User talk:5urd

2011-05-26T20:40:14Z

MuscleNerd:

User talk:5urd

2011-05-26T20:34:35Z

MuscleNerd:

Talk:AT+XNONCE

2011-02-06T07:24:15Z

MuscleNerd:

Actually it's at+xnonce?, not at+nonce :)

Talk:AT+XNONCE

2011-02-06T07:23:37Z

MuscleNerd: New page: Actually it's at+xnonce, not at+nonce :)

Actually it's at+xnonce, not at+nonce :)

NAND

2010-12-18T11:14:44Z

2010-09-09T19:57:54Z

MuscleNerd:

An SoC developed by Apple in-house chip design department. It is currently used in [[k48ap|iPad]], [[N90ap|iPhone 4]], and [[N81ap|iPod Touch 4G]]. Publicly, Apple refers to this chip as the '''A4'''.

== Exploits ==

=== [[iBoot]] ===
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

=== [[Kernel]] ===
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.2
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 3.2.1

=== [[Userland]] ===
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.2
* [[PDF CFF Font Stack Overflow]] - Works up to [[iOS]] 3.2.1

== Boot Chain ==
[[S5L8930 (Bootrom)|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD

These are the same specifications as the [[S5L8920]] and [[S5L8922]], except this processor has a higher clock speed.

== See also ==
* [[S5L8930 (Bootrom)]]

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

AT+XAPP Vulnerability

2010-06-29T19:04:10Z

MuscleNerd: Undo revision 6786 by Leobruh (Talk)

Used as an injection vector for the current iPhone 3G and iPhone 3GS unlock payloads‭ - ‬ultrasn0w 0.93‭. ‬Currently available in all baseband versions until 05.13.04‭.‬
‭
== Credit ==

* '''vulnerability''': [http://twitter.com/sherif_hashim sherif_hashim], also discovered by [http://twitter.com/westbaer westbaer], [[geohot]] and [http://twitter.com/oranav Oranav] (each one independently)
* '''exploitation''': [[iPhone Dev Team]]

== Exploit ==

There is a stack overflow in the AT+XAPP‭="..." ‬command‭, ‬which allows unsigned code execution on the [[X-Gold 608]]

at+xapp="‬0000111122223333444455556666777788889999000011112222"‬

applying a string of more than 52‭ ‬characters will trigger the overflow
‭

== Implementation ==

The exploit was used by [[iPhone Dev Team]] in [[Ultrasn0w]] 0.93‭ which is able to unlock 4.26.08‭, ‬5.11.07‭, ‬5.12.01‭ ‬and 5.13.04‭ ‬BB firmwares

----

[[Category:Baseband Exploits]]

Talk:Spirit

2010-05-05T20:17:35Z

MuscleNerd:

There exists also a tool called [[Spirit Fixer|Spirit Fixer v1.01]], written by [[Kirma]]. Anybody knows what that is? Here's a link: http://twitter.com/elior231/status/13296125900

--[[User:Http|http]] 21:42, 4 May 2010 (UTC)

I'd love to see a technical writeup of everything, although I don't blame you if you don't. I'm lazy about those things too. As far as trying to keep it secret from Apple, I don't feel theres a point, they'll find it no matter what we do.

--[[User:Geohot|geohot]] 14:02, 5 May 2010 (UTC)

I have started reverse engineering Spirit and making some UML(like) data flow and function diagrams. The problem is that I am guessing at too many things since I did not wana post anything and have someone get pissed it was out there. I am up for putting a formal brief together if others want to collaborate. I would imagine as Geohot said, that apple had this disassembled before the .tar was dry. Not to mention that they are not just looking for the exploit that was used (since they most likely had a whiteboard full of potentials during design) , they are looking for copyright violations and their stollen code in every bit of its bits.

--KodeSlinger 16:31, 5 May 2010 (UTC)

Meh, as mentioned on spiritjb.com, once Apple has shown that they've fixed it, the source will be released anyway. - MuscleNerd

@MuscleNerd - I started working on it BS (Before Spirit :) ), to create a centralized location that dynamically maps (HW/FW/SW) physical and logical drawings together. My thought was something like this wiki on crack. Ideally to generate functional diagrams of the idevice that act as a starting point to link to more detailed sections pertaining to that functions exploits, related functions, and source code samples(or any other data). Since I am new to this community I have been trying to organize this data for my own brain, and thought others might use it. I will post some screen shots later. The more organized we are the easier it will be to exploit the next vulnerability.
--[[User:Viper911h|KodeSlinger]] 20:11, 5 May 2010 (UTC)

Oh hah, cool :) If you do that though, obviously you shouldn't go overboard and start publicly discussing variations of this that would help Apple close other holes yet to be exploited (it sounds like your well-versed enough to do that!) - MuscleNerd

2008-11-29T04:23:04Z

MuscleNerd:

This was an exploit in pre 2.0 versions of iBoot

==Credit==
[[The dev team]]

==Exploit==
This is a very simple exploit. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices. You can run unsigned code on the s5l using this, but the GPIOs need to be restored first.

In 2.0 iBoots, they check the permission register for this command, so the exploit doesn't work.

[[Category:Jailbreaks]]

Diags (iBoot command)

2008-11-29T01:22:06Z

MuscleNerd:

This was an exploit in pre 2.0 versions of iBoot

==Credit==
[[The dev team]]

==Exploit==
This is a very simple exploit. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices. You can run unsigned code on the baseband using this, but the GPIOs need to be restored first.

In 2.0 iBoots, they check the permission register for this command, so the exploit doesn't work.

[[Category:Jailbreaks]]

Pwnage 2.0

2008-11-25T11:19:24Z

MuscleNerd: pwnagetool and family load the dfu exploit explicitly now

This exploit in the [[VROM]] is really the ultimate exploit, since it allows unsigned code to be run at the lowest level. It can be patched out '''only''' by a new hardware revision.

==Credit==
[[The dev team]]

==Exploit==
There is a stack overflow in the certificate parsing code. By passing a malformed certificate, unsigned code can be run.

==Implementations==
*[[PwnageTool]]
*[[QuickPwn]]
*[[WinPwn]]
*[http://lpahome.com/geohot/iran.rar iran]

[[Category:Jailbreaks]]