== Timing ==

You should write something to autodetect device timing, I will look at it (already forked) but no guarantees. --[[User:Phyrrus9|Phyrrus9]] ([[User talk:Phyrrus9|talk]]) 21:06, 2 October 2013 (UTC)
:Thanks for the suggestion Phyrrus9, I'm planning on doing that. Eventually, the idea is for the whole process will be automated; I'm trying to move away from greenpois0n and recboot (instead using some syringe tools), and use iRecovery to detect what mode the device is in instead of relying on user feedback. --[[User:CompilingEntropy|CompilingEntropy]] ([[User talk:CompilingEntropy|talk]]) 22:13, 2 October 2013 (UTC)
::I would be willing to help out with that. --[[User:Phyrrus9|Phyrrus9]] ([[User talk:Phyrrus9|talk]]) 00:05, 3 October 2013 (UTC)
:::That would be great; what I need the most help with right now is getting a working version of injectpois0n. It always gives me <code>segmentation fault 11</code> when I compile it from source, and I haven't been able to fix it. --[[User:CompilingEntropy|CompilingEntropy]] ([[User talk:CompilingEntropy|talk]]) 12:51, 5 October 2013 (UTC)
::::If you can tell me where you got that code, and send me a zip of your current tree, I can find the fault. email is at [[User:Phyrrus9]] --[[User:Phyrrus9|Phyrrus9]] ([[User talk:Phyrrus9|talk]]) 00:37, 6 October 2013 (UTC)
:::::The source is available at https://github.com/Chronic-Dev/syringe, I'll be able to email you a precompiled zip on Tuesday. --[[User:CompilingEntropy|CompilingEntropy]] ([[User talk:CompilingEntropy|talk]]) 08:22, 6 October 2013 (UTC)
::::::I can compile syringe, I mean is the code on your github the most current? --[[User:Phyrrus9|Phyrrus9]] ([[User talk:Phyrrus9|talk]]) 19:31, 6 October 2013 (UTC)
:::::::Yep, the latest is on github. To be clear, injectpois0n segfaults when run on its own for me. If I could get past that, I could easily implement it in keylimepie. --[[User:CompilingEntropy|CompilingEntropy]] ([[User talk:CompilingEntropy|talk]]) 05:35, 7 October 2013 (UTC)
::::::::Could you tell me where you are when it segfaults? I can gdb it and tell you/fix the problem --[[User:Phyrrus9|Phyrrus9]] ([[User talk:Phyrrus9|talk]]) 20:11, 7 October 2013 (UTC)

== iPhone 4 (CDMA) support ==

Syringe can have n92ap support. Example: [https://github.com/Haifisch/AESPayload Github] --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 15:19, 7 October 2013 (UTC)

Talk:Keylimepie

2013-10-06T19:31:37Z

Phyrrus9:

Talk:Keylimepie

2013-10-06T00:37:21Z

Phyrrus9:

Template talk:Keys

2013-10-05T02:04:01Z

Phyrrus9:

== File Names ==
I know why we list the file names of the Root FS and ramdisks: to know which is which. Why don't we list the file names of the other ([[IMG3 File Format|IMG3]]) files? I have seen some [[n82ap|iPhone 3G]] (<code>iPhone1,2</code>/<code>n82ap</code>) firmwares that contain [[m68ap|iPhone 2G]] (<code>iPhone1,1</code>/<code>m68ap</code> IMG3 files also under <code>/Firmware/dfu</code> and <code>/Firmware/all_flash</code>. There have also been some firmwares that contain multiple [[Kernelcache]]s. To know which is which, you need to look up the [[Application Processor|application processor]]'s name. If you have the keys in front of you, it would make sense to have the file name also. Listing the file names of the Root FS and ramdisks makes it so you don't have to look in <code>BuildManifest.plist</code> to find out which is which. So why do we make you have to look up the applicatioin processor's name? Granted, this situation doesn't happen that often, but it would still make sense. As for how to acomplish this, we can just use the current method for IMG3 files, but modified a bit ([[Big Bear 5C1 (iPhone)|iPhone 2G 2.0.2 (5C1)]]):
| iBSS = iBSS.m68ap.RELEASE.dfu
| iBSSIV = TODO
| iBSSKey = TODO
Any ideas? --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 15:58, 3 October 2013 (UTC)
:Sounds like a great idea, but I would also add an option for the kernelcache (not the key) but the filename. --[[User:Phyrrus9|Phyrrus9]] ([[User talk:Phyrrus9|talk]]) 02:04, 5 October 2013 (UTC)

User:Phyrrus9

2013-10-03T02:29:18Z

Phyrrus9: Update table

Ethan Laur (phyrrus9), [[iPhone]] hacker and programmer.

Skills include:
*C/C++
*C#
*Bash/batch/BASIC
*PHP
*HTML5
*CSS3
*buffer overflows :P
*Obj-C
*some assembly language (i386)
*Pro bathroom cleaner & cashier :P

I can pretty much do any of the tasks you need that don't involve 8 months of my time

Achivements:
*State Finals Champion Cross Country 2012 [http://www.superiortiming.com/wp-content/uploads/2012/10/UP-Finals-Div-1-Boys.htm source]
*Member of the HackStore team
*Member of the Private Dev Team [http://198.154.63.108/ website here]
*Member of the [http://www.openjailbreak.org OpenJailbreak] team.

Current projects include:
*LaserTag (v2)
*Various libraries [http://github.com/phyrrus9 here]
*Super Key Seeker 3 http://goo.gl/fpA7v
**Other SKS3 Links
*Source code http://goo.gl/jwf4y
*iMod https://github.com/phyrrus9/iMod-Installer
**To install:
*#Open Cydia and add "http://modtech.co/repo/iPhone"
*#Install the "iMod Installer" package
*#Open the imod app
*#Read the instructions, turn switch to on, and press install
*#Press the reboot button
*[http://goo.gl/7nxeo Phoenix 5.1 Jailbreak] (semi-untethered)
*[http://goo.gl/4gW4u Commander]
*[http://goo.gl/NeDwn iLoader] ([[OpeniBoot]])

== Contact ==
*Twitter: @phyrrus9
*Email: phyrrus9@gmail.com
*Facebook: If you can find me I will add you.

==iDevices==
{| class="wikitable" style="text-align:center;"
|-
!
! iPod touch 1G
! iPod touch 2G (MB)
! iPod touch 2G (MC)
! iPod touch 3G
! iPod touch 4G
! iPhone 3G
! iPhone 3GS (MB)
! AppleTV 2G
! iPod Nano 6G
! iPhone 5 (A1428)
! iPhone 5S (A1533)
|-
! Size
| 16GB
| 16GB
| 8GB
| 32GB
| 8GB
| 8GB
| 32GB
| {{n/a}}
| 16GB
| 16GB
| 16GB
|-
! Firmware
| 3.1.2 + Android
| 3.1.3
| 3.1.3
| 5.1.1
| 6.0
| 3.1.3
| 6.1.3
| 5.1 (6.0)
| 1.2
| 7.0.2
| 7.0.2
|-
! Jailbroken
| {{yes|Untethered}}
| {{yes|Untethered}}
| {{yes|Untethered}}
| {{yes|Untethered}}
| {{no}}
| {{no}}
| {{yes|Untethered}}
| {{no}}
| {{no}}
| {{partial}}
| {{partial}}
|-
! Developer
| {{No}}
| {{No}}
| {{No}}
| {{Yes}}
| {{Yes}}
| {{No}}
| {{Yes}}
| {{Yes}}
| {{No}}
| {{Yes}}
| {{Yes}}
|-
! Still Owned?
| {{Yes}}
| {{No|(2011)}}
| {{No|(2010)}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
|}

==Other Devices==

{| class="wikitable" style="text-align:center;"
|-
!
! Macbook Pro (2011) MC
! Dell Latitude 2110
! HP Pavillion DV-x
! Dell xxxxx
! Powermac G4
! Nexus 7
|-
! Size
| 500GB
| 250GB
| 250GB
| 80GB
| 40GB
| 16GB
|-
! Processor
| 2.4gHZ Dual Core
| 1.86gHZ x2 single core
| 2.1gHZ Dual Core
| 2.4gHZ Dual Core
| 433mHZ G4
| NVIDIA Tegra 3 quad core
|-
! Memory
| 4GB
| 2GB
| 4GB
| 4GB
| 256MB
| 1GB
|-
! First OS
| Mac OS X 10.9
| Windows 7
| Windows 8
| Debian Squeeze
| Mac OS X 10.4.11
| Cyanogenmod 10.1 Nightly
|-
! Second OS
| Mac OS X 10.8
| Debian Lenny
| Windows 7
| Android 2.1
| None
| None
|-
! Third OS
| None
| None
| Debian Squeeze
| None
| None
| None
|-
|}

Talk:Keylimepie

2013-10-03T00:05:36Z

Phyrrus9:

Talk:Main Page

2013-10-02T21:14:38Z

Phyrrus9: /* Update for new devices */ new section

{{Talk Archive}}

== Baseband Chip Page Titles ==
For the baseband chip page titles, I think we should stick with the model number despite the marketing name. Pages:
* [[S-Gold 2|PMB8876]] marketed "S-Gold 2"
* [[X-Gold 608|PMB8878]] marketed "X-Gold 608"
* [[XMM 6180]] marketed "X-Gold 618"
* [[MDM6600]] (unknown marketing name)
* [[MDM6610]] (unknown marketing name)
* [[MDM9x00]] (unknown marketing name)
--[[User:5urd|5urd]] 21:35, 8 May 2012 (MDT)
:I'm leaning more towards the marketing names, since I think people are more familiar with them and they've been in use for a long time. We've always referred to the iPhone 2G's baseband as the "S-Gold 2" and the iPhone 3G/3GS's baseband as the "X-Gold 608." (By the way, it sounds like Qualcomm "markets" their chips by model number. [http://www.qualcomm.com/media/releases/2011/02/14/qualcomm-announces-commercial-availability-gobi3000-modules]) --[[User:Dialexio|Dialexio]] 00:11, 9 May 2012 (MDT)
:I created most of these newer pages and always used the model number (without space). So I agree with that in general. Changing old ones is a totally different story though, where we need more consent. I would be for it (and create a redirect on the marketing names). --[[User:Http|http]] 01:52, 9 May 2012 (MDT)

== Baseband downgrade possibility: Attempt for 04.11.08/04.12.01 to 04.10.01 ==
'''0x1''' There is no downgrade possibility; according to the most basis of fact in how baseband works as explained by dear MuscleNerd and there is signature checks as well as bootloader's chain of trust that I'm not going to repeat them again, but for this topic I start from iTunes error 1,-1,11

'''0x2''' iTunes error 1,-1,11 :
We will get this error whenever we want to do something with BB which is not allowed by apple. you can read about these error in detail from here[http://theiphonewiki.com/wiki/index.php?title=ITunes_Errors].
Going deeper, this error raise by baseband's bootloader whenever you attempt to downgrade BB (in this case), this happens inside the NOR so this is why we can not exploit it easily from the outside.
Another reason for this error (and in here the most important one that I wanted to discuss) is that apple no longer signing that firmware.

'''0x3''' The situation that there is no BB installed on iPhone! :
I could restore my iPhone4 in the case of there will be no BB at all. I called it reset my BB. There will be no Wifi, no BT.
At the first time (a few months since I've started to work on) I thought it is dead (as apple confirmed this also). But I could restore it only to stock firmware with the latest one.
So for who stays in 04.11.08 it may lead to do upgrade to 04.12.01 permanently with the latest iOS, now is 5.1.1 and before for me was 5.0.1, so be sure what you are doing and then go to reset the BB.
So back to the game, if there was no BB then there is no bootloeader inside the NOR to stuck BB update process but I do not know that in this case what happened to "sectable" also known as "locktable" which is the master accountable to unlock the carrier, any way I think so only firmware signature checking by apple will be remain in "restore verify process" by iTunes. because as mentioned earlier, "currentBB"(BB to be updated) is allowed to be update by "comingBB" (BB to be updating to) only if :
1. "currentBB" < "comingBB" (= are you the most recent/lastest BB?)
2. "comingBB" is now signing by apple (=if so, does apple sign you? Are you eligible?)
Huum... What happens if "currentBB"="null/zero/no matter"? Could we eliminate option (1) from the security check above in this case? So what next?

'''0x4''' Track back to the issue lead us inside the bbfw file (ICE3_04.11.08_BOOT_02.13.Release) which contains four .fls files inside, and the most important one is psi_flash.fls who is in charge of security checks before handover the routines to stack.fls which is responsible for updating the baseband. This file does like NOR bootloader but fortunately it's outside the device so it is accessible but not such easy format to be understand by programmers. They are raw ROM based images for XMM6180 chip, ARM based and programmed in Thread-X, but the compiler is unknown; I will write about some disassembly notes using ida pro 6.1; by the way I leave my iPhone with no BB trying to find out and break the trust chains in the above files in order to bypass the bootloader security checks which may let us to downgrade to 04.10.01 which is currently unlocked by Gevey.
Keep in mind that if this solution works..., it will need the SHSH for downgrading the iOS firmware to do reset the BB.
I heard that iPhoneDevTeam are going to release the new version of Redsn0w which there will be no need to restore by iTunes but I do not know if the baseband approaches supposed to be addressed or it will work like iFaith that is basically bypass (preserve) BB, any way if I found this article useful I will note about disassembly and possibility approach as well as BB reset to share with any followers.
'''--[[User:Kambiz|Kambiz]] 07:49, 13 May 2012 (MDT)K.N'''

== Bluetooth Chip on [[iPhone 5]] ==
Is there any confirmation of the Bluetooth chip used in the iPhone 5? If there is, can we edit this page and add it? --[[User:5urd|5urd]] 10:04, 8 October 2012 (MDT)
:Chipworks [http://www.chipworks.com/blog/recentteardowns/2012/10/02/apple-iphone-5-the-rf/ analyzed the iPhone 5's Murata Wi-Fi module] and determined it uses the [[BCM4334]]. I'll add it to the Main Page now. --[[User:Dialexio|Dialexio]] 20:35, 8 October 2012 (MDT)

== Adding vulnerability to main page ==
The page [[CVE-2013-0964]] is currently orphaned. I think it would fit under the "Vulnerabilities and Exploits" subheading. Can someone with adequate permission make the change? [[User:0x56|0x56]] ([[User talk:0x56|talk]]) 03:52, 12 September 2013 (UTC)
:Added. --[[User:Http|http]] ([[User talk:Http|talk]]) 00:53, 13 September 2013 (UTC)

== Update for new devices ==

Somebody should update the main page (table) for the 5s and 5c --[[User:Phyrrus9|Phyrrus9]] ([[User talk:Phyrrus9|talk]]) 21:14, 2 October 2013 (UTC)

2013-01-07T18:22:32Z

Phyrrus9: Added other devices section and updated idevices

Ethan Laur (phyrrus9), [[iPhone]] hacker and programmer.

Skills include:
*C/C++
*C#
*Bash/batch/BASIC
*PHP
*HTML5
*CSS3
*buffer overflows :P
*Obj-C
*some assembly language (i386)
*Pro bathroom cleaner & cashier :P

I can pretty much do any of the tasks you need that don't involve 8 months of my time

Achivements:
*State Finals Champion Cross Country 2012 [http://www.superiortiming.com/wp-content/uploads/2012/10/UP-Finals-Div-1-Boys.htm source]
*Member of the HackStore team
*Member of the Private Dev Team

Current projects include:
*LaserTag (v2)
*Various libraries [http://github.com/phyrrus9 here]
*Super Key Seeker 3 http://goo.gl/fpA7v
**Other SKS3 Links
*Source code http://goo.gl/jwf4y
*iMod https://github.com/phyrrus9/iMod-Installer
**To install:
*#Open Cydia and add "http://modtech.co/repo/iPhone"
*#Install the "iMod Installer" package
*#Open the imod app
*#Read the instructions, turn switch to on, and press install
*#Press the reboot button
*[http://goo.gl/7nxeo Phoenix 5.1 Jailbreak] (semi-untethered)
*[http://goo.gl/4gW4u Commander]
*[http://goo.gl/NeDwn iLoader] ([[OpeniBoot]])

== Contact ==
*Twitter: @phyrrus9
*Email: phyrrus9@gmail.com
*Facebook: If you can find me I will add you.

==iDevices==
{| class="wikitable" style="text-align:center;"
|-
!
! iPod touch 1G
! iPod touch 2G (MB)
! iPod touch 2G (MC)
! iPod touch 3G
! iPod touch 4G
! iPhone 3G
! iPhone 3GS (MB)
! AppleTV 2G
! iPod Nano 6G
! iPhone 5 (A1428)
|-
! Size
| 16GB
| 16GB
| 8GB
| 32GB
| 8GB
| 8GB
| 32GB
| {{n/a}}
| 16GB
| 16GB
|-
! Firmware
| 3.1.2 + Android
| 3.1.3
| 3.1.3
| 5.1.1
| 6.0
| 3.1.3
| 6.1 beta 4
| 5.1 (6.0)
| 1.2
| 6.1 beta 4
|-
! Jailbroken
| {{yes|Untethered}}
| {{yes|Untethered}}
| {{yes|Untethered}}
| {{yes|Untethered}}
| {{no}}
| {{no}}
| {{yes|Untethered}}
| {{no}}
| {{no}}
| {{no}}
|-
! Developer
| {{No}}
| {{No}}
| {{No}}
| {{Yes}}
| {{Yes}}
| {{No}}
| {{Yes}}
| {{Yes}}
| {{No}}
| {{Yes}}
|-
! Still Owned?
| {{Yes}}
| {{No|(2011)}}
| {{No|(2010)}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
|}

==Other Devices==

{| class="wikitable" style="text-align:center;"
|-
!
! Macbook Pro (2011) MC
! Dell Latitude 2110
! HP Pavillion DV-x
! Dell xxxxx
! Powermac G4
! Nexus 7
|-
! Size
| 500GB
| 250GB
| 250GB
| 80GB
| 40GB
| 16GB
|-
! Processor
| 2.4gHZ Dual Core
| 1.86gHZ x2 single core
| 2.1gHZ Dual Core
| 2.4gHZ Dual Core
| 433mHZ G4
| NVIDIA Tegra 3 quad core
|-
! Memory
| 4GB
| 2GB
| 4GB
| 4GB
| 256MB
| 1GB
|-
! First OS
| Mac OS X 10.8
| Windows 7
| Windows 8
| Debian Squeeze
| Mac OS X 10.4.11
| Android 4.2.1
|-
! Second OS
| None
| Debian Lenny
| Windows 7
| Android 2.1
| None
| None
|-
! Third OS
| None
| None
| Debian Squeeze
| None
| None
| None
|-
|}

User:Phyrrus9

2013-01-02T21:20:23Z

Phyrrus9: Added developer section

User:Phyrrus9

2013-01-02T21:14:57Z

Phyrrus9: Added new phone

Talk:OTA Updates

2012-12-04T01:52:26Z

Phyrrus9:

== Encryption ==
Are the updates encrypted in any way ([[VFDecrypt]]?) --[[User:5urd|5urd]] 18:31, 30 August 2011 (MDT)
:No. Just regular Zips. --[[User:M2m|M2m]] 22:36, 30 August 2011 (MDT)
:Only NOR payloads and RAM disks are encrypted, rest of the "asset" is unencrypted --pjakuszew 04:19, 31 August 2011 (MDT)

== Tracker ==
Anyone into making a watchguard that tracks mesu.apple.com for changes (and records them)? --[[User:M2m|M2m]] 00:55, 12 November 2011 (MST)
:I did a [http://cole.freehostingcloud.com/scripts/Apple%20OTA%20Update%20Checker.php crude one]. It works by comparing against a list of already done URLs in an array --[[User:5urd|5urd]] 13:16, 12 November 2011 (MST)
:::I would just curl --user-agent="softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0" http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml -o OTA.xml and pipe it into shasum. In case shasum change, save as new version with date and time (and display)... --[[User:M2m|M2m]] 19:00, 12 November 2011 (MST)
::::One problem with that is that I can't test it on my computer here at my house as I am on windows. To test it with curl I would need to upload it to my website. What I did was open a connection with fsockopen(), sent some request headers, then read the response to a string. After that, I parsed the [[PLIST File Format|plist]] to an array. Unfortunately, the parser leaves some artifacts on the hash as it is a compressed hash. So I decided to use the file location instead. It still works pretty well. I had to remove the URL form area as it messed with the array in unwanted ways. I am working on moving it from an array to just line by line URLs preventing the failure as I just append the line to it. When I finish it, I will post the code on [http://cole.freehostinglcoud.com/cms/Scripts:PHP/Apple_OTA_Update_Checker my website]. --[[User:5urd|5urd]] 21:43, 12 November 2011 (MST)
::::: curl is avialable for windows[http://curl.haxx.se/download.html] --[[User:M2m|M2m]] 04:43, 13 November 2011 (MST)
:::::: doesn't matter, it already works and spits out a nice table. --[[User:5urd|5urd]] 16:05, 13 November 2011 (MST)
::::::: So is your tracker available online already ? --[[User:M2m|M2m]] 19:59, 26 November 2011 (MST)
:::::::: Yes. When you add a link to the wiki, you can add it to the textbox one per line and click submit and it wont show up again. --[[User:5urd|5urd]] 13:37, 27 November 2011 (MST)
:::::::: [http://pastie.org/2930838 Spammers]. It doesn't work because it works like this:
for (
$i = 0;
$i < sizeof(array_keys($plist['Assets']));
$i++)
{
if (
!in_array(
$plist['Assets'][$i]['__BaseURL'] . $plist['Assets'][$i]['__RelativePath'],
$usedurls)
)
{
// Output table
}
}
:::::::: --[[User:5urd|5urd]] 17:34, 27 November 2011 (MST)
::::::::: Should do the trick to make a backup of OTA.xml's whenever there is a change
#!/bin/bash
SHA_OLD=1
while true; do
SHA_CUR=$(curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml | shasum)

if [ "$SHA_OLD" = "$SHA_CUR" ]; then
echo nothing to do
else
NOW=$(date +"%F")
NOWT=$(date +"%T")
echo download
curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml -o OTA_$NOW-$NOWT.xml

SHA_OLD=$(curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml | shasum)
fi
sleep 600
done
:::::::::--[[User:M2m|M2m]] 08:33, 24 March 2012 (MDT)

== Carrier Beta ==
What is a carrier beta? --[[User:5urd|5urd]] 18:33, 9 January 2012 (MST)
:Most likely a beta for carrier provisions. --[[User:Rdqronos|rdqronos]] 16:19, 26 March 2012 (MDT)
:: <code>-_-</code> --[[User:5urd|5urd]] 14:33, 21 July 2012 (MDT)

== Applying .patch files from OTA updates ==
Hey guys, has anyone successfully "patched" a file with a .patch file from the "patches" folder of an OTA update? I am trying to do this and can't get it to work. I have tried on OS X, iOS, and Linux, with multiple different patches, and always get the same error: 
patch: **** Only garbage was found in the patch input.
With --verbose option:
Hmm... I can't seem to find a patch in there anywhere.
I understand from some research that common .patch files have a certain syntax to them, bu I have looked inside these .patch files (using a text editor) and they never contain any readable text (even a .txt.patch file). This leads me to believe that iOS uses a specific and exclusively designed version of Patch. If so, how would I make use of that? 
Ideally I would patch the files on-device via SSH, as I am developing something yet-to-be-announced which would need to do so automatically. If needed, it could alternatively be done using Mac OS X or Linux. 
I would greatly appreciate any help, --[[User:ValleyForge|ValleyForge]] 23:12, 28 June 2012 (MDT)
:I'd like to help, but I need to learn :P --[[User:Dylan Laws|Haifisch]] 21:49, 5 July 2012 (MDT)
::I actually figured it out, you have to use the bspatch command which is available on iOS, Mac OS X, Linux, and Windows :) --[[User:ValleyForge|ValleyForge]] 22:59, 5 July 2012 (MDT)
:::Fancy wanna iMessage me and we can brain storm what good can come out of this. Maybe a jailbreak technique ;) --[[User:Dylan Laws|Haifisch]] 10:21, 6 July 2012 (MDT)
::::Quick note: all OTA updates are signed with a private key owned by Apple. Unless you get into that department of Apple, you can't sign them without brute force. --[[User:5urd|5urd]] 12:09, 6 July 2012 (MDT)

== File Names ==
Does anyone have the slightest on how Apple names their files? It looks like a hash that is 20 bytes long (40 hex chars/160 bits). From [[wikipedia:List of hash functions|this list]], there are a few like that, but none that I have heard of. --[[User:5urd|5urd]] 14:32, 21 July 2012 (MDT)
: Should be the SHA-1 of the file.--[[User:M2m|M2m]] 21:14, 21 July 2012 (MDT)

== Resequence? and deleting files? ==
# In most updates there are "added", "patches", and "replace" folders in the payload folder. In the iOS 6.0 updates, there is a folder among those named "resequence". What does this do? Currently the only file contained in the resequence folder is the dyld cache.
# How do OTA updates control which/whether files are deleted? Where is it specified which files are deleted, or do they delete files at all?
--[[User:ValleyForge|ValleyForge]] 23:55, 29 September 2012 (MDT)

== Documentation ==
Someone should make a page with the documentation links, here's the XML: http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdateDocumentation/com_apple_MobileAsset_SoftwareUpdateDocumentation.xml --[[User:Srb21103|Srb21103]] 20:16, 20 November 2012 (MST)
:I was wondering where the documentation was retrieved from… I don't think it needs a new page, but I think it can be easily added onto this page as a new column. --[[User:Dialexio|Dialexio]] 20:04, 24 November 2012 (MST)

== Exploits ==
I'm interested in this stuff also. I have a sense there's an exploit here somewhere, but I haven't had time to look into it --[[User:Posixninja|posixninja]] 17:18, 22 November 2012 (MST)
:Their would definitely be an exploit, but it'd be fairly easily patched by Apple. You're best looking for a bootrom exploit. --[[User:Srb21103|Srb21103]] 19:48, 22 November 2012 (MST)
::Removing the signing checks would be a big achievement because we could have jail broken OTA Updates by patching out the kernel and some files in the package. --[[User:5urd|5urd]] 20:32, 22 November 2012 (MST)
:I've been examining the Settings app, kernel, and appropriate frameworks, but I haven't found anything. It is however obvious that the package contents are signed. --[[User:5urd|5urd]] 20:32, 22 November 2012 (MST)
:I set up a fake mesu.apple.com server for testing, but it seems that even the plist is somehow signed. After changing a single letter in the plist, iOS says something about having a connection problem when trying to fetch it. --[[User:Tobi|Tobi]] 11:00, 26 November 2012 (CEST)
::The Plist contains a certificate and a signature section at the bottom - so obviously this takes care that a plist can not be modified by just anyone.--[[User:M2m|M2m]] 05:27, 26 November 2012 (MST)
:::LOL, stupid me for not actually looking at the file. Although I found the source of the thing that [http://www.opensource.apple.com/source/Security/Security-55163.44/sec/Security/SecPolicyPriv.h signs the files]. Look for the function called SecPolicyCreateMobileAsset --[[User:Tobi|Tobi]] 16:04, 26 November 2012 (CEST)
::::A header file isn't going to do us much good. Maybe something along the lines of the [http://www.opensource.apple.com/source/Security/Security-55179.1/sec/Security/SecPolicy.c actual source itself]?
SecPolicyRef SecPolicyCreate(CFStringRef oid, CFDictionaryRef options) {
SecPolicyRef result = NULL;

require(oid, errOut);
require(options, errOut);
require(result =
(SecPolicyRef)_CFRuntimeCreateInstance(kCFAllocatorDefault,
SecPolicyGetTypeID(),
sizeof(struct __SecPolicy) - sizeof(CFRuntimeBase), 0), errOut);

CFRetain(oid);
result->_oid = oid;
CFRetain(options);
result->_options = options;

errOut:
return result;
}
static bool SecPolicyAddAppleCertificationAuthorityOptions(CFMutableDictionaryRef options, bool honorValidity)
{
bool success = false;

if (honorValidity)
SecPolicyAddBasicX509Options(options);
else
SecPolicyAddBasicCertOptions(options);

#if 0
CFDictionaryAddValue(options, kSecPolicyCheckKeyUsage,
kCFBooleanTrue);
CFDictionaryAddValue(options, kSecPolicyCheckExtendedKeyUsage,
kCFBooleanTrue);
#endif

/* Basic X.509 policy with the additional requirements that the chain
length is 3, it's anchored at the AppleCA and the leaf certificate
has issuer "Apple iPhone Certification Authority". */
CFDictionaryAddValue(options, kSecPolicyCheckIssuerCommonName,
CFSTR("Apple iPhone Certification Authority"));

require(SecPolicyAddChainLengthOptions(options, 3), errOut);
require(SecPolicyAddAppleAnchorOptions(options), errOut);

success = true;

errOut:
return success;
}
static SecPolicyRef SecPolicyCreateAppleCertificationAuthorityPolicy(CFStringRef policyOID, CFStringRef leafName, bool honorValidity)
{
CFMutableDictionaryRef options = NULL;
SecPolicyRef result = NULL;

require(options = CFDictionaryCreateMutable(kCFAllocatorDefault, 0,
&kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks), errOut);

require(SecPolicyAddAppleCertificationAuthorityOptions(options, honorValidity), errOut);

CFDictionaryAddValue(options, kSecPolicyCheckSubjectCommonName, leafName);

require(result = SecPolicyCreate(policyOID, options),
errOut);

errOut:
CFReleaseSafe(options);
return result;
}
SecPolicyRef SecPolicyCreateOTATasking(void)
{
return SecPolicyCreateAppleCertificationAuthorityPolicy(kSecPolicyOIDOTATasking, CFSTR("OTA Task Signing"), true);
}
SecPolicyRef SecPolicyCreateMobileAsset(void)
{
return SecPolicyCreateAppleCertificationAuthorityPolicy(kSecPolicyOIDMobileAsset, CFSTR("Asset Manifest Signing"), false);
}
::::--[[User:5urd|5urd]] 18:19, 26 November 2012 (MST)

== Apple TV ==

I don't really know how to add these to the wiki. [http://appldnld.apple.com/AppleTV/041-7282.20121128.Hfam1/com_apple_MobileAsset_SoftwareUpdate/2fed502c1d4b10b75997f0be421546195f60d3c5.zip 2G] [http://appldnld.apple.com/AppleTV/041-7280.20121128.QwPi9/com_apple_MobileAsset_SoftwareUpdate/f25fe546fe5356dce272420621f278b7ed15b0fb.zip 3G] They're mentioned in the mesu.apple.com XML, but are a bit different from the other OTA updates. (Notably, considering the file size, it looks like it contains an image to restore an Apple TV.) Any ideas?

Speaking of the Apple TV, it seems like Apple wants to keep the version numbers confusing. I think that we should add a new column for the "marketing version" for this page as well. --[[User:Dialexio|Dialexio]] 18:57, 2 December 2012 (MST)

== OTA Beta download url. ==

I would like to say I feel that adding the download url for the OTA on beta iOS leads to more piracy. Please can we delete this and add a blank cell for beta? If so I am fully willing to do this myself. --[[User:Adaminsull|Adaminsull]] 15:26, 3 December 2012 (MST)
::Whut... I'm pretty sure the OTA ZIP cannot be installed by the user without Apple's update code blah blah blah; No reason to, no piracy. --[[User:Haifisch|Haifisch]] 18:30, 3 December 2012 (MST)
It wouldn't matter since it won't activate if you are not registered under the developer program

User:Phyrrus9

2012-11-17T17:52:44Z

Phyrrus9: updated table

2012-10-02T13:35:56Z

Phyrrus9: Update info

User:Phyrrus9

2012-07-04T17:05:52Z

Phyrrus9: added sks3

I am phyrrus9, rookie [[iPhone]] hacker and programmer.

Skills include:
*C/C++
*C#
*Bash/batch/BASIC
*PHP
*HTML5
*CSS3
*buffer overflows :P
*Obj-C

I can pretty much do any of the tasks you need that don't involve 8 months of my time

Current projects include:
*Super Key Seeker 3 http://goo.gl/fpA7v
**Other SKS3 Links
*Source code http://goo.gl/jwf4y
*iMod https://github.com/phyrrus9/iMod-Installer
**To install:
*#Open Cydia and add "http://modtech.co/repo/iPhone"
*#Install the "iMod Installer" package
*#Open the imod app
*#Read the instructions, turn switch to on, and press install
*#Press the reboot button
*[http://goo.gl/7nxeo Phoenix 5.1 Jailbreak] (semi-untethered)
*[http://goo.gl/4gW4u Commander]
*[http://goo.gl/NeDwn iLoader] ([[OpeniBoot]])

== Contact ==
*Twitter: @phyrrus9
*Email: phyrrus9@gmail.com
*Facebook: If you can find me I will add you.

User:Phyrrus9

2012-06-16T02:18:33Z

Phyrrus9: added iMod stuffs

I am phyrrus9, rookie iphone hacker and programmer.

Skills include:
*C/C++
*C#
*Bash/batch/BASIC
*php
*html5
*css3
*buffer overflows :P
*Objective-C

I can pretty much do any of the tasks you need that don't involve 8 months of my time

Current projects include:
*iMod https://github.com/phyrrus9/iMod-Installer
-->To install:
1.) Open Cydia and add "http://modtech.co/repo/iPhone"
2.) Install the "iMod Installer" package
3.) Open the imod app
4.) Read the instructions, turn switch to on, and press install
5.) Press the reboot button
*Phoenix 5.1 Jailbreak semi-untethered: http://goo.gl/7nxeo
*Commander: http://goo.gl/4gW4u
*iLoader (OiB): http://goo.gl/NeDwn

=contact=
*Twitter: @phyrrus9
*Email: phyrrus9@gmail.com
*Facebook: If you can find me I will add you.

User:Phyrrus9

2012-04-19T15:26:32Z

Phyrrus9:

User:Phyrrus9

2012-04-19T15:13:38Z

Phyrrus9: added 5.1 jb

I am phyrrus9, rookie iphone hacker and programmer.

Skills include:
*C/C++
*C#
*Bash/batch/BASIC
*php
*html5
*css3
*buffer overflows :P
*Objective-C

I can pretty much do any of the tasks you need that don't involve 8 months of my time

Current projects include:
*Phoenix 5.1 Jailbreak semi-untethered: http://goo.gl/7nxeo
*Commander: http://goo.gl/4gW4u
*iLoader (OiB): http://goo.gl/NeDwn

=contact=
*Twitter: @phyrrus9
*Email: phyrrus9@gmail.com
*Facebook: If you can find me I will add you.

User:Phyrrus9

2012-03-22T12:28:27Z

Phyrrus9:

I am phyrrus9, rookie iphone hacker and programmer.

Skills include:
C/C++
C#
Bash/batch/BASIC
php
html5
css3
buffer overflows :P

I can pretty much do any of the tasks you need that don't involve 8 months of my time

Current projects include:
Commander: http://goo.gl/4gW4u
iLoader (OiB): http://goo.gl/NeDwn

=contact=
Twitter: @phyrrus9
Email: phyrrus9@gmail.com

Bluefreeze

2012-03-22T12:27:46Z

Phyrrus9:

[[iFaith]] has a protection that you don't use it on the wrong firmware to protect you. '''Bluefreeze''', a tool written by a group called [[The Private Dev Team]] with help from [[User:phyrrus9]], modifies the firmware version (and firmware checksum) in the iFaith certificate file, so that this check gets disabled. By doing so, you can install any firmware version on your device, even without having saved the [[SHSH]] files. The problem by doing so is that you actually install a firmware without signatures.

Bluefreeze asks you to build and browse to two ipsw's one signed properly and one not signed. Then Bluefreeze swaps the properly signed img3 files in the properly signed firmware file with the incorrectly signed img3 files in the unsigned ipsw thus resulting in an ipsw file with properly signed img3 files. This firmware file is used for the downgrade.

Having an incorrectly signed firmware installed won't let you boot of course. But because the limera1n exploit ignores incorrect signitures we can use the limera1n exploit (DFU mode, then using redsn0w) to boot up your device. The problem is only that you have to repeat this every time (similar to a tethered jailbreak), so it's not a downgrade you would want. This should be your last resort, and only if you absolutely need a downgrade.

This way a downgrade to [[iOS]] 4.3, 4.3.5, or 5.0 from 5.0.1 is possible. Supported devices are iPhone 3GS, iPod touch 3G, and all [[S5L8930|A4]] devices.

One common misconception about this downgrade solution is that it may conflict with an untethered jailbreak. This is completely false. If proper exploits are used (anything but a userland one ex: Jailbreakme 3.0) and properly jailbroken this tethered downgrade would become an untethered downgrade.

Another common misconception about this is that you can downgrade and use [[TinyUmbrella]] or [[iFaith]] to get a valid [[SHSH]] blob and use that to restore to that and be untethered. This is false also.

== Purpose ==
With this method you can install a firmware for which you don't have [[SHSH]] saved for some tests, for examle if you're a software developer and need to do some tests on a specific version.

== Alternative ==
A much easier way to do a "tethered downgrade" ( unsure if this still works ):
* 1. Patch ASR on the Ramdisk ( you can just create a custom IPSW and use that. )
* 2. Replace the Rootfs-DMG of the currently signed Firmware with the decrypted Rootfs-DMG of the older Firmware
* 3. After the Filesystem of the old Firmware is installed, use iRecovery and upload a pwned iBSS, iBEC and Kernel from the old Firmware
* 4. Send the device the "bootx"-Command using iRecovery.
* 5. Done! Remember your device will always need to boot tethered.

== Download ==
* [http://www.mediafire.com/?9olh9qd8v1q4xm7 Windows]

== External Links ==
* [https://github.com/ThePrivateDevTeam/Bluefreeze GitHub]
* [http://www.youtube.com/watch?v=UpZKxqLqK7A Guide]
* [http://bluefreeze.weebly.com/index.html Home Page]

[[Category:GUI Tools]]

Bluefreeze

2012-03-22T12:27:25Z

Phyrrus9:

[[iFaith]] has a protection that you don't use it on the wrong firmware to protect you. '''Bluefreeze''', a tool written by a group called [[The Private Dev Team]] with help from [[phyrrus9]], modifies the firmware version (and firmware checksum) in the iFaith certificate file, so that this check gets disabled. By doing so, you can install any firmware version on your device, even without having saved the [[SHSH]] files. The problem by doing so is that you actually install a firmware without signatures.

Bluefreeze asks you to build and browse to two ipsw's one signed properly and one not signed. Then Bluefreeze swaps the properly signed img3 files in the properly signed firmware file with the incorrectly signed img3 files in the unsigned ipsw thus resulting in an ipsw file with properly signed img3 files. This firmware file is used for the downgrade.

Having an incorrectly signed firmware installed won't let you boot of course. But because the limera1n exploit ignores incorrect signitures we can use the limera1n exploit (DFU mode, then using redsn0w) to boot up your device. The problem is only that you have to repeat this every time (similar to a tethered jailbreak), so it's not a downgrade you would want. This should be your last resort, and only if you absolutely need a downgrade.

This way a downgrade to [[iOS]] 4.3, 4.3.5, or 5.0 from 5.0.1 is possible. Supported devices are iPhone 3GS, iPod touch 3G, and all [[S5L8930|A4]] devices.

One common misconception about this downgrade solution is that it may conflict with an untethered jailbreak. This is completely false. If proper exploits are used (anything but a userland one ex: Jailbreakme 3.0) and properly jailbroken this tethered downgrade would become an untethered downgrade.

Another common misconception about this is that you can downgrade and use [[TinyUmbrella]] or [[iFaith]] to get a valid [[SHSH]] blob and use that to restore to that and be untethered. This is false also.

== Purpose ==
With this method you can install a firmware for which you don't have [[SHSH]] saved for some tests, for examle if you're a software developer and need to do some tests on a specific version.

== Alternative ==
A much easier way to do a "tethered downgrade" ( unsure if this still works ):
* 1. Patch ASR on the Ramdisk ( you can just create a custom IPSW and use that. )
* 2. Replace the Rootfs-DMG of the currently signed Firmware with the decrypted Rootfs-DMG of the older Firmware
* 3. After the Filesystem of the old Firmware is installed, use iRecovery and upload a pwned iBSS, iBEC and Kernel from the old Firmware
* 4. Send the device the "bootx"-Command using iRecovery.
* 5. Done! Remember your device will always need to boot tethered.

== Download ==
* [http://www.mediafire.com/?9olh9qd8v1q4xm7 Windows]

== External Links ==
* [https://github.com/ThePrivateDevTeam/Bluefreeze GitHub]
* [http://www.youtube.com/watch?v=UpZKxqLqK7A Guide]
* [http://bluefreeze.weebly.com/index.html Home Page]

[[Category:GUI Tools]]

User:Phyrrus9

2012-02-14T03:20:58Z

Phyrrus9: Created page with "I am phyrrus9, rookie iphone hacker and programmer. Skills include: C/C++ C# Bash/batch/BASIC php html5 css3 buffer overflows :P I can pretty much do any of the tasks you need..."