The iPhone Wiki - User contributions [en]

Talk:IDA Pro Setup

2010-08-07T15:18:34Z

L0g0:

==update please==
==More instructions==
It could be great if someone writes more instructions for the other basebands and models.. I tried with the instruction for 3G baseband in 3gs 5.12.01 baseband and I got an error in IDA Pro...
--[[User:L0g0|L0g0]] 15:18, 7 August 2010 (UTC)

Thank you all for contributing. -caique2001-

----
==More instructions==
It could be great if someone writes more instructions for the other basebands and models.. I tried with the instruction for 3G baseband in 3gs 5.12.01 baseband and I got an error in IDA Pro...
--[[User:L0g0|L0g0]] 18:54, 29 July 2010 (UTC)
---

Hi! I'm a n00b trying to learn a way to discover vulnerabilities in baseband 05.12.01 ... but this article needs an update... please, someone update it , also it could help me to help you xD
Also, there is no tutorial on how to find a way to jailbreak, and there arent well documented all the actually available jailbreaks...

--[[User:L0g0|L0g0]] 06:21, 28 June 2010 (UTC)

http://www.theiphonewiki.com/wiki/index.php?title=Greenpois0n

use the greenpois0n utilities. [[User:Leobruh|Leobruh]] 07:34, 28 June 2010 (UTC)!

This page is correct and doesnt need an update. You need to read up on exploits if you want to make jailbreaks. Lately buffer based overflows have been used the most. Google it, Wikipedia it and understand what exploits are. Use IDA next. As for a tutorial, let me write one for you: 1. Find a function which can be exploited to run usercode, 2. Insert code to edit/overwrite fstab to
mount (all) disks as read/write, instead of read-only. Optional 3. Transfer cydia.app. Done.

- toomuchjames

Hi, could anyone explain, how to dump the bootrom (iPod Touch 2G MC). Thank you

== help ==

where do I get the baseband fls file???

== update please ==
==More instructions==
It could be great if someone writes more instructions for the other basebands and models.. I tried with the instruction for 3G baseband in 3gs 5.12.01 baseband and I got an error in IDA Pro...
--[[User:L0g0|L0g0]] 15:18, 7 August 2010 (UTC)

Talk:SUNorthstarTwo 7E18 (iPhone2,1)

2010-07-29T18:58:28Z

L0g0: /* Youtube Video about decryption error */

this keys are wrong!!!
Restore Ramdisk (018-6495-022.dmg)
* IV: 50a5d7418e3091a2c1d878495a6dbc6a
* Key: 217c7c38387264f2a2fef7a661d1bbeb705e7c90581c5b73055fe44f5bbc0498
{{unsigned|L0g0|01:03, July 27, 2010}}

I can confirm that these keys are in fact correct..
<pre>$ xpwntool 018-6495-022.dmg restore.dmg -iv 50a5d7418e3091a2c1d878495a6dbc6a -k 217c7c38387264f2a2fef7a661d1bbeb705e7c90581c5b73055fe44f5bbc0498
/home/ubuntu/code/posixninja/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 657029ec782d39a538418c0305cf98a7b8a7f38fcfa602e4dad677de90ee4bf91f3a81918aeded7b8bf1388f511aaf4f</pre>
This command produces a valid ramdisk
--[[User:Cool name|Cool name]] 00:43, 28 July 2010 (UTC)

==Youtube Video about decryption error==
MMM... Look at this... here it show there errors I'm telling you..
http://www.youtube.com/watch?v=7ivTu0003rI
[http://www.youtube.com/watch?v=7ivTu0003rI]
--[[User:L0g0|L0g0]] 08:41, 29 July 2010 (UTC)
:It seems like you are using an ancient version of xpwntool, this could be the issue. Look here for a newer version and try it out: http://www.posixninja.org/downloads.html --[[User:Cool name|Cool name]] 15:02, 29 July 2010 (UTC)
::It worked!! Thanks!!! only one question... the baseband fls file I must reverse is ICE2_05.12.01.fls? the other called ICE04.05.04_G.fls what is it? Thank you very much!!!
PD: I Get an error when trying to open the ICE2_05.12.01.fls file with IDA Pro.. using instruction for 3G Baseband,... perhaps that article needs an update with instructions for other baseband or an explanation of why we put those memory addresses so we can solve what to do with any baseband version.... http://theiphonewiki.com/wiki/index.php?title=IDA_Pro_Setup

--[[User:L0g0|L0g0]] 18:40, 29 July 2010 (UTC)

Talk:IDA Pro Setup

2010-07-29T18:54:41Z

L0g0:

Thank you all for contributing. -caique2001-

----
==More instructions==
It could be great if someone writes more instructions for the other basebands and models.. I tried with the instruction for 3G baseband in 3gs 5.12.01 baseband and I got an error in IDA Pro...
--[[User:L0g0|L0g0]] 18:54, 29 July 2010 (UTC)
---

Hi! I'm a n00b trying to learn a way to discover vulnerabilities in baseband 05.12.01 ... but this article needs an update... please, someone update it , also it could help me to help you xD
Also, there is no tutorial on how to find a way to jailbreak, and there arent well documented all the actually available jailbreaks...

--[[User:L0g0|L0g0]] 06:21, 28 June 2010 (UTC)

http://www.theiphonewiki.com/wiki/index.php?title=Greenpois0n

use the greenpois0n utilities. [[User:Leobruh|Leobruh]] 07:34, 28 June 2010 (UTC)!

This page is correct and doesnt need an update. You need to read up on exploits if you want to make jailbreaks. Lately buffer based overflows have been used the most. Google it, Wikipedia it and understand what exploits are. Use IDA next. As for a tutorial, let me write one for you: 1. Find a function which can be exploited to run usercode, 2. Insert code to edit/overwrite fstab to
mount (all) disks as read/write, instead of read-only. Optional 3. Transfer cydia.app. Done.

- toomuchjames

Hi, could anyone explain, how to dump the bootrom (iPod Touch 2G MC). Thank you

== help ==

where do I get the baseband fls file???

Talk:SUNorthstarTwo 7E18 (iPhone2,1)

2010-07-29T18:40:08Z

L0g0: /* Youtube Video about decryption error */

Talk:SUNorthstarTwo 7E18 (iPhone2,1)

2010-07-29T18:39:08Z

L0g0:

Talk:SUNorthstarTwo 7E18 (iPhone2,1)

2010-07-29T08:42:06Z

L0g0: /* Youtube Video about decryption error */

Talk:SUNorthstarTwo 7E18 (iPhone2,1)

2010-07-29T08:41:47Z

L0g0:

Talk:SUNorthstarTwo 7E18 (iPhone2,1)

2010-07-27T01:03:35Z

L0g0: New page: this keys are wrong!!! Restore Ramdisk (018-6495-022.dmg) * IV: 50a5d7418e3091a2c1d878495a6dbc6a * Key: 217c7c38387264f2a2fef7a661d1bbeb705e7c90581c5b73055fe44f5bbc0498

this keys are wrong!!!
Restore Ramdisk (018-6495-022.dmg)

* IV: 50a5d7418e3091a2c1d878495a6dbc6a
* Key: 217c7c38387264f2a2fef7a661d1bbeb705e7c90581c5b73055fe44f5bbc0498

Talk:IDA Pro Setup

2010-07-26T09:09:51Z

L0g0:

Thank you all for contributing. -caique2001-

----

Hi! I'm a n00b trying to learn a way to discover vulnerabilities in baseband 05.12.01 ... but this article needs an update... please, someone update it , also it could help me to help you xD
Also, there is no tutorial on how to find a way to jailbreak, and there arent well documented all the actually available jailbreaks...

--[[User:L0g0|L0g0]] 06:21, 28 June 2010 (UTC)

http://www.theiphonewiki.com/wiki/index.php?title=Greenpois0n

use the greenpois0n utilities. [[User:Leobruh|Leobruh]] 07:34, 28 June 2010 (UTC)!

This page is correct and doesnt need an update. You need to read up on exploits if you want to make jailbreaks. Lately buffer based overflows have been used the most. Google it, Wikipedia it and understand what exploits are. Use IDA next. As for a tutorial, let me write one for you: 1. Find a function which can be exploited to run usercode, 2. Insert code to edit/overwrite fstab to
mount (all) disks as read/write, instead of read-only. Optional 3. Transfer cydia.app. Done.

- toomuchjames

Hi, could anyone explain, how to dump the bootrom (iPod Touch 2G MC). Thank you

== help ==

where do I get the baseband fls file???

Talk:IDA Pro Setup

2010-06-28T06:21:42Z

L0g0:

Talk:IDA Pro Setup

2010-06-28T06:21:02Z

L0g0:

Thank you all for contributing. -caique2001-
Hi! I'm a n00b trying to learn a way to discover vulnerabilities in baseband 05.12.01 ... but this article needs an update... please, someone update it , also it could help me to help you xD
Also, there is no tutorial on how to find a way to jailbreak, and there arent well documented all the actually available jailbreaks...