The iPhone Wiki - User contributions [en]

Mobile obliterator

2009-06-25T11:18:36Z

MiW: New page: <nowiki> \o/ | <--- iphone thief /\ __o___ _ .%( _ ,)%_ ._ (_ ' ( ` ) _ .__) (...

<nowiki>
\o/
| <--- iphone thief
/\
__o___
_ .%( _ ,)%_ ._
(_ ' ( ` ) _ .__)
( ( ( ) ( `) ) _)
(__ (_ (_ . _) _) ,__)
`~~`\ ' . /`~~`
; ;
/ \
_____________/iPhone \_____________

</nowiki>

What does this mysterious function do?
Are you game enough to try it?

Libexec

2009-06-25T11:12:02Z

MiW:

<nowiki>
drwxr-xr-x 4 root wheel 1632 Jun 23 20:31 ./
drwxr-xr-x 10 root wheel 340 Jun 22 07:29 ../
-rwxr-xr-x 1 root wheel 222128 May 19 12:43 BackupAgent*
-rwxr-xr-x 1 root wheel 15920 May 19 12:34 CrashHousekeeping*
-rwxr-xr-x 1 root wheel 23920 May 19 12:27 CrashReportCopyAgent*
-rwxr-xr-x 1 root wheel 44784 May 19 12:36 SyncAgent*
-rwxr-xr-x 1 root wheel 15376 May 19 12:25 afcd*
-rwxr-xr-x 1 root wheel 18816 May 19 12:33 aggregated*
-rwxr-xr-x 1 root wheel 15440 May 19 12:27 amfid*
-rwxr-xr-x 1 root wheel 19600 Apr 21 19:21 bigram*
-rwxr-xr-x 1 root wheel 83120 May 19 12:25 bootpd*
-rwxr-xr-x 1 root wheel 19856 Apr 21 19:21 code*
-r-xr-xr-x 1 root wheel 185328 May 19 12:26 configd*
-rwxr-xr-x 1 root wheel 9616 May 19 12:27 crash_mover*
drwxr-xr-x 2 root wheel 340 Jun 24 23:28 cydia/
-rwxr-xr-x 1 root wheel 16032 May 19 12:25 debug_image_mount*
-rwxr-xr-x 1 root wheel 14224 Jun 22 00:58 devteam-utility*
-rwxr-xr-x 1 root wheel 13552 Apr 19 08:20 fingerd*
-rwxr-xr-x 1 root wheel 24288 Apr 21 19:21 frcode*
drwxr-xr-x 2 root wheel 170 Apr 25 07:31 gnupg/
-rwxr-xr-x 1 root wheel 557600 Jun 22 23:35 installd*
-rwxrwxrwx 1 root wheel 557488 Jun 22 23:31 installd-hacked-30*
-rwxr-xr-x 1 root wheel 19024 May 19 12:36 itdbprepserver*
-r-xr-xr-x 1 root wheel 10016 May 19 12:24 launchproxy*
-rwxr-xr-x 1 root wheel 1118736 May 19 12:38 locationd*
-rwxr-xr-x 1 root wheel 15216 May 19 12:38 lockbot*
-rwxr-xr-x 1 root wheel 625888 May 19 12:38 lockdownd*
-rwxr-xr-x 1 root wheel 30176 May 19 12:43 mc_mobile_tunnel*
-rwxr-xr-x 1 root wheel 10240 May 19 12:25 misagent*
-rwxr-xr-x 1 root wheel 102480 May 19 12:38 misd*
-rwxr-xr-x 1 root wheel 19664 May 19 12:24 mobile_file_relay*
-rwxr-xr-x 1 root wheel 14640 May 19 12:34 mobile_house_arrest*
-rwxr-xr-x 1 root wheel 29520 May 19 12:26 mobile_image_mounter*
-rwxr-xr-x 1 root wheel 14640 May 19 12:36 mobile_installation_proxy*
-rwxr-xr-x 1 root wheel 54864 May 19 12:31 </nowiki>[[mobile_obliterator]]*<nowiki>
-rwxr-xr-x 1 root wheel 20336 May 19 12:45 mobile_profile_janitor*
-rwxr-xr-x 1 root wheel 10256 May 19 12:25 notification_proxy*
-rwxr-xr-x 1 root wheel 152672 May 19 12:27 ptpd*
-rwxr-xr-x 1 root wheel 33584 Apr 21 19:31 rmt*
-rwxr-xr-x 1 root wheel 82448 May 19 12:26 securityd*
-rwxr-xr-x 1 root wheel 44240 May 5 16:28 sftp-server*
-rws--x--x 1 root wheel 155520 May 5 16:28 ssh-keysign*
-rwxr-xr-x 1 root wheel 28928 May 5 16:28 ssh-rand-helper*
-r-xr-xr-x 1 root wheel 449 Jan 2 2008 sshd-keygen-wrapper*
-rwxr-xr-x 1 root wheel 24448 May 19 12:23 stackshot*
-rwxr-xr-x 1 root wheel 9152 May 19 12:35 stackshotserver*
-rwxr-xr-x 1 root wheel 8928 May 19 12:26 syslog_relay*
-rwxr-xr-x 1 root wheel 13072 Apr 8 20:20 vndevice*

</nowiki>

Libexec

2009-06-25T11:11:26Z

MiW: New page: <nowiki> drwxr-xr-x 4 root wheel 1632 Jun 23 20:31 ./ drwxr-xr-x 10 root wheel 340 Jun 22 07:29 ../ -rwxr-xr-x 1 root wheel 222128 May 19 12:43 BackupAgent* -rwxr-xr-x 1 root w...

<nowiki>
drwxr-xr-x 4 root wheel 1632 Jun 23 20:31 ./
drwxr-xr-x 10 root wheel 340 Jun 22 07:29 ../
-rwxr-xr-x 1 root wheel 222128 May 19 12:43 BackupAgent*
-rwxr-xr-x 1 root wheel 15920 May 19 12:34 CrashHousekeeping*
-rwxr-xr-x 1 root wheel 23920 May 19 12:27 CrashReportCopyAgent*
-rwxr-xr-x 1 root wheel 44784 May 19 12:36 SyncAgent*
-rwxr-xr-x 1 root wheel 15376 May 19 12:25 afcd*
-rwxr-xr-x 1 root wheel 18816 May 19 12:33 aggregated*
-rwxr-xr-x 1 root wheel 15440 May 19 12:27 amfid*
-rwxr-xr-x 1 root wheel 19600 Apr 21 19:21 bigram*
-rwxr-xr-x 1 root wheel 83120 May 19 12:25 bootpd*
-rwxr-xr-x 1 root wheel 19856 Apr 21 19:21 code*
-r-xr-xr-x 1 root wheel 185328 May 19 12:26 configd*
-rwxr-xr-x 1 root wheel 9616 May 19 12:27 crash_mover*
drwxr-xr-x 2 root wheel 340 Jun 24 23:28 cydia/
-rwxr-xr-x 1 root wheel 16032 May 19 12:25 debug_image_mount*
-rwxr-xr-x 1 root wheel 14224 Jun 22 00:58 devteam-utility*
-rwxr-xr-x 1 root wheel 13552 Apr 19 08:20 fingerd*
-rwxr-xr-x 1 root wheel 24288 Apr 21 19:21 frcode*
drwxr-xr-x 2 root wheel 170 Apr 25 07:31 gnupg/
-rwxr-xr-x 1 root wheel 557600 Jun 22 23:35 installd*
-rwxrwxrwx 1 root wheel 557488 Jun 22 23:31 installd-hacked-30*
-rwxr-xr-x 1 root wheel 19024 May 19 12:36 itdbprepserver*
-r-xr-xr-x 1 root wheel 10016 May 19 12:24 launchproxy*
-rwxr-xr-x 1 root wheel 1118736 May 19 12:38 locationd*
-rwxr-xr-x 1 root wheel 15216 May 19 12:38 lockbot*
-rwxr-xr-x 1 root wheel 625888 May 19 12:38 lockdownd*
-rwxr-xr-x 1 root wheel 30176 May 19 12:43 mc_mobile_tunnel*
-rwxr-xr-x 1 root wheel 10240 May 19 12:25 misagent*
-rwxr-xr-x 1 root wheel 102480 May 19 12:38 misd*
-rwxr-xr-x 1 root wheel 19664 May 19 12:24 mobile_file_relay*
-rwxr-xr-x 1 root wheel 14640 May 19 12:34 mobile_house_arrest*
-rwxr-xr-x 1 root wheel 29520 May 19 12:26 mobile_image_mounter*
-rwxr-xr-x 1 root wheel 14640 May 19 12:36 mobile_installation_proxy*
-rwxr-xr-x 1 root wheel 54864 May 19 12:31 mobile_obliterator*
-rwxr-xr-x 1 root wheel 20336 May 19 12:45 mobile_profile_janitor*
-rwxr-xr-x 1 root wheel 10256 May 19 12:25 notification_proxy*
-rwxr-xr-x 1 root wheel 152672 May 19 12:27 ptpd*
-rwxr-xr-x 1 root wheel 33584 Apr 21 19:31 rmt*
-rwxr-xr-x 1 root wheel 82448 May 19 12:26 securityd*
-rwxr-xr-x 1 root wheel 44240 May 5 16:28 sftp-server*
-rws--x--x 1 root wheel 155520 May 5 16:28 ssh-keysign*
-rwxr-xr-x 1 root wheel 28928 May 5 16:28 ssh-rand-helper*
-r-xr-xr-x 1 root wheel 449 Jan 2 2008 sshd-keygen-wrapper*
-rwxr-xr-x 1 root wheel 24448 May 19 12:23 stackshot*
-rwxr-xr-x 1 root wheel 9152 May 19 12:35 stackshotserver*
-rwxr-xr-x 1 root wheel 8928 May 19 12:26 syslog_relay*
-rwxr-xr-x 1 root wheel 13072 Apr 8 20:20 vndevice*

</nowiki>

Filesystem

2009-06-25T11:09:00Z

MiW:

This is a ls -al from the shell of a JB 3.0 iPhone 3G.
<nowiki>
drwxrwxr-t 15 root admin 748 Jun 25 19:21 ./
drwxrwxr-t 15 root admin 748 Jun 25 19:21 ../
drwx------ 2 _unknown _unknown 204 May 22 17:33 .fseventsd/
lrwxr-xr-x 1 root admin 27 Jun 22 01:00 Applications -> /var/stash/Applications.pwn/
drwxrwxr-x 2 root admin 68 May 14 17:17 Developer/
drwxr-xr-t 14 root admin 714 Jun 22 07:29 Library/
drwxr-xr-x 3 root wheel 102 Jun 18 07:38 System/
lrwxr-xr-x 1 root admin 11 Jun 25 19:21 User -> /var/mobile/
drwxr-xr-x 2 root wheel 2006 Jun 22 23:38 bin/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 boot/
drwxrwxr-t 2 root admin 68 May 14 14:17 cores/
dr-xr-xr-x 3 root wheel 1237 Jun 25 19:20 dev/
lrwxrwxrwx 1 root wheel 12 Jun 22 01:00 etc -> private/etc//
drwxr-xr-x 2 root wheel 68 Oct 28 2006 lib/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 mnt/
drwxr-xr-x 4 root wheel 136 Jun 18 07:41 private/
drwxr-xr-x 2 root wheel 1224 Jun 22 01:05 sbin/
lrwxrwxrwx 1 root wheel 16 Jun 22 01:00 tmp -> private/var/tmp/
drwxr-xr-x 6 root wheel 306 Jun 22 01:02 </nowiki>[[usr]]<nowiki>
lrwxrwxrwx 1 root wheel 12 Jun 22 01:00 var -> private/var/
</nowiki>

Filesystem

2009-06-25T11:08:38Z

MiW:

This is a ls -al from the shell of a JB 3.0 iPhone 3G.
<nowiki>
drwxrwxr-t 15 root admin 748 Jun 25 19:21 ./
drwxrwxr-t 15 root admin 748 Jun 25 19:21 ../
drwx------ 2 _unknown _unknown 204 May 22 17:33 .fseventsd/
lrwxr-xr-x 1 root admin 27 Jun 22 01:00 Applications -> /var/stash/Applications.pwn/
drwxrwxr-x 2 root admin 68 May 14 17:17 Developer/
drwxr-xr-t 14 root admin 714 Jun 22 07:29 Library/
drwxr-xr-x 3 root wheel 102 Jun 18 07:38 System/
lrwxr-xr-x 1 root admin 11 Jun 25 19:21 User -> /var/mobile/
drwxr-xr-x 2 root wheel 2006 Jun 22 23:38 bin/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 boot/
drwxrwxr-t 2 root admin 68 May 14 14:17 cores/
dr-xr-xr-x 3 root wheel 1237 Jun 25 19:20 dev/
lrwxrwxrwx 1 root wheel 12 Jun 22 01:00 etc -> private/etc//
drwxr-xr-x 2 root wheel 68 Oct 28 2006 lib/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 mnt/
drwxr-xr-x 4 root wheel 136 Jun 18 07:41 private/
drwxr-xr-x 2 root wheel 1224 Jun 22 01:05 sbin/
lrwxrwxrwx 1 root wheel 16 Jun 22 01:00 tmp -> private/var/tmp/
drwxr-xr-x 6 root wheel 306 Jun 22 01:02 [[usr]]
lrwxrwxrwx 1 root wheel 12 Jun 22 01:00 var -> private/var/
</nowiki>

Filesystem

2009-06-25T10:14:02Z

MiW: 3.0 Update

This is a ls -al from the shell of a JB 3.0 iPhone 3G.

drwxrwxr-t 15 root admin 748 Jun 25 19:21 ./
drwxrwxr-t 15 root admin 748 Jun 25 19:21 ../
drwx------ 2 _unknown _unknown 204 May 22 17:33 .fseventsd/
lrwxr-xr-x 1 root admin 27 Jun 22 01:00 Applications -> /var/stash/Applications.pwn/
drwxrwxr-x 2 root admin 68 May 14 17:17 Developer/
drwxr-xr-t 14 root admin 714 Jun 22 07:29 Library/
drwxr-xr-x 3 root wheel 102 Jun 18 07:38 System/
lrwxr-xr-x 1 root admin 11 Jun 25 19:21 User -> /var/mobile/
drwxr-xr-x 2 root wheel 2006 Jun 22 23:38 bin/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 boot/
drwxrwxr-t 2 root admin 68 May 14 14:17 cores/
dr-xr-xr-x 3 root wheel 1237 Jun 25 19:20 dev/
lrwxrwxrwx 1 root wheel 12 Jun 22 01:00 etc -> private/etc//
drwxr-xr-x 2 root wheel 68 Oct 28 2006 lib/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 mnt/
drwxr-xr-x 4 root wheel 136 Jun 18 07:41 private/
drwxr-xr-x 2 root wheel 1224 Jun 22 01:05 sbin/
lrwxrwxrwx 1 root wheel 16 Jun 22 01:00 tmp -> private/var/tmp/
drwxr-xr-x 6 root wheel 306 Jun 22 01:02 [[usr]]
lrwxrwxrwx 1 root wheel 12 Jun 22 01:00 var -> private/var/

User:MiW

2009-01-03T09:39:02Z

MiW:

=Yo!=
I was in line for a prepaid iPhone on the 11th of July, and finally got it on the 24th of August.
Paid $849AUD for a 16GB and bought $80 worth of prepaid credit for the unlock codes.

I am interested in the OSX/BSD environment on the Phone, GPS and cryptography.

==2009==
I cracked my iphone screen at a music festival. Was facing outward in my pocket and some jerkface hit me in the side.
I have seen this injury before.

[[Image:Small-crack-glass-near-home.jpg]]

=Ideas=
[[Backup the iPhone Flash for restore without iTunes]]

File:Small-crack-glass-near-home.jpg

2009-01-03T09:37:06Z

MiW: my iphone glass got cracked :-(

my iphone glass got cracked :-(

User talk:ChronicDev

2008-10-18T04:50:16Z

MiW: questioning removal of my question

You're a sysop. Be careful with delete, unlinking is usually good enough

Hey chronic,

you were completely dismissive of my question and you removed it..
Its still a valid question and you didn't answer it:

Look at this revision.
http://www.theiphonewiki.com/wiki/index.php?title=System_Log&oldid=2269

You say cydia symlinks the partition.. rar rar yes yes
but the binaries have different sizes!! how does a symlink explain this?
These are TWO different binaries...
[[User:MiW|MiW]] 04:50, 18 October 2008 (UTC)

System Log

2008-08-31T09:57:40Z

MiW: ooooopps! do we need to be worried about user posting Hashes? Apple has a record of these via our ITMS's

=2 Syslogs?!?=
MiWs-IPhone:/var/log root# locate syslogd
/private/var/stash/libexec.??????/syslogd
/System/Library/LaunchDaemons/com.apple.syslogd.plist
/usr/sbin/syslogd

Miws-IPhone:/var/log root# ls -al /private/var/stash/libexec.??????/syslogd
-rwxr-xr-x 1 root wheel 216240 Jun 15 07:13 /private/var/stash/libexec.??????/syslogd*
Miws-IPhone:/var/log root# ls -al /usr/sbin/syslogd
-r-xr-xr-x 1 root wheel 72096 Aug 10 19:38 /usr/sbin/syslogd*

Thats a little strange.

MiW-IPhone:~ root# /var/stash/libexec.??????/syslogd --version
syslogd (GNU inetutils) 1.5
MiW-IPhone:~ root# /usr/libexec/syslogd --version
syslogd (GNU inetutils) 1.5

Same version, 71K vs 212K.... What is the difference friends?

=bgm's trick for enabling system log=

1. In the shell, do: echo "*.* /var/log/syslog" > /etc/syslog.conf

2. Add the following tags to /System/Library/LaunchDaemons/com.apple.syslogd.plist after the tag <string>/usr/sbin/syslogd</string>

<string>-bsd_out</string>
<string>1</string>

This will tell the Daemon Launcher to call /usr/sbin/syslogd -bsd_out 1, and we have configured it to write all messages to /var/log/syslog

3. "reboot & enjoy your kernel and other messages" (bgm)

==Note==
The syslog will grow very big quite quickly, but the folder /var/log/syslog is on the data partition (music, etc).<br>
If you keep your device full of music, be careful you don't fill the partition. Unix systems tend to break when they
cant write to the syslog. Keep an eye on it or employ some log rotation.

To disable:
In a shell, do:
rm /var/log/syslog; mknod /var/log/syslog c 3 2

This will turn /var/log/syslog into a /dev/null

To reenable:
In a shell, do:
rm /var/log/syslog; touch /var/log/syslog

This will remove the /dev/null and make a blank regular file

=Reference=
http://code.google.com/p/iphone-elite/wiki/IphoneSyslogd<br>
(full history: http://code.google.com/p/iphone-elite/source/list?path=/wiki/IphoneSyslogd.wiki&start=398)

System Log

2008-08-29T04:36:16Z

MiW: Added Syslog stuff

=2 Syslogs?!?=
MiWs-IPhone:/var/log root# locate syslogd
/private/var/stash/libexec.??????/syslogd
/System/Library/LaunchDaemons/com.apple.syslogd.plist
/usr/sbin/syslogd

Miws-IPhone:/var/log root# ls -al /private/var/stash/libexec.??????/syslogd
-rwxr-xr-x 1 root wheel 216240 Jun 15 07:13 /private/var/stash/libexec.L8zI9r/syslogd*
Miws-IPhone:/var/log root# ls -al /usr/sbin/syslogd
-r-xr-xr-x 1 root wheel 72096 Aug 10 19:38 /usr/sbin/syslogd*

Thats a little strange.

MiW-IPhone:~ root# /var/stash/libexec.??????/syslogd --version
syslogd (GNU inetutils) 1.5
MiW-IPhone:~ root# /usr/libexec/syslogd --version
syslogd (GNU inetutils) 1.5

Same version, 71K vs 212K.... What is the difference friends?

=Zibree's trick for enabling system log=

1. In the shell, do: echo "*.* /var/log/syslog" > /etc/syslog.conf

2. Add the following tags to /System/Library/LaunchDaemons/com.apple.syslogd.plist after the tag <string>/usr/sbin/syslogd</string>

<string>-bsd_out</string>
<string>1</string>

This will tell the Daemon Launcher to call /usr/sbin/syslogd -bsd_out 1, and we have configured it to write all messages to /var/log/syslog

3. "reboot & enjoy your kernel and other messages" (Zibree)

==Note==
The syslog will grow very big quite quickly, but the folder /var/log/syslog is on the data partition (music, etc).<br>
If you keep your device full of music, be careful you don't fill the partition. Unix systems tend to break when they
cant write to the syslog. Keep an eye on it or employ some log rotation.

To disable:
In a shell, do:
rm /var/log/syslog; mknod /var/log/syslog c 3 2

This will turn /var/log/syslog into a /dev/null

To reenable:
In a shell, do:
rm /var/log/syslog; touch /var/log/syslog

This will remove the /dev/null and make a blank regular file

=Reference=
Zibree, 2007, http://code.google.com/p/iphone-elite/wiki/IphoneSyslogd

Main Page

2008-08-29T04:10:41Z

MiW:

<table border=1 width=100%><tr>
<td bgcolor=#64ff64 width=50%><center><b>[[PwnageTool|Jailbreak]]</b></center></td>
<td bgcolor=#ff6464 width=50%><center><b>[[Unlock 2.0|Unlock]]</b></center></td>
</tr>
<tr>
<td colspan=2>
<center>[[Disclaimer]]</center>
</td>
</tr>
</table><BR>


{| cellspacing="3" width="100%"
|- valign="top"
|width="20%" class="MainPageBG" style="border: 1px #999999; color: #000; background-color: rgb(255,255,255)"|
<div style="padding: .3em .7em .7em"> <BR> <BR> __TOC__ </div>
|width="80%" class="MainPageBG" style="border: 1px #c6c9ff; color: #000; background-color: #f0f0ff"|
<div style="padding: .3em .7em .7em"> {{Welcome}} </div>
|}
==Software==
* [[Filesystem]]
* [[Device Nodes]]
* [[System Log]]

==Hardware==
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[n45ap|iPod Touch (n45ap)]]

==App Processor (Jailbreak)==
The iPhone makes use of the [[S5L8900]] platform as application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband (Unlock)==

The [[Baseband Device]] is where the [[unlock]] applies.

==File formats==
* [[8900 File Format]]
* [[IMG2 File Format]]
* [[IMG3 File Format]]
* [[secpack]]
* [[secpack 2.0]]
* [[seczone]]

==Protocols==
* [[Recovery Mode 0x1280]]
* [[Recovery Mode 0x1281]]
* [[DFU 0x1222]]
* [[WTF 0x1227]]
* [[Normal Mode 0x1290]]
* [[Restore Mode]]
* [[Baseband Bootrom Protocol]]
* [[Interactive Mode|Baseband Bootloader Protocol]]

==Keys==
* [[AES Keys]]
* [[Apple Certificate]]
* [[Baseband RSA Keys]]
* [[Baseband TEA Keys]]
* [[IMG3 Keys / IVs]]
* [[NCK]]
* [[VFDecrypt Keys|Root Filesystem DMG Keys]]

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Tutorials==
see [[Tutorials|here]]

==Useful Links==
see [[Useful Links|here]]

==Definitions==
* [[jailbreak]]
* [[activation]]
* [[unlock]]
* [[Baseband Device|baseband]]
* [[Baseband Bootloader|bootloader]]
* [[DFU]]
* [[NORID]]
* [[CHIPID]]

Device Nodes

2008-08-29T03:58:22Z

MiW: /* Interesting Character Devices */

The underlying unix OS that powers the iPhone has a number of device nodes.
These nodes can be read from or written to by the OS or applications.

A iPhone 3G 2.0.2 contains:

crw-rw-rw- 1 root wheel 21, 0 Aug 28 15:35 aes_0
crw------- 1 root wheel 23, 0 Aug 28 18:56 bpf0
crw------- 1 root wheel 23, 1 Aug 28 18:56 bpf1
crw------- 1 root wheel 23, 2 Aug 28 15:35 bpf2
crw------- 1 root wheel 23, 3 Aug 28 15:35 bpf3
c------r-- 1 root wheel 11, 0 Aug 28 15:35 btreset
crw--w--w- 1 root wheel 0, 0 Aug 28 15:35 console
crw-rw-rw- 1 root wheel 1, 5 Aug 28 18:56 cu.bluetooth
crw-rw-rw- 1 root wheel 1, 7 Aug 28 15:35 cu.debug
crw-rw-rw- 1 root wheel 1, 1 Aug 28 15:35 cu.iap
crw-rw-rw- 1 root wheel 1, 3 Aug 28 15:35 cu.umts
brw-r----- 1 root operator 14, 0 Aug 28 15:35 disk0
brw-r----- 1 root operator 14, 1 Aug 28 15:35 disk0s1
brw-r----- 1 root operator 14, 2 Aug 28 15:35 disk0s2
crw------- 1 root wheel 9, 0 Aug 28 15:35 dlci.spi-baseband.0
crw------- 1 root wheel 9, 1 Aug 28 18:56 dlci.spi-baseband.1
crw------- 1 root wheel 9, 10 Aug 28 15:35 dlci.spi-baseband.10
crw------- 1 root wheel 9, 11 Aug 28 15:35 dlci.spi-baseband.11
crw------- 1 root wheel 9, 12 Aug 28 15:35 dlci.spi-baseband.12
crw------- 1 root wheel 9, 13 Aug 28 15:35 dlci.spi-baseband.13
crw------- 1 root wheel 9, 14 Aug 28 15:35 dlci.spi-baseband.14
crw------- 1 root wheel 9, 15 Aug 28 15:35 dlci.spi-baseband.15
crw------- 1 root wheel 9, 2 Aug 28 19:13 dlci.spi-baseband.2
crw------- 1 root wheel 9, 3 Aug 28 18:56 dlci.spi-baseband.3
crw------- 1 root wheel 9, 4 Aug 28 18:56 dlci.spi-baseband.4
crw------- 1 root wheel 9, 5 Aug 28 18:56 dlci.spi-baseband.5
crw------- 1 root wheel 9, 6 Aug 28 18:56 dlci.spi-baseband.6
crw------- 1 root wheel 9, 7 Aug 28 18:56 dlci.spi-baseband.7
crw------- 1 root wheel 9, 8 Aug 28 18:56 dlci.spi-baseband.8
crw------- 1 root wheel 9, 9 Aug 28 18:56 dlci.spi-baseband.9
crw------- 1 root wheel 6, 0 Aug 28 15:35 klog
cr--r--r-- 1 root wheel 13, 3 Aug 28 15:35 mrvl868x0
crw------- 1 root wheel 9, 0 Aug 28 15:35 mux.spi-baseband
crw-rw-rw- 1 root wheel 3, 2 Aug 28 18:56 null
crw-rw-rw- 1 root tty 15, 1 Aug 28 19:13 ptmx
crw-rw-rw- 1 root wheel 5, 0 Aug 28 15:35 ptyp0
crw-rw-rw- 1 root wheel 5, 1 Aug 28 15:35 ptyp1
crw-rw-rw- 1 root wheel 5, 2 Aug 28 15:35 ptyp2
crw-rw-rw- 1 root wheel 5, 3 Aug 28 15:35 ptyp3
crw-rw-rw- 1 root wheel 5, 4 Aug 28 15:35 ptyp4
crw-rw-rw- 1 root wheel 5, 5 Aug 28 15:35 ptyp5
crw-rw-rw- 1 root wheel 5, 6 Aug 28 15:35 ptyp6
crw-rw-rw- 1 root wheel 5, 7 Aug 28 15:35 ptyp7
crw-rw-rw- 1 root wheel 8, 0 Aug 28 15:35 random
crw-r----- 1 root operator 14, 0 Aug 28 15:35 rdisk0
crw-r----- 1 root operator 14, 1 Aug 28 15:35 rdisk0s1
crw-r----- 1 root operator 14, 2 Aug 28 15:35 rdisk0s2
crw-rw-rw- 1 root wheel 20, 0 Aug 28 15:35 sha1_0
crw-rw-rw- 1 root wheel 2, 0 Aug 28 15:35 tty
crw-rw-rw- 1 root wheel 1, 4 Aug 28 15:35 tty.bluetooth
crw-rw-rw- 1 root wheel 1, 6 Aug 28 15:35 tty.debug
crw-rw-rw- 1 root wheel 1, 0 Aug 28 15:35 tty.iap
crw-rw-rw- 1 root wheel 1, 2 Aug 28 15:35 tty.umts
crw-rw-rw- 1 root wheel 4, 0 Aug 28 15:35 ttyp0
crw-rw-rw- 1 root wheel 4, 1 Aug 28 15:35 ttyp1
crw-rw-rw- 1 root wheel 4, 2 Aug 28 15:35 ttyp2
crw-rw-rw- 1 root wheel 4, 3 Aug 28 15:35 ttyp3
crw-rw-rw- 1 root wheel 4, 4 Aug 28 15:35 ttyp4
crw-rw-rw- 1 root wheel 4, 5 Aug 28 15:35 ttyp5
crw-rw-rw- 1 root wheel 4, 6 Aug 28 15:35 ttyp6
crw-rw-rw- 1 root wheel 4, 7 Aug 28 15:35 ttyp7
crw--w---- 1 root tty 16, 0 Aug 28 19:13 ttys000
crw-rw-rw- 1 root wheel 10, 2 Aug 28 15:35 uart.bluetooth
crw-rw-rw- 1 root wheel 10, 3 Aug 28 15:35 uart.debug
crw-rw-rw- 1 root wheel 10, 0 Aug 28 15:35 uart.iap
crw-rw-rw- 1 root wheel 10, 1 Aug 28 15:35 uart.umts
crw-rw-rw- 1 root wheel 8, 1 Aug 28 15:35 urandom
brw------- 1 root operator 1, 0 Aug 28 15:35 vn0
brw------- 1 root operator 1, 1 Aug 28 15:35 vn1
crw-rw-rw- 1 root wheel 3, 3 Aug 28 15:35 zero

=Block Devices=
{| border="1" cellpadding="20" cellspacing="0"
|disk0
|iPhone flash memory (4, 8 or 16GB)
|-
| disk0s1
| OS partition. Stores / root file system.
|-
| disk0s2
| User space. Stores Music, Photos, Videos, Podcasts, Ringtones and Apps. Mounted as /private/var.
|-
| vn0
| unknown
|-
| vn1
| unknown
|-
|}

=Interesting Character Devices=
{|border="1" cellpadding="20" cellspacing="0"
|Dev Node
|Description
|Children
|-
| rdisk0
| RAW Disk; to access the Flash
| rdisk0s1 (root) rdisk0s2 (data)
|-
| dlci.spi-baseband
| iPhone Baseband Radio
| dlci.spi-baseband.0 - dlci.spi-baseband.15
|-
| uart.umts
| Serial connection to the Utms radio (?)
|-
| dlci.spi-baseband.9
| GPS device (read from by /usr/libexec/locationd82 for CoreLocation services)
|-
| mem
| Raw access to RAM (has been blocked since 1.0.2)
| kmem, Raw access to Kernel Memory (also blocked since 1.0.2)
|-
|}

User:MiW

2008-08-29T03:16:33Z

MiW: New page: =Yo!= I was in line for a prepaid iPhone on the 11th of July, and finally got it on the 24th of August. Paid $849AUD for a 16GB and bought $80 worth of prepaid credit for the unlock codes....

Tutorials

2008-08-29T03:11:51Z

MiW: not ready yet....

== Jailbreaking ==

You can read lots of tutorials on [[Useful_Links#Websites|iClarified]]. Also have a look on the [[Ground_Rules#A_note_on_tutorials|ground rules]] concerning tutorials.

==Unlocking==
* [[Unlock iPhone 3G with TurboSim|TurboSIM Unlock, for iPhone 3G]]
* [[Unlock iPhone with WinPwn 2.0|Unlock firmware version 2.0 with WinPwn 2.0, for original iPhone]]

==Troubleshooting==
* [[Troubleshoot Winpwn-iTunes common errors]]

==Semi-Technical==
* [[Mounting ramdisk of ipsw beta 4-7]]

==Reversing==
* [[IDA Pro Setup|Setting up IDA Pro Advanced to reverse the baseband]]

==Resources==
Check also the [[Useful Links|link section]].

Tutorials

2008-08-29T02:52:15Z

MiW:

== Jailbreaking ==

You can read lots of tutorials on [[Useful_Links#Websites|iClarified]]. Also have a look on the [[Ground_Rules#A_note_on_tutorials|ground rules]] concerning tutorials.
==Backup==
* [[Backup the iPhone Flash for restore without iTunes]]

==Unlocking==
* [[Unlock iPhone 3G with TurboSim|TurboSIM Unlock, for iPhone 3G]]
* [[Unlock iPhone with WinPwn 2.0|Unlock firmware version 2.0 with WinPwn 2.0, for original iPhone]]

==Troubleshooting==
* [[Troubleshoot Winpwn-iTunes common errors]]

==Semi-Technical==
* [[Mounting ramdisk of ipsw beta 4-7]]

==Reversing==
* [[IDA Pro Setup|Setting up IDA Pro Advanced to reverse the baseband]]

==Resources==
Check also the [[Useful Links|link section]].

Device Nodes

2008-08-29T02:43:05Z

MiW:

The underlying unix OS that powers the iPhone has a number of device nodes.
These nodes can be read from or written to by the OS or applications.

A iPhone 3G 2.0.2 contains:

crw-rw-rw- 1 root wheel 21, 0 Aug 28 15:35 aes_0
crw------- 1 root wheel 23, 0 Aug 28 18:56 bpf0
crw------- 1 root wheel 23, 1 Aug 28 18:56 bpf1
crw------- 1 root wheel 23, 2 Aug 28 15:35 bpf2
crw------- 1 root wheel 23, 3 Aug 28 15:35 bpf3
c------r-- 1 root wheel 11, 0 Aug 28 15:35 btreset
crw--w--w- 1 root wheel 0, 0 Aug 28 15:35 console
crw-rw-rw- 1 root wheel 1, 5 Aug 28 18:56 cu.bluetooth
crw-rw-rw- 1 root wheel 1, 7 Aug 28 15:35 cu.debug
crw-rw-rw- 1 root wheel 1, 1 Aug 28 15:35 cu.iap
crw-rw-rw- 1 root wheel 1, 3 Aug 28 15:35 cu.umts
brw-r----- 1 root operator 14, 0 Aug 28 15:35 disk0
brw-r----- 1 root operator 14, 1 Aug 28 15:35 disk0s1
brw-r----- 1 root operator 14, 2 Aug 28 15:35 disk0s2
crw------- 1 root wheel 9, 0 Aug 28 15:35 dlci.spi-baseband.0
crw------- 1 root wheel 9, 1 Aug 28 18:56 dlci.spi-baseband.1
crw------- 1 root wheel 9, 10 Aug 28 15:35 dlci.spi-baseband.10
crw------- 1 root wheel 9, 11 Aug 28 15:35 dlci.spi-baseband.11
crw------- 1 root wheel 9, 12 Aug 28 15:35 dlci.spi-baseband.12
crw------- 1 root wheel 9, 13 Aug 28 15:35 dlci.spi-baseband.13
crw------- 1 root wheel 9, 14 Aug 28 15:35 dlci.spi-baseband.14
crw------- 1 root wheel 9, 15 Aug 28 15:35 dlci.spi-baseband.15
crw------- 1 root wheel 9, 2 Aug 28 19:13 dlci.spi-baseband.2
crw------- 1 root wheel 9, 3 Aug 28 18:56 dlci.spi-baseband.3
crw------- 1 root wheel 9, 4 Aug 28 18:56 dlci.spi-baseband.4
crw------- 1 root wheel 9, 5 Aug 28 18:56 dlci.spi-baseband.5
crw------- 1 root wheel 9, 6 Aug 28 18:56 dlci.spi-baseband.6
crw------- 1 root wheel 9, 7 Aug 28 18:56 dlci.spi-baseband.7
crw------- 1 root wheel 9, 8 Aug 28 18:56 dlci.spi-baseband.8
crw------- 1 root wheel 9, 9 Aug 28 18:56 dlci.spi-baseband.9
crw------- 1 root wheel 6, 0 Aug 28 15:35 klog
cr--r--r-- 1 root wheel 13, 3 Aug 28 15:35 mrvl868x0
crw------- 1 root wheel 9, 0 Aug 28 15:35 mux.spi-baseband
crw-rw-rw- 1 root wheel 3, 2 Aug 28 18:56 null
crw-rw-rw- 1 root tty 15, 1 Aug 28 19:13 ptmx
crw-rw-rw- 1 root wheel 5, 0 Aug 28 15:35 ptyp0
crw-rw-rw- 1 root wheel 5, 1 Aug 28 15:35 ptyp1
crw-rw-rw- 1 root wheel 5, 2 Aug 28 15:35 ptyp2
crw-rw-rw- 1 root wheel 5, 3 Aug 28 15:35 ptyp3
crw-rw-rw- 1 root wheel 5, 4 Aug 28 15:35 ptyp4
crw-rw-rw- 1 root wheel 5, 5 Aug 28 15:35 ptyp5
crw-rw-rw- 1 root wheel 5, 6 Aug 28 15:35 ptyp6
crw-rw-rw- 1 root wheel 5, 7 Aug 28 15:35 ptyp7
crw-rw-rw- 1 root wheel 8, 0 Aug 28 15:35 random
crw-r----- 1 root operator 14, 0 Aug 28 15:35 rdisk0
crw-r----- 1 root operator 14, 1 Aug 28 15:35 rdisk0s1
crw-r----- 1 root operator 14, 2 Aug 28 15:35 rdisk0s2
crw-rw-rw- 1 root wheel 20, 0 Aug 28 15:35 sha1_0
crw-rw-rw- 1 root wheel 2, 0 Aug 28 15:35 tty
crw-rw-rw- 1 root wheel 1, 4 Aug 28 15:35 tty.bluetooth
crw-rw-rw- 1 root wheel 1, 6 Aug 28 15:35 tty.debug
crw-rw-rw- 1 root wheel 1, 0 Aug 28 15:35 tty.iap
crw-rw-rw- 1 root wheel 1, 2 Aug 28 15:35 tty.umts
crw-rw-rw- 1 root wheel 4, 0 Aug 28 15:35 ttyp0
crw-rw-rw- 1 root wheel 4, 1 Aug 28 15:35 ttyp1
crw-rw-rw- 1 root wheel 4, 2 Aug 28 15:35 ttyp2
crw-rw-rw- 1 root wheel 4, 3 Aug 28 15:35 ttyp3
crw-rw-rw- 1 root wheel 4, 4 Aug 28 15:35 ttyp4
crw-rw-rw- 1 root wheel 4, 5 Aug 28 15:35 ttyp5
crw-rw-rw- 1 root wheel 4, 6 Aug 28 15:35 ttyp6
crw-rw-rw- 1 root wheel 4, 7 Aug 28 15:35 ttyp7
crw--w---- 1 root tty 16, 0 Aug 28 19:13 ttys000
crw-rw-rw- 1 root wheel 10, 2 Aug 28 15:35 uart.bluetooth
crw-rw-rw- 1 root wheel 10, 3 Aug 28 15:35 uart.debug
crw-rw-rw- 1 root wheel 10, 0 Aug 28 15:35 uart.iap
crw-rw-rw- 1 root wheel 10, 1 Aug 28 15:35 uart.umts
crw-rw-rw- 1 root wheel 8, 1 Aug 28 15:35 urandom
brw------- 1 root operator 1, 0 Aug 28 15:35 vn0
brw------- 1 root operator 1, 1 Aug 28 15:35 vn1
crw-rw-rw- 1 root wheel 3, 3 Aug 28 15:35 zero

=Block Devices=
{| border="1" cellpadding="20" cellspacing="0"
|disk0
|iPhone flash memory (4, 8 or 16GB)
|-
| disk0s1
| OS partition. Stores / root file system.
|-
| disk0s2
| User space. Stores Music, Photos, Videos, Podcasts, Ringtones and Apps. Mounted as /private/var.
|-
| vn0
| unknown
|-
| vn1
| unknown
|-
|}

=Interesting Character Devices=
{|border="1" cellpadding="20" cellspacing="0"
|rdisk0
|Character Device to access the Flash
|-
|mux.spi-baseband
|-
|uart.umts
|-
|dlci.spi-baseband.9
|GPS device (read from by /usr/libexec/locationd82 for CoreLocation services)
|-
|cu.umts
|}

Talk:Device Nodes

2008-08-29T02:40:52Z

MiW:

Um, on any Mac OS block device diskXsY has a character device counterpart called rdiskXsY, so rdisk0* is just a character device for accessing the flash.

! Ahh! Thanks for that correction [[User:MiW|MiW]]

== lol ==

on the same topic as above...rdisko is not ramdisk...do you know what ramdisk means? :)

I do know what a ramdisk means yes! Why is it so strange that there would exist a ramdisk device node? The device must read the ramdisk contents
from flash before it copies to ram right?

Ive had my device for a little under 4 days now, and from a linux background so I am not totally sure how
OSX/BSD handles it all. Im just trying report all the info I find.
[[User:MiW|MiW]]

Also, maybe add /dev/kmem and /dev/mem as blocked nodes

"blocked nodes"? Does the kernel prevent the user from reading from these nodes?
Oh and i am totally right about the GPS.

MiWs-IPhone:/usr/libexec root# strings locationd82 | grep dev
/dev/dlci.spi-baseband.9

[[User:MiW|MiW]]

Device Nodes

2008-08-28T14:40:50Z

MiW: gps

The underlying unix OS that powers the iPhone has a number of device nodes.
These nodes can be read from or written to by the OS or applications.

A iPhone 3G 2.0.2 contains:

crw-rw-rw- 1 root wheel 21, 0 Aug 28 15:35 aes_0
crw------- 1 root wheel 23, 0 Aug 28 18:56 bpf0
crw------- 1 root wheel 23, 1 Aug 28 18:56 bpf1
crw------- 1 root wheel 23, 2 Aug 28 15:35 bpf2
crw------- 1 root wheel 23, 3 Aug 28 15:35 bpf3
c------r-- 1 root wheel 11, 0 Aug 28 15:35 btreset
crw--w--w- 1 root wheel 0, 0 Aug 28 15:35 console
crw-rw-rw- 1 root wheel 1, 5 Aug 28 18:56 cu.bluetooth
crw-rw-rw- 1 root wheel 1, 7 Aug 28 15:35 cu.debug
crw-rw-rw- 1 root wheel 1, 1 Aug 28 15:35 cu.iap
crw-rw-rw- 1 root wheel 1, 3 Aug 28 15:35 cu.umts
brw-r----- 1 root operator 14, 0 Aug 28 15:35 disk0
brw-r----- 1 root operator 14, 1 Aug 28 15:35 disk0s1
brw-r----- 1 root operator 14, 2 Aug 28 15:35 disk0s2
crw------- 1 root wheel 9, 0 Aug 28 15:35 dlci.spi-baseband.0
crw------- 1 root wheel 9, 1 Aug 28 18:56 dlci.spi-baseband.1
crw------- 1 root wheel 9, 10 Aug 28 15:35 dlci.spi-baseband.10
crw------- 1 root wheel 9, 11 Aug 28 15:35 dlci.spi-baseband.11
crw------- 1 root wheel 9, 12 Aug 28 15:35 dlci.spi-baseband.12
crw------- 1 root wheel 9, 13 Aug 28 15:35 dlci.spi-baseband.13
crw------- 1 root wheel 9, 14 Aug 28 15:35 dlci.spi-baseband.14
crw------- 1 root wheel 9, 15 Aug 28 15:35 dlci.spi-baseband.15
crw------- 1 root wheel 9, 2 Aug 28 19:13 dlci.spi-baseband.2
crw------- 1 root wheel 9, 3 Aug 28 18:56 dlci.spi-baseband.3
crw------- 1 root wheel 9, 4 Aug 28 18:56 dlci.spi-baseband.4
crw------- 1 root wheel 9, 5 Aug 28 18:56 dlci.spi-baseband.5
crw------- 1 root wheel 9, 6 Aug 28 18:56 dlci.spi-baseband.6
crw------- 1 root wheel 9, 7 Aug 28 18:56 dlci.spi-baseband.7
crw------- 1 root wheel 9, 8 Aug 28 18:56 dlci.spi-baseband.8
crw------- 1 root wheel 9, 9 Aug 28 18:56 dlci.spi-baseband.9
crw------- 1 root wheel 6, 0 Aug 28 15:35 klog
cr--r--r-- 1 root wheel 13, 3 Aug 28 15:35 mrvl868x0
crw------- 1 root wheel 9, 0 Aug 28 15:35 mux.spi-baseband
crw-rw-rw- 1 root wheel 3, 2 Aug 28 18:56 null
crw-rw-rw- 1 root tty 15, 1 Aug 28 19:13 ptmx
crw-rw-rw- 1 root wheel 5, 0 Aug 28 15:35 ptyp0
crw-rw-rw- 1 root wheel 5, 1 Aug 28 15:35 ptyp1
crw-rw-rw- 1 root wheel 5, 2 Aug 28 15:35 ptyp2
crw-rw-rw- 1 root wheel 5, 3 Aug 28 15:35 ptyp3
crw-rw-rw- 1 root wheel 5, 4 Aug 28 15:35 ptyp4
crw-rw-rw- 1 root wheel 5, 5 Aug 28 15:35 ptyp5
crw-rw-rw- 1 root wheel 5, 6 Aug 28 15:35 ptyp6
crw-rw-rw- 1 root wheel 5, 7 Aug 28 15:35 ptyp7
crw-rw-rw- 1 root wheel 8, 0 Aug 28 15:35 random
crw-r----- 1 root operator 14, 0 Aug 28 15:35 rdisk0
crw-r----- 1 root operator 14, 1 Aug 28 15:35 rdisk0s1
crw-r----- 1 root operator 14, 2 Aug 28 15:35 rdisk0s2
crw-rw-rw- 1 root wheel 20, 0 Aug 28 15:35 sha1_0
crw-rw-rw- 1 root wheel 2, 0 Aug 28 15:35 tty
crw-rw-rw- 1 root wheel 1, 4 Aug 28 15:35 tty.bluetooth
crw-rw-rw- 1 root wheel 1, 6 Aug 28 15:35 tty.debug
crw-rw-rw- 1 root wheel 1, 0 Aug 28 15:35 tty.iap
crw-rw-rw- 1 root wheel 1, 2 Aug 28 15:35 tty.umts
crw-rw-rw- 1 root wheel 4, 0 Aug 28 15:35 ttyp0
crw-rw-rw- 1 root wheel 4, 1 Aug 28 15:35 ttyp1
crw-rw-rw- 1 root wheel 4, 2 Aug 28 15:35 ttyp2
crw-rw-rw- 1 root wheel 4, 3 Aug 28 15:35 ttyp3
crw-rw-rw- 1 root wheel 4, 4 Aug 28 15:35 ttyp4
crw-rw-rw- 1 root wheel 4, 5 Aug 28 15:35 ttyp5
crw-rw-rw- 1 root wheel 4, 6 Aug 28 15:35 ttyp6
crw-rw-rw- 1 root wheel 4, 7 Aug 28 15:35 ttyp7
crw--w---- 1 root tty 16, 0 Aug 28 19:13 ttys000
crw-rw-rw- 1 root wheel 10, 2 Aug 28 15:35 uart.bluetooth
crw-rw-rw- 1 root wheel 10, 3 Aug 28 15:35 uart.debug
crw-rw-rw- 1 root wheel 10, 0 Aug 28 15:35 uart.iap
crw-rw-rw- 1 root wheel 10, 1 Aug 28 15:35 uart.umts
crw-rw-rw- 1 root wheel 8, 1 Aug 28 15:35 urandom
brw------- 1 root operator 1, 0 Aug 28 15:35 vn0
brw------- 1 root operator 1, 1 Aug 28 15:35 vn1
crw-rw-rw- 1 root wheel 3, 3 Aug 28 15:35 zero

=Block Devices=
{| border="1" cellpadding="20" cellspacing="0"
|disk0
|iPhone flash memory (4, 8 or 16GB)
|-
| disk0s1
| OS partition. Stores / root file system.
|-
| disk0s2
| User space. Stores Music, Photos, Videos, Podcasts, Ringtones and Apps. Mounted as /private/var.
|-
| vn0
| unknown
|-
| vn1
| unknown
|-
|}

=Interesting Character Devices=
{|border="1" cellpadding="20" cellspacing="0"
|rdisk0
| Ramdisk, encrypted?
|-
|rdisk0s1
| Why is the ramdisk in 2 partitions?
|-
|dlci.spi-baseband.9
|GPS (extracted string from /usr/libexec/locationd)
|-
|rdisk0s2
|-
|mux.spi-baseband
|-
|uart.umts
|-
|cu.umts
|}

Research: Pwnage Patches

2008-08-28T11:56:56Z

MiW: /* Patched Area */ tweaked layout

If you have IDA Pro and you are at least semi-handy with ARM please contribute :)

Thanks to CPICH for helping out!

== 2.0 (5A347) iBoot ==

=== Patched Area ===
There is only 1 patch made to the iBoot, iLLB, iBEC, iBSS, and WTF.n82ap. They are all iBoots, pretty much, and they all have the same opcodes to their patches, so I am going to assume that they all have this same patch for the same reason. Please feel free to correct this if this is not true.

Here is a snippet of it from IDA:
APPLE
ROM:1800587C 01 20 MOVS R0, #1 ; R0 = 1
ROM:1800587E 40 42 NEGS R0, R0 ; R0 = -1
---------------------------------------------------------------------------
PWNAGE PATCH
ROM:1800587C 01 20 MOVS R0, #1 ; R0 = 1
ROM:1800587E 00 20 MOVS R0, #0 ; R0 = 0
This will set register r0 to 0, for the next section.

=== Why does this help us? ===
ROM:18005D72 FF F7 D2 FC BL sub_1800571A ; Branch with Link

That jumps to 0x1800571A. Why does that matter? well, the above "Patched Area" is at the end of this routine, and then we come back with our modified R0. Right after this BL, we get this, which is where our new R0 comes into play:

ROM:18005D76 00 28 CMP R0, #0 ; Set cond. codes on Op1 - Op2
ROM:18005D78 00 D0 BEQ loc_18005D7C ; Branch
ROM:18005D7A 8A E0 B loc_18005E92 ; Branch

If R0 = 0, which is does, it will jump to 0x18005D7C. If not, it will go to 0x18005E92. I don't know the nitty gritty, but basically this is to make it so that we jump to an earlier part in the file that we were supposed to. A further analysis may be in order, I will definitely get to that later.

== 2.0 (5A347) DeviceTree ==

=== Patched Area ===
Easy one. Just two string patches

==== Patch One ====
At offset 0x30, "secure-root-prefix" is patched to "xxxxxx-root-prefix"

==== Patch Two ====
At offset 0x3344, "function-disable_keys" is patched to "xxxxxxxx-disable_keys".
This would presumably prevent the hardware keys from being disabled at boot.

=== Wait what? ===
This tricks the iPhone into:
# Making it always secure boot
# Making it enable key access

This is required to decrypt KBAGs, as a sidenote.

== 2.0 (5A347) [[Lockdownd]] ==
This may actually confuse some people. You see, there is 'technically' two patches, but in reality, there is only one. The second one is the rehashed signature done with ldid, because you must remember that this is a userland binary, not a lower level one like the [[iBoot]], which resides in the [[NOR]]. These files on the main filesystem must cohere to the demands of the [[kernel]], and according to a [[devteam]] member, the patches to not require this were to complex and it would just be much easier to use ldid to take care of it. So that is what they did here. They took the original file, then one with the one patch that they needed, rehashed the patched one, BsDiff'd them, and then as you can now tell, the .patch tile contains the actual patch + the new sig :)

(Be back in a little bit with actual snippets from IDA showing the actual patch done, I want to go through the actual low level stuff first)

I don't think the dev team is using ldid because ldid changes the file size (i.e. asr sig patch added 0x20 bytes using ldid). However the same ldid method may work as well.

Research: Pwnage Patches

2008-08-28T11:50:26Z

MiW: changed to register r0

If you have IDA Pro and you are at least semi-handy with ARM please contribute :)

Thanks to CPICH for helping out!

== 2.0 (5A347) iBoot ==

=== Patched Area ===
There is only 1 patch made to the iBoot, iLLB, iBEC, iBSS, and WTF.n82ap. They are all iBoots, pretty much, and they all have the same opcodes to their patches, so I am going to assume that they all have this same patch for the same reason. Please feel free to correct this if this is not true.

Here is a snippet of it from IDA:

ROM:1800587C 01 20 MOVS R0, #1 ; R0 = 1
ROM:1800587E 40 42 NEGS R0, R0 ; PWNAGE PATCH
ROM:1800587E ; Change 40 42 > 00 20
ROM:1800587E ; That will make it:
ROM:1800587E ; MOVS R0 = #0
ROM:1800587E ;
ROM:1800587E ; R0 (unpatched) = -1
ROM:1800587E ; R0 (patched) = 0

=== Why does this help us? ===
ROM:18005D72 FF F7 D2 FC BL sub_1800571A ; Branch with Link

That jumps to 0x1800571A. Why does that matter? well, the above "Patched Area" is at the end of this routine, and then we come back with our modified R0. Right after this BL, we get this, which is where our new R0 comes into play:

ROM:18005D76 00 28 CMP R0, #0 ; Set cond. codes on Op1 - Op2
ROM:18005D78 00 D0 BEQ loc_18005D7C ; Branch
ROM:18005D7A 8A E0 B loc_18005E92 ; Branch

If R0 = 0, which is does, it will jump to 0x18005D7C. If not, it will go to 0x18005E92. I don't know the nitty gritty, but basically this is to make it so that we jump to an earlier part in the file that we were supposed to. A further analysis may be in order, I will definitely get to that later.

== 2.0 (5A347) DeviceTree ==

=== Patched Area ===
Easy one. Just two string patches

==== Patch One ====
At offset 0x30, "secure-root-prefix" is patched to "xxxxxx-root-prefix"

==== Patch Two ====
At offset 0x3344, "function-disable_keys" is patched to "xxxxxxxx-disable_keys".
This would presumably prevent the hardware keys from being disabled at boot.

=== Wait what? ===
This tricks the iPhone into:
# Making it always secure boot
# Making it enable key access

This is required to decrypt KBAGs, as a sidenote.

== 2.0 (5A347) [[Lockdownd]] ==
This may actually confuse some people. You see, there is 'technically' two patches, but in reality, there is only one. The second one is the rehashed signature done with ldid, because you must remember that this is a userland binary, not a lower level one like the [[iBoot]], which resides in the [[NOR]]. These files on the main filesystem must cohere to the demands of the [[kernel]], and according to a [[devteam]] member, the patches to not require this were to complex and it would just be much easier to use ldid to take care of it. So that is what they did here. They took the original file, then one with the one patch that they needed, rehashed the patched one, BsDiff'd them, and then as you can now tell, the .patch tile contains the actual patch + the new sig :)

(Be back in a little bit with actual snippets from IDA showing the actual patch done, I want to go through the actual low level stuff first)

I don't think the dev team is using ldid because ldid changes the file size (i.e. asr sig patch added 0x20 bytes using ldid). However the same ldid method may work as well.

Main Page

2008-08-28T10:14:45Z

MiW:

<table border=1 width=100%><tr>
<td bgcolor=#64ff64 width=50%><center><b>[[PwnageTool|Jailbreak]]</b></center></td>
<td bgcolor=#ff6464 width=50%><center><b>[[Unlock 2.0|Unlock]]</b></center></td>
</tr>
<tr>
<td colspan=2>
<center>[[Disclaimer]]</center>
</td>
</tr>
</table><BR>


{| cellspacing="3" width="100%"
|- valign="top"
|width="20%" class="MainPageBG" style="border: 1px #999999; color: #000; background-color: rgb(255,255,255)"|
<div style="padding: .3em .7em .7em"> <BR> <BR> __TOC__ </div>
|width="80%" class="MainPageBG" style="border: 1px #c6c9ff; color: #000; background-color: #f0f0ff"|
<div style="padding: .3em .7em .7em"> {{Welcome}} </div>
|}
==Software==
* [[Filesystem]]
* [[Device Nodes]]

==Hardware==
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[n45ap|iPod Touch (n45ap)]]

==App Processor (Jailbreak)==
The iPhone makes use of the [[S5L8900]] platform as application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband (Unlock)==

The [[Baseband Device]] is where the [[unlock]] applies.

==File formats==
* [[8900 File Format]]
* [[IMG2 File Format]]
* [[IMG3 File Format]]
* [[secpack]]
* [[secpack 2.0]]
* [[seczone]]

==Protocols==
* [[Recovery Mode 0x1280]]
* [[Recovery Mode 0x1281]]
* [[DFU 0x1222]]
* [[WTF 0x1227]]
* [[Normal Mode 0x1290]]
* [[Restore Mode]]
* [[Baseband Bootrom Protocol]]
* [[Interactive Mode|Baseband Bootloader Protocol]]

==Keys==
* [[AES Keys]]
* [[Apple Certificate]]
* [[Baseband RSA Keys]]
* [[Baseband TEA Keys]]
* [[IMG3 Keys / IVs]]
* [[NCK]]
* [[VFDecrypt Keys|Root Filesystem DMG Keys]]

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Tutorials==
see [[Tutorials|here]]

==Useful Links==
see [[Useful Links|here]]

==Definitions==
* [[jailbreak]]
* [[activation]]
* [[unlock]]
* [[Baseband Device|baseband]]
* [[Baseband Bootloader|bootloader]]
* [[DFU]]
* [[NORID]]
* [[CHIPID]]

Filesystem

2008-08-28T10:14:30Z

MiW: added fs listing

drwx------ 2 _unknown _unknown 170 Aug 10 21:25 .fseventsd/
lrwxr-xr-x 1 root admin 30 Aug 26 19:35 Applications -> /var/stash/Applications.??????/
drwxrwxr-x 2 root admin 68 Jun 16 15:21 Developer/
drwxr-xr-t 15 root admin 748 Aug 26 23:26 Library/
drwxr-xr-x 3 root wheel 102 Aug 21 20:29 System/
lrwxr-xr-x 1 root admin 11 Aug 28 15:36 User -> /var/mobile/
drwxr-xr-x 2 root wheel 2040 Jun 17 05:56 bin/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 boot/
drwxrwxr-t 2 root admin 68 Jun 16 14:24 cores/
dr-xr-xr-x 3 root wheel 1213 Aug 28 15:35 [[Device Nodes|dev/]]
lrwxr-xr-x 1 root admin 11 Aug 10 21:25 etc -> private/etc/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 lib/
drwxr-xr-x 2 root wheel 68 Oct 28 2006 mnt/
drwxr-xr-x 4 root wheel 136 Aug 26 18:39 private/
drwxr-xr-x 2 root wheel 442 Jun 19 16:31 sbin/
lrwxr-xr-x 1 root admin 15 Aug 10 21:25 tmp -> private/var/tmp/
drwxr-xr-x 8 root wheel 374 Aug 26 19:35 usr/
lrwxr-xr-x 1 root admin 11 Aug 10 21:25 var -> private/var/

Device Nodes

2008-08-28T10:09:55Z

MiW:

The underlying unix OS that powers the iPhone has a number of device nodes.
These nodes can be read from or written to by the OS or applications.

A iPhone 3G 2.0.2 contains:

crw-rw-rw- 1 root wheel 21, 0 Aug 28 15:35 aes_0
crw------- 1 root wheel 23, 0 Aug 28 18:56 bpf0
crw------- 1 root wheel 23, 1 Aug 28 18:56 bpf1
crw------- 1 root wheel 23, 2 Aug 28 15:35 bpf2
crw------- 1 root wheel 23, 3 Aug 28 15:35 bpf3
c------r-- 1 root wheel 11, 0 Aug 28 15:35 btreset
crw--w--w- 1 root wheel 0, 0 Aug 28 15:35 console
crw-rw-rw- 1 root wheel 1, 5 Aug 28 18:56 cu.bluetooth
crw-rw-rw- 1 root wheel 1, 7 Aug 28 15:35 cu.debug
crw-rw-rw- 1 root wheel 1, 1 Aug 28 15:35 cu.iap
crw-rw-rw- 1 root wheel 1, 3 Aug 28 15:35 cu.umts
brw-r----- 1 root operator 14, 0 Aug 28 15:35 disk0
brw-r----- 1 root operator 14, 1 Aug 28 15:35 disk0s1
brw-r----- 1 root operator 14, 2 Aug 28 15:35 disk0s2
crw------- 1 root wheel 9, 0 Aug 28 15:35 dlci.spi-baseband.0
crw------- 1 root wheel 9, 1 Aug 28 18:56 dlci.spi-baseband.1
crw------- 1 root wheel 9, 10 Aug 28 15:35 dlci.spi-baseband.10
crw------- 1 root wheel 9, 11 Aug 28 15:35 dlci.spi-baseband.11
crw------- 1 root wheel 9, 12 Aug 28 15:35 dlci.spi-baseband.12
crw------- 1 root wheel 9, 13 Aug 28 15:35 dlci.spi-baseband.13
crw------- 1 root wheel 9, 14 Aug 28 15:35 dlci.spi-baseband.14
crw------- 1 root wheel 9, 15 Aug 28 15:35 dlci.spi-baseband.15
crw------- 1 root wheel 9, 2 Aug 28 19:13 dlci.spi-baseband.2
crw------- 1 root wheel 9, 3 Aug 28 18:56 dlci.spi-baseband.3
crw------- 1 root wheel 9, 4 Aug 28 18:56 dlci.spi-baseband.4
crw------- 1 root wheel 9, 5 Aug 28 18:56 dlci.spi-baseband.5
crw------- 1 root wheel 9, 6 Aug 28 18:56 dlci.spi-baseband.6
crw------- 1 root wheel 9, 7 Aug 28 18:56 dlci.spi-baseband.7
crw------- 1 root wheel 9, 8 Aug 28 18:56 dlci.spi-baseband.8
crw------- 1 root wheel 9, 9 Aug 28 18:56 dlci.spi-baseband.9
crw------- 1 root wheel 6, 0 Aug 28 15:35 klog
cr--r--r-- 1 root wheel 13, 3 Aug 28 15:35 mrvl868x0
crw------- 1 root wheel 9, 0 Aug 28 15:35 mux.spi-baseband
crw-rw-rw- 1 root wheel 3, 2 Aug 28 18:56 null
crw-rw-rw- 1 root tty 15, 1 Aug 28 19:13 ptmx
crw-rw-rw- 1 root wheel 5, 0 Aug 28 15:35 ptyp0
crw-rw-rw- 1 root wheel 5, 1 Aug 28 15:35 ptyp1
crw-rw-rw- 1 root wheel 5, 2 Aug 28 15:35 ptyp2
crw-rw-rw- 1 root wheel 5, 3 Aug 28 15:35 ptyp3
crw-rw-rw- 1 root wheel 5, 4 Aug 28 15:35 ptyp4
crw-rw-rw- 1 root wheel 5, 5 Aug 28 15:35 ptyp5
crw-rw-rw- 1 root wheel 5, 6 Aug 28 15:35 ptyp6
crw-rw-rw- 1 root wheel 5, 7 Aug 28 15:35 ptyp7
crw-rw-rw- 1 root wheel 8, 0 Aug 28 15:35 random
crw-r----- 1 root operator 14, 0 Aug 28 15:35 rdisk0
crw-r----- 1 root operator 14, 1 Aug 28 15:35 rdisk0s1
crw-r----- 1 root operator 14, 2 Aug 28 15:35 rdisk0s2
crw-rw-rw- 1 root wheel 20, 0 Aug 28 15:35 sha1_0
crw-rw-rw- 1 root wheel 2, 0 Aug 28 15:35 tty
crw-rw-rw- 1 root wheel 1, 4 Aug 28 15:35 tty.bluetooth
crw-rw-rw- 1 root wheel 1, 6 Aug 28 15:35 tty.debug
crw-rw-rw- 1 root wheel 1, 0 Aug 28 15:35 tty.iap
crw-rw-rw- 1 root wheel 1, 2 Aug 28 15:35 tty.umts
crw-rw-rw- 1 root wheel 4, 0 Aug 28 15:35 ttyp0
crw-rw-rw- 1 root wheel 4, 1 Aug 28 15:35 ttyp1
crw-rw-rw- 1 root wheel 4, 2 Aug 28 15:35 ttyp2
crw-rw-rw- 1 root wheel 4, 3 Aug 28 15:35 ttyp3
crw-rw-rw- 1 root wheel 4, 4 Aug 28 15:35 ttyp4
crw-rw-rw- 1 root wheel 4, 5 Aug 28 15:35 ttyp5
crw-rw-rw- 1 root wheel 4, 6 Aug 28 15:35 ttyp6
crw-rw-rw- 1 root wheel 4, 7 Aug 28 15:35 ttyp7
crw--w---- 1 root tty 16, 0 Aug 28 19:13 ttys000
crw-rw-rw- 1 root wheel 10, 2 Aug 28 15:35 uart.bluetooth
crw-rw-rw- 1 root wheel 10, 3 Aug 28 15:35 uart.debug
crw-rw-rw- 1 root wheel 10, 0 Aug 28 15:35 uart.iap
crw-rw-rw- 1 root wheel 10, 1 Aug 28 15:35 uart.umts
crw-rw-rw- 1 root wheel 8, 1 Aug 28 15:35 urandom
brw------- 1 root operator 1, 0 Aug 28 15:35 vn0
brw------- 1 root operator 1, 1 Aug 28 15:35 vn1
crw-rw-rw- 1 root wheel 3, 3 Aug 28 15:35 zero

=Block Devices=
{| border="1" cellpadding="20" cellspacing="0"
|disk0
|iPhone flash memory (4, 8 or 16GB)
|-
| disk0s1
| OS partition. Stores / root file system.
|-
| disk0s2
| User space. Stores Music, Photos, Videos, Podcasts, Ringtones and Apps. Mounted as /private/var.
|-
| vn0
| unknown
|-
| vn1
| unknown
|-
|}

=Interesting Character Devices=
{|border="1" cellpadding="20" cellspacing="0"
|rdisk0
|-
|rdisk0s1
|-
|rdisk0s2
|-
|mux.spi-baseband
|-
|uart.umts
|-
|cu.umts
|}

Main Page

2008-08-28T10:06:04Z

MiW: Added Device nodes page

<table border=1 width=100%><tr>
<td bgcolor=#64ff64 width=50%><center><b>[[PwnageTool|Jailbreak]]</b></center></td>
<td bgcolor=#ff6464 width=50%><center><b>[[Unlock 2.0|Unlock]]</b></center></td>
</tr>
<tr>
<td colspan=2>
<center>[[Disclaimer]]</center>
</td>
</tr>
</table><BR>


{| cellspacing="3" width="100%"
|- valign="top"
|width="20%" class="MainPageBG" style="border: 1px #999999; color: #000; background-color: rgb(255,255,255)"|
<div style="padding: .3em .7em .7em"> <BR> <BR> __TOC__ </div>
|width="80%" class="MainPageBG" style="border: 1px #c6c9ff; color: #000; background-color: #f0f0ff"|
<div style="padding: .3em .7em .7em"> {{Welcome}} </div>
|}
==Software==
* [[Device Nodes]]

==Hardware==
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[n45ap|iPod Touch (n45ap)]]

==App Processor (Jailbreak)==
The iPhone makes use of the [[S5L8900]] platform as application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband (Unlock)==

The [[Baseband Device]] is where the [[unlock]] applies.

==File formats==
* [[8900 File Format]]
* [[IMG2 File Format]]
* [[IMG3 File Format]]
* [[secpack]]
* [[secpack 2.0]]
* [[seczone]]

==Protocols==
* [[Recovery Mode 0x1280]]
* [[Recovery Mode 0x1281]]
* [[DFU 0x1222]]
* [[WTF 0x1227]]
* [[Normal Mode 0x1290]]
* [[Restore Mode]]
* [[Baseband Bootrom Protocol]]
* [[Interactive Mode|Baseband Bootloader Protocol]]

==Keys==
* [[AES Keys]]
* [[Apple Certificate]]
* [[Baseband RSA Keys]]
* [[Baseband TEA Keys]]
* [[IMG3 Keys / IVs]]
* [[NCK]]
* [[VFDecrypt Keys|Root Filesystem DMG Keys]]

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Tutorials==
see [[Tutorials|here]]

==Useful Links==
see [[Useful Links|here]]

==Definitions==
* [[jailbreak]]
* [[activation]]
* [[unlock]]
* [[Baseband Device|baseband]]
* [[Baseband Bootloader|bootloader]]
* [[DFU]]
* [[NORID]]
* [[CHIPID]]

Device Nodes

2008-08-28T10:02:34Z

MiW: added device nodes from iphone