2009-10-31T14:50:54Z

Oranav: Talk:AT+XEMN moved to Talk:AT+XEMN Heap Overflow: This page is about the overflow hole, not the command.

#REDIRECT [[Talk:AT+XEMN Heap Overflow]]

AT+XEMN Heap Overflow

2009-10-31T14:50:02Z

Oranav: /* Timeline */

AT+XEMN is a command on baseband 5.11.07 (pushed out with the 3.1 release), which when exploited correctly, causes a heap overflow allowing the crash to be moulded into an injection vector. This injection vector can then be used to inject an unlocking payload to provide a coveted Software SIM Unlock on the official 3.1(.2) firmware running 5.11.07

== Exception Dump ==
+XLOG: Exception Number: 1
Trap Class: 0xDDDD (SW GENERATED TRAP)
Identification: 140 (0x008C)
Date: 22.10.2009
Time: 00:30
File: atform/text/_malloc.c
Line: 1036
Logdata:
2E 0C 76 ED 40 14 31 64 61 74 63 3A 31 00 64 63 ..v.@.1datc:1.dc
20 44 F4 E9 20 20 20 20 20 20 20 20 20 20 20 20 D..
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20

== Timeline ==
=== July 2009 ===
*[[User:Oranav|Oranav]] discovers this crash.
*Shortly after discovered, The [[iPhone Dev Team]], confirms that the crash is non-exploitable.

=== September 2009 ===
*iH8sn0w discovered this command independently but kept it a secret for about a month. [http://twitter.com/iH8sn0w/status/4353547726 ]

=== October 2009 ===
*When the Dev-Team stated that iH8sn0w did not have a unlock, he posted the command on Twitter. [http://twitter.com/iH8sn0w/status/4954333558]
*Shortly after, Oranav posted his Hash from July. [http://pastebin.ca/1485104]
*MuscleNerd tells iHacker that the crash was received awhile ago and was non-exploitable. [http://twitter.com/MuscleNerd/status/4978871033][http://twitter.com/iHacker/status/4978821448]
*[[User:Geohot|Geohot]] attempts to exploit this crash, but later finds out as well that it is non-exploitable. [http://twitter.com/geohot/status/4979506974]
*The hunt for another exploit continues as New 3G/3G[S] users join or if 3G/3G[S] users upgrade to Official Apple Firmware.
*Geohot does more investigation and discovers that this crash is indeed exploitable, and that it's a heap overflow. [http://twitter.com/geohot/status/5196861045]
*Geohot has achieved arbitrary code execution and has begun working on unlock which will be called blacksn0w. [http://iphonejtag.blogspot.com/2009/10/heap-of-trouble.html]
*Geohot posts a video of an unlocked 05.11.07 device. [http://www.youtube.com/watch?v=g23e9e9zOVI]

2009-07-18T16:38:19Z

Oranav:

This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching /etc/fstab to mount the System partition as read-write. This is entirely different to an [[unlock]]. Jailbreaking is the first action that must be taken before things like non-official [[activation]], and non-official unlocking, can proceed.

The original jailbreak also included modifying the [[AFC|afc]] service (service used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to creating a new service (afc2) that allows access to the full filesystem.

Modern jailbreaks also include patching the OS kernel to get around code-signing and other restrictions.

==Exploits which were used in order to jailbreak (in chronological order)==
=== 1.0.2 ===
* [[Restore Mode]] (iBoot had a command named cp, which had access to the whole filesystem)
=== 1.1.1 ===
* [[Symlinks]] (an update jailbreak)
* [[libtiff exploit]] (Adapted from the PSP scene, used by [[Jailbreakme]])
=== 1.1.2 / 1.1.3 ===
* [[Mknod]] (an update jailbreak)
=== 1.1.4 ===
* [[Ramdisk Hack]]

==Exploits which are used in order to jailbreak 2.0 and above==
===iPhone / iPhone 3G / iPod Touch===
* [[Pwnage]] and [[Pwnage 2.0]] (together)
===iPod Touch 2G===
* [[ARM7 Go]] (used by tethered jailbreaks)
* [[24kpwn]]
===iPhone 3GS===
All jailbreaks are using the [[24kpwn]] exploit, but you need an iBoot exploit as well because of [[ECID]].
====3.0====
* [[iBoot Environment Variable Overflow]]

Restore Mode

2009-07-18T16:29:16Z

Oranav: /* Exploits */

This is the mode the Apple ramdisk enters to restore the iPhone.

==Exploits==
The original jailbreaks were done by booting the phone into restore mode and copying an /etc/fstab and afcd plist from the user partition. This was done by using the cp iBoot command, a command which had access to the whole filesystem.

==Implementations==
*[[itunesmobiledevice.dll]]
*[http://lpahome.com/geohot/gshell.rar gshell]

[[Category:Jailbreaks]]
[[Category:Protocols (S5L)]]

Jailbreak

2009-07-18T16:28:07Z

Oranav: /* Exploits which was used in order to jailbreak (in chronological order) */

Jailbreak

2009-07-18T16:27:57Z

Oranav:

This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching /etc/fstab to mount the System partition as read-write. This is entirely different to an [[unlock]]. Jailbreaking is the first action that must be taken before things like non-official [[activation]], and non-official unlocking, can proceed.

The original jailbreak also included modifying the [[AFC|afc]] service (service used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to creating a new service (afc2) that allows access to the full filesystem.

Modern jailbreaks also include patching the OS kernel to get around code-signing and other restrictions.

==Exploits which was used in order to jailbreak (in chronological order)==
=== 1.0.2 ===
* [[Restore Mode]] (iBoot had a command named cp, which had access to the whole filesystem)
=== 1.1.1 ===
* [[Symlinks]] (an update jailbreak)
* [[libtiff exploit]] (Adapted from the PSP scene, used by [[Jailbreakme]])
=== 1.1.2 / 1.1.3 ===
* [[Mknod]] (an update jailbreak)
=== 1.1.4 ===
* [[Ramdisk Hack]]