 2G and 4G. --[[User:Jacob|Jacob]] 18:58, 17 March 2012 (MDT)
:So then how does one calculate the hash? I tried it with the Serial+ECID+MAC+Bluetooth MAC SHA1 calculation and it was completely different... maybe someone should update this... --[[User:Rdqronos|rdqronos]] 20:54, 17 March 2012 (MDT)
::I can confirm it's not working. I tried with ECID in both upper/lower case, with/without leading zeroes, even in decimal. --[[User:Http|http]] 07:46, 18 March 2012 (MDT)
:::What about with first 11 digits of the serial? --[[User:Jacob|Jacob]] 14:50, 18 March 2012 (MDT)
::I can confirm that it is working at least on my iPad 2 and my iPhone 4 --[[User:Rud0lf77|rud0lf77]] 12:15, 18 March 2012 (MDT)

Talk:UDID

2012-03-18T01:01:58Z

Jacob:

Talk:UDID

2012-03-18T00:58:24Z

Jacob:

Isn't the serial 12 characters long? --[[User:Rdqronos|rdqronos]] 18:14, 17 March 2012 (MDT)
:Yes --[[User:Jacob|Jacob]] 18:58, 17 March 2012 (MDT)

Kdebug

2012-03-17T21:40:04Z

Jacob: linked to kdebug header

{{lowercase}}
'''kdebug''' is a XNU built-in debugging facility, which has been around OS X from its early days, and is present - to varying extents - in iOS. In OS X, sc_usage(1), fs_usage(1) and latency(1) make use of it. The facility can be enabled and controlled via sysctl(2) calls, similar to the following code.

#define KDEBUG_ENABLE_TRACE 0x1
#define KDEBUG_ENABLE_ENTROPY 0x2
#define KDEBUG_ENABLE_CHUD 0x4

// N.B - must SETBUF before facility can be enabled.

int mib[4];
mib[0] = CTL_KERN;
mib[1] = KERN_KDEBUG;
mib[2] = KERN_KDENABLE; /* or a host of other codes from kdebug.h */
mib[3] = /* One of above values, 0 disables */;

if (sysctl(mib, 4, NULL, &needed, NULL, 0) < 0)
{
perror("sysctl, KERN_KDENABLE\n");
}

kdebug's most useful feature is to enable kernel-level tracing, but can also be enabled for entropy collection (i.e. /dev/random like behavior), among other things. The CHUD (Computer Hardware Understanding) interfaces are very powerful, though woefully poorly documented, and private to Apple (and probably deserve a future Wiki entry on their own). They likely exist in iOS4, though a sysctl to enable them in iOS 5 fails.

The user mode header, <sys/kdebug.h> is partial, at best. A complete header can be found in the [http://www.opensource.apple.com/source/xnu/xnu-1699.24.23/bsd/sys/kdebug.h XNU source code].

In OS X, most of the kdebug functionality can be met (and exceeded) by DTrace. This is not an option with iOS, which does not have DTrace. The kdebug facility, however, is supported. iOS 5.01 has been verified to support it to a similar extent as OS X, including clean compilation and execution of sc_usage(1). The same cannot be said for iOS 4, wherein the binaries compile, but do not execute properly.

Talk:Main Page

2012-03-08T01:09:16Z

Jacob: /* Firmware */

{{Talk Archive|2010|2011|2012}}

== [[iPhone Tracker]] ==
[[iPhone Tracker]]? --[[User:5urd|5urd]] 11:34, 9 September 2011 (MDT)

== Apple TV 3 ==
As I am told, it is Apple TV 3G. Just because the blogs use "iPod Touch 4," that doesnt mean we use that. --[[User:5urd|5urd]] 17:30, 7 March 2012 (MST)

== Firmware ==

How is iOS 5.1 for iPhone 3GS Jailbreakable untethered for old bootrom and tethered for new bootrom when the holes were patched(from what I understand) and on the main page it shows there is no jailbreak for everything else. I'm confused here
:I am going to try and answer though it is hard to tell what you are asking by your grammar. Those are bootrom exploits, which cannot be patched by any firmware update. There isn't a jailbreak available though, they have to update the programs like redsn0w to work with the new version of iOS. Once it is updated the jailbreak will be untethered for old bootroms and tethered for the new ones (excluding 4S and iPads since there isn't any bootrom exploits for those). Modern jailbreaks require userland exploits to be untethered, but iOS 5.1 patched the vulnerabilities we have been using to get untethered. Hope that helps. --[[User:Jacob|Jacob]] 18:09, 7 March 2012 (MST)

Keynote

2012-03-08T01:02:08Z

Jacob: /* 2011 */ 2012

== 2007 ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed;" border="1"
|-
! Event
! Key Points
! Date
! Edgesuite.net Page
! Apple.com Page
! Streaming URL(s)
! Audio-Only URL
! Video Podcast URL
|-
| Macworld 2007
| [[m68ap|iPhone]] introduction.
| January 9, 2007
| [http://events.apple.com.edgesuite.net/j47d52oo/event/index.html Broken]
| [http://www.apple.com/quicktime/qtv/mwsf07/ Defunct]
| [http://stream.qtv.apple.com/events/jan/j47d52oo/m_8848125_650_ref.mov]
[http://stream.qtv.apple.com/events/jan/j47d52oo/m_sub8848125_650_ref.mov iPhone Intro Only]
| N/A
| [http://movies.apple.com/movies/us/podcast/apple_keynotes/MacworldSFKeynote2007.m4v Defunct]
[http://itstreaming.apple.com/podcasts/apple_keynotes/1_macworld2007.m4v]
|-
| WWDC 2007
| Web 2.0 app development for iPhone.
| June 11, 2007
| [http://events.apple.com.edgesuite.net/d7625zs/event/index.html Partially Broken]
| [http://www.apple.com/quicktime/qtv/wwdc07/ Defunct]
| [http://stream.qtv.apple.com/events/jun/d7625zs/m_99427722_650_ref.mov]
| [http://stream.qtv.apple.com/events/jun/d7625zs/m_99427722_audio_ref.mov Deleted]
| N/A
|-
| "The beat goes on."
| iOS 1.1(.1) & [[n45ap|iPod touch]] introduction.
| September 5, 2007
| [http://events.apple.com.edgesuite.net/s83522y/event/index.html Partially Broken]
| [http://www.apple.com/quicktime/qtv/specialevent0907/ Defunct]
| [http://stream.qtv.apple.com/events/sep/s83522y/m_63827621b_350_ref.mov Lower Quality]
[http://stream.qtv.apple.com/events/sep/s83522y/m_63827621b_650_ref.mov Better Quality]
| [http://stream.qtv.apple.com/events/sep/s83522y/63827621b_audio_ref.mov]
| N/A
|}

== 2008 ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed;" border="1"
|-
! Event
! Key Points
! Date
! Edgesuite.net Page
! Apple.com Page
! Streaming URL(s)
! HD Stream URL
! Audio-Only URL
! Video Podcast URL
! Special Notes
|-
| Macworld 2008
| iOS 1.1.3 introduction.
| January 15, 2008
| [http://events.apple.com.edgesuite.net/f27853y2/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/mwsf08/ Defunct]
| [http://stream.qtv.apple.com/events/jan/f27853y2/m_972345688g_350_ref.mov Lower Quality]
[http://stream.qtv.apple.com/events/jan/f27853y2/m_972345688g_650_ref.mov Better Quality]
| [http://stream.qtv.apple.com/events/jan/f27853y2/972345688g_1200_ref.mov]
[http://stream.qtv.apple.com/events/jan/f27853y2/mw2008_hd.qtl System requirements]
| N/A
| [http://movies.apple.com/movies/us/podcast/apple_keynotes/macworld2008keynote.mov Defunct]
[http://itstreaming.apple.com/podcasts/apple_keynotes/2_macworld2008.mov]
| [http://stream.qtv.apple.com/events/jan/f27853y2/sysrec.mov System requirements for HD stream]
[http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=272082409 Defunct podcast URL]
|-
| iPhone SDK Roadmap
| iPhone SDK introduction.
| March 6, 2008
| [http://events.apple.com.edgesuite.net/rtp20e92/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/iphoneroadmap/ Defunct]
| [http://stream.qtv.apple.com/events/mar/rtp20e92/m_08770365506i_650_ref.mov]
| [http://stream.qtv.apple.com/events/mar/rtp20e92/m_08770365506i_1200_ref.mov]
| N/A
| [http://movies.apple.com/movies/us/podcast/iphoneroadmap/march_2008_IPOD.m4v Defunct]
[http://itstreaming.apple.com/podcasts/apple_keynotes/3_iphone_software.m4v]
|
|-
| WWDC 2008
| [[n82ap|iPhone 3G]] introduction.
| June 9, 2008
| [http://events.apple.com.edgesuite.net/0806wdt546x/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/wwdc08/ Defunct]
| [http://stream.qtv.apple.com/events/jun/0806wdt546x/m_080690210abcn_650_ref.mov]
| [http://stream.qtv.apple.com/events/jun/0806wdt546x/m_080690210abcn_1200_ref.mov]
| [http://stream.qtv.apple.com/events/mar/rtp20e92/08770365506i_audio_ref.mov]
| [http://movies.apple.com/movies/us/podcast/apple_keynotes/wwdc2008.m4v Defunct]
[http://itstreaming.apple.com/podcasts/apple_keynotes/4_wwdc2008.m4v]
|
|-
| Let's Rock
| iOS 2.1 and [[n72ap|iPod touch 2G]] introduction.
| September 9, 2008
| [http://events.apple.com.edgesuite.net/0809dt4bs89/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/letsrock/ Defunct]
| [http://stream.qtv.apple.com/events/sep/0809dt4bs89/m_08091776wrvx_650_ref.mov]
| [http://stream.qtv.apple.com/events/sep/0809dt4bs89/m_08091776wrvx_1200_ref.mov]
| [http://stream.qtv.apple.com/events/sep/0809dt4bs89/m_08091776wrvx_audio_ref.mov Defunct]
| [http://movies.apple.com/movies/us/podcasts/apple_keynotes/sj-keynote-20080909.m4v Defunct]
[http://itstreaming.apple.com/podcasts/apple_keynotes/5_september2008.m4v]
|
|}

== 2009 ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed;" border="1"
|-
! Event
! Date
! Edgesuite.net Page
! Apple.com Page
! Streaming URL(s)
! HD Stream URL
! iPhone Stream URL
! Audio-Only URL
! Video Podcast URL
! Special Notes
|-
| iPhone OS 3.0 Preview
| March 17, 2009
| [http://events.apple.com.edgesuite.net/0903lajkszg/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/preview-iphone-os/ Defunct]
| [http://stream.qtv.apple.com/events/mar/0903lajkszg/m_090374535329zdwg_650_ref.mov]
| [http://stream.qtv.apple.com/events/mar/0903lajkszg/m_090374535329zdwg_hd_ref.mov]
|
| [http://stream.qtv.apple.com/events/mar/0903lajkszg/m_090374535329zdwg_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes/iphone-os-3-preview-event-20090317.m4v Defunct]
[http://itstreaming.apple.com/podcasts/apple_keynotes/8_iphone2009.m4v]
|
|-
| WWDC
| June 8, 2009
| [http://events.apple.com.edgesuite.net/0906paowdnv/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/wwdc09/ Defunct]
| [http://stream.qtv.apple.com/events/jun/0906paowdnv/m_0906jhoiudvfvn_650_ref.mov]
| [http://stream.qtv.apple.com/events/jun/0906paowdnv/m_0906jhoiudvfvn_hd_ref.mov]
|
| [http://stream.qtv.apple.com/events/jun/0906paowdnv/m_0906jhoiudvfvn_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes/wwdc2009.m4v Defunct]
[http://itstreaming.apple.com/podcasts/apple_keynotes/9_wwdc2009.m4v]
|
|-
| "It's only rock and roll, but we like it."
| September 9, 2009
| [http://events.apple.com.edgesuite.net/0909oijasdv/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/specialevent0909/]
[http://www.apple.com/apple-events/september-2009/]

(both are defunct)
| [http://stream.qtv.apple.com/events/sep/0909oijasdv/0909pihvasb23_2_220_ref.mov Low Quality]
[http://stream.qtv.apple.com/events/sep/0909oijasdv/0909pihvasb23_2_350_ref.mov Better Quality]

[http://stream.qtv.apple.com/events/sep/0909oijasdv/0909pihvasb23_2_650_ref.mov Higher Quality]
| [http://stream.qtv.apple.com/events/sep/0909oijasdv/0909pihvasb23_1_hd_ref.mov]
| [http://stream.qtv.apple.com/events/sep/0909oijasdv/0909pihvasb23_iphone_ref.mov For iOS ≤2.x]
[http://qthttp.apple.com.edgesuite.net/0909oijasdv/all.m3u8 For iOS ≥3.0]
| [http://stream.qtv.apple.com/events/sep/0909oijasdv/m_0909pihvasb23_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes/sept2009_event.m4v Defunct]
[http://itstreaming.apple.com/podcasts/apple_keynotes/10_september2009.m4v]
| You can substitute "_2_" instead of "_1_" in the stream URLs.
|}

== 2010 ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed;" border="1"
|-
! Event
! Date
! Edgesuite.net Page
! Apple.com Page
! Low Quality Stream
! Better Quality Stream
! Higher Quality Stream
! HD Stream
! iOS Stream
! Audio-Only Stream
! Video Podcast URL
! style="width:13%;"| Special Notes
|-
| "Come see what we've been working on."
(iPad announcement)
| January 27, 2010
| [http://events.apple.com.edgesuite.net/1001q3f8hhr/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/specialevent0110/]
[http://www.apple.com/apple-events/january-2010/]

(both are defunct)
| [http://stream.qtv.apple.com/events/jan/1001q3f8hhr/1001908r5ft6dswz_1_220_ref.mov]
| [http://stream.qtv.apple.com/events/jan/1001q3f8hhr/1001908r5ft6dswz_1_350_ref.mov]
| [http://stream.qtv.apple.com/events/jan/1001q3f8hhr/1001908r5ft6dswz_1_650_ref.mov]
| [http://stream.qtv.apple.com/events/jan/1001q3f8hhr/1001908r5ft6dswz_1_hd_ref.mov]
| [http://stream.qtv.apple.com/events/jan/1001q3f8hhr/1001908r5ft6dswz_iphone_ref.mov For iOS ≤2.x]
[http://qthttp.apple.com.edgesuite.net/1001q3f8hhr/all.m3u8 For iOS ≥3.0]
| [http://stream.qtv.apple.com/events/jan/1001q3f8hhr/1001908r5ft6dswz_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes/ipad.m4v]
[http://itstreaming.apple.com/podcasts/apple_keynotes/11_ipad.m4v]
| You can substitute "_2_," "_5_," or "_9_" instead of "_1_" in the stream URLs.
|-
| "Get a sneek peak into the future of iPhone OS."
| April 8, 2010
| [http://events.apple.com.edgesuite.net/1004fk8d5gt/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/specialevent0410/]
[http://www.apple.com/apple-events/april-2010/]

(both are defunct)
| [http://stream.qtv.apple.com/events/apr/1004fk8d5gt/1004767kjhgoiashdbnv_0220_ref.mov]
| [http://stream.qtv.apple.com/events/apr/1004fk8d5gt/1004767kjhgoiashdbnv_0350_ref.mov]
| [http://stream.qtv.apple.com/events/apr/1004fk8d5gt/1004767kjhgoiashdbnv_0650_ref.mov]
| [http://stream.qtv.apple.com/events/apr/1004fk8d5gt/1004767kjhgoiashdbnv_hd_ref.mov]
| [http://stream.qtv.apple.com/events/apr/1004fk8d5gt/1004767kjhgoiashdbnv_iphone_ref.mov For iOS ≤2.x]
[http://qthttp.apple.com.edgesuite.net/1004fk8d5gt/1004767kjhgoiashdbnv_iphone_http_ref.mov For iOS ≥3.0] [http://qthttp.apple.com.edgesuite.net/1004fk8d5gt/all.m3u8 (alt)]
| [http://stream.qtv.apple.com/events/apr/1004fk8d5gt/1004767kjhgoiashdbnv_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes/apr2010_evt.m4v]
[http://itstreaming.apple.com/podcasts/apple_keynotes/12_april2010.m4v]
|
|-
| WWDC
| June 7, 2010
| [http://events.apple.com.edgesuite.net/1006ad9g4hjk/event/index.html (Partially) Broken]
| [http://www.apple.com/quicktime/qtv/wwdc10/]
[http://www.apple.com/apple-events/wwdc-2010/]
| [http://stream.qtv.apple.com/events/jun/1006ad9g4hjk/1006127iojapsoiujdv_220_ref.mov]
| [http://stream.qtv.apple.com/events/jun/1006ad9g4hjk/1006127iojapsoiujdv_350_ref.mov]
| [http://stream.qtv.apple.com/events/jun/1006ad9g4hjk/1006127iojapsoiujdv_650_ref.mov]
[http://stream.qtv.apple.com/events/jun/1006ad9g4hjk/1006127iojapsoiujdv_i650_ref.mov (Snow Leopard)]
| [http://stream.qtv.apple.com/events/jun/1006ad9g4hjk/1006127iojapsoiujdv_hd_ref.mov]
| [http://stream.qtv.apple.com/events/jun/1006ad9g4hjk/1006127iojapsoiujdv_iphone_ref.mov]
| [http://stream.qtv.apple.com/events/jun/1006ad9g4hjk/1006127iojapsoiujdv_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes/wwdc10_keynote.m4v]
[http://itstreaming.apple.com/podcasts/apple_keynotes/13_wwdc2010.m4v]
| From here on, the iOS-optimized streams require iOS 3.0 or newer.
|-
| July 16 Press Conference
| July 16, 2010
| [http://events.apple.com.edgesuite.net/100716iab73asc/event/index.html (Partially) Broken]
| [http://www.apple.com/apple-events/july-2010/]
| [http://stream.qtv.apple.com/events/jul/100716iab73asc/100716wiuhvbaealjhvb_220_ref.mov]
| [http://stream.qtv.apple.com/events/jul/100716iab73asc/100716wiuhvbaealjhvb_350_ref.mov]
| [http://stream.qtv.apple.com/events/jul/100716iab73asc/100716wiuhvbaealjhvb_650_ref.mov]
[http://qthttp.apple.com.edgesuite.net/100716iab73asc/sl_all_w.m3u8 (Snow Leopard)]
| [http://stream.qtv.apple.com/events/jul/100716iab73asc/100716wiuhvbaealjhvb_hd_ref.mov]
| [http://stream.qtv.apple.com/events/jul/100716iab73asc/100716wiuhvbaealjhvb_iphone_ref.mov]
| [http://stream.qtv.apple.com/events/jul/100716iab73asc/100716wiuhvbaealjhvb_audio_ref.mov]
|
|
|-
| Apple Special Event September 2010
| September 1, 2010
| [http://events.apple.com.edgesuite.net/1009qpeijrfn/event/index.html]
| [http://www.apple.com/apple-events/september-2010/]
| [http://stream.qtv.apple.com/events/sep/1009qpeijrfn/1009oiubqherbfoteg_220_ref.mov]
| [http://stream.qtv.apple.com/events/sep/1009qpeijrfn/1009oiubqherbfoteg_350_ref.mov]
| [http://stream.qtv.apple.com/events/sep/1009qpeijrfn/1009oiubqherbfoteg_650_ref.mov]
[http://qthttp.apple.com.edgesuite.net/1009qpeijrfn2/sl.m3u8 (Snow Leopard)]
| [http://stream.qtv.apple.com/events/sep/1009qpeijrfn/1009oiubqherbfoteg_hd_ref.mov]
| [http://stream.qtv.apple.com/events/sep/1009qpeijrfn/1009oiubqherbfoteg_ipad_ref.mov iPad]
[http://stream.qtv.apple.com/events/sep/1009qpeijrfn/1009oiubqherbfoteg_iphone_ref.mov iPhone]
| [http://stream.qtv.apple.com/events/sep/1009qpeijrfn/1009oiubqherbfoteg_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes/itunesQTX.m4v]
[http://itstreaming.apple.com/podcasts/apple_keynotes/14_september2010.m4v]
| This event was streamed live. [http://qthttp.apple.com.edgesuite.net/1009qpeijrfn/sl.m3u8 This] might have been the stream.
|}

== 2011 ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed;" border="1"
|-
! Event
! Date
! Edgesuite.net Page
! Apple.com Page
! Low Quality Stream
! Better Quality Stream
! Higher Quality Stream
! HD Stream
! iOS Stream
! Audio-Only Stream
! Video Podcast URL
! Special Notes
|-
| "Come see what 2011 will be the year of."
| March 2, 2011
| [http://events.apple.com.edgesuite.net/1103pijanbdvaaj/event/index.html]
| [http://www.apple.com/apple-events/march-2011/]
| [http://stream.qtv.apple.com/events/mar/1103pijanbdvaaj/1103pijnpfvrbfvijbavojh_220_ref.mov]
| [http://stream.qtv.apple.com/events/mar/1103pijanbdvaaj/1103pijnpfvrbfvijbavojh_350_ref.mov]
| [http://stream.qtv.apple.com/events/mar/1103pijanbdvaaj/1103pijnpfvrbfvijbavojh_650_ref.mov]
[http://qthttp.apple.com.edgesuite.net/1103pijanbdvaaj/sl_vod.m3u8 (Snow Leopard)]
| [http://stream.qtv.apple.com/events/mar/1103pijanbdvaaj/1103pijnpfvrbfvijbavojh_hd_ref.mov]
| [http://stream.qtv.apple.com/events/mar/1103pijanbdvaaj/1103pijnpfvrbfvijbavojh_ipad_vod_ref.mov iPad]
[http://stream.qtv.apple.com/events/mar/1103pijanbdvaaj/1103pijnpfvrbfvijbavojh_iphone_vod_ref.mov iPhone]
| [http://stream.qtv.apple.com/events/mar/1103pijanbdvaaj/1103pijnpfvrbfvijbavojh_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes/mar2011.m4v]
[http://itstreaming.apple.com/podcasts/apple_keynotes/16_march2011.m4v]
|
|-
| WWDC
| June 6, 2011
| [http://events.apple.com.edgesuite.net/11piubpwiqubf06/event/]
| [http://www.apple.com/apple-events/wwdc-2011/]
| [http://stream.qtv.apple.com/events/mar/11piubpwiqubf06/11piunpaiubsdvadibvas06_220_ref.mov]
| [http://stream.qtv.apple.com/events/mar/11piubpwiqubf06/11piunpaiubsdvadibvas06_350_ref.mov]
| [http://stream.qtv.apple.com/events/mar/11piubpwiqubf06/11piunpaiubsdvadibvas06_650_ref.mov]
[http://qthttp.apple.com.edgesuite.net/11piubpwiqubf06c/sl_vod.m3u8 (Snow Leopard)]
| [http://stream.qtv.apple.com/events/mar/11piubpwiqubf06/11piunpaiubsdvadibvas06_hd_ref.mov]
| [http://stream.qtv.apple.com/events/mar/11piubpwiqubf06/11piunpaiubsdvadibvas06_ipad_vod_ref.mov iPad]
[http://stream.qtv.apple.com/events/mar/11piubpwiqubf06/11piunpaiubsdvadibvas06_iphone_vod_ref.mov iPhone]
| [http://stream.qtv.apple.com/events/mar/11piubpwiqubf06/11piunpaiubsdvadibvas06_audio_ref.mov]
| [http://movies.apple.com/datapub/us/podcasts/apple_keynotes2/wwdc2011_ipod.m4v]
[http://itstreaming.apple.com/podcasts/apple_keynotes/17_wwdc2011_ipod.m4v]

[http://itstreaming.apple.com/podcasts/apple_keynotes/wwdc2011appletv.m4v HD]
|
|-
| "Let's talk iPhone."
| October 4, 2011
| [http://events.apple.com.edgesuite.net/11piuhbvdlbkvoih10/event/index.html]
| [http://www.apple.com/apple-events/october-2011/]
| [http://stream.qtv.apple.com/events/oct/11piuhbvdlbkvoih10/11mnbzxcbnkhbvshdfeuygxvst10_220_ref.mov]
| [http://stream.qtv.apple.com/events/oct/11piuhbvdlbkvoih10/11mnbzxcbnkhbvshdfeuygxvst10_350_ref.mov]
| [http://stream.qtv.apple.com/events/oct/11piuhbvdlbkvoih10/11mnbzxcbnkhbvshdfeuygxvst10_650_ref.mov]
[http://qthttp.apple.com.edgesuite.net/11piuhbvdlbkvoih10c/sl_vod_mvp.m3u8 (Snow Leopard)]
| [http://stream.qtv.apple.com/events/oct/11piuhbvdlbkvoih10/11mnbzxcbnkhbvshdfeuygxvst10_hd_ref.mov]
| [http://stream.qtv.apple.com/events/oct/11piuhbvdlbkvoih10/11mnbzxcbnkhbvshdfeuygxvst10_ipad_vod_ref.mov iPad]
[http://stream.qtv.apple.com/events/oct/11piuhbvdlbkvoih10/11mnbzxcbnkhbvshdfeuygxvst10_iphone_vod_ref.mov iPhone]
| [http://stream.qtv.apple.com/events/oct/11piuhbvdlbkvoih10/11mnbzxcbnkhbvshdfeuygxvst10_audio_ref.mov]
| [http://movies.apple.com/datapub/us/newpodcasts/apple_keynotes/oct2011_ipod.m4v]
[http://itstreaming.apple.com/podcasts/apple_keynotes/18_oct2011_ipod.m4v]

[http://itstreaming.apple.com/podcasts/apple_keynotes/oct2011_appletv.m4v HD]
|
|}

== 2012 ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed;" border="1"
|-
! Event
! Date
! Edgesuite.net Page
! Apple.com Page
! Low Quality Stream
! Better Quality Stream
! Higher Quality Stream
! HD Stream
! iOS Stream
! Audio-Only Stream
! Video Podcast URL
! Special Notes
|-
| Apple Education Event - January 2012
| January 19, 2012
| [http://events.apple.com.edgesuite.net/1201oihbafvpihboijhpihbasdouhbasv/event/index.html]
| [http://www.apple.com/apple-events/education-january-2012/]
| [http://stream.qtv.apple.com/events/jan/1201oihbafvpihboijhpihbasdouhbasv/12pibasvpqihbsdfvihbasdv01_220_ref.mov]
| [http://stream.qtv.apple.com/events/jan/1201oihbafvpihboijhpihbasdouhbasv/12pibasvpqihbsdfvihbasdv01_350_ref.mov]
| [http://stream.qtv.apple.com/events/jan/1201oihbafvpihboijhpihbasdouhbasv/12pibasvpqihbsdfvihbasdv01_650_ref.mov]
[http://qthttp.apple.com.edgesuite.net/1201oihbafvpihboijhpihbasdouhbasv/sl_vod_mvp.m3u8 (Snow Leopard)]
| [http://stream.qtv.apple.com/events/jan/1201oihbafvpihboijhpihbasdouhbasv/12pibasvpqihbsdfvihbasdv01_hd_ref.mov]
| [http://stream.qtv.apple.com/events/jan/1201oihbafvpihboijhpihbasdouhbasv/12pibasvpqihbsdfvihbasdv01_ipad_ref.mov iPad]
[http://stream.qtv.apple.com/events/jan/1201oihbafvpihboijhpihbasdouhbasv/12pibasvpqihbsdfvihbasdv01_iphone_ref.mov iPhone]
| [http://stream.qtv.apple.com/events/jan/1201oihbafvpihboijhpihbasdouhbasv/12pibasvpqihbsdfvihbasdv01_audio_ref.mov]
| [http://itstreaming.apple.com/podcasts/apple_keynotes/19_jan2012_ipod.m4v]

[http://itstreaming.apple.com/podcasts/apple_keynotes_hd/3_jan2012appletv.m4v HD]
|
|-
| "We have something you really have to see. And touch."
| March 7, 2012
| [http://events.apple.com.edgesuite.net/123pibhargjknawdconwecown/event/index.html]
| [http://www.apple.com/apple-events/march-2012/]
| [http://stream.qtv.apple.com/events/mar/123pibhargjknawdconwecown/12oihbqeorvfhbpiubqnfv3_220_ref.mov]
| [http://stream.qtv.apple.com/events/mar/123pibhargjknawdconwecown/12oihbqeorvfhbpiubqnfv3_350_ref.mov]
| [http://stream.qtv.apple.com/events/mar/123pibhargjknawdconwecown/12oihbqeorvfhbpiubqnfv3_650_ref.mov][http://qthttp.apple.com.edgesuite.net/123pibhargjknawdconwecown/sl_vod_mvp.m3u8 (Snow Leopard)]
| [http://stream.qtv.apple.com/events/mar/123pibhargjknawdconwecown/12oihbqeorvfhbpiubqnfv3_hd_ref.mov]
| [http://stream.qtv.apple.com/events/mar/123pibhargjknawdconwecown/12oihbqeorvfhbpiubqnfv3_ipad_ref.mov iPad]
[http://stream.qtv.apple.com/events/mar/123pibhargjknawdconwecown/12oihbqeorvfhbpiubqnfv3_iphone_ref.mov iPhone]
| [http://stream.qtv.apple.com/events/mar/12oihbqeorvfhbpiubqnfv3_audio_ref.mov]
|
|
|}

== External Links ==
* [http://itstreaming.apple.com/podcasts/apple_keynotes/apple_keynotes.xml Apple Keynotes Podcast]
* [http://itstreaming.apple.com/podcasts/apple_keynotes_hd/apple_keynotes_hd.xml Apple Keynotes (HD) Podcast]
* [http://www.apple.com/podcasts/apple_keynotes/apple_keynotes.xml Apple Keynotes Podcast (old)]
* [http://www.apple.com/apple-events/ Apple - Events]

Corona

2012-02-01T22:01:53Z

Jacob: 1.0-7 and 1.0-8

[[File:Corona.png|thumb|right|The details page for Corona in Cydia.]]
'''Corona''' is a [[Cydia.app|Cydia]] package from the [[Chronic Dev (team)|Chronic Dev Team]] on [[Saurik]]'s repo. It uses [[User:pod2g|pod2g]]'s [[Racoon String Format Overflow Exploit]] and an [[HFS Heap Overflow]] to untether iOS 5.0.1 on previously-jailbroken devices. Alternatively, users can also re-run the [[iPhone Dev Team]]'s [[redsn0w]] 0.9.10 to untether their jailbreak with the same exploit. The name is an anagram of the aforementioned [http://linux.die.net/man/8/racoon racoon] software.

==A5 Jailbreak==
{{main|Absinthe}}

According to [http://pod2g-ios.blogspot.com/2012/01/sandbox-difficulties.html pod2g's blog], he was having problems with the app [[sandbox]]ing system used on the [[S5L8940|A5]] processor in the [[iPad 2]] and [[N94ap|iPhone 4S]], so he got [[User:planetbeing|planetbeing]], [[User:MuscleNerd|MuscleNerd]], [[User:posixninja|Joshua Hill]] and [[saurik]], dubbed the "dream team", to help to fix it[http://pod2g-ios.blogspot.com/2012/01/sandbox-difficulties.html][https://twitter.com/pod2g/status/156696427521773568]. [[User:DHowett|Dustin Howett]] also demoed the A5 jailbreak [http://www.youtube.com/watch?v=rDBHXbwgdc4 on YouTube]. It was released on January 20, 2012 as [[Absinthe]].

==Changelog==
* '''1.0-8''' Fixed an issue were corona failed on iPhone 4S on iOS 5.0
* '''1.0-7''' 1.0-6 had a "Depends" that made it refuse to install on an original iPad.
* '''1.0-6''' fixed iBooks issues (books having DRM may show half pictures and/or grey rectangles).
* '''1.0-5''' was updated by Saurik again to require a reboot after installing.
* '''1.0-4''' includes sandbox patches by [[User:comex|comex]] that fixes [[iBooks]] problems, as well as another fix for [[launchctl]].[http://blog.iphone-dev.org/post/14857834236/untethered-holidays]
* '''1.0-3''' was updated by Saurik to enable [[redsn0w]] 0.9.10 users to update the jailbreak through Cydia.
* '''1.0-2''' attempted to fix a bug that caused launchctl to not start daemons on-demand.
* '''1.0-1''' is the initial release of the jailbreak.

==External Links==
*[http://pod2g-ios.blogspot.com/2012/01/details-on-corona.html pod2g's details on the exploits]
[[Category:Hacking Software]]
[[Category:Jailbreaks]]

/System/Library/Caches/com.apple.kernelcaches

2012-01-30T23:48:19Z

Jacob: Created page with "=== Files === * kernelcache"

=== Files ===
* [[kernelcache]]

/System/Library/Caches

2012-01-30T23:14:44Z

Jacob: Created page with "=== Children === * com.apple.dyld * com.apple.kernelcaches"

=== Children ===
* [[/System/Library/Caches/com.apple.dyld|com.apple.dyld]]
* [[/System/Library/Caches/com.apple.kernelcaches|com.apple.kernelcaches]]

/System/Library/BulletinBoardPlugins

2012-01-30T23:11:35Z

Jacob: Sorry, messed up format there.

=== Children ===
* [[/System/Library/BulletinBoardPlugins/CalendarProvider.bundle|CalendarProvider.bundle]]
* [[/System/Library/BulletinBoardPlugins/GameKitDataProvider.bundle|GameKitDataProvider.bundle]]
* [[/System/Library/BulletinBoardPlugins/MailDataProvider.bundle|MailDataProvider.bundle]]
* [[/System/Library/BulletinBoardPlugins/MPDataProvider.bundle|MPDataProvider.bundle]]
* [[/System/Library/BulletinBoardPlugins/PushDataProviderFactory.bundle|PushDataProviderFactory.bundle]]
* [[/System/Library/BulletinBoardPlugins/SMSBBPlugin.bundle|SMSBBPlugin.bundle]]

/System/Library/BulletinBoardPlugins

2012-01-30T23:06:10Z

Jacob: Created page with "=== Folders === * {{ipfw|CalendarProvider.bundle}} * {{ipfw|GameKitDataProvider.bundle}} * {{ipfw|MailDataProvider.bundle}} * {{ipfw|MPDataProvider.bundle}} * {{ipfw|PushDataProv..."

=== Folders ===
* {{ipfw|CalendarProvider.bundle}}
* {{ipfw|GameKitDataProvider.bundle}}
* {{ipfw|MailDataProvider.bundle}}
* {{ipfw|MPDataProvider.bundle}}
* {{ipfw|PushDataProviderFactory.bundle}}
* {{ipfw|SMSBBPlugin.bundle}}

/System/Library

2012-01-30T22:55:30Z

Jacob: /* Folders */

== Summary ==

== Children ==
=== Folders ===
* {{ipfw|AccessibilityBundles}}
* {{ipfw|ApplePTP}}
* {{ipfw|AppleUSBDevice}}
* {{ipfw|Audio}}
* {{ipfw|Backup}}
* {{ipfw|BulletinBoardPlugins}}
* {{ipfw|Caches}}
* {{ipfw|Carrier Bundles}}
* {{ipfw|CoreServices}}
* {{ipfw|DataClassMigrators}}
* {{ipfw|Extensions}}
* {{ipfw|Filesystems}}
* {{ipfw|Fonts}}
* {{ipfw|Frameworks}}
* {{ipfw|HIDPlug-Ins}}
* {{ipfw|Internet Plug-Ins}}
* {{ipfw|KeyboardDictionaries}}
* {{ipfw|KeyboardLayouts}}
* {{ipfw|LaunchDaemons}}
* {{ipfw|LinguisticData}}
* {{ipfw|LocationBundles}}
* {{ipfw|Lockdown}}
* {{ipfw|ManagedConfigurationBundles}}
* {{ipfw|MediaCapture}}
* {{ipfw|MediaStreamPlugins}}
* {{ipfw|Obliteration}}
* {{ipfw|PreferenceBundles}}
* {{ipfw|PrivateFrameworks}}
* {{ipfw|PublishingBundles}}
* {{ipfw|RegionFeatures}}
* {{ipfw|ScreenReader}}
* {{ipfw|SearchBundles}}
* {{ipfw|SetupAssistantBundles}}
* {{ipfw|Spotlight}}
* {{ipfw|SpringBoardPlugins}}
* {{ipfw|SyncBundles}}
* {{ipfw|SystemConfiguration}}
* {{ipfw|TextInput}}
* {{ipfw|UserEventPlugins}}
* {{ipfw|VideoDecoders}}
* {{ipfw|VideoEncoders}}
* {{ipfw|VideoProcessors}}
* {{ipfw|VoiceServices}}
* {{ipfw|Watchdog}}
* {{ipfw|WeeAppPlugins}}

=== Files ===
(none)

== Parents ==
[[:/|(Root)]]/[[/System|System]]

/System/Library/Backup

2012-01-30T22:47:16Z

Jacob: Created page with "Information about what gets backed up to iTunes and iCloud. === Files === * {{ipfw|Domains.plist}}"

Information about what gets backed up to iTunes and iCloud.
=== Files ===
* {{ipfw|Domains.plist}}

/System/Library/AppleUSBDevice

2012-01-30T22:41:53Z

Jacob: Created page with "=== Files === * {{ipfw|USBDeviceConfiguration.plist}}"

=== Files ===
* {{ipfw|USBDeviceConfiguration.plist}}

/System/Library/ApplePTP

2012-01-30T22:40:16Z

Jacob: Created page with "Contains a plist with information used by picture transfer protocol. === Files === * {{ipfw|PTPDeviceInfoDataset.plist}}"

Contains a plist with information used by picture transfer protocol.
=== Files ===
* {{ipfw|PTPDeviceInfoDataset.plist}}

Bootrom 574.4

2012-01-30T21:11:28Z

Jacob: Removed story plot :D

This is the first revision of the [[S5L8930]] bootrom, found in the [[K48ap|iPad]], the [[N81ap|iPod touch 4G]], and in the [[N90ap|iPhone 4]]. [[limera1n|Limera1n]] was released by [[geohot]] to jailbreak devices using this revision of the bootrom.

[[SHA-1 Image Segment Overflow|SHAtter]], a different exploit that only targets [[S5L8930]] devices was found, but never used.

[[Category:Bootrom]]

Corona

2012-01-30T17:00:23Z

Jacob: /* Changelog */ Even though it is not released yet, figured it was best to get it out of the way.

[[File:Corona.png|thumb|right|The details page for Corona in Cydia.]]
'''Corona''' is a [[Cydia.app|Cydia]] package from the [[Chronic Dev (team)|Chronic Dev Team]] on [[Saurik]]'s repo. It uses [[User:pod2g|pod2g]]'s [[Racoon String Format Overflow Exploit]] and an [[HFS Heap Overflow]] to untether iOS 5.0.1 on previously-jailbroken devices. Alternatively, users can also re-run the [[iPhone Dev Team]]'s [[redsn0w]] 0.9.10 to untether their jailbreak with the same exploit. The name is an anagram of the aforementioned [http://linux.die.net/man/8/racoon racoon] software.

==A5 Jailbreak==
{{main|Absinthe}}

According to [http://pod2g-ios.blogspot.com/2012/01/sandbox-difficulties.html pod2g's blog], he was having problems with the app [[sandbox]]ing system used on the [[S5L8940|A5]] processor in the [[iPad 2]] and [[N94ap|iPhone 4S]], so he got [[User:planetbeing|planetbeing]], [[User:MuscleNerd|MuscleNerd]], [[User:posixninja|Joshua Hill]] and [[saurik]], dubbed the "dream team", to help to fix it[http://pod2g-ios.blogspot.com/2012/01/sandbox-difficulties.html][https://twitter.com/pod2g/status/156696427521773568]. [[User:DHowett|Dustin Howett]] also demoed the A5 jailbreak [http://www.youtube.com/watch?v=rDBHXbwgdc4 on YouTube]. It was released on January 20, 2012 as [[Absinthe]].

==Changelog==
* '''1.0-6''' fixed iBooks issues (books having DRM may show half pictures and/or grey rectangles).
* '''1.0-5''' was updated by Saurik again to require a reboot after installing.
* '''1.0-4''' includes sandbox patches by [[User:comex|comex]] that fixes [[iBooks]] problems, as well as another fix for [[launchctl]].[http://blog.iphone-dev.org/post/14857834236/untethered-holidays]
* '''1.0-3''' was updated by Saurik to enable [[redsn0w]] 0.9.10 users to update the jailbreak through Cydia.
* '''1.0-2''' attempted to fix a bug that caused launchctl to not start daemons on-demand.
* '''1.0-1''' is the initial release of the jailbreak.

==External Links==
*[http://pod2g-ios.blogspot.com/2012/01/details-on-corona.html pod2g's details on the exploits]
[[Category:Hacking Software]]
[[Category:Jailbreaks]]

The iPhone Wiki:Community portal

2011-12-25T23:18:05Z

Jacob:

{{Talk Archive|2010|2011|2012}}
This is the place to post tasks that need to be done on the wiki. Also this is the place for proposed changes. I heard about people wanting a favicon and arranging the main page into categories.

== Site Related Requests ==
=== 2.2b1 ===
Is 2.2b1 5G26 or 5G27, because on [[Beta Firmware]], it says 5G27... --[[User:Balloonhead66|Balloonhead66]] 19:48, 6 August 2011 (MDT)

=== Key pages ===
I would like to propose a new rule: Do not create a key page (e.g.- [[Jasper 8C148 (iPad)]]) unless you can also provide at least one key. Key pages are meant to share decryption keys with others. Copying and pasting from a template page provides us with no information whatsoever, and also wastes time (both the poster's and the administrators'). Thoughts on this? --[[User:Dialexio|Dialexio]] 21:50, 4 November 2011 (MDT)
:I'm against that. While I agree we shouldn't create all empty pages to fill out later, I don't see any reason to have a rule for that. Or was that a problem recently and I missed it? I also created pages with very few content (like [[Siri]]), that other users picked up or hopefully will pick up and enhanced. Key pages are a little different though. And the page you reference was never empty (but had wrong keys initially). So if you feel a big need to have such a rule, go on. -- [[User:Http|http]] 05:06, 5 November 2011 (MDT)
::I was simply using that page as an example of a key page, for those that had no clue what I was talking about. I think that posting an article with little content is a bit different from an empty key page; at least a small amount of information is being provided. In addition, it's easier to tell whether a key page needs to be filled out or not if the key page's link is red because the page was never created. I'll wait for additional feedback from anybody else before I decide on whether or not to add this to the rules. --[[User:Dialexio|Dialexio]] 11:31, 5 November 2011 (MDT)
:::Ok --[[User:Balloonhead66|Balloonhead66]] 16:58, 12 December 2011 (MST)

=== New Upper Left Image ===
If someone has a good one, I'll change it. Who still has an iPhone 2G? --[[User:Geohot|geohot]] 13:11, 12 December 2011 (MST)
:[[:File:NewLogo.png]]? Problem is one like that doesnt scale well. Maybe a rotated (like this) image of an [[n94ap|iPhone 4S]] or an [[iPad 2]]. I have an image of a rotated iPhone 4S if you want... --[[User:Balloonhead66|Balloonhead66]] 14:04, 12 December 2011 (MST)
:Something with an iPhone and the [[:File:Iptwiki.png|iPhone wiki logo]] from the main page would look good. I'll see if I can make one up. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 23:06, 17 December 2011 (MST)
:why not the [http://en.wikipedia.org/wiki/File:Apple_iOS.svg iOS logo]? --[[User:M2m|M2m]] 10:02, 18 December 2011 (MST)
::I don't think we can use that because it's a copyrighted logo. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:06, 18 December 2011 (MST)
::Agreed --[[User:Balloonhead66|Balloonhead66]] 18:15, 18 December 2011 (MST)
:Mine requires a bit of [[User:thekirbylover/skin.css|extra CSS]] for it too look good. This can be added to [[Mediawiki:skin.css]]. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 17:59, 19 December 2011 (MST)
:i have an iPhone 2G geohot! --[[User:Zmaster|Zmaster]] 12:08, 24 December 2011 (MST)
:Ok, I got something from @iSurenix. He says: "In case you don't like it, I can always fix it up etc. but I think it looks new, fresh and updated." -- [[User:Http|http]] 13:40, 25 December 2011 (MST)
::Excellent! --[[User:balloonhead66|Cole Johnson]] 14:54, 25 December 2011 (MST)
::I think it blends into the background too much because the iPhone is white. Thats just my opinion thought. Otherwise I like it. --[[User:JacobVengeance|Jacob]] 16:18, 25 December 2011 (MST)
==== Proposed logos ====
<gallery>
File:thekirbylover's iPhone Wiki logo.png|[[User:thekirbylover|thekirbylover]]
File:Theiphonewiki.png|{{twitter|iSurenix}}
</gallery>

=== Cydia links ===
Links to Cydia, such as cydia://package/com.example.test, don't seem to wanna be linkified by the wiki, but there's an internal setting you can change: <tt>$wgUrlProtocols[] = "cydia://";</tt>. You might also want to use [[MediaWiki:Vector.css]] to add a mini Cydia icon next to it. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:06, 18 December 2011 (MST)
:As for the ''localsettings.php'' change, this is [[user:geohot|geohot]]'s problem. As for the CSS change, we could use [http://theiphonewiki.com/wiki/images/thumb/9/91/Cydia.png/16px-Cydia.png Cydia.png@16px]. --[[User:Balloonhead66|Balloonhead66]] 18:15, 18 December 2011 (MST)
::Yep, I was gonna put that CSS in my [[User:thekirbylover/monobook.css]] after I posted that. Also, correct me if I'm wrong, but I think Monobook.css is used on Vector pages too. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:21, 18 December 2011 (MST)
:::I checked the source and the "/load.php?{CRAP}" are empty and for some reason, {{wp|Google Chrome}}'s "Inspect Element" show up styles... --[[User:Balloonhead66|Balloonhead66]] 18:29, 18 December 2011 (MST)
:::/skin.css is cross skin while /vector.css and /monobook.css are per-skin --[[User:Balloonhead66|Balloonhead66]] 18:31, 18 December 2011 (MST)

=== MD Bootrom ===
Editing the [[models]] page, I noticed that the new white [[iPod4,2|iPod touch 4]]s have MD bootroms. However, I'm not sure about the black models, so can someone with a black touch 4 bought after September please tell me which model is reported in Settings? Thanks. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 23:46, 22 December 2011 (MST)
:Those are not bootroms; those are model numbers. According to Apple's online store, the black iPod touch 4G still has the same "MC" model numbers as before. --[[User:Dialexio|Dialexio]] 10:27, 23 December 2011 (MST)
::Ah, I see. Thanks for checking. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 16:33, 23 December 2011 (MST)

User talk:Haifisch

2011-12-01T03:31:47Z

Jacob: /* Spamming emails */

== Removal of BootRa1n ==
Hi Dylan. Sorry that you're not happy with the removal of the BootRa1n page. But currently there is no value for the wiki in having this page. I know that you took some time implementing this etc. but I made a comparison of both source files and for me it just looks like moving the credits to you. The only additional "feature" is to send the exploit code. If your tool really gets used by a lot of people, then they should come to me and tell me to re-add the page. Usual rule here for [[:Category:GUI Tools|tools]] is that the author itself does ''not'' add the page itself, but instead users that use the tool frequently create the page. If everybody adds its own tools that are never used, we have a big advertising wiki and that contradicts the [[Ground Rules]]. I hope you understand that. If you really want to re-add the page, get a lot of people (currently on the wiki) together that want it and let me know. I hope you're not too disappointed and still contribute other infos to this wiki. You already helped, as we now have the [[iBootUtil]] page (I left the link to your fork there btw). -- [[User:Http|http]] 13:39, 25 September 2011 (MDT)
:Alright its cool just my family is proud of me for making something people would want (Not trying to make all of this sad) but its cool.- Dylan Laws
::Sorry if I upset you at all or anything, but I don't like when people take others code and attempt to say it is their own. I currently work on my own projects, I don't add them here because they are pretty much useless or have better alternatives. The wiki should be a place to gain familiarity in those areas. I used it when I first came to try and share a bug I found, but ended up giving it to a more skilled person in private. You should learn more and thrive to become an independent developer. You have the passion, but you need to understand you can't just rename stuff and call it your own. If you want a good start in really easy stuff, feel free to email me using my user page and "email this user". I am not skilled at all, but I do know and use Lua and Java daily. They aren't much, but a good start. once again, sorry. --[[User:JacobVengeance|Jacob]] 22:50, 25 September 2011 (MDT)
:::Actually thats pretty cool can you make a UI with Java? I need to make a UI for my upcoming project that im coding in batch. Email me here dakotatheguy@gmail.com -Dylan Laws
::::You could make a UI very easily using an IDE like Netbeans. If you can't figure things out, google is always a resource. --[[User:JacobVengeance|Jacob]] 23:26, 25 September 2011 (MDT)
:::::Hmmm ok....... --Dylan Laws
::::Batch is run from the command line, not as a GUI... --[[User:Balloonhead66|Balloonhead66]] 20:00, 26 September 2011 (MDT)
:::::No GUI but i made iFixer under batch --Dylan Laws
::::::I was unable to find iFixer on the internet --[[User:Balloonhead66|Balloonhead66]] 20:22, 27 September 2011 (MDT)
:::::::[http://fr0st.zxq.net/saffron/WIN.html Windows] --Dylan Laws

== Spamming emails ==
Recently I have been getting spam emails of invites to random sites from Dylan. I have read on twitter that other people were having similar issues with him. I don't think this is acceptable and so far his contributions to the wiki are only focused on his "Team" and his "tools". He should be banned for now. Anyone else agree or experience similar things from him? --[[User:JacobVengeance|Jacob]] 13:58, 30 November 2011 (MST)
:I personally have not gotten any spam from him on twitter or through e-mail. --[[User:Balloonhead66|Balloonhead66]] 14:15, 30 November 2011 (MST)
::Well I have gotten a couple, but only one currently in my inbox, here is a [http://img502.imageshack.us/img502/756/screenshotat20111130172.png picture]--[[User:JacobVengeance|Jacob]] 15:32, 30 November 2011 (MST)
:I received them (and was bothered by them) as well, but I can't say that he could/should be banned for that. Emails are off-site and they're not part of the wiki; banning him for that would be like getting banned from Facebook over a tweet saying "Add 'Dialexio' on Game Center!" Regarding programs, I do recall there being a discussion about posting programs on this wiki (particularly VFDecrypt GUIs), but a rule never explicitly mentioned anything about programs, aside from avoiding copyright infringement. Perhaps we can explore the idea of mkaing such a rule (or amending an existing one) on the [[The iPhone Wiki:Community portal|Community portal]]. --[[User:Dialexio|Dialexio]] 16:56, 30 November 2011 (MST)
::[[:Category:GUI Tools]] Rule 2 --[[User:Balloonhead66|Balloonhead66]] 17:55, 30 November 2011 (MST)
:::Those should be moved to the [[Ground Rules]]… Hopefully I'll get to it before the weekend. --[[User:Dialexio|Dialexio]] 20:16, 30 November 2011 (MST)
:: Also I should mention that he once again has taken credit for someone elses code. The program he recently posted has code from ih8sn0ws iDetector. [http://imageshack.us/f/705/61572783.jpg/ Proof] --[[User:JacobVengeance|Jacob]] 20:08, 30 November 2011 (MST)
:For every one who has received an email from me, A apology is need from me to you personally. My Gmail has a lot of emails with recent business with others, I will be cleaning out my contacts. And Dialexio you seemed to be bothered by my emails how so? I'm not sure of people on Twitter. Spamming isn't my thing to do, I hate spam just like the rest of us. If you have a problem with me please just email me. You can ban me if you would like but this Wiki is very useful to me. The decision isn't up to me though. Please decide with good reason. --[[User:Dylan Laws|Dylan Laws]] 19:36, 30 November 2011 (MST)
::I never had intentions of banning you, and still don't. I was getting annoyed as some of those email invites were being sent to the address I use to handle account creation requests. You already told me that you dealt with the invites going to my email address. --[[User:Dialexio|Dialexio]] 20:16, 30 November 2011 (MST)
:
:: In case of people not seeing this "Also I should mention that he once again has taken credit for someone elses code. The program he recently posted has code from ih8sn0ws iDetector. Proof --Jacob 20:08, 30 November 2011 (MST)" I did take the iDetector code and put it as the DFU checker in my program. The reason being that it was in the same folder is because i couldn't figure out why the code didnt work in my project but his, So I moved my project file from mine to him simply because of errors. It works now, Thanks for checking for me Jacob much appreciated.--[[User:Dylan Laws|Dylan Laws]] 20:22, 30 November 2011 (MST)
:It isn't just the build directory that is in plain text. You should look through it with a hex editor before giving excuses. --[[User:JacobVengeance|Jacob]] 20:31, 30 November 2011 (MST)

User talk:Haifisch

2011-12-01T03:08:01Z

Jacob:

== Removal of BootRa1n ==
Hi Dylan. Sorry that you're not happy with the removal of the BootRa1n page. But currently there is no value for the wiki in having this page. I know that you took some time implementing this etc. but I made a comparison of both source files and for me it just looks like moving the credits to you. The only additional "feature" is to send the exploit code. If your tool really gets used by a lot of people, then they should come to me and tell me to re-add the page. Usual rule here for [[:Category:GUI Tools|tools]] is that the author itself does ''not'' add the page itself, but instead users that use the tool frequently create the page. If everybody adds its own tools that are never used, we have a big advertising wiki and that contradicts the [[Ground Rules]]. I hope you understand that. If you really want to re-add the page, get a lot of people (currently on the wiki) together that want it and let me know. I hope you're not too disappointed and still contribute other infos to this wiki. You already helped, as we now have the [[iBootUtil]] page (I left the link to your fork there btw). -- [[User:Http|http]] 13:39, 25 September 2011 (MDT)
:Alright its cool just my family is proud of me for making something people would want (Not trying to make all of this sad) but its cool.- Dylan Laws
::Sorry if I upset you at all or anything, but I don't like when people take others code and attempt to say it is their own. I currently work on my own projects, I don't add them here because they are pretty much useless or have better alternatives. The wiki should be a place to gain familiarity in those areas. I used it when I first came to try and share a bug I found, but ended up giving it to a more skilled person in private. You should learn more and thrive to become an independent developer. You have the passion, but you need to understand you can't just rename stuff and call it your own. If you want a good start in really easy stuff, feel free to email me using my user page and "email this user". I am not skilled at all, but I do know and use Lua and Java daily. They aren't much, but a good start. once again, sorry. --[[User:JacobVengeance|Jacob]] 22:50, 25 September 2011 (MDT)
:::Actually thats pretty cool can you make a UI with Java? I need to make a UI for my upcoming project that im coding in batch. Email me here dakotatheguy@gmail.com -Dylan Laws
::::You could make a UI very easily using an IDE like Netbeans. If you can't figure things out, google is always a resource. --[[User:JacobVengeance|Jacob]] 23:26, 25 September 2011 (MDT)
:::::Hmmm ok....... --Dylan Laws
::::Batch is run from the command line, not as a GUI... --[[User:Balloonhead66|Balloonhead66]] 20:00, 26 September 2011 (MDT)
:::::No GUI but i made iFixer under batch --Dylan Laws
::::::I was unable to find iFixer on the internet --[[User:Balloonhead66|Balloonhead66]] 20:22, 27 September 2011 (MDT)
:::::::[http://fr0st.zxq.net/saffron/WIN.html Windows] --Dylan Laws

== Spamming emails ==
Recently I have been getting spam emails of invites to random sites from Dylan. I have read on twitter that other people were having similar issues with him. I don't think this is acceptable and so far his contributions to the wiki are only focused on his "Team" and his "tools". He should be banned for now. Anyone else agree or experience similar things from him? --[[User:JacobVengeance|Jacob]] 13:58, 30 November 2011 (MST)
:I personally have not gotten any spam from him on twitter or through e-mail. --[[User:Balloonhead66|Balloonhead66]] 14:15, 30 November 2011 (MST)
::Well I have gotten a couple, but only one currently in my inbox, here is a [http://img502.imageshack.us/img502/756/screenshotat20111130172.png picture]--[[User:JacobVengeance|Jacob]] 15:32, 30 November 2011 (MST)
:I received them (and was bothered by them) as well, but I can't say that he could/should be banned for that. Emails are off-site and they're not part of the wiki; banning him for that would be like getting banned from Facebook over a tweet saying "Add 'Dialexio' on Game Center!" Regarding programs, I do recall there being a discussion about posting programs on this wiki (particularly VFDecrypt GUIs), but a rule never explicitly mentioned anything about programs, aside from avoiding copyright infringement. Perhaps we can explore the idea of mkaing such a rule (or amending an existing one) on the [[The iPhone Wiki:Community portal|Community portal]]. --[[User:Dialexio|Dialexio]] 16:56, 30 November 2011 (MST)
::[[:Category:GUI Tools]] Rule 2 --[[User:Balloonhead66|Balloonhead66]] 17:55, 30 November 2011 (MST)
:: Also I should mention that he once again has taken credit for someone elses code. The program he recently posted has code from ih8sn0ws iDetector. [http://imageshack.us/f/705/61572783.jpg/ Proof] --[[User:JacobVengeance|Jacob]] 20:08, 30 November 2011 (MST)
::::
:For every one who has received an email from me, A apology is need from me to you personally. My Gmail has a lot of emails with recent business with others, I will be cleaning out my contacts. And Dialexio you seemed to be bothered by my emails how so? I'm not sure of people on Twitter. Spamming isn't my thing to do, I hate spam just like the rest of us. If you have a problem with me please just email me. You can ban me if you would like but this Wiki is very useful to me. The decision isn't up to me though. Please decide with good reason. --[[User:Dylan Laws|Dylan Laws]] 19:36, 30 November 2011 (MST)

User talk:Haifisch

2011-11-30T22:32:25Z

Jacob: /* Spamming emails */

User talk:Haifisch

2011-11-30T20:58:08Z

Jacob:

==Spamming emails==
Recently I have been getting spam emails of invites to random sites from Dylan. I have read on twitter that other people were having similar issues with him. I don't think this is acceptable and so far his contributions to the wiki are only focused on his "Team" and his "tools". He should be banned for now. Anyone else agree or experience similar things from him? --[[User:JacobVengeance|Jacob]] 13:58, 30 November 2011 (MST)

== Removal of BootRa1n ==
Hi Dylan. Sorry that you're not happy with the removal of the BootRa1n page. But currently there is no value for the wiki in having this page. I know that you took some time implementing this etc. but I made a comparison of both source files and for me it just looks like moving the credits to you. The only additional "feature" is to send the exploit code. If your tool really gets used by a lot of people, then they should come to me and tell me to re-add the page. Usual rule here for [[:Category:GUI Tools|tools]] is that the author itself does ''not'' add the page itself, but instead users that use the tool frequently create the page. If everybody adds its own tools that are never used, we have a big advertising wiki and that contradicts the [[Ground Rules]]. I hope you understand that. If you really want to re-add the page, get a lot of people (currently on the wiki) together that want it and let me know. I hope you're not too disappointed and still contribute other infos to this wiki. You already helped, as we now have the [[iBootUtil]] page (I left the link to your fork there btw). -- [[User:Http|http]] 13:39, 25 September 2011 (MDT)
:Alright its cool just my family is proud of me for making something people would want (Not trying to make all of this sad) but its cool.- Dylan Laws
::Sorry if I upset you at all or anything, but I don't like when people take others code and attempt to say it is their own. I currently work on my own projects, I don't add them here because they are pretty much useless or have better alternatives. The wiki should be a place to gain familiarity in those areas. I used it when I first came to try and share a bug I found, but ended up giving it to a more skilled person in private. You should learn more and thrive to become an independent developer. You have the passion, but you need to understand you can't just rename stuff and call it your own. If you want a good start in really easy stuff, feel free to email me using my user page and "email this user". I am not skilled at all, but I do know and use Lua and Java daily. They aren't much, but a good start. once again, sorry. --[[User:JacobVengeance|Jacob]] 22:50, 25 September 2011 (MDT)
:::Actually thats pretty cool can you make a UI with Java? I need to make a UI for my upcoming project that im coding in batch. Email me here dakotatheguy@gmail.com -Dylan Laws
::::You could make a UI very easily using an IDE like Netbeans. If you can't figure things out, google is always a resource. --[[User:JacobVengeance|Jacob]] 23:26, 25 September 2011 (MDT)
:::::Hmmm ok....... --Dylan Laws
::::Batch is run from the command line, not as a GUI... --[[User:Balloonhead66|Balloonhead66]] 20:00, 26 September 2011 (MDT)
:::::No GUI but i made iFixer under batch --Dylan Laws
::::::I was unable to find iFixer on the internet --[[User:Balloonhead66|Balloonhead66]] 20:22, 27 September 2011 (MDT)

[http://fr0st.zxq.net/saffron/WIN.html Windows] --Dylan Laws

User:Http

2011-11-25T15:34:50Z

Jacob: That has bugged me for days lol

{{DISPLAYTITLE:User:http}}
I'm employed as a professional software developer. My first machine code experience was on a [[wikipedia:Commodore 64|Commodore 64]] ([[wikipedia:MOS Technology 6510|6510 processor]]) in the early 80s I think. Later [[wikipedia:Motorola 68000|Motorola 68000]] ([[wikipedia:Amiga 2000|AMIGA 2000]]), [[wikipedia:Intel 80186|Intel 80186]] and [[wikipedia:HP Saturn (microprocessor)|SATURN]] (on the [[wikipedia:HP-48 series|HP48SX calculator]], I reverse engineered the whole operating system, that was 1992).

In the last ten years I'm not programming assembler anymore (only C/C++, JavaScript, .NET, etc.), but I know the basics of the new technology as well (memory protection by the processor etc.). I do ''not'' know ARM assembly or objective C yet, but both seem quite simple. I just didn't find the time to learn it yet.

I support some users through the page http://www.jbfaq.com.

I have an [[N90ap|iPhone 4]] and an [[K94ap|iPad 2 (3G)]]. I also have control of an [[N45ap|iPod Touch 1G]], an [[N88ap|iPhone 3GS]] (new boot) and an [[N81ap|iPod Touch 4G]]. Since June 2010 I have a [[wikipedia:Mac mini|Mac Mini]] for [http://developer.apple.com/ iPhone development], but actually don't use it.

You can [[Special:Emailuser/Http|reach me by email]] here, or on [http://www.twitter.com/SwissHttp Twitter: SwissHttp].

Talk:Main Page

2011-11-20T21:05:10Z

Jacob:

{{Talk Archive|2010|2011}}

== [[iPhone Tracker]] ==
[[iPhone Tracker]]? --[[User:Balloonhead66|Balloonhead66]] 11:34, 9 September 2011 (MDT)

== Steve Jobs ==
Rest in peace, Steve. You will be especially missed by us here at the iPhone Wiki, as without you, we wouldn't have the iPhone, the iPod, or the iPad, and we wouldn't be hacking them. You were a true genius, a true visionary, and most of all, the best person this world has ever seen. Thank you, Steve. --[[User:Rdqronos|rdqronos]] 18:28, 5 October 2011 (MDT)
:<nowiki />*thumbs up* --[[User:Balloonhead66|Balloonhead66]] 20:49, 19 November 2011 (MST)

== Block ==
Why is there a three year block on this? (I'm surprised it has been one year already...) --[[User:Balloonhead66|Balloonhead66]] 20:49, 19 November 2011 (MST)
:As I recall, an edit war kept breaking out in the "Hackers" section. I gave a warning that the next time an edit war occurred, it would be protected for three years.[http://theiphonewiki.com/wiki/index.php?title=Special%3ALog&type=protect&page=Main+Page] --[[User:Dialexio|Dialexio]] 10:04, 20 November 2011 (MST)
::What about moving it (and the header of the next one to keep people from placing it below the <nowiki>{{Main Page/Hackers}}</nowiki>) to [[Main Page/Hackers]] and protecting that page? --[[User:Balloonhead66|Balloonhead66]] 13:13, 20 November 2011 (MST)
:::I don't think we should have to edit the main page enough to branch it off like that. We should keep things organized rather than making new pages. --[[User:JacobVengeance|Jacob]] 14:05, 20 November 2011 (MST)

Bootrom

2011-11-19T20:36:02Z

Jacob: /* Linux */ No need for gnome-device-manager. Also for people who don't use gnome.

==Introduction / old+new==
The bootrom (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

Certain models, including the [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].

You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.

==Finding bootrom version==
===From the model number ([[n72ap|iPod touch 2G]])===
If the second character of your Model Number is "B" (e.g.- '''FB533''', '''MB533''', or '''PB533'''), your iPod has the old bootrom. If the second character is "C" ('''FC086''', '''MC086''' or '''PC086'''), your iPod has the new bootrom.

===From the serial number ([[n88ap|iPhone 3GS]])===
The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010), while the fourth and the fifth indicate the week. The first "new bootrom" devices are from week 40 of 2009 (??940?????? or higher serials). Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.

===From the DFU Device descriptors (All devices)===
====Windows====
# Connect Device & Enter [[DFU Mode]]
# Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver
# Right-Click & click Properties
# Go to Details tab & select Device Instance Path in the dropdown box
# The end of the info string will show the bootrom version

====Mac OS X====
# Connect Device & Enter [[DFU Mode]]
# Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)
# The end of the Serial Number string will show the bootrom version in brackets (ie: [iBoot-574.4])

====Linux====
# Make sure your distribution has '''usbutils''' installed. (most distributions have it by default)
# Connect Device & Enter [[DFU Mode]]
# In terminal, run '''sudo lsusb -v'''
# Find the line that says '''iSerial''' and your bootrom version will be at the end of the line.

== Dumping the bootrom ==
You can use [[Bootrom Dumper Utility]] by [[User:pod2g|pod2g]] to dump the bootrom on devices that are vulnerable to the [[limera1n]] exploit.

== Revisions ==
===[[S5L8720]], used in the [[N72ap|iPod touch 2G]]===
* [[iBoot-240.4]] "old bootrom"
* [[iBoot-240.5.1]] "new bootrom"

===[[S5L8920]], used in the [[N88ap|iPhone 3GS]]===
* [[iBoot-359.3]] "old bootrom"
* [[iBoot-359.3.2]] "new bootrom"

===[[S5L8922]], used in the [[N18ap|iPod touch 3G]]===
* [[iBoot-359.5]]

===[[S5L8930]], used in the [[K48ap|iPad]], [[N90ap|iPhone 4]], [[K66ap|Apple TV 2G]] and [[N81ap|iPod touch 4G]]===
* [[iBoot-574.4]]

===[[S5L8940]], used in the [[iPad 2]] and [[N94ap|iPhone 4S]]===
* [[iBoot-838.3]]

Pwnage

2011-11-18T17:48:33Z

Jacob:

This exploit is in the [[S5L8900]] bootrom, thus available in the [[M68ap|iPhone]], [[N45ap|iPod touch]], and [[N82ap|iPhone 3G]]. The exploit is that the bootrom doesn't signature check [[LLB]].

==Credit==
[[iPhone Dev Team]]

==Exploit==
===[[S5L8900]]===
Pwnage exploits a bad chain of trust in the boot sequence of the S5L8900 device. The boot sequence includes [[LLB]] and [[iBoot (Bootloader)|iBoot]] modules which are stored in the device's [[NOR]] flash and are typically encrypted (as of 1.1.*). However, they are not signed with RSA signature at that point, because the 8900 container is dropped away before the file is written to NOR. Pwnage exploits this vulnerability.

First, Apple assumes that if something is in NOR, it had necessarily passed through an RSA signature verification, and is therefore authentic Apple code. This is incorrect, because the only mechanism preventing the writing of unauthorized code to the NOR flash is the kernel. The iPhone/iPod touch kernel contains an extension designed specifically to write to NOR, called AppleImage2NORAccess. This extension performs an RSA signature verification on any data it tries to write. The verification itself is performed by the FairPlay extension, which is heavily obfuscated, but neutering the check is very simple. After the check is patched out, anything can be written to the NOR flash.

Second, Apple assumes that disabling the encryption keys in “normal” environment will prevent from writing firmware files to the NOR flash. Luckily, we have found a way to run our code in “secure” environment and use AppleImage2NORAccess extension the same way as Apple does it on restore.

Before iOS 2.0, the [[NOR]] was set up in a way that when the firmware images were flashed there, the RSA signatures were dropped along with the rest of the firmware container. So although [[iBoot (Bootloader)|iBoot]] signature checked the [[kernel]], [[LLB]] did not signature check [[iBoot (Bootloader)|iBoot]], and the [[VROM]] did not signature check [[LLB]].

Pwnage starts by booting from a memory device (ramdisk) in “secure” environment to prevent the kernel from disabling encryption keys. Also, we add another memory device, pointed at the kernel's address space, to allow live kernel patching. After booting up, we patch out signature check from AppleImage2NorAccess extention and proceed with flashing our custom firmware files ([[iBoot (Bootloader)|iBoot]], [[LLB]], DeviceTree, and pictures). Because the signature check has been patched out, and encryption keys are available, AppleImage2NORAccess happily writes them to the suitable location in NOR flash. After that, the device can be restarted, and will accept any unsigned 8900 file without complaint.

One specific aspect of the attack that is worth examining more closely is the [[iBoot (Bootloader)|iBoot]] patch. iBoot is the last and most complicated bootloader on the devices, and is what actually loads up the kernel with DeviceTree. However, Apple made the decision to keep all the PKE (Public Key Encryption) logic out of iBoot, instead putting it in the secure bootloader. Thus, iBoot actually jumps into the secure bootloader when it wants to verify the authenticity of an 8900 file. This makes it hard to directly patch out the RSA signature verification from iBoot, as it actually occurs in the secure bootloader. Simply killing the jump into the secure bootloader is impossible, as it also fills in other information iBoot needs to proceed.

Because of the tight coupling between the secure bootloader and the higher-level bootloaders, Apple gave us a solution: the secure bootloader often needs to call functions in the higher-level bootloaders, but it has the problem of knowing where to jump, as functions move around in different revisions. To get around this, Apple made thunks out of the function calls, and makes the higher-level bootloaders patch the secure bootloader on the fly (in RAM) with the relevant jump addresses. They just copy the secure bootloader into RAM and blindly apply a list of patches to it. We exploited this pre-existing patching mechanism to patch out the RSA signature verification from secure bootloader.

Post-2.0, images are now written to [[NOR]] in a way that one can verify the other, like [[LLB]] verifying [[iBoot (Bootloader)|iBoot]], the [[VROM (S5L8900)|bootrom]] cannot be written to, so it still defaults to just reading [[LLB]] normally, un-signature checked.

The [[bootrom]] has a vulnerability in [[DFU Mode]] when processesing iBoot certificates which are on a DER format. It copies all the certificate information onto the stack, but the signature itself is copied without any sort of bounds checking. So then you have classic stack buffer overflow and then you just make the signature checking function return true.

[[25C3 presentation "Hacking the iPhone"|More info]].

===[[S5L8720]] and on===
This exploit has been fixed on the [[N72ap|iPod touch 2G]] and all devices released after it. The [[VROM (S5L8720)|bootrom]] sigchecks [[LLB]] before jumping to it now, and if the [[LLB]] is patched, it will default to [[DFU Mode]]. The [[0x24000 Segment Overflow]] exploit was later found in the first revisions of the [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] [[bootrom]]s, allowing the device to be fully jailbroken. It has since been fixed with new bootrom revisions for these devices. Newer devices were never susceptible to the [[0x24000 Segment Overflow]].

==Implementation==
* [[PwnageTool]]
* [[XPwn]]
* [[iPhoneLinux]]

[[Category:Jailbreaks]]
[[Category:Exploits]]
[[Category:VROM]]
[[Category:Bootrom Exploits]]

S5L8940

2011-10-17T22:56:52Z

Jacob:

[[Image:A5.jpg|right]]
This is the Apple A5 processor, that is currently used in the [[iPad 2]] and the [[N94ap|iPhone 4S]]. Manufactured by Samsung, the processor itself is dual-core, with a processing speed of up to 1GHz.

{{stub}}

File:A5.jpg

2011-10-17T22:55:54Z

Jacob:

S5L8930

2011-10-17T22:54:07Z

Jacob: Picture

[[Image:A4.jpg|right]]
An SoC developed by Apple in-house chip design department. It is currently used in [[k48ap|iPad]], both models of the iPhone 4 ([[n90ap|GSM]] and [[n92ap|CDMA]]), [[K66ap|Apple TV 2G]] and the [[N81ap|iPod touch 4G]]. Publicly, Apple refers to this chip as the '''A4'''.

== Exploits ==

=== [[S5L8930 (Bootrom)|Bootrom]] ===
* [[limera1n]]
* [[SHAtter]]

=== [[iBoot]] ===
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

=== [[Kernel]] ===
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.2
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 4.0.1 (excluding iOS 3.2.2)
* [[Packet Filter Kernel Exploit]] - Works up to [[iOS]] 4.1
* [[HFS Legacy Volume Name Stack Buffer Overflow]] - Works up to [[iOS]] 4.2.8
* [[ndrv_setspec() Integer Overflow]] - Works up to [[iOS]] 4.3.3

=== [[Userland]] ===
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.2
* [[Malformed CFF Vulnerability]] - Works up to [[iOS]] 4.0.1 (excluding iOS 3.2.2)

== Boot Chain ==
[[S5L8930 (Bootrom)|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD
* '''RAM''': 256 MB ([[K66ap|Apple TV 2G]], [[K48ap|iPad]], and [[N81ap|iPod touch 4G]]) or 512 MB ([[iPhone 4]])

Aside from the [[iPhone 4]]'s additional RAM and an overall higher clock speed, these are the same specifications as the [[S5L8920]] and [[S5L8922]].

== See also ==
* [[S5L8930 (Bootrom)]]

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

File:A4.jpg

2011-10-17T22:52:56Z

Jacob: A picture of the A4 processor chip.

A picture of the A4 processor chip.

Talk:S5L8930

2011-10-17T22:25:21Z

Jacob:

==Icon==
Would there be any problem if i added the actually chip images to this and the [[A5]] page? I still love added images and icons to pages. --[[User:JacobVengeance|Jacob]] 16:25, 17 October 2011 (MDT)
==Merge?==
Should this and the A4 page be merged? They're practically the same in content. --[[User:Dialexio|Dialexio]] 17:18, 6 April 2010 (UTC)
:A4 is just the public name for the s5l8930, no? I say we merge it and make A4 redirect to this page, with a /very minor/ explanation on why it redirects you to this page. ~Drake
::This was from when the pages were separate entities. The problem has since been resolved. :) --[[User:Dialexio|Dialexio]] 04:13, 20 September 2010 (UTC)

==Is there an iBoot exploit?==

Geohot got the iPad to boot verbosely, and the VFDecrypt and other fun keys.

This almost certainly means there is an iboot/llb exploit out there, no? Can the keys be gotten with just a tethered bootrom exploits?

[[User:Iemit737|Iemit737]] 21:39, 25 August 2010 (UTC)

it could be possible he found a bootrom exploit that was pwnage 2 like however the real pwnage exploits the unchecked LLB but apple could have made a mistake with the new shsh check --[[User:Liamchat|liamchat]] 19:20, 29 August 2010 (UTC)

Are we sure that geohot even had an untethered bootrom exploit? He had denied that "pwned4life" or whatever it was was real. [[User:LiNK|LiNK]] 02:07, 20 September 2010 (UTC)

UPDATED:There /is/ a bootrom exploit. It's probably tethered (for now). It's a code-execution exploit, as you can't get keys without executing code. Hope this helps. ~Drake
::A bootrom exploit tethered or untethered can be used to boot verbosely, SIDEBAR: people take tethered/untethered as meaning far too much, all tethered/untethered means is you need to plug in to something to boot, it has absolutely NO bearing on any other capability --[[User:Lilstevie|Lilstevie]] 14:26, 20 September 2010 (UTC)

==New Untethered Kernel Exploit?==
http://blog.iphone-dev.org/post/1197198297/shattered-ipod-touch-4g
If you look closely in this video, upon respring there is some distortion in the top left corner. I'm guessing there is another one of those Spirit/Star type exploits in one of the frameworks that allows some shellcode to get stuck into the framebuffer to provide an untethered jailbreak... Which is awesome... [[User:Iemit737|Iemit737]] 22:59, 27 September 2010 (UTC)

I think it is a problem with [[PwnageTool]]; it is not ready for [[Iphone_4]] and [[N81ap]] yet and there were the same problems with [[Sn0wbreeze]] --[[User:Liamchat|liamchat]] 17:19, 28 September 2010 (UTC)

That's not correct at all. :/ It has to do with the exploit itself, not the program that is used to jailbreak. [[User:LiNK|LiNK]] 22:40, 3 October 2010 (UTC)

The problem is not really with pwnageTool because they said they got the touch 4G to restore a custom IPSW. The issue is getting a nice exploit for the main boot chain that's not tethered [[User:Iemit737|Iemit737]] 22:08, 28 September 2010 (UTC)

SHA-1 Image Segment Overflow

2011-10-16T19:37:06Z

Jacob: /* Compatibility */

SHAtter was an exploit that allowed unsigned code execution from a flaw in the bootrom. It was never used in a public jailbreak due to the exploit used in [[limera1n]] being released first.

== Compatibility ==
SHAtter only works with [[S5L8930|A4]] devices:
* [[k48ap|iPad]]
* [[iPhone 4]] (both models)
* [[n81ap|iPod touch 4G]]
* [[k66ap|Apple TV 2G]]

== Credit ==
*[[pod2g]]

== Vulnerability ==
Explaination by [[p0sixninja]] at [[MyGreatFest]]:

It tricked the bootrom to think the size of the image uploading was larger then what it actually was.Then when it would try to load the image, it would see that it was wrong. Then it would try to wipe out the entire image with all 0s and go past it and start wiping out bootrom.

Exploitation was done by overwriting sha1 registers to zeros so then when it went to check images it would copy part of image into 0x0. (where the bootrom is) It would take the image uploaded and copy it over top of the bootrom. (which turns out to be writable over the data portion)

[[Category:Bootrom Exploits]]

Bootrom 574.4

2011-10-16T19:35:30Z

Jacob:

This is the first revision of the [[S5L8930]] bootrom, found in the [[K48ap|iPad]], the [[N81ap|iPod touch 4G]], and in the [[N90ap|iPhone 4]]. Geohot has hinted at an undiscovered bootrom exploit in all iDevices. He then left the jailbreak scene, but came back to release [[limera1n]].

[[SHAtter]], a different exploit that only targets [[S5L8930]] devices was found, but never used.

The iPhone Wiki:Current events

2011-10-13T22:54:15Z

Jacob: /* Secondary */

'''See Also: ''[[Timeline]]'''''

== Primary Goals ==
* [[X-Gold 608 Unlock|Break X-Gold 608 Chain of Trust]]
* [[X-Gold 618 Unlock|Break X-Gold 618 Chain of Trust]]
* Break the chain of trust on devices with newer bootroms ([[N72ap|iPod touch 2G]], [[N18ap|iPod touch 3G]], [[N88ap|iPhone 3GS]], [[K48ap|iPad]], [[N90ap|iPhone 4 (GSM model)]], [[N81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]], [[N92ap|iPhone 4 (CDMA model)]]).
* Find a bootrom exploit that allows unsigned code execution (preferrably on startup) on newer devices ([[iPad 2]]).

== Secondary ==
* Get [[iDroid]] running on [[N72ap|iPod touch 2G]] and newer devices.
* Get kernel extensions working on 2.x+
* Finish the [[:/|Firmware]] Listing

JailbreakMe

2011-10-12T19:45:06Z

Jacob: jailbreakme.com/star

JailbreakMe is a site that has been used multiple times to jailbreak iDevices. It is currently online with the [[Saffron]] and [[Star]] Jailbreaks by [[User:Comex|comex]].

== First Incarnation (AppSnapp) ==
Initially, [http://www.conceitedsoftware.com/ Conceited Software] utilized the [[LibTiff]] exploit with jailbreakme.com, which also went by the name "AppSnapp," to jailbreak iOS 1.1.1. Upon the release of iOS 2.0 and the debut of the App Store, Conceited Software closed JailbreakMe, when it remained dormant for a while.

== Second Incarnation (Star) ==
{{main|Star}}
[[User:Comex|comex]] has since repurposed the domain for [[Star]], his userland [[jailbreak]] for iOS 3.1.2 through 4.0.1. However, comex stated that the bug used for the untethered jailbreak was there until 4.3 as Apple did not patch the bug correctly. It was properly patched on 4.3.1 in order to prevent the jailbreak of the iPad 2. It's still possible the site could be repurposed to jailbreak iDevices up to 4.3, but this has not yet been done.

== Third Incarnation (Saffron) ==
{{main|Saffron}}
In June 2011, comex began to put up teasers on JailbreakMe. In early July 2011, someone Googled comex's other site and found a prerelease version of "Saffron," the third incarnation of JailbreakMe. Word about this "leak" inevitably spread. On July 6, 2011, "Saffron" made its official debut on JailbreakMe.

== Owner Problem ==
On October 7, [[MuscleNerd]] announced that the domain was sold and that the new owner was unknown, so that there is a big danger of the site hosting malware. It turned out that the new owner was friendly and sold it the next day to [[Saurik]] who hosted the site anyway. Problem solved.
=== References ===
*[http://twitter.com/#!/MuscleNerd/status/122266354173739010 sale announcement]
*[http://twitter.com/#!/MuscleNerd/status/122267822280814592 untrusted]
*[http://twitter.com/#!/MuscleNerd/status/122715500349374465 buyback announcement]

== External Link ==
*[http://jailbreakme.com/ jailbreakme.com]

Usbmux

2011-10-12T09:22:37Z

Jacob:

During normal operations, [[iTunes]] communicates with the [[iPhone]] using something called “usbmux” – this is a system for multiplexing several “connections” over one USB pipe. Conceptually, it provides a TCP-like system – processes on the host machine open up connections to specific, numbered ports on the mobile device. (This resemblance is more than superficial – on the mobile device, usbmuxd actually makes TCP connections to localhost using the port number you give it.)

On the Mac, this is handled by /System/Library/PrivateFrameworks/MobileDevice.framework/Resources/usbmuxd, a daemon that is started by launchd (see /System/Library/LaunchDaemons/ com.apple.usbmuxd.plist). It creates a listening UNIX Domain Socket at /var/run/usbmuxd. usbmuxd then watches for [[iPhone]] connections via USB; when it detects an [[iPhone]] running in [[Normal_Mode|normal mode]] (as opposed to [[Recovery_Mode_(Protocols)|recovery mode]]), it will connect to it and then start relaying requests that it receives via /var/run/usbmuxd – this is to say, usbmuxd is the only thing that actually speaks USB to the [[iPhone]]. This means that third-party applications which wish to talk to the [[iPhone]] must either do so through usbmuxd, or usbmuxd must be replaced.

== Layered Communications ==

Communications between the host (generally, [[iTunes]] running on a Mac or Windows machine) and the device (an [[iPhone]], [[iPad]] or [[iPod touch]]) take place using a complicated scheme of nested layers. From lowest level to highest, they are:

* USB protocol: multiplexes multiple data streams over one pair of bulk endpoints
* usbmuxd protocol: provides a way of opening connections to TCP ports on the device
* lockdownd protocol: tbd
* iTunesHelper?
* AFC?

== Client to usbmuxd ==

When a process on the host machine wants to talk to the iPhone, it opens up a connection to /var/run/usbmuxd. It then performs an initial handshake; after this handshake, the data in the socket is transparently tunneled to the specified TCP port on the phone. An easy way to watch this happen is to use socat, like so:

sudo mv /var/run/usbmuxd /var/run/usbmuxx
sudo socat -t100 -x -v UNIX-LISTEN:/var/run/usbmuxd,mode=777,reuseaddr,fork UNIX-CONNECT:/var/run/usbmuxx

=== Data structures ===

All data structures are little-endian

struct usbmux_header {
u32 length; // length of message, including header
u32 reserved; // always zero
u32 type; // message type
u32 tag; // responses to this query will echo back this tag
};

struct usbmux_result {
struct usbmux_header header;
u32 result;
};

struct usbmux_connect_request {
struct usbmux_header header;
u32 device_id;
u16 port; // TCP port number
};

enum {
usbmux_result = 1,
usbmux_connect = 2,
usbmux_hello = 3,
};

=== Sequence of Events ===

1) Client opens connection to /var/run/usbmuxd

2) Client sends "Hello" packet:
10000000 00000000 03000000 02000000
(length = 0x10, reserved = 0, type = 3, tag = 2)

3) Client receives "Hello" response:
14000000 00000000 01000000 02000000 00000000
(length = 0x14, type = 1, tag = 2, result = 0)

4) Client receives device ID:
1c 01 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ................
19 00 00 00 91 12 31 33 31 34 64 66 34 61 30 30 ......1314df4a00
65 37 31 37 35 35 62 31 32 30 31 66 64 36 34 34 e71755b1201fd644
35 34 63 63 35 38 36 39 39 63 30 31 66 64 00 00 54cc58699c01fd..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[...]
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 10 fd ............
(length=0x1c1, type = 4, tag = 0, device_id = 0x19, usb_product_id = 0x1291, serial number string = "1314.....01fd".... ?)

5) Client sends TCP connect request:
18000000 00000000 02000000 03000000 19000000 00160000
(length = 0x18, type = 2, tag = 3, device_id = 0x19, port = 0x0016 (big-endian) = 22)

6) Client receives ACK:

* Connection refused:
14000000 00000000 01000000 03000000 03000000
(length = 0x14, type = 1, tag = 3, result = 3 -- connection refused?)

* Connection established:
14000000 00000000 01000000 03000000 00000000
(length = 0x14, type = 1, tag = 3, result = 0 -- no error)

From this point on, data is piped directly between the unix socket on the host and the TCP port on the device.

== lockdownd protocol ==

lockdownd uses port 62078. It uses a simple packet format - each packet is a 32-bit big-endian word indicating the size of the payload of the packet. Packets are in XML plist format, unless otherwise stated; the first two packets are shown in full, and the rest are abbreviated for the sake of readability.

Example: plug iTouch into iTunes

1. request: {Label=iTunesHelper, Request=QueryType}
0000011d (length of request, now in big-endian!)

ASCII payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>iTunesHelper</string>
<key>Request</key>
<string>QueryType</string>
</dict>
</plist>

2. response: {Request=QueryType, Result=Success, Type=com.apple.mobile.lockdown}
00000156 (length)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Request</key>
<string>QueryType</string>
<key>Result</key>
<string>Success</string>
<key>Type</key>
<string>com.apple.mobile.lockdown</string>
</dict>
</plist>

3. request: {Label=iTunesHelper, PairRecord={DeviceCertificate=xxxx,HostCertificate=xxxx,HostID=xxxx,RootCertificate=xxxx}, Request=ValidatePair}

<dict>
<key>Label</key>
<string>iTunesHelper</string>
<key>PairRecord</key>
<dict>
<key>DeviceCertificate</key>
<data>
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNOVENDQVIyZ0F3SUJB
[...]
RVJUSUZJQ0FURS0tLS0tCg==
</data>
<key>HostCertificate</key>
<data>
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN1akNDQWFLZ0F3SUJB
[...]
UlRJRklDQVRFLS0tLS0K
</data>
<key>HostID</key>
<string>D7......-....-....-....-........4EFE</string>
<key>RootCertificate</key>
<data>
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNyVENDQVpXZ0F3SUJB
[...]
NUVPRitjZVFNcUovZHBFdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
</data>
</dict>
<key>Request</key>
<string>ValidatePair</string>
</dict>

4. response: {Request=ValidatePair, Result=Success}

<dict>
<key>Request</key>
<string>ValidatePair</string>
<key>Result</key>
<string>Success</string>
</dict>

5. request: {HostID=xxx, Label=iTunesHelper, Request=StartSession}

<dict>
<key>HostID</key>
<string>D7......-....-....-....-........4EFE</string>
<key>Label</key>
<string>iTunesHelper</string>
<key>Request</key>
<string>StartSession</string>
</dict>

6. response: {EnableSessionSSL=true, Request=StartSession, Result=Success, SessionID=xxx}

<dict>
<key>EnableSessionSSL</key>
<true/>
<key>Request</key>
<string>StartSession</string>
<key>Result</key>
<string>Success</string>
<key>SessionID</key>
<string>DE622607-91A9-4DA7-A38C-F6DC1F8EF24F</string>
</dict>

== usbmuxd to iPhone ==

(TBD …)

== Acknowledgements ==

This document was originally part of wikee.iphwn.org, which no longer seems to exist. This version was pulled from archive.org on 12 Oct 2011, and was last edited on 13 Jul 2008. All credit for this document should go to the [[iPhone Dev Team]].

== Resources ==

* [[MobileDevice Library]]
* [http://libimobiledevice.org/docs/html/files.html Protocol Documentation]
* [http://libimobiledevice.org/ iFuse]

IDroid

2011-10-12T01:13:06Z

Jacob:

{{lowercase}}
[[Image:Openiboot.png|thumb|right|200px|Device running the OpeniBoot console.]]
iDroid is a project which goals are to port linux and Android to the [[iPhone]]/[[iPod touch]]/[[iPad]] and make a Free (free software) OS alternative to the Apple proprietary "{{wp|iOS (Apple)|iOS}}".

iDroid is not actually a hack/exploit neither an unlock, but it is based on [[Bootrom]] exploits which allowing the running of unsigned code at low level.

=== OpeniBoot ===

The goals of OpeniBoot are
* to run low-level code,
* to have low and critical drivers ([[NAND]] and [[NOR]] driver, [[NOR_(NVRAM)|NVRAM]]...), and
* to have a debugger and development environment (chainloading, upgrading itself and USB mass storage).

=== Linux ===
A linux Bootloader, a working linux kernel (just a question of cross-compiler), porting drivers, run wifi and command line through SSH.

=== Android ===
On April 21, 2010, an Android distribution based on iPhoneLinux called iDroid was released.

* Announcement on the linuxoniphone blog: [http://linuxoniphone.blogspot.com/2010/04/ive-been-working-on-this-quietly-in.html iDroid initial release]
* Official iDroid Wiki: [http://www.idroidproject.org/ iDroid Project]

== Frequently Asked Questions ==

To see answers to frequently-asked questions about iPhoneLinux and iDroid, go to the [http://www.idroidproject.org/wiki/Frequently_Asked_Questions iPhoneLinux FAQ] page.

Golden Master

2011-10-05T05:21:49Z

Jacob:

A golden master build is likely the final build of a piece of software. Three builds of iOS that were declared Golden Master are 2.0 5A345 (despite 5A347 being the publicly-released build), 4.0 8A293, and 5.0 9A334.
{{stub|firmware}}

User talk:Haifisch

2011-09-26T05:26:18Z

Jacob:

User talk:Haifisch

2011-09-26T04:50:21Z

Jacob:

IBootUtil

2011-09-25T17:09:06Z

Jacob: Lowercase F

{{lowercase}}
iBootutil is an open source iBoot communication tool by John Heaton (GoJohnnyboi). iBootUtil is for Mac console application. IOKit-based USB communication program that talks with the iPhone bootloader.

== Credit ==
* Gojohnnyboi

== Forks ==
*[https://github.com/isnowrain/ibootutil isnowra1n's fork with sending exploits added]

== Source code ==
*[https://github.com/Gojohnnyboi/ibootutil iBootUtil Source]

User:Jacob

2011-09-25T17:08:00Z

Jacob: Fixed. Went back to old username a while ago for a friend. Sorry :)

This is my main [http://twitter.com/JacobVengeance Twitter]
==Devices==
iPod touch 8GB 4G - iOS 4.3.3 jailbroken with [[Saffron]]

IBootUtil

2011-09-25T08:47:16Z

Jacob:

iBootutil is an open source iBoot communication tool by John Heaton (GoJohnnyboi). iBootUtil is for Mac console application. IOKit-based usb communication program that talks with the iPhone bootloader.

== Forks ==
*[https://github.com/isnowrain/ibootutil isnowra1n's Fork with sending exploits added]
*[http://theiphonewiki.com/wiki/index.php?title=BootRa1n BootRa1n]

==External Links==
*[https://github.com/Gojohnnyboi/ibootutil iBootUtil Source]

IBootUtil

2011-09-25T08:46:48Z

Jacob: :/

iBootutil is an open source iBoot communication tool by John Heaton (GoJohnnyboi). iBootUtil is for Mac console application. IOKit-based usb communication program that talks with the iPhone bootloader.

== Forks ==
*[https://github.com/isnowrain/ibootutil isnowra1n's Fork with sending exploits added}
*[http://theiphonewiki.com/wiki/index.php?title=BootRa1n BootRa1n]

==External Links==
*[https://github.com/Gojohnnyboi/ibootutil iBootUtil Source]

HFS Legacy Volume Name Stack Buffer Overflow

2011-09-23T07:03:35Z

Jacob: I0n1cs presentation also includes information about this vulnerability and exploit

The '''HFS Legacy Volume Name Stack Buffer Overflow''' is a [[kernel]] vulnerability used to achieve an [[untethered jailbreak]]. Its exploit implementation, dubbed "feedface,"[https://twitter.com/pod2g/status/33997326070583296] was used in conjunction with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]] in [[greenpois0n (jailbreak)|greenpois0n]].

== Credit ==
[[User:Jan0|jan0]], [[User:pod2g|pod2g]], [[User:posixninja|Posixninja]]

== Sources for information ==
*[http://www.twitlonger.com/show/8jep67 TwitLonger]
*http://pastie.org/2060071 (from a [https://twitter.com/0naj/status/80211549427482624 tweet] by [[User:jan0|jan0]])
*[http://www.slideshare.net/i0n1c/blackhat-usa-2011-stefan-esser-ios-kernel-exploitation BlackHat Presentation by [[I0n1c]]] (starting at slide 24)

[[Category:Exploits]]