The iPhone Wiki - User contributions [en]

Sn0wbreeze

2009-10-21T17:48:46Z

Prince: New page: Sn0wbreeze is a PwnageTool-like application currently being developed for Windows (32-bit) and was set to release on 12th October. The release date is now unknown. It's believed that the ...

Sn0wbreeze is a PwnageTool-like application currently being developed for Windows (32-bit) and was set to release on 12th October. The release date is now unknown.

It's believed that the team are having problems with XPwn and need some touching up done with hfsplus.exe.

WinPwn

2009-10-21T17:46:37Z

Prince:

[[Image:Winpwn_screen.PNG|thumb|right|350px|WinPwn 2.0.0.3 RC1, running on Windows XP]]
The Windows version of [[PwnageTool]], by [[cmw]]. WinPwn, [[QuickPwn]], [[XPwn]] and [[PwnageTool]] are currently the only programs capable of [[jailbreak|jailbreaking]] 2.0 firmware.

This software is now discontinued, although there is a rumour of a WinPwn 4.0, but this is unknown if true.

See [[Sn0wbreeze]] for a *possible* WinPwn replacement.

[[Category:Hacking Software]]

IBoot Environment Variable Overflow

2009-10-21T17:44:06Z

Prince: /* Implementation in purplera1n */

{{DISPLAYTITLE:iBoot Environment Variable Overflow}}
This is an exploit in the iBoot parsing of commands and environment variables.

== Credit ==
[[User:Geohot|geohot]]

== Explanation ==
This is a heap overflow in 3.0's [[iBoot]]. I'm really tired right now and will write more tomorrow.

My implementation saves the first 8 bytes in overruns(important or phone crashes), and overwrites the first 8 bytes of the '?' environment variable in the ring buffer. When the ring buffer is freed, it attempts to close the ring. In doing so, it changes the command table to have an entry at 0x41000000, where I then(must be done after or else cmd pointer gets overwritten) upload the geohot command. Run it and enjoy.

== Implementation in purplera1n ==
setenv a bbbbbbbbb1bbbbbbbbb2bbbbbbbbb3bbbbbbbbb4bbbbbbbbb5bbbbbbbbb6bbbbbbbbb7bbbbbbbbb8bbbbbbbbb9bbbbbbbbbAbbbbbbbbbBbbbbbbbbbCbbbbbbbbbDbbbbbbbbbEbbbbbbbbbbbbtbbbbbbbbbubbbbbbbbbvbbbbbbbbbwbbbbbbbbbxbbbbbbbbbybbbbbbbbbzbbbbbbbbbHbbbbbbbbbIbbbbbbbbbJbbbbgeohotbbbbbbbbbLbbbbbbbbbMbbbbbbbbbNbbbbbbbbbObbbbbbbbbPbbbbbbbbbbQbbbbbbbbbRbbbbbbbbbSbbbbbbbbbTbbbbbbbbbUbbbbbbbbbVbbbbbbbbbWbbbbbbb

xxxx $a $a $a $a geohotaaaa \"\x04\x01\" \\ \"\x0c\" \\ \\ \\ \\ \\ \"\x41\x04\xA0\x02\" \\ \\ \\ \\ wwww;echo copyright;echo geohot

Pretty sure that bit shouldn't be there ^^, but I'll leave it in for the sake of people
[[Category:Exploits]]