The iPhone Wiki - User contributions [en]

User:Palz

2011-10-23T18:24:02Z

Palz:

==Info==
Hello. I normally am listed as palz2015 (as in my twitter and email) but I made the account as such.

==What do I do==
I have been working on some iPhwn (yeah, spell it that way) and iPod touch userland hacks, as well as an [[iphonelinux]] X Window port, dubbed as [[Zwindow]]. I also co-founded the ra1ndev team (who is known for nothing other than unfinished projects :)

==Contact==
palz2015 [at] gmail [dot] com
me [at] palz2015 [dot] com
http://palz2015.com
@palz2015 on Twitter

Talk:Pwnage 2.0

2010-10-23T21:49:30Z

Palz:

Can anyone post the file structure for the certificate and the malformed certificate? --[[User:Paul0|paulzero]] 06:24, 13 March 2009 (UTC)

==Merge Request==
Shouldn't this be merged with Pwnage? --[[User:Palz|Palz]] 21:23, 23 October 2010 (UTC)
:It's a different exploit than [[Pwnage]] if I understood this correctly. Every exploit should have its own page. --[[User:Http|http]] 21:47, 23 October 2010 (UTC)
::Yes, but pwnage2.0 is listed and defined here. --[[User:Palz|Palz]] 21:49, 23 October 2010 (UTC)

Talk:Pwnage 2.0

2010-10-23T21:23:46Z

Palz:

can anyone post the file structure for the certificate and the malformed certificate?--[[User:Paul0|paulzero]] 06:24, 13 March 2009 (UTC)

Shouldn't this be merged with Pwnage? --[[User:Palz|Palz]] 21:23, 23 October 2010 (UTC)

PwnageTool

2010-10-23T21:19:38Z

Palz:

'''PwnageTool''' is a [[iOS]] [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it to restore to in [[iTunes]].

==Exploits Used==
===Version 4.0===
* Bootrom exploit (used by [[limera1n]] and [[greenpois0n]])

===Version 2.0===
* [[Pwnage 2.0]]
* [[Pwnage]]

===Version 1.0===
* [[Pwnage]]
* [[Ramdisk Hack]]

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[M68ap|iPhone 2G]]
| April 3, 2008
|-
| [[N45ap|iPod touch 1G]]
| April 3, 2008
|-
| [[N82ap|iPhone 3G]]
| Jul 19, 2008
|-
| [[N72ap|iPod touch 2G]]
| Oct 2, 2009
|-
| [[N88ap|iPhone 3GS]]
| Oct 2, 2009
|}
Note that the [[N18ap|iPod touch 3G]] and subsequent devices are not supported. With the iPod touch 2G and iPhone 3GS you must be jailbroken prior to using PwnageTool. The [[S5L8900]] devices you can go into [[DFU Mode]] and restore with [[iTunes]] without being jailbroken.

==Versions==

PwnageTool was released April 3, 2008 but largely unused until version 2.0 was released July 19, 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 1.1.4 ====
| style="white-space: nowrap;" | April 3, 2008
| |
* Initial release
* Jailbreaks 1.1.4 firmware
* Supports iPod touch 1G and iPhone 2G.
* Add [[BootNeuter]] in the IPSW to unlock iPhone 2G.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}

=== 2.x: Second major release of Pwnagetool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0 ====
| style="white-space: nowrap;" | Jul 19, 2008
| |
* Added iPhone 3G support [http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.1 ====
| style="white-space: nowrap;" | Aug 4, 2008
| |
* Jailbreaks 2.0.1 firmware
* Works for 2.0 and 2.0.1.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.2 ====
| style="white-space: nowrap;" | Aug 21, 2008
| |
* Jailbreaks 2.0.2 firmware [http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.3 ====
| style="white-space: nowrap;" | Aug 25, 2008
| |
* Jailbreaks 2.0.2 firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.1 ====
| style="white-space: nowrap;" | Sep 13, 2008
| |
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a valid Cydia source, and add them onto your custom IPSW.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.2 ====
| style="white-space: nowrap;" | Nov 21, 2008
| |
* Jailbreaks 2.2 firmware
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.2.5 ====
| style="white-space: nowrap;" | Jan 30, 2009
| |
* Jailbreaks 2.2.1
* Not updated by [[iPhone Dev Team]] but made official.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}

=== 3.x: Third Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.0 ====
| style="white-space: nowrap;" | Jun 19, 2009
| |
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1 ====
| style="white-space: nowrap;" | Sep 15, 2009
| |
* Jailbreaks 3.1 firmware for iPhone 2G and 3G
* Jailbreaks 3.1.1 firmware for iPod touch 1G
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1.3 ====
| style="white-space: nowrap;" | Oct 2, 2009
| |
* Support for iPhone 3GS with [[iBoot-359.3]] bootrom and iPod touch 2G with [[iBoot-240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1.4 ====
| style="white-space: nowrap;" | Oct 13, 2009
| |
* Jailbreaks 3.1.2 firmware for iPhone 2G, 3G, 3GS with [[iBoot-359.3]] bootrom, iPod touch 1G, iPod touch 2G with [[iBoot-240.4]] bootrom
* iPod touch 3G not supported.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |

==== 3.1.5 ====
| style="white-space: nowrap;" | Feb 7, 2010
| |
* Jailbreaks 3.1.3 firmware for devices supported in 3.1.4.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}
=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 4.0 ====
| style="white-space: nowrap;" | Jun 22, 2010
| |
* Jailbreaks 4.0 firmware for devices supported in 3.1.4.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 4.01 ====
| style="white-space: nowrap;" | Jun 23, 2010
| |
* Fixes iBooks issue in 4.0
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, [[BootNeuter]] ([[M68ap|iPhone]] software unlock), custom packages and boot logos. This method is usually less secure than the quick exploits such ([[redsn0w]], [[QuickPwn]], [[purplera1n]], [[blackra1n]], etc.).

==How to create Custom Firmware Bundles==
Following steps are needed:
#Copy an existing bundle as a template
#Decrypt [[IMG3 File Format|IMG3]] [[KBAG]]s and put the keys into Info.plist - usually using an [http://forums.openpwn.org/viewtopic.php?f=8&t=19&p=101#p101 AES payload]
#Use [[GenPass]] with decrypted [[Restore/Update Ramdisks|ramdisk]] to get the rootfs vfdecrypt key, put the key and rootfs volume name into Info.plist
#Unpack [[NOR]] files, [[Restore/Update Ramdisks|ramdisk]] and [[kernelcache]] using [[AES Keys]], apply patches (for minor upgrades, you can apply byte pattern-based patches from previous version, so you don't have to use [[IDA]] for every file)
#Patch [[wikipedia:Apple Software Restore|ASR]] from the [[Restore Ramdisk]], use [[Apple's Codesign Tool|codesign]] or [[ldid]] to fix up its code page hashes.
#Use [http://www.daemonology.net/bsdiff/ bsdiff] to create diffs by diffing unpacked original versus patched files. [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] utilize [[0x24000 Segment Overflow|a different bootrom exploit]], so the encrypted [[LLB]] for these devices need patching, using the [[XPwn|xpwntool]] option "-x24k" (for [[N72ap|iPod touch 2G]]) or "-xn8824k" (for [[N88ap|iPhone 3GS]]) to patch the file.

(from here: [https://twitter.com/veeence/status/24393474627 question] and [http://www.twitlonger.com/show/61crcq answer])

==Problems==
This method does have negative aspects. The most common errors are the [[ITunes Errors#Errors 16xx|1600 errors]], a group of errors saying that the either the firmware file is corrupt or you didn't put it in the right mode (recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common computer error is a [[ITunes Errors#Error 1604|1604 error]] which means that the firmware file is corrupt.

==Windows==
PwnageTool is expected to remain exclusive to Mac OS X. As of October 2009, [[User:ih8sn0w|iH8sn0w]], et. al. has announced that they made a project that will bring PwnageTool's functionality to Windows, called [[sn0wbreeze]]. [http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

[[Category:Hacking Software]]

Talk:Cydia.app

2010-10-23T21:02:20Z

Palz:

==Icon==
Can someone add a high resolution Cydia icon to this page? --[[User:JacobVengeance|JakeAnthraX]] 04:33, 22 October 2010 (UTC)
:Done. :) --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 05:03, 22 October 2010 (UTC)
:Thank You, I like images and icons for some reason. --[[User:JacobVengeance|JakeAnthraX]] 16:30, 22 October 2010 (UTC)
== Name Change? ==
How about Cydia.app? Sounds better, in my opinion. --[[User:Dra1nerdrake|dra1nerdrake]] 01:20, 23 October 2010 (UTC)
:Sounds good to me. :) --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 02:08, 23 October 2010 (UTC)

:I would prefer /var/stash/Applications.*****/Cydia.app as it sounds more like the fs --[[User:Balloonhead66|Balloonhead66]] 18:21, 23 October 2010 (UTC)

:I think the discussion isn't finished, although someone moved it already. If everybody agrees to leave it like Cydia.app, then we should update all links (click on "what links here" to see them). -- [[User:Http|http]] 19:51, 23 October 2010 (UTC)
::Yeah, I just moved it to shut you guys up. Balloonhead66, wouldn't it be better to describe an application rather than a directory? --[[User:Palz|Palz]] 21:02, 23 October 2010 (UTC)

Cydia.app

2010-10-23T18:11:57Z

Palz:

[[Image:Cydia.png|thumb|Icon for Cydia.]]
Cydia is an open source application installer created by [[Saurik]] that uses the Debian APT system for package management. It is included with all [[iPhone Dev Team]] [[jailbreak]]s, and is found in every mainstream jailbreak tool (e.g [[redsn0w]], [[limera1n]], [[blackra1n]], [[PwnageTool]], [[sn0wbreeze]], [[greenpois0n]], [[Spirit]], [[Star]]) since iOS 2.0. However, for a more portable and lightweight jailbreak, some tools use apps like [[Loader.app|Loader]] or [[blackra1n/limera1n.app]] to
download and install Cydia, instead of having it preinstall.
==See also==
[[Cydia Server|Cydia SHSH server]]

Talk:Cydia.app

2010-10-23T18:11:16Z

Palz: Talk:Cydia Application moved to Talk:Cydia.app: More sensible

Cydia Application

2010-10-23T18:11:16Z

Palz: Cydia Application moved to Cydia.app: More sensible

#REDIRECT [[Cydia.app]]

Talk:Cydia Application

2010-10-23T18:11:16Z

Palz: Talk:Cydia Application moved to Talk:Cydia.app: More sensible

#REDIRECT [[Talk:Cydia.app]]

Cydia.app

2010-10-23T18:11:16Z

Palz: Cydia Application moved to Cydia.app: More sensible

/Library

2010-10-23T04:32:46Z

Palz: Not a child of /Library

== Summary ==
Contains files and executables required by all users
== Parents ==
[[/| Root]]

==Children==

/bin

2010-10-23T04:27:59Z

Palz: New page: Folder that contains GNU coreutils (cat, cp, bzip).

Folder that contains GNU coreutils (cat, cp, bzip).

Loader.app

2010-10-23T02:40:35Z

Palz: New page: Loader is an application used by greenpois0n. It is added via a ramdisk, and can download and install Cydia.

Loader is an application used by [[greenpois0n]]. It is added via a [[ramdisk]], and can download and install [[Cydia Application|Cydia]].

Cydia.app

2010-10-23T02:37:32Z

Palz:

Cydia.app

2010-10-23T02:35:47Z

Palz:

List of Apple TVs

2010-10-22T05:36:27Z

Palz:

Apple TV is Apple's self-described hobby. It serves as a media center, so you can access online media through your TV.

== First generation ==
[[Image:AppleTv1g.jpg|thumb|223px|This is the original Apple TV.]]
The original Apple TV (codenamed iTV) was released in 2007. It had component video, HDMI and analog audio output. It ran a modified version of [[wikipedia:Mac OS X Tiger|Mac OS X Tiger]] and contained an Intel processor.

== Second generation ==
[[Image:AppleTv2g.jpg|thumb|300px|This is the second generation Apple TV.]]

File:AppleTv1g.jpg

2010-10-22T05:29:36Z

Palz: uploaded a new version of "Image:AppleTv1g.jpg"

This is the first gen iTV

File:AppleTv1g.jpg

2010-10-22T05:21:50Z

Palz: uploaded a new version of "Image:AppleTv1g.jpg": First gen iTV

This is the first gen iTV

File:AppleTv1g.jpg

2010-10-22T05:20:41Z

Palz: This is the first gen iTV

This is the first gen iTV

Main Page

2010-10-22T05:15:59Z

Palz:

[[Image:Iptwiki.png|center]]

{{:Main Page/Welcome}}
{| border="1" class="wikitable" style="width:100%;"
|-
|style="background-color:lime; text-align:center; width:25%;"| '''[[Jailbreak (S5L8920+)|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]'''
|style="background-color:orange; text-align:center; width:25%;"| '''[[Jailbreak (S5L8920+)|Find bootrom exploit allowing unsigned code exec on startup (S5L8920+)]]'''
|style="background-color:orange; text-align:center; width:25%;"| '''[[X-Gold 608 Unlock|Break Chain of Trust (X-Gold 608)]]'''
|style="background-color:orange; text-align:center; width:25%;"| '''[[X-Gold 618 Unlock|Break Chain of Trust (X-Gold 618)]]'''
|}

{{col-begin}}
{{col-2}}
{{HeadingA|Software}}
* [[/|Filesystem]]
* [[Firmware]]
* [[iTunes]]
** [[iTunes Errors]]
** [[iTunes Modes]]
* [[Keys]]
** [[AES Keys]]
** [[Apple Certificate]]
** [[Baseband RSA Keys|RSA Keys]]
** [[Baseband TEA Keys|TEA Keys]]
** [[NCK]]
* [[Protocols]]
** [[Normal Mode]]
** [[Recovery Mode (Protocols)|Recovery Mode]]
** [[Restore Mode]]
** [[DFU (Protocol)|DFU]]
** [[Baseband Bootrom Protocol]]
** [[Interactive Mode|Baseband Bootloader Protocol]]
* [[System Log|System Log (syslog)]]

====Jailbreak Software====
* [[blackra1n]]
* [[greenpois0n]]
* [[iBrickr]]
* [[iLiberty / iLiberty+]]
* [[iNdependence]]
* [[JailbreakMe]]
* [[limera1n]]
* [[purplera1n]]
* [[PwnageTool]]
* [[redsn0w]]
* [[sn0wbreeze]]
* [[Spirit]]
* [[ZiPhone]]

{{col-2}}
{{HeadingB|Hardware}}
====[[iPhone]]====
* [[M68ap|iPhone (m68ap)]]
* [[N82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]
* [[N90ap|iPhone 4 (n90ap)]]

====[[iPod touch]]====
* [[N45ap|iPod touch (n45ap)]]
* [[N72ap|iPod touch 2G (n72ap)]]
* [[N18ap|iPod touch 3G (n18ap)]]
* [[N81ap|iPod touch 4G (n81ap)]]

====[[iPad]]====
* [[K48ap|iPad (k48ap)]]

====[[Apple TV]]====
* [[K66ap|Apple TV 2G (k66ap)]]

====Processors====
* [[S5L8900]] ([[M68ap|iPhone]], [[N45ap|iPod touch]], [[N82ap|iPhone 3G]])
* [[S5L8720]] ([[N72ap|iPod touch 2G]])
* [[S5L8920]] ([[N88ap|iPhone 3GS]])
* [[S5L8922]] ([[N18ap|iPod touch 3G]])
* [[S5L8930]] ([[k48ap|iPad]], [[n90ap|iPhone 4]], [[n81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]])
* [[Baseband Device]]

====Other====
* [[Bluetooth]]
* [[Gyroscope]]
* [[Accelerometer]]
* [[Compass]]
{{col-end}}

{{col-begin}}
{{col-2}}
{{HeadingA|Development}}

====iPhone Hackers====
* [[User:Planetbeing|planetbeing]]
* [[User:MuscleNerd|MuscleNerd]]
* [[User:Comex|comex]]
* [[User:Geohot|geohot]]

====iPhone Hacker Teams====
* [[iPhone Dev Team]]
* [[Chronic Dev (team)|Chronic Dev]]

====Application Development====
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

====Application Copy Protection====
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]
* [[Defeating Cracks]]
{{col-2}}
{{HeadingB|Help}}

====Guides====
* [[Tutorials]]
* [[Useful Links]]

====Definitions====
* [[Activation]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[Bootrom]] / [[VROM]]
* [[CHIPID]]
* [[CPID]]
* [[DFU Mode]]
* [[ECID]]
* [[iBEC]]
* [[iBoot]]
* [[iBSS]]
* [[Jailbreak]]
** [[Tethered jailbreak]]
** [[Untethered jailbreak]]
* [[Kernel]]
* [[LLB]]
* [[NAND]]
* [[NOR]]
* [[NORID]]
* [[SHSH]]
* [[Unlock]]
{{col-end}}

{| border="1" class="wikitable" style="background-color:orange; width:100%;"
|-
|colspan="4" style="background-color:orange; text-align:center;"| [[Disclaimer]]
|}

__NOTOC____NOEDITSECTION__

Gyroscope

2010-10-22T05:12:45Z

Palz: New page: This is present in the iPhone 4 and the iPod touch 4G. It detects movements far more precise than the accelerometer, and creates 6-axis motion sensing combined with...

This is present in the [[N90ap|iPhone 4]] and the [[N81ap|iPod touch 4G]]. It detects movements far more precise than the [[accelerometer]], and creates 6-axis motion sensing combined with the Compass (iPhone-only) and the accelerometer.

Main Page

2010-10-22T05:07:38Z

Palz: Otherish hardware, eh?

[[Image:Iptwiki.png|center]]

{{:Main Page/Welcome}}
{| border="1" class="wikitable" style="width:100%;"
|-
|style="background-color:lime; text-align:center; width:25%;"| '''[[Jailbreak (S5L8920+)|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]'''
|style="background-color:orange; text-align:center; width:25%;"| '''[[Jailbreak (S5L8920+)|Find bootrom exploit allowing unsigned code exec on startup (S5L8920+)]]'''
|style="background-color:orange; text-align:center; width:25%;"| '''[[X-Gold 608 Unlock|Break Chain of Trust (X-Gold 608)]]'''
|style="background-color:orange; text-align:center; width:25%;"| '''[[X-Gold 618 Unlock|Break Chain of Trust (X-Gold 618)]]'''
|}

{{col-begin}}
{{col-2}}
{{HeadingA|Software}}
* [[/|Filesystem]]
* [[Firmware]]
* [[iTunes]]
** [[iTunes Errors]]
** [[iTunes Modes]]
* [[Keys]]
** [[AES Keys]]
** [[Apple Certificate]]
** [[Baseband RSA Keys|RSA Keys]]
** [[Baseband TEA Keys|TEA Keys]]
** [[NCK]]
* [[Protocols]]
** [[Normal Mode]]
** [[Recovery Mode (Protocols)|Recovery Mode]]
** [[Restore Mode]]
** [[DFU (Protocol)|DFU]]
** [[Baseband Bootrom Protocol]]
** [[Interactive Mode|Baseband Bootloader Protocol]]
* [[System Log|System Log (syslog)]]

====Jailbreak Software====
* [[blackra1n]]
* [[greenpois0n]]
* [[iBrickr]]
* [[iLiberty / iLiberty+]]
* [[iNdependence]]
* [[JailbreakMe]]
* [[limera1n]]
* [[purplera1n]]
* [[PwnageTool]]
* [[redsn0w]]
* [[sn0wbreeze]]
* [[Spirit]]
* [[ZiPhone]]

{{col-2}}
{{HeadingB|Hardware}}
====[[iPhone]]====
* [[M68ap|iPhone (m68ap)]]
* [[N82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]
* [[N90ap|iPhone 4 (n90ap)]]

====[[iPod touch]]====
* [[N45ap|iPod touch (n45ap)]]
* [[N72ap|iPod touch 2G (n72ap)]]
* [[N18ap|iPod touch 3G (n18ap)]]
* [[N81ap|iPod touch 4G (n81ap)]]

====[[iPad]]====
* [[K48ap|iPad (k48ap)]]

====[[Apple TV]]====
* [[K66ap|Apple TV 2G (k66ap)]]

====Processors====
* [[S5L8900]] ([[M68ap|iPhone]], [[N45ap|iPod touch]], [[N82ap|iPhone 3G]])
* [[S5L8720]] ([[N72ap|iPod touch 2G]])
* [[S5L8920]] ([[N88ap|iPhone 3GS]])
* [[S5L8922]] ([[N18ap|iPod touch 3G]])
* [[S5L8930]] ([[k48ap|iPad]], [[n90ap|iPhone 4]], [[n81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]])
* [[Baseband Device]]

====Other====
* [[Bluetooth]]
* [[Gyroscope]]
{{col-end}}

{{col-begin}}
{{col-2}}
{{HeadingA|Development}}

====iPhone Hackers====
* [[User:Planetbeing|planetbeing]]
* [[User:MuscleNerd|MuscleNerd]]
* [[User:Comex|comex]]
* [[User:Geohot|geohot]]

====iPhone Hacker Teams====
* [[iPhone Dev Team]]
* [[Chronic Dev (team)|Chronic Dev]]

====Application Development====
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

====Application Copy Protection====
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]
* [[Defeating Cracks]]
{{col-2}}
{{HeadingB|Help}}

====Guides====
* [[Tutorials]]
* [[Useful Links]]

====Definitions====
* [[Activation]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[Bootrom]] / [[VROM]]
* [[CHIPID]]
* [[CPID]]
* [[DFU Mode]]
* [[ECID]]
* [[iBEC]]
* [[iBoot]]
* [[iBSS]]
* [[Jailbreak]]
** [[Tethered jailbreak]]
** [[Untethered jailbreak]]
* [[Kernel]]
* [[LLB]]
* [[NAND]]
* [[NOR]]
* [[NORID]]
* [[SHSH]]
* [[Unlock]]
{{col-end}}

{| border="1" class="wikitable" style="background-color:orange; width:100%;"
|-
|colspan="4" style="background-color:orange; text-align:center;"| [[Disclaimer]]
|}

__NOTOC____NOEDITSECTION__

PurpleRestore

2010-10-22T05:04:38Z

Palz: Spammahs. Meh.

''PurpleRestore'' is a cross-platform tool used for flashing iDevices. Barely anything is known about it, this tool provides far more customization than [[iTunes]].

Cydia.app

2010-10-21T03:26:18Z

Palz: Random, but article still needs work

Cydia is an open source application installer created by [[Saurik]] that uses the Debian APT system for package management. It is included with all [[iPhone Dev Team]] [[jailbreak]]s, and is found in every mainstream jailbreak tool (e.g [[redsn0w]], [[blackra1n]], [[PwnageTool]], [[sn0wbreeze]], [[Spirit]]) since iOS 2.0.

Cydia SHSH Server

2010-10-21T03:25:15Z

Palz:

Cydia/Saurik Server is a server that was created by [[Saurik]]. It stores [[SHSH]] blobs for devices that use Cydia's "on-file" feature. For more details see [[SHSH]] and [[TinyUmbrella]].

== Usage ==
To use the server to restore to a firmware no longer being signed by Apple (e.g. 4.0.1), you must first [[jailbreak]] and use Cydia's "Make your life easier" option. Then add the following line to /etc/hosts (Mac OS X/Linux via [[user:posixninja|posixninja's]] idevicerestore) or C:\Windows\System32\drivers\etc\hosts (Windows XP+):

'''74.208.10.249 gs.apple.com'''

Note: On windows, make sure you open hosts as administrator.
Then go along with the restore process. If the restore fails after "Verifying iPhone restore with Apple", you have not set up correctly.

== How it works ==
Basically, it uses the [[wikipedia:hosts|hosts]] file to redirect the Apple firmware server to saurik's. His server has a ECID SHSH database, just like apple's. When an older firmware request is sent to apple, it will deny the SHSH request and error out. When it's requested at saurik's, if you've saved it, it finds the SHSH and continues with the restore.

== See also ==
[[Cydia Application]]

Bootrom 359.3

2010-10-21T00:24:36Z

Palz:

[[S5L8920]] bootrom revision for the [[N88ap|iPhone 3GS]] sold between June 2009 and September 2009.

'''Vulnerable to the [[0x24000 Segment Overflow]] exploit.'''

Bootrom

2010-10-21T00:23:49Z

Palz: /* S5L8930, used in the iPad, iPhone 4, and iPod touch 4G */

==Introduction / old+new==
The bootrom (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is unwritable. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

Often users refer to '''old bootrom''' or '''new bootrom''' devices. The '''new bootrom''' devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. Therefore these newer versions of the [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] are not vulnerable to this exploit and had only a [[tethered jailbreak]]/[[unlock]] until [[Spirit]] came out. Currently, these devices can be jailbroken on iOS 4.1 with [[greenpois0n]] along with every device available.

Please see also [[Stage 2 Bootloader|Apple's stage 2 bootloader]], which also uses the "iBoot" name.

==Check bootrom version==
To find out if you have an old or new bootrom, the easiest way is to look at the serial number. If the 4th and 5th digits are lower than 40, then you probably have an old bootrom. If they are higher than 45, then you probably have a new bootrom. These two digits show the production week. For refurbished phones and for numbers inbetween, the result is undefined and you have to make the following exact check.

To check your device's bootrom version, you must put your device into [[DFU Mode]]. Make sure it is '''not''' in [[Recovery Mode]], as Recovery Mode does not mention the bootrom version. If you have Mac OS X, go to System Profiler, and under the "Hardware" category, go to USB, and click on "Apple Mobile Device (DFU Mode)." If you have Windows, go to Device Manager, find USB controller, subitem Apple Mobile Device USB Driver. In Properties, Details, select Device Instance Path in the dropdown. The end of the info string will show the bootrom version.

If you're on Linux and have a Desktop Environment setup, install gnome-device-manager and start it. Connect you're device in DFU Mode, search in the left tree-view for "USB Device" and look at Summary -> Model until it says "Apple Mobile Device (DFU Mode)". If it does go to Properties (next to Summary) and search for "usb_device.serial". The end of the String will show you the bootrom version.

== Revisions ==
===[[S5L8900]], used in the [[M68ap|iPhone]], [[N45ap|iPod touch 1G]], and [[N82ap|iPhone 3G]]===

===[[S5L8720]], used in the [[N72ap|iPod touch 2G]]===
* [[iBoot-240.4]] "old bootrom"
* [[iBoot-240.5.1]] "new bootrom"

===[[S5L8920]], used in the [[N88ap|iPhone 3GS]]===
* [[iBoot-359.3]] "old bootrom"
* [[iBoot-359.3.2]] "new bootrom"

===[[S5L8922]], used in the [[N18ap|iPod touch 3G]]===
* [[iBoot-359.5]]

===[[S5L8930]], used in the [[K48ap|iPad]], [[N90ap|iPhone 4]], [[K66ap|Apple TV 2G]] and [[N81ap|iPod touch 4G]]===
* [[iBoot-574.4]]

Cydia SHSH Server

2010-10-20T23:40:37Z

Palz:

Main Page

2010-10-19T16:37:09Z

Palz: Made it green to make people feel better

[[Image:Iptwiki.png|center]]

{{:Main Page/Welcome}}
{| border="1" class="wikitable" style="width:100%;"
|-
|style="background-color:lime; text-align:center; width:25%;"| '''[[Jailbreak (S5L8920+)|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]'''
|style="background-color:lime; text-align:center; width:25%;"| '''[[Jailbreak (S5L8920+)|Find bootrom exploit allowing unsigned code exec on startup (S5L8920+)]]'''
|style="background-color:orange; text-align:center; width:25%;"| '''[[X-Gold 608 Unlock|Break Chain of Trust (X-Gold 608)]]'''
|style="background-color:orange; text-align:center; width:25%;"| '''[[X-Gold 618 Unlock|Break Chain of Trust (X-Gold 618)]]'''
|}

{{col-begin}}
{{col-2}}
{{HeadingA|Software}}
* [[/|Filesystem]]
* [[Firmware]]
* [[iTunes]]
** [[iTunes Errors]]
** [[iTunes Modes]]
* [[Keys]]
** [[AES Keys]]
** [[Apple Certificate]]
** [[Baseband RSA Keys|RSA Keys]]
** [[Baseband TEA Keys|TEA Keys]]
** [[NCK]]
* [[Protocols]]
** [[Normal Mode]]
** [[Recovery Mode (Protocols)|Recovery Mode]]
** [[Restore Mode]]
** [[DFU (Protocol)|DFU]]
** [[Baseband Bootrom Protocol]]
** [[Interactive Mode|Baseband Bootloader Protocol]]
* [[System Log|System Log (syslog)]]

====Jailbreak Software====
* [[blackra1n]]
* [[greenpois0n]]
* [[iBrickr]]
* [[iLiberty / iLiberty+]]
* [[iNdependence]]
* [[JailbreakMe]]
* [[limera1n]]
* [[purplera1n]]
* [[PwnageTool]]
* [[redsn0w]]
* [[sn0wbreeze]]
* [[Spirit]]
* [[ZiPhone]]

{{col-2}}
{{HeadingB|Hardware}}
====[[iPhone]]====
* [[M68ap|iPhone (m68ap)]]
* [[N82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]
* [[N90ap|iPhone 4 (n90ap)]]

====[[iPod touch]]====
* [[N45ap|iPod touch (n45ap)]]
* [[N72ap|iPod touch 2G (n72ap)]]
* [[N18ap|iPod touch 3G (n18ap)]]
* [[N81ap|iPod touch 4G (n81ap)]]

====[[iPad]]====
* [[K48ap|iPad (k48ap)]]

====[[Apple TV]]====
* [[K66ap|Apple TV 2G (k66ap)]]

====Processors====
* [[S5L8900]] ([[M68ap|iPhone]], [[N45ap|iPod touch]], [[N82ap|iPhone 3G]])
* [[S5L8720]] ([[N72ap|iPod touch 2G]])
* [[S5L8920]] ([[N88ap|iPhone 3GS]])
* [[S5L8922]] ([[N18ap|iPod touch 3G]])
* [[S5L8930]] ([[k48ap|iPad]], [[n90ap|iPhone 4]], [[n81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]])
* [[Baseband Device]]

====Other====
* [[Bluetooth]]
{{col-end}}

{{col-begin}}
{{col-2}}
{{HeadingA|Development}}

====iPhone Hackers====
* [[User:Planetbeing|planetbeing]]
* [[User:MuscleNerd|MuscleNerd]]
* [[User:Comex|comex]]
* [[User:Geohot|geohot]]

====iPhone Hacker Teams====
* [[iPhone Dev Team]]
* [[Chronic Dev (team)|Chronic Dev]]

====Application Development====
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

====Application Copy Protection====
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]
* [[Defeating Cracks]]
{{col-2}}
{{HeadingB|Help}}

====Guides====
* [[Tutorials]]
* [[Useful Links]]

====Definitions====
* [[Activation]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[Bootrom]] / [[VROM]]
* [[CHIPID]]
* [[CPID]]
* [[DFU Mode]]
* [[ECID]]
* [[iBEC]]
* [[iBoot]]
* [[iBSS]]
* [[Jailbreak]]
** [[Tethered jailbreak]]
** [[Untethered jailbreak]]
* [[Kernel]]
* [[LLB]]
* [[NAND]]
* [[NOR]]
* [[NORID]]
* [[SHSH]]
* [[Unlock]]
{{col-end}}

{| border="1" class="wikitable" style="background-color:orange; width:100%;"
|-
|colspan="4" style="background-color:orange; text-align:center;"| [[Disclaimer]]
|}

__NOTOC____NOEDITSECTION__

Talk:Usb control msg(0xA1, 1) Exploit

2010-10-18T16:51:40Z

Palz:

Is this even suppose to be here? :S

[[User:Ih8sn0w|iH8sn0w]] 00:31, 21 September 2010 (UTC)
:[[User:Pod2g|Pod2g]] posted it himself so I don't see much of a problem for it as it doesn't sound like it will work on new devices. --[[User:OMEGA_RAZER|OMEGA_RAZER]]

So would this exploit lead to a tethered jailbreak or would it be untethered? --[[User:JacobVengeance|JacobVengeance]] 01:50, 21 September 2010 (UTC)

:Tethered. This just allows unsigned code execution to be performed regardless of SHSH or model revision at the DFU/bootrom level. This is useful for redsn0w or blackra1n type hacks as they provide a quick and unclosable exploit to perform the actual jailbreak. Functionally, this replaces the need for sending 2.1.1 iBSS + iBEC to use Arm7Go or the 3.1.2 iBSS/iBEC (if that can even be done?) for that other USB control msg exploit in 3.1.2 iBoot. [[User:Iemit737|Iemit737]] 02:37, 21 September 2010 (UTC)

the new bootrom ipod touch 2g where ipod touch 3g so will this exploit work on ipod3g and iphone 3gs --[[User:Liamchat|liamchat]] 14:51, 21 September 2010 (UTC)

:I don't completely understand your question, but no, this exploit will work on nothing other than the 2nd generation iPod touch (and is not particularly big news, since we can already run unsigned code on the second gen touch). [[User:AriX|AriX]] 18:01, 21 September 2010 (UTC)

[[User:Pod2g|Pod2g]] : I released this one because it's old devices only (Apple engineers already found and fixed it).
The good thing about it, is that it's a way to execute unsigned assembly code easily ''in the context of the bootrom''.
Researchers can use it to explore the bootrom, try things, etc. Also, maybe it could be useful for iDroid ?

palz2015 : So could it be untethered using the exploit to run code that patches the kernel, and preform a userland-only jailbreak, just from DFU?

no because the exploit will replace the rdisk with a pwnd one ( that will fail the check ) and cydia will need to know how to use the exploit but you can re inject apple's rdisk --[[User:Liamchat|liamchat]] 18:55, 27 September 2010 (UTC)
: What are you talking about? Filesystem modification causes no problems, dropping in a dylib, adding a daemon for a userland jailbreak and changing FStab is a fully functional jailbreak. Also cydia does not have knowledge of how to use any exploit... [[User:Iemit737|Iemit737]] 21:19, 30 September 2010 (UTC)

What is classified as a 'New Device'. Would an iPod Touch 2G with the 2nd revision of the S5L8720 bootrom be classified as a new device? --[[User:Ac3xx|ac3xx]] 17:44, 30 September 2010 (UTC)

:The second revision of the touch 2G does have this exploit, but no devices after that. [[User:Iemit737|Iemit737]] 21:19, 30 September 2010 (UTC)

But really, you could execute an unsigned ramdisk, have it patch the kernel at boot (so no recovery mode), and userland jailbreak. Untethered? --[[User:Palz|Palz]] 21:41, 30 September 2010 (UTC)
:Where would this ramdisk come from that patches the kernel at boot?? Ramdisks only come from Recovery/DFU mode which is what SHAtter is all about. But if this ramdisk's purpose is just to drop in a dynamic library / binary you can convince iOS to execute that uses another userland exploit in some framework, then you would have an untethered jailbreak. [[User:Iemit737|Iemit737]] 21:46, 30 September 2010 (UTC)
:You could do that. So long as you have an exploit (like this) and a payload, you can exploit, upload payload and then upload a pwned iBSS. Then, once in a pwned environment you can easily boot a pwned ramdisk with a userland jailbreak on it - no problem :) [[User:Windows Helpdesk|blackthund3r]] 06:14, 18 October 2010 (UTC)
::Yeah, I mean use this, run the ramdisk, patch the kernel, it adds a daemon for jailbreame star or spirit to make it untethered. Like limera1n. --[[User:Palz|Palz]] 16:51, 18 October 2010 (UTC)

== Steaks4U? ==
Is this the Steaks4U exploit pod2g mentioned on twitter? --[[User:Rekoil|Rekoil]] 14:43, 18 October 2010 (UTC)
:Yes. Look at article's history, last two edits by him. -- [[User:Http|http]] 16:44, 18 October 2010 (UTC)

Talk:Limera1n

2010-10-15T22:16:44Z

Palz: /* He did it */

== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out [[SHAtter]] and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:Geohot|Geohots]] exploit not used and keep [[SHAtter]] for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)
:::I think it's because they need to be plugged in for the ramdisk to be uploaded (hence the logo). --[[User:Palz|Palz]] 21:15, 12 October 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)

::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)

== He did it==
It's in the wild. Thoughts? ~Drake
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)
::::::Blackra1n uses purpled1sk too :/ All it is is an exploit like arm7_go in DFU that pwns iBoot (temporarily) and applies a userland jailbreak from a ramdisk. --[[User:Palz|Palz]] 22:16, 15 October 2010 (UTC)

== Pwnage ==

Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)

== Support ==

I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)

== Why no ipt2g support? ==

I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)

:It works for the ipt2g new bootrom, but geohot didn't take his time to remake anything so that it would work with our device. greenpois0n will support our devices, just takes a little while to write up everything needed. --[[User:JacobVengeance|JakeAnthraX]] 05:24, 13 October 2010 (UTC)

== hacktivation.dylib ==

I added info about it and how to remove it for people who activate with iTunes. Hope no one minds. --[[User:Cmdshft|cmdshft]] 04:31, 13 October 2010 (UTC)

== Pwn4life ==

Is this a pwned4life? If it is, can a restore remove it? --[[User:Balloonhead66|Balloonhead66]] 02:10, 15 October 2010 (UTC)
:A DFU Mode restore will return you to a fresh and all Apple state --[[User:OMEGA RAZER|OMEGA RAZER]] 04:20, 15 October 2010 (UTC)

Talk:Limera1n

2010-10-15T22:16:14Z

Palz: /* He did it */

== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out [[SHAtter]] and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:Geohot|Geohots]] exploit not used and keep [[SHAtter]] for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)
:::I think it's because they need to be plugged in for the ramdisk to be uploaded (hence the logo). --[[User:Palz|Palz]] 21:15, 12 October 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)

::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)

== He did it==
It's in the wild. Thoughts? ~Drake
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)
::::::Blackra1n uses purpled1sk too :/ All it is is an exploit like arm7_go in DFU that pwns iBoot (temporarily) and applies a userland jailbreak. --[[User:Palz|Palz]] 22:16, 15 October 2010 (UTC)

== Pwnage ==

Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)

== Support ==

I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)

== Why no ipt2g support? ==

I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)

:It works for the ipt2g new bootrom, but geohot didn't take his time to remake anything so that it would work with our device. greenpois0n will support our devices, just takes a little while to write up everything needed. --[[User:JacobVengeance|JakeAnthraX]] 05:24, 13 October 2010 (UTC)

== hacktivation.dylib ==

I added info about it and how to remove it for people who activate with iTunes. Hope no one minds. --[[User:Cmdshft|cmdshft]] 04:31, 13 October 2010 (UTC)

== Pwn4life ==

Is this a pwned4life? If it is, can a restore remove it? --[[User:Balloonhead66|Balloonhead66]] 02:10, 15 October 2010 (UTC)
:A DFU Mode restore will return you to a fresh and all Apple state --[[User:OMEGA RAZER|OMEGA RAZER]] 04:20, 15 October 2010 (UTC)

Talk:Limera1n

2010-10-12T21:15:43Z

Palz: /* Latest edit to Limera1n */

== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out [[SHAtter]] and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:Geohot|Geohots]] exploit not used and keep [[SHAtter]] for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)
:::I think it's because they need to be plugged in for the ramdisk to be uploaded (hence the logo). --[[User:Palz|Palz]] 21:15, 12 October 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)

::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)

== He did it==
It's in the wild. Thoughts? ~Drake
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)

== Pwnage ==

Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)

== Support ==

I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)

== Why no ipt2g support? ==

I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)

Talk:Limera1n

2010-10-12T21:13:51Z

Palz: /* Why no ipt2g support? */ new section

== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out [[SHAtter]] and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:Geohot|Geohots]] exploit not used and keep [[SHAtter]] for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)

::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)

== He did it==
It's in the wild. Thoughts? ~Drake
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)

== Pwnage ==

Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)

== Support ==

I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)

== Why no ipt2g support? ==

I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)

Baseband Device

2010-10-09T19:52:08Z

Palz:

This is the device in the iPhone that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the [[ARM]] core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in its NVRAM.

The [[M68ap|iPhone]]'s baseband processor is the [[S-Gold 2]]. The [[N82ap|iPhone 3G]] and the [[N88ap|iPhone 3GS]] make use of the [[X-Gold 608]] chip for this purpose. The [[N90ap|iPhone 4]] uses the [[XMM 6180]].

You can check some [[Baseband Commands]] too (by pH and EvilPenguin).

==[[Seczone]]==
This is the area in the baseband where the lock state is stored.

===Layout===
0x400--NCK token
0xA00--IMEI signature
0xB00--IMEI
0xC00--Locks table

===Encryption===
Many of the sections are encrypted using [[Baseband TEA Keys|TEA]] based off the [[CHIPID]] and [[NORID]]. See [[NCK Brute Force]] for more info.

==Exploits==
* [[SIM hacks]]

===[[S-Gold 2]]===
* [[Fakeblank]]
* [[IPSF]]
* [[Minus 0x400]]
* [[Minus 0x20000 with Back Extend Erase]]

===[[X-Gold 608]]===
* [[JerrySIM]]
* [[AT+stkprof]]
* [[AT+XLOG Vulnerability]]
* [[AT+XEMN Heap Overflow]]
* [[AT+XAPP Vulnerability]]

===[[XMM 6180]]===
* [[AT+XAPP Vulnerability]]

==Theoretical Attacks==
* [[NCK Brute Force]]
* [[Baseband JTAG]]

==Boot Chain==
[[Baseband Bootrom|bootrom]]->[[Baseband Bootloader|bootloader]]->[[Baseband Firmware|firmware]]

[[Category:Baseband]]

S5L8720

2010-10-09T19:09:02Z

Palz:

This is the Application Processor used on the [[n72ap|iPod Touch 2G]].

== Exploits ==
=== [[iBoot]] ===
'''Note''': [[iBoot]] on the S5L8720 can be downgraded, allowing any of these exploits to be used on future firmwares

* [[ARM7 Go]] - Works on [[iOS]] 2.1.1
* [[iBoot Environment Variable Overflow]] - Works up to [[iOS]] 3.1 beta 3
* [[usb_control_msg(0x21, 2) Exploit]] - Works up to [[iOS]] 3.1.2

=== [[S5L8720 (Bootrom)|Bootrom]] ===
* [[0x24000 Segment Overflow]] - only in [[iBoot-240.4]] (old bootrom)
* [[usb_control_msg(0xA1, 1) Exploit]] - in [[iBoot-240.4]] and [[iBoot-240.5.1]]

=== [[Kernel]] ===
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.1.3
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 4.0

=== [[Userland]] ===
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.1.3
* [[PDF CFF Font Stack Overflow]] - Works up to [[iOS]] 4.0

==Boot Chain==
[[VROM]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

It is definitely worthy to note that the [[Pwnage]] exploit is fixed because the images are now flashed to the [[NOR]] in their encrypted [[IMG3 File Format|IMG3]] containers, and the [[S5L8720 (Bootrom)|bootrom]] can properly check [[LLB]]'s signature. That being said, unsigned images can still be run using the [[0x24000 Segment Overflow]], provided the [[S5L8720 (Bootrom)|bootrom]] is [[iBoot-240.4|old enough]].

==See Also==
* [[S5L8720 (Hardware)]]
* [[S5L File Formats]]

==External Links==
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf Technical Reference Manual: ARM1176JZF-S]

Talk:Greenpois0n (jailbreak)

2010-10-09T05:27:46Z

Palz:

I guess the arsenic one can incorporate new bootrom exploits to make pwnagetool-style ipsws? --[[User:Palz|Palz]] 05:27, 9 October 2010 (UTC)

Talk:Greenpois0n (jailbreak)

2010-10-09T05:27:09Z

Palz: New page: I guess the custom firmware one can incorporate new bootrom exploits to make pwnagetool-style ipsws? --~~~~

I guess the custom firmware one can incorporate new bootrom exploits to make pwnagetool-style ipsws? --[[User:Palz|Palz]] 05:27, 9 October 2010 (UTC)

Bootrom 240.4

2010-10-09T04:58:15Z

Palz:

[[S5L8720]] bootrom revision for [[N72ap|iPod touch 2G]] devices sold between September 2008 and September 2009. It patches the [[Pwnage]] exploit, as the bootrom now properly signature checks LLB.

'''This is vulnerable to the [[0x24000 Segment Overflow]] exploit'''.

'''This is vulnerable to the [[usb_control_msg(0xA1, 1) Exploit]]'''.

Bootrom 240.4

2010-10-09T04:57:21Z

Palz: fused

[[S5L8720]] bootrom revision for [[N72ap|iPod touch 2G]] devices sold between September 2008 and September 2009.

'''This is vulnerable to the [[0x24000 Segment Overflow]] exploit'''.

'''This is vulnerable to the [[usb_control_msg(0xA1, 1) Exploit]]'''.

Talk:Usb control msg(0xA1, 1) Exploit

2010-09-30T21:42:15Z

Palz:

Talk:Usb control msg(0xA1, 1) Exploit

2010-09-30T21:41:09Z

Palz:

Is this even suppose to be here? :S

[[User:Ih8sn0w|iH8sn0w]] 00:31, 21 September 2010 (UTC)
:[[User:Pod2g|Pod2g]] posted it himself so I don't see much of a problem for it as it doesn't sound like it will work on new devices. --[[User:OMEGA_RAZER|OMEGA_RAZER]]

So would this exploit lead to a tethered jailbreak or would it be untethered? --[[User:JacobVengeance|JacobVengeance]] 01:50, 21 September 2010 (UTC)

:Tethered. This just allows unsigned code execution to be performed regardless of SHSH or model revision at the DFU/bootrom level. This is useful for redsn0w or blackra1n type hacks as they provide a quick and unclosable exploit to perform the actual jailbreak. Functionally, this replaces the need for sending 2.1.1 iBSS + iBEC to use Arm7Go or the 3.1.2 iBSS/iBEC (if that can even be done?) for that other USB control msg exploit in 3.1.2 iBoot. [[User:Iemit737|Iemit737]] 02:37, 21 September 2010 (UTC)

the new bootrom ipod touch 2g where ipod touch 3g so will this exploit work on ipod3g and iphone 3gs --[[User:Liamchat|liamchat]] 14:51, 21 September 2010 (UTC)

:I don't completely understand your question, but no, this exploit will work on nothing other than the 2nd generation iPod touch (and is not particularly big news, since we can already run unsigned code on the second gen touch). [[User:AriX|AriX]] 18:01, 21 September 2010 (UTC)

[[User:Pod2g|Pod2g]] : I released this one because it's old devices only (Apple engineers already found and fixed it).
The good thing about it, is that it's a way to execute unsigned assembly code easily ''in the context of the bootrom''.
Researchers can use it to explore the bootrom, try things, etc. Also, maybe it could be useful for iDroid ?

palz2015 : So could it be untethered using the exploit to run code that patches the kernel, and preform a userland-only jailbreak, just from DFU?

no because the exploit will replace the rdisk with a pwnd one ( that will fail the check ) and cydia will need to know how to use the exploit but you can re inject apple's rdisk --[[User:Liamchat|liamchat]] 18:55, 27 September 2010 (UTC)
: What are you talking about? Filesystem modification causes no problems, dropping in a dylib, adding a daemon for a userland jailbreak and changing FStab is a fully functional jailbreak. Also cydia does not have knowledge of how to use any exploit... [[User:Iemit737|Iemit737]] 21:19, 30 September 2010 (UTC)

What is classified as a 'New Device'. Would an iPod Touch 2G with the 2nd revision of the S5L8720 bootrom be classified as a new device? --[[User:Ac3xx|ac3xx]] 17:44, 30 September 2010 (UTC)

:The second revision of the touch 2G does have this exploit, but no devices after that. [[User:Iemit737|Iemit737]] 21:19, 30 September 2010 (UTC)

But really, you could execute an unsigned ramdisk, have it patch the kernel, and userland jailbreak. Untethered? --[[User:Palz|Palz]] 21:41, 30 September 2010 (UTC)

Zwindow

2010-09-30T21:23:10Z

Palz: Not gonna work with mobileterminal

ZWindow is a port of the X Window System to iphonelinux. It is a work in progress, as it can only start the server, not launch any [[wikipedia:X11|X11]] applications (as well as the fact that there is no touch support or keyboard). It aims to provide an open-source graphical OS separate from the Apple OS.

Zwindow

2010-09-30T21:16:15Z

Palz:

ZWindow is a port of the X Window System to iphonelinux/MobileTerminal (maybe?). It is a work in progress, as it can only start the server, not launch any [[wikipedia:X11|X11]] applications (as well as the fact that there is no touch support or keyboard).

List of Apple TVs

2010-09-29T22:06:31Z

Palz:

Apple TV is Apple's brand of a home media center. The second generation ([[K66ap|AppleTV2,1]]) runs [[iOS]].

List of Apple TVs

2010-09-29T22:06:25Z

Palz:

Apple TV is Apple's brand of a home media center. The second generation ([[K66AP|AppleTV2,1]]) runs [[iOS]].

List of Apple TVs

2010-09-29T22:05:59Z

Palz:

Apple TV is Apple's brand of a home media center. The second generation ([[K66Ap|AppleTV2,1]]) runs [[iOS]].

List of Apple TVs

2010-09-29T22:05:34Z

Palz: New page: Apple TV is Apple's brand of a home media center. The second generation (AppleTV2,1) runs iOS.

Apple TV is Apple's brand of a home media center. The second generation ([[K88Ap|AppleTV2,1]]) runs [[iOS]].

Zwindow

2010-09-27T01:39:33Z

Palz:

ZWindow is a port of the X Window System to iphonelinux/MobileTerminal (maybe?). It is a work in progress, as it can only start the server, not launch any [[wikipedia:X11]] applications (as well as the fact that there is no touch support or keyboard).

Zwindow

2010-09-27T01:38:25Z

Palz:

ZWindow is a port of the X Window System to iphonelinux/MobileTerminal (maybe?). It is a work in progress, as it can only start the server, not launch any [[wikipedia:X11]] applications.