The iPhone Wiki - User contributions [en]

Talk:Racoon String Format Overflow Exploit

2012-01-21T14:28:17Z

Qwertyoruiop: Created page with "Format "Overflow" Exploit? It's not an overflow, it's a Format String Vulnerability. I think you should change this page's name. --~~~~"

Format "Overflow" Exploit? It's not an overflow, it's a Format String Vulnerability. I think you should change this page's name. --[[User:Qwertyoruiop|Qwertyoruiop]] 07:28, 21 January 2012 (MST)

User:Qwertyoruiop

2011-10-30T21:40:39Z

Qwertyoruiop: stop it coletardson

{{lowercase}}__NOTOC__
I am Cole Johnson, a 15-year-old (as of November 1, 2011) {{wp|Mormonism|Mormon}} who resides in Southern {{wp|California}}. You can find me by my many [[#Aliases|aliases]]. My [[#My Projects|projects]] are listed below. I know many [[#Programming Languages|languages]]. My {{user:balloonhead66/site|/cms/Cole_Stuff:Main|site}} consists of many sections.

== My Projects ==
* [[iDecryptIt]] ([[Talk:iDecryptIt|talk]]) - A GUI for decrypting [[iOS]] {{wp|FileVault}} file systems
* [[iSim]] ([[Talk:iSim|talk]]) - A web-based simulator of [[iOS]] requiring a {{wp|web server}}
* {{User:balloonhead66/site|cms/Cole_Stuff:Main|Cole Stuff CMS}} - A {{wp|Content management system|CMS}} for my site
* Downloading EVERY firmware file for iOS (currently 1.0-5.0 and 3.0b1-5.0GM)

== Aliases ==
* balloonhead66
* colejohnson66
* cole66
* balloomhead66 on [http://ifans.com iFans] (spelling error)

== Devices ==
{| class="wikitable"
|-
! style="width:12.5%" | Device
! style="width:12.5%" | [[N90ap|iPhone 4 (GSM)]]
! style="width:12.5%" | [[N45ap|iPod touch 1G]]
! style="width:12.5%" | [[N72ap|iPod touch 2G (MC)]]
! style="width:12.5%" | [[N81ap|iPod touch 4G]]
! style="width:12.5%" | [[N81ap|iPod touch 4G]]
! style="width:12.5%" | [[K93ap|iPad 2 (Wi-Fi)]]
|-
! Recieved
| July 2010
| March 2010
| November 1, 2009
| October 1, 2010
| November 2010
| March 2011
|-
! Paid
| Unknown
| $120 - Craigslist
| Unknown (Gift)
| $250 - Discount! :)
| Free!
| $799
|-
! Size
| 16GB
| colspan="2" | 8GB
| colspan="2" | 32GB
| 64GB
|-
! Starting FW
| [[Apex 8A293 (iPhone 4)|4.0]] (8A293)
| [[Snowbird 3A100a (iPod touch)|1.1]] (3A100a)
| [[Northstar 7C145 (iPod touch 2G)|3.1.1]] (7C145)
| [[Baker 8B117 (iPod touch 4G)|4.1]] (8B117)
| [[Baker 8B118 (iPod touch 4G)|4.1]] (8B118)
| [[Durango 8F191 (iPad 2 Wi-Fi)|4.3]] (8F191)
|-
! Current FW
| [[Telluride 9A334 (iPhone 4)|5.0]] (9A334)
| [[SUNorthstarTwo 7E18 (iPod touch)|3.1.3]] (7E18)
| [[Apex 8A293 (iPod touch 2G)|4.0]] (8A293)
| [[Baker 8B118 (iPod touch 4G)|4.1]] (8B118)
| [[Telluride 9A334 (iPod touch 4G)|5.0]] (9A334)
| [[Telluride 9A334 (iPad 2 Wi-Fi)|5.0]] (9A334)
|-
! Comments
| Mom's
| Brother's
| colspan="2" |  
| Free replacement
| Mom's
|-
! Jailbroken?
| colspan="2" {{no}}
| {{yes|Yes; till sold}}
| {{yes|Yes; till broke}}
| colspan="2" {{no}}
|-
! [[iBoot (Bootloader)|iBoot]]
| [[iBoot-1219.43.32|1219.43.32]]
| [[iBoot-636.66.33|636.66.33]]
| [[iBoot-889.24|889.24]]
| [[iBoot-931.18.27|931.18.27]]
| colspan="2" | [[iBoot-1219.43.32|1219.43.32]]
|-
! Owned
| colspan="2" {{yes}}
| {{no|No; Sold}}
| {{no|No; Cracked}}
| colspan="2" {{yes}}
|-
! Sold or Lost
| colspan="2" {{n/a}}
| {{yes|August 2010}}
| {{yes|November 2010}}
| colspan="2" {{n/a}}
|}

== Programming Languages ==
{| class="wikitable" style="float:right;"
|-
| {{yes|Known}}
|-
| {{partial|Learning}}
|-
| style="background-color:#87CEEB; color: black; text-align: center;" | Learned and forgot
|-
| {{no|Going to learn}}
|-
| style="background-color:#966FD6; color: black; text-align: center;" | Learned and stopped
|}
{| class="wikitable"
|-
! rowspan="2" | General
| colspan="3" {{yes|{{wp|Visual BASIC}} + {{wp|Windows Presentation Foundation|WPF}}}}
| colspan="3" {{yes|{{wp|Extensible Application Markup Language|XAML}}}}
|-
| colspan="3" {{yes|{{wp|C (programming language)|C}}}}
| colspan="3" {{partial|{{wp|C Sharp (programming language)|C#}}}}
|-
! rowspan="2" | Web
| colspan="2" {{yes|{{wp|HTML}}}}
| colspan="2" {{yes|{{wp|XHTML}}}}
| colspan="2" {{yes|{{wp|XML}}}}
|-
| colspan="3" {{yes|{{wp|PHP}}}}
| colspan="3" {{yes|Mediawiki Wiki-Markup}}
|-
! Java
| style="background:#87CEEB; color:black; text-align:center;" colspan="3" | {{wp|Java}}
| style="background:#966FD6; color:black; text-align:center;" colspan="3" | G-Java
|-
! Database
| colspan="6" {{yes|{{wp|SQL}} ({{wp|MySQL}})}}
|-
! Low-level
| colspan="6" {{no|{{wp|Assembly language|Assembly}}}}
|}

== Contact Info ==
* OpenFeint
** colejohnson66
* [[:/Applications/GameCenter~iphone.app|Game Center]]
* Plus+
* {{wp|Skype}}
** balloonhead66
* Jelly Car 2
** cole66
* {{wp|Twitter}}
** {{twitter|colejohnson66}}
* Google Profile
** [http://www.google.com/profiles/coleharrisjohnson coleharrisjohnson]

User:Qwertyoruiop

2011-10-30T21:12:07Z

Qwertyoruiop:

2011-07-02T23:50:39Z

Qwertyoruiop:

IBSS commands

2011-01-08T12:23:38Z

Qwertyoruiop:

{{DISPLAYTITLE:iBSS commands}}
You can access this command list by typing "help" after [[iBSS]] is uploaded.

bootx boot a kernel cache at specified address
tsys boot into tsys (if present)
diags boot into diagnostics (if present)
setpicture set the image on the display
bgcolor set the display background color
poweroff power off the device
halt halt the system (good for JTAG)
reboot reboot the device
run use contents of enironment var as script
script run script at specific address
go jump directly to address
mws memory write - string
mwb memory write - 8bit
mwh memory write - 16bit
mw memory write - 32bit
mdb memory display - 8bit
mdh memory display - 16bit
md memory display - 32bit
ramdisk create a radisk from the specified address
powernvram Access Power NVRAM.
charge Manage the charger chip.
devicetree create a device tree from the specified address
saveenv save current environment to flash
syscfg flash SysCfg inspection
chunk chunk a file
arm7_stop stop the arm7
arm7_go start the arm7 with a downloaded image
iic iic read/write
usb run a USB command
sha1 SHA-1 hash of memory
crc POSIX 1003.2 checksum of memory
clearenv clear all environment variables
setenv set an environment variable
printenv print one or all environment variables
image flash image inspection
pki PKI
bdev block device commands

== command descriptions ==

(Recovery) iPhone$ usb
Usage:
usb get <filename> [address] [amount]
usb get tftp://servername.com/file.bin [address] [amount]
usb put <filename> <amount> [address]
(Recovery) iPhone$ pki
not enough arguments.
pki verify <cert-chain-as-concatenated-der-blobs-data> <length> <signature-blob-data> <length> <hash-blob-data> <length>
verify-image <8900-1.0-image-data> <length>
(Recovery) iPhone$ bdev
not enough arguments
usage:
bdev list
bdev read <dev> <offset> <len> [<address>]
bdev write <dev> <offset> [<len>] [<address>]
bdev memcmp <dev> <offset> [<len>] [<address>]
bdev erase <dev> <offset> <len>
(Recovery) iPhone$ image
not enough arguments.
image list [<detailed>]
image load [<type>|memory] [<address>]
(Recovery) iPhone$ printenv
config_board = 'n72ap'
loadaddr = '0x9000000'
boot-command = 'fsboot'
idle-off = 'true'
boot-device = 'nand0'
boot-partition = '0'
boot-path = '/System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8720x'
display-color-space = 'RGB888'
display-timing = 'n72'
P bootdelay = '0'
P platform-uuid = <DATA>
P backlight-level = '56'
P debug-uarts = '4'
P auto-boot = 'false'
image-version = '0x3'
framebuffer = '0xfb04000'
secure-boot = '0x1'
? = '0xfffffff'
(Recovery) iPhone$ crc
not enough arguments.
crc <address> <len>
(Recovery) iPhone$ sha1
not enough arguments.
sha1 <address> <len>
(Recovery) iPhone$ iic
not enough arguments.
iic read <bus> <iicaddr> <len>
iic readreg <bus> <iicaddr> <reg> <len>
iic write <bus> <iicaddr> <data0> <data1> ...
(Recovery) iPhone$ chunk
Enter a sub-command

Commands:
put_test
get_test
(Recovery) iPhone$ syscfg
0x53724e6d 'SrNm' 0x30304539 0x48453134 0x00333032 0x00000000
0x46774964 'FwId' 0x01000000 0x00000000 0x000a2700 0x00000000
0x48775672 'HwVr' 0x00000000 0x00000000 0x00000000 0x00000000
0x48774964 'HwId' 0x00000000 0x00000000 0x00000000 0x00000000
0x53775672 'SwVr' 0x00000000 0x00000000 0x00000000 0x00000000
(Recovery) iPhone$ saveenv
0x4d4c424e 'MLBN' 0x00000000 0x00000000 0x00000000 0x00000000
0x4d6f6423 'Mod#' 0x3335424d 0x00000031 0x00000000 0x00000000
0x5265676e 'Regn' 0x412f4446 0x00000000 0x00000000 0x00000000
0x4d4c4223 'MLB#' 0x30394339 0x50393237 0x5a323437 0x00000041
(Recovery) iPhone$ devicetree
0x42617474 'Batt' 0x42617474 0x00000012 0x00001fd8 0xffffffff
0x53425672 'SBVr' 0x00000031 0x00000000 0x00000000 0x00000000
0x4d74436c 'MtCl' 0x4d74436c 0x00000100 0x00001ed8 0xffffffff
(Recovery) iPhone$ powernvram
usage:
powernvram <command>
list List NVRAM Properties.
set <prop#> <value> Set NVRAM Property.
(Recovery) iPhone$ powernvram list
0: [iBootState] 0x00
1: [iBootDebug] 0x00
2: [iBootStage] 0x00
3: [iBootErrorCount] 0x05
4: [iBootErrorStage] 0x30
(Recovery) iPhone$ md
0x09000000: e59f3014 e3a02a02 e1c320b0 e3e02000
0x09000010: e2833c9d e58326c0 eafffffe 2200f300
0x09000020: 00000000 00000000 00000000 00000000
0x09000030: 00000000 00000000 00000000 00000000
0x09000040: 00000000 00000000 00000000 00000000
0x09000050: 00000000 00000000 00000000 00000000
0x09000060: 00000000 00000000 00000000 00000000
0x09000070: 00000000 00000000 00000000 00000000
0x09000090: 00000000 00000000 00000000 00000000
0x090000a0: 00000000 00000000 00000000 00000000
0x090000b0: 00000000 00000000 00000000 00000000
0x090000c0: 00000000 00000000 00000000 00000000
0x090000d0: 00000000 00000000 00000000 00000000
0x090000e0: 00000000 00000000 00000000 00000000
0x090000f0: 00000000 00000000 00000000 00000000
(Recovery) iPhone$ mdh
0x09000100: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000110: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000120: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000130: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000140: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000150: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000160: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000170: 0000 0000 0000 0000 0000 0000 0000 000
0x09000180: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000190: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001a0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001b0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001c0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001d0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001e0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001f0: 0000 0000 0000 0000 0000 0000 0000 0000
59f3014 (Recovery) iPhone$ mdd
(Recovery) iPhone$ mdb
0x09000200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000260: 00 00 00 0 00 00 00 00 00 00 00 00 00 00 00 00
0x09000270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002c0: 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00
0x090002d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
(Recovery) iPhone$ mw
mw [<address>] <data>
(Recovery) iPhone$ mwh
mwh [<address>] <data>
(Recovery) iPhone$ mwb
mwb [<address>] <data>
(Recovery) iPhone$ mws
mws [<address>] <data>
(Recovery) iPhone$ bgcolor
wrong number of args.
bgcolor <red> <green> <blue>
(Recovery) iPhone$ setpicture
wrong number of args.
setpicture update? [<addr> [<size>]]
(Recovery) iPhone$ tsys
boot_flash: could not find image
(Recovery) iPhone$ diags
boot_flash: could not find image
(Recovery) iPhone$ run
run <variable>
(Recovery) iPhone$ script
running script at 0x9000000
finished running script (EOF at 0x900000c)
0??*?? ??

?SYNTAX ERROR
] POSIX 1003.2 cpresent)
(Recovery) iPhone$ bootx
Attempting to validate kernelcache @ 0x09000000
(Recovery) iPhone$ usb_control_msg(iDev, 0x21, 2, 0, 0, 0, 0, 1000)
Kernelcache image not valid
error loading kernelcache

2010-11-07T15:22:29Z

Qwertyoruiop: /* Useless Team Pages */ forgot signature :P

{{Talk Archive|Start-July 1, 2010}}

This is the place to post tasks that need to be done on the wiki. Also this is the place for proposed changes. I heard about people wanting a favicon and arranging the main page into categories.

== Site Related Requests ==

=== iPhone Compatibility ===

Well the wikis startpage (and maybe other pages) do not display really good on the iphone ;) -- [[User:M2m|M2m]] 16:11, 14 September 2010 (UTC)

:Well, I think it's good enough. Ok, it's not optimized, but it's ok. If we improve the startpage to have only one column, then that would look ugly on a PC. I work a lot in here from my iPhone. The biggest problem is the edit box. You cannot really edit big texts from your iPhone. But that's a problem of the Wiki itself (Mediawiki) and we cannot fix that just by changing texts or layout. -- [[User:Http|http]] 22:25, 14 September 2010 (UTC)

::On all textboxes, use 2 fingers to scroll --[[User:Balloonhead66|Balloonhead66]] 02:52, 27 October 2010 (UTC)

=== Logo ===
{| style="float: right;" class=wikitable border=1
|-
! New logo design
| [[Image:NewLogo.png|thumb|135px|A new logo design]]
| [[Image:NewLogo-geohot.png|thumb|135px|A new logo design with a '''By geohot''']]
|-
| New logo design
with a new name
| [[Image:NewNameLogo.png|thumb|135px|A new logo with a new name]]
| [[Image:NewNameLogo-geohot.png|thumb|135px|A new logo with a new name and a '''By geohot''']]
|}
The Logo should be updated as the wiki is no longer iPhone only but (I think) all iOS devices (or a larger part of it). Possibly also a new URL? theioswiki (but i know this is not as easy) -- [[User:M2m|M2m]] 16:09, 14 September 2010 (UTC)
:A new URL would be something that Geohot would have to do. But although this is not only about iPhones, that doesn't mean we have to change the logo or the URL. At the beginning there was the iPhone and the iPod touch. Now only the iPad has come to the family. Nothing really new. -- [[User:Http|http]] 22:25, 14 September 2010 (UTC)
::Isn't the new AppleTV said to be running iOS as well ? ;) --[[User:M2m|M2m]] 23:22, 14 September 2010 (UTC)
:::Yes --[[User:Balloonhead66|Balloonhead66]] 00:07, 31 October 2010 (UTC)
:I could design a new logo that has all the iOS family on it including all generations of the phone and the ipod touch, ATV, and iPad if it is still wanted... --[[User:Locke|Locke]]
::That won't be neccassary as I am already in the midst of creating one... --[[User:Balloonhead66|Balloonhead66]] 19:16, 5 November 2010 (UTC)
::Done... Please post content above the <code><nowiki>{{clear}}</nowiki></code> IT is therte to keep the next section below the table... When the text gets below the table, you may remove the clear template link. --[[User:Balloonhead66|Balloonhead66]] 23:46, 5 November 2010 (UTC)
{{clear}}

===Baseband: Processor vs. Platform===
All right, so The iPhone Wiki has articles about baseband ''processors''. However, the [[XMM 6180]] is about the baseband ''platform''. The wiki mostly references baseband processors, but I'm a bit reluctant to go that route since it was [[User:Oranav|Oranav]], who definitely knows more about the baseband than me, that changed the article from baseband processor to baseband platform. I'd like to keep things consistent, so should we stick with referencing it by processor or platform? This inconsistency is bugging the crap out of me. --[[User:Dialexio|Dialexio]] 06:19, 9 August 2010 (UTC)

=== Cleanup orphaned pages ===
The [[Special:Lonelypages|orphaned pages]] should be cleaned up. Possible work:
*most of those pages need to get updated
*add a link on another page to it, so that it's not orphaned anymore
*The main page and some disambiguation pages may remain orphaned.
*Some pages are really old, outdated and not worth to get updated. In this case add a deletion request to its talk page.
*Maybe we need a new overview page that links to some of these pages (e.g. my request for a [[Beta Firmware]] page, see [[Talk:VFDecrypt_Keys:_3.x_BETA#STOP]])
*Please note that links with a prefix don't count for this list, so that pages that only appear on a Category page also appear in this list. To get the full links list, go to the page and click "what links here".
I started with a little cleanup already. --[[User:Http|http]] 10:02, 23 October 2010 (UTC)

===VFDecrypt GUIs===
I don't mean to sound like a dictator, but I'd like to request for no more VFDecrypt GUIs to be added here. There are more than enough of them, so I feel there really isn't a need to add any more. Whenever a new one arises, an argument spews over about its usefulness, as well as whether it belongs on this wiki. These arguments clog up the [[Special:Recentchanges|Recent changes]] page, making it tougher to keep an eye on things with the wiki. So, once again, I'd like to ask for no more VFDecrypt GUIs to have a place on this wiki. '''As of now, this is NOT a rule that will be imposed. It's just a polite request, nothing more.''' --[[User:Dialexio|Dialexio]] 19:35, 30 October 2010 (UTC)
:I'd ask for GUI's of all kinds, such as VFDecrypt, iRecovery, and so on. Anyone can make a GUI. It takes a real hacker to write a program. --[[User:Dra1nerdrake|dra1nerdrake]] 22:52, 30 October 2010 (UTC)
::We only have 3 publiclly available ones + 2 in development --[[User:Balloonhead66|Balloonhead66]] 00:14, 31 October 2010 (UTC)
:I saw this coming when the new page for [[GiRecovery]] ([[Zeratul]]) first appeared some months ago. This Wiki is not intended to promote these tools. I didn't want to just delete the page though. One way we could go: Make sure '''all''' applications (including highly recognized ones and jailbreak apps like [[Limera1n]]) will get listed on an overview [[Tools]] page. It should be categorized by tool purpose and operating system. Maybe also by related iOS firmware. As soon as this works well, we just have to assure that not anybody adds new tools there. For example by having two users request a new entry (without the author). We can start this Tools page in any case. Initially we can include all these useless GUI apps already existing here also. -- [[User:Http|http]] 07:38, 31 October 2010 (UTC)
:We could delete the original pages and merge them with the page of the original app in a subsection. To be honest, though, I still don't see the point of having 4 softwares that do the same thing with the same features. --[[User:Ryccardo|Ryccardo]] 09:22, 31 October 2010 (UTC)
:All of them just decrypt. But mine will have 7zip integration to extract it for you and possibly look up the key automatically based on the Dmg name... --[[User:Balloonhead66|Balloonhead66]] 14:28, 31 October 2010 (UTC)

===Useless Team Pages===
I think we should remove all the team pages of users. Keep the Chronic and iPhone dev teams, but the rest that are just milking the wiki as a way to seek fame. There is no purpose for it and it just causes a large amount of useless edits and arguments. Instead of having a team page how about just add the software you make and use the credits part of it? Is there really a need for team pages? I am open to all discussions, just don't argue here. --[[User:JacobVengeance|JakeAnthraX]] 14:49, 7 November 2010 (UTC)
:As long as the team in question is actually doing *something* I see no reason not to document them. [[User:MaybachMan|MaybachMan]] 15:11, 7 November 2010 (UTC)
::Well my counter to that is still there is no need for it. Maybe when you guys do something that is amazing or make something that isn't already out there. I don't want to fight, don't think I do. I just want the wiki to be peaceful and a place of knowledge. Not people gloating to be parts of groups and leech off of other people. Is the page really that important to you? --[[User:JacobVengeance|JakeAnthraX]] 15:14, 7 November 2010 (UTC)
:::My team made a jailbreak using usb control msg for iPodTouch2g MC. It was compatible with 4.0.2 and it was semitethered. Anyway I don't want it on theiphonewiki, because this wiki should NOT be TheTeamsWiki.--[[User:Qwertyoruiop|Qwertyoruiop]] 15:22, 7 November 2010 (UTC)
::::The page isn't for showing off, we made it so we can have a place to list all the projects the team makes, which I find useful. I don't want to fight over it, but I just think it has a use for organising knowledge on here, that's all. [[User:MaybachMan|MaybachMan]] 15:19, 7 November 2010 (UTC)
Well I'm done arguing. I still say both be removed until a group release is made. Either way it doesn't matter much to me, but I had to make things fair between the groups. Let other people voice their opinions for a day or so and don't remove deletion request until it is decided as a community, okay? --[[User:JacobVengeance|JakeAnthraX]] 15:21, 7 November 2010 (UTC)

==iPhone Related Requests==
See: [[Unsolved problems]]

Keys/ivs for 4.0 beta 1/2/3 need to be updated. Many of them on are on the Internet, but not on here. Related pages:
*[[VFDecrypt_Keys:_4.x_BETA]]
*[[Beta Firmware]]

The iPhone Wiki:Community portal

2010-11-07T15:16:25Z

Qwertyoruiop: /* Useless Team Pages */

{{Talk Archive|Start-July 1, 2010}}

This is the place to post tasks that need to be done on the wiki. Also this is the place for proposed changes. I heard about people wanting a favicon and arranging the main page into categories.

== Site Related Requests ==

=== iPhone Compatibility ===

Well the wikis startpage (and maybe other pages) do not display really good on the iphone ;) -- [[User:M2m|M2m]] 16:11, 14 September 2010 (UTC)

:Well, I think it's good enough. Ok, it's not optimized, but it's ok. If we improve the startpage to have only one column, then that would look ugly on a PC. I work a lot in here from my iPhone. The biggest problem is the edit box. You cannot really edit big texts from your iPhone. But that's a problem of the Wiki itself (Mediawiki) and we cannot fix that just by changing texts or layout. -- [[User:Http|http]] 22:25, 14 September 2010 (UTC)

::On all textboxes, use 2 fingers to scroll --[[User:Balloonhead66|Balloonhead66]] 02:52, 27 October 2010 (UTC)

=== Logo ===
{| style="float: right;" class=wikitable border=1
|-
! New logo design
| [[Image:NewLogo.png|thumb|135px|A new logo design]]
| [[Image:NewLogo-geohot.png|thumb|135px|A new logo design with a '''By geohot''']]
|-
| New logo design
with a new name
| [[Image:NewNameLogo.png|thumb|135px|A new logo with a new name]]
| [[Image:NewNameLogo-geohot.png|thumb|135px|A new logo with a new name and a '''By geohot''']]
|}
The Logo should be updated as the wiki is no longer iPhone only but (I think) all iOS devices (or a larger part of it). Possibly also a new URL? theioswiki (but i know this is not as easy) -- [[User:M2m|M2m]] 16:09, 14 September 2010 (UTC)
:A new URL would be something that Geohot would have to do. But although this is not only about iPhones, that doesn't mean we have to change the logo or the URL. At the beginning there was the iPhone and the iPod touch. Now only the iPad has come to the family. Nothing really new. -- [[User:Http|http]] 22:25, 14 September 2010 (UTC)
::Isn't the new AppleTV said to be running iOS as well ? ;) --[[User:M2m|M2m]] 23:22, 14 September 2010 (UTC)
:::Yes --[[User:Balloonhead66|Balloonhead66]] 00:07, 31 October 2010 (UTC)
:I could design a new logo that has all the iOS family on it including all generations of the phone and the ipod touch, ATV, and iPad if it is still wanted... --[[User:Locke|Locke]]
::That won't be neccassary as I am already in the midst of creating one... --[[User:Balloonhead66|Balloonhead66]] 19:16, 5 November 2010 (UTC)
::Done... Please post content above the <code><nowiki>{{clear}}</nowiki></code> IT is therte to keep the next section below the table... When the text gets below the table, you may remove the clear template link. --[[User:Balloonhead66|Balloonhead66]] 23:46, 5 November 2010 (UTC)
{{clear}}

===Baseband: Processor vs. Platform===
All right, so The iPhone Wiki has articles about baseband ''processors''. However, the [[XMM 6180]] is about the baseband ''platform''. The wiki mostly references baseband processors, but I'm a bit reluctant to go that route since it was [[User:Oranav|Oranav]], who definitely knows more about the baseband than me, that changed the article from baseband processor to baseband platform. I'd like to keep things consistent, so should we stick with referencing it by processor or platform? This inconsistency is bugging the crap out of me. --[[User:Dialexio|Dialexio]] 06:19, 9 August 2010 (UTC)

=== Cleanup orphaned pages ===
The [[Special:Lonelypages|orphaned pages]] should be cleaned up. Possible work:
*most of those pages need to get updated
*add a link on another page to it, so that it's not orphaned anymore
*The main page and some disambiguation pages may remain orphaned.
*Some pages are really old, outdated and not worth to get updated. In this case add a deletion request to its talk page.
*Maybe we need a new overview page that links to some of these pages (e.g. my request for a [[Beta Firmware]] page, see [[Talk:VFDecrypt_Keys:_3.x_BETA#STOP]])
*Please note that links with a prefix don't count for this list, so that pages that only appear on a Category page also appear in this list. To get the full links list, go to the page and click "what links here".
I started with a little cleanup already. --[[User:Http|http]] 10:02, 23 October 2010 (UTC)

===VFDecrypt GUIs===
I don't mean to sound like a dictator, but I'd like to request for no more VFDecrypt GUIs to be added here. There are more than enough of them, so I feel there really isn't a need to add any more. Whenever a new one arises, an argument spews over about its usefulness, as well as whether it belongs on this wiki. These arguments clog up the [[Special:Recentchanges|Recent changes]] page, making it tougher to keep an eye on things with the wiki. So, once again, I'd like to ask for no more VFDecrypt GUIs to have a place on this wiki. '''As of now, this is NOT a rule that will be imposed. It's just a polite request, nothing more.''' --[[User:Dialexio|Dialexio]] 19:35, 30 October 2010 (UTC)
:I'd ask for GUI's of all kinds, such as VFDecrypt, iRecovery, and so on. Anyone can make a GUI. It takes a real hacker to write a program. --[[User:Dra1nerdrake|dra1nerdrake]] 22:52, 30 October 2010 (UTC)
::We only have 3 publiclly available ones + 2 in development --[[User:Balloonhead66|Balloonhead66]] 00:14, 31 October 2010 (UTC)
:I saw this coming when the new page for [[GiRecovery]] ([[Zeratul]]) first appeared some months ago. This Wiki is not intended to promote these tools. I didn't want to just delete the page though. One way we could go: Make sure '''all''' applications (including highly recognized ones and jailbreak apps like [[Limera1n]]) will get listed on an overview [[Tools]] page. It should be categorized by tool purpose and operating system. Maybe also by related iOS firmware. As soon as this works well, we just have to assure that not anybody adds new tools there. For example by having two users request a new entry (without the author). We can start this Tools page in any case. Initially we can include all these useless GUI apps already existing here also. -- [[User:Http|http]] 07:38, 31 October 2010 (UTC)
:We could delete the original pages and merge them with the page of the original app in a subsection. To be honest, though, I still don't see the point of having 4 softwares that do the same thing with the same features. --[[User:Ryccardo|Ryccardo]] 09:22, 31 October 2010 (UTC)
:All of them just decrypt. But mine will have 7zip integration to extract it for you and possibly look up the key automatically based on the Dmg name... --[[User:Balloonhead66|Balloonhead66]] 14:28, 31 October 2010 (UTC)

===Useless Team Pages===
I think we should remove all the team pages of users. Keep the Chronic and iPhone dev teams, but the rest that are just milking the wiki as a way to seek fame. There is no purpose for it and it just causes a large amount of useless edits and arguments. Instead of having a team page how about just add the software you make and use the credits part of it? Is there really a need for team pages? I am open to all discussions, just don't argue here. --[[User:JacobVengeance|JakeAnthraX]] 14:49, 7 November 2010 (UTC)
:As long as the team in question is actually doing *something* I see no reason not to document them. [[User:MaybachMan|MaybachMan]] 15:11, 7 November 2010 (UTC)
::Well my counter to that is still there is no need for it. Maybe when you guys do something that is amazing or make something that isn't already out there. I don't want to fight, don't think I do. I just want the wiki to be peaceful and a place of knowledge. Not people gloating to be parts of groups and leech off of other people. Is the page really that important to you? --[[User:JacobVengeance|JakeAnthraX]] 15:14, 7 November 2010 (UTC)
:::My team made a jailbreak using usb control msg for iPodTouch2g MC. It was compatible with 4.0.2 and it was semitethered. Anyway I don't want it on theiphonewiki, because this wiki should NOT be TheTeamsWiki.

==iPhone Related Requests==
See: [[Unsolved problems]]

Keys/ivs for 4.0 beta 1/2/3 need to be updated. Many of them on are on the Internet, but not on here. Related pages:
*[[VFDecrypt_Keys:_4.x_BETA]]
*[[Beta Firmware]]

Timberline 5G77a (iPod2,1)

2010-11-07T15:13:00Z

Qwertyoruiop: Timberline 5G77a moved to Timberline 5G77a (iPod Touch 2G): Added the device

== Decryption Keys ==
=== Root Filesystem ===
*'''[[VFDecrypt Keys|VFDecrypt]] Key''':

=== 018-4085-128.dmg ===
* '''IV''': 479c46f27f5b18ac5fa01885cf2b06f9
* '''Key''': 778b488833cada940a10a7c44cac7413

=== 018-4112-121.dmg ===
* '''IV''': 6f711568306ac332f1743a06f0498714
* '''Key''': 76a5da7da3d81035c9f0c636846e92e0

=== [[DeviceTree]].n72ap.img3 ===
* '''IV''': 218e1e3cb623ff7521f8ac61c922b224
* '''Key''': 6ceced7f93416afcd69b428ea15313e2

=== [[LLB]].n72ap.RELEASE.img3 ===
* '''IV''': 79a2d896c74ac334073786e4b2383ff1
* '''Key''': e9479822f30d0f86582149d3b83d8801

=== applelogo.s5l8720x.img3 ===
* '''IV''': 84fdb401700547796d1db8a4e4dc1765
* '''Key''': 992dec77ad422af79ebecc34bf110053

=== batterylow0.s5l8720x.img3 ===
* '''IV''': 314f871e331bacf66b6a30f1f62069f6
* '''Key''': 2a92718e1ec880370c6994a4bf411d6d

=== batterylow1.s5l8720x.img3 ===
* '''IV''': a1aa4e41818056898c318fdc4df981c8
* '''Key''': 81b978d6fbfadc278193420b58f5d2d5

=== glyphcharging.s5l8720x.img3 ===
* '''IV''': 4d7f5313fa745ec9de3e900137f29fac
* '''Key''': 915a8251928cae06e2073c77fcfdaf8d

=== glyphplugin.s5l8720x.img3 ===
* '''IV''': 41e3241844a77ea4dd7675cfabb2eed7
* '''Key''': 1e00d9bc076170f5c2e3a76a6d1149fe

=== [[iBEC]].n72ap.RELEASE.dfu ===
* '''IV''': 9eff6fb9e4b9fd4ce0b9a10ed82c6bd0
* '''Key''': 83000205209203001e95d69d960065ee

=== [[iBSS]].n72ap.RELEASE.dfu ===
* '''IV''': 9eff6fb9e4b9fd4ce0b9a10ed82c6bd0
* '''Key''': 83000205209203001e95d69d960065ee

=== [[iBoot]].n72ap.RELEASE.img3 ===
* '''IV''': c9a400fab94cb516953a6e30c7c17662
* '''Key''': a64b02ed6808452f7283bbea5dba2411

=== needservice.s5l8720x.img3 ===
* '''IV''': 2d332c80453caf0af67dcd07fc435446
* '''Key''': 1fc8bb45e517bd55c31e3a642a44c3de

Timberline 5G77a (iPod2,1)

2010-11-07T15:12:19Z

Qwertyoruiop: WTF was not an IMG3

Talk:PwnPie

2010-11-07T12:21:14Z

Qwertyoruiop:

Talk:PwnPie

2010-11-07T12:13:47Z

Qwertyoruiop:

Wildcat 7B367 (iPad1,1)

2010-11-06T23:27:59Z

Qwertyoruiop: Added a lot of keys using PwnPie. Someone needs to formats them btw.

==Decryption Keys==
=== Root Filesystem ===
* '''[[VFDecrypt Keys|VFDecrypt]] Key''': 2be8f3a0a02f2d259c9b297cb2d156a85adf79fed4ffe88c546a42c2a47aa55f70cadebd

=== 018-7225-009.dmg ===
* '''IV''': ac36df9b6d4a8d6c76cfd1dc542ec77d
* '''Key''': 2cc7f6ba799ffadbec51238847a8154157a14013ed6be5b8a25c77d9da476395

=== 018-7226-009.dmg ===
* '''IV''': 9c051576ddd94f48c324cf7ac3197fe1
* '''Key''': 31e7ecd9c364414205a8fa0092cc80c0d67eae40e75ffa27b37048c42335a106

=== DeviceTree.k48ap.img3 ===
* '''IV''': 0e3fdb2cd018eaab38b427b34cbf556d
* '''Key''': 2b5a61188dd993997da958d56b08ae55aea4362a5d29fceb627de91150199d75

=== LLB.k48ap.RELEASE.img3 ===
* '''IV''': c85cf15d8242b5bba914ad3506a37dde
* '''Key''': 2ad3f34c1a8530802fe4f301d90c88423a6cccd57614844815f085ab8c9bbeef

=== applelogo.s5l8930x.img3 ===
* '''IV''': e839ae241b3c2010a13c2031973f7310
* '''Key''': f6a6c39e8ea1c2bf9d2bd4eef2e7ef4d0d0611d86a6d8511c625b58042e8e31e

=== batterycharging0.s5l8930x.img3 ===
* '''IV''': 0a33ce75fa4d27332d8d2d3cec282baf
* '''Key''': f9fef3eebf4bec7ae5165aa97ecbbe1bdf5abe03e79d6c8e5e87cbac78a9e535

=== batterycharging1.s5l8930x.img3 ===
* '''IV''': 0fad5bc049fb7902c47dabd9e4014e64
* '''Key''': c2ec30e2843b11540e98657e16b482d30070231accf67373fe895bb5e41089e9

=== batteryfull.s5l8930x.img3 ===
* '''IV''': 13c130314ee35dfc242c4c5ad9496ba8
* '''Key''': 3b51f2658e2e84b90dd6cff40e723653c207af9afc8f8e59047fe56282041ae3

=== batterylow0.s5l8930x.img3 ===
* '''IV''': 39018f4c7614bb324c90b34a593a4996
* '''Key''': 57b7d7753f9012b5cff48af4c13ce0f0425e84f1a2360f7904baac9e366b975a

=== batterylow1.s5l8930x.img3 ===
* '''IV''': 8c141f550b8b019bfea9377bd9632536
* '''Key''': 28ae9a4e2d29e144fd91784ec7f09b226961def938577ff539fd307981be512c

=== glyphcharging.s5l8930x.img3 ===
* '''IV''': a908f13bd3f0cc21200160aaa0534b6e
* '''Key''': 6de70e3bf8c2ae5e716e584b1b68d57d30629086e494503772c5fc0ca8bac9f3

=== glyphplugin.s5l8930x.img3 ===
* '''IV''': fc3e56a76dfbbb1821fa7e4d18e9b8e0
* '''Key''': 2d4f8322fc622e26493e332518511a9d4d186b6219b111763b06c7534fa08ad0

=== iBEC.k48ap.RELEASE.dfu ===
* '''IV''': 5e0b3d5aee240120e0c6dcc64034324f
* '''Key''': d127363289fe0b1b2d6b9f758b0616f0c6751e2b870cc434ac34a57ef64858fa

=== iBSS.k48ap.RELEASE.dfu ===
* '''IV''': b83ba3ecc1919d4dc80a560230b80910
* '''Key''': eb3c9eabd45eb5701fe1998d570fa38a31ba2807918345a5c7efe0fff7ce1bea

=== iBoot.k48ap.RELEASE.img3 ===
* '''IV''': 36e1bcd042ac193f7305c8e6077d3df7
* '''Key''': 1e3a1ca2f45d15452b16b9fe0a2c214a0af897f09ee269f8e5967fc74b1022ac

=== kernelcache.release.k48 ===
* '''IV''': 0ce08a45b54f54bb99f12e582122b992
* '''Key''': 8c80ca1a1fb8a1f87b6dfa34d186fd235118025029c0aa8df6a70bd33987c146

=== needservice.s5l8930x.img3 ===
* '''IV''': e2e77412159785541a51437c720a4d99
* '''Key''': 930070d1d2cebc1399ee68f3d6bb503add2d0b0afa1b93e4a33d3b6d665dd0a9

Talk:PwnPie

2010-11-06T21:22:35Z

Qwertyoruiop: ih8n00bs reverenge

Actually that app works. If anyone needs it, write now. If you are cba, bookmark the link. --[[User:Qwertyoruiop|Qwertyoruiop]] 21:22, 6 November 2010 (UTC)

User:Qwertyoruiop

2010-11-06T20:31:03Z

Qwertyoruiop: who i am?

Just a bored pie-eater.

PwnPie

2010-11-06T20:27:02Z

Qwertyoruiop: Another n00b-friendly app.

PwnPie is another annoying app being disclosed on TheiPhoneWiki.

PwnPie also is what iKeys should be, but iKeys isn't real.
== What it does ==
Basically it takes an ipsw and parses every img3 inside.

Using BASH, we launch GreenPois0n monitoring his output, and when it loads iBSS we kill it.
We will have a iDevice in iBSS pwned.

Using teh "go aes dec" command we find keys/ivs and format them.

The tool will also decrypt for you the whole ipsw, so you can play w/ it easily.

A private beta version can produce a TheiPhoneWiki's page, allowing to add keys easily.

If u r a scriptkiddie please go away (eg. liamchat) and try to do that manually a lot of times, to learn how KBAG works.

If u r too bored to get keys/ivs but you know how to do, use this.

Latest version can be found here:
https://github.com/qwertyoruiop/PwnPie/blob/master/PwnPie.sh

~qwertyoruiop

Talk:Main Page

2010-11-01T19:03:57Z

Qwertyoruiop:

== "robert" ==
Hacking a wiki is like stealing a c00kie from a kid. BAD.
(cookies ftw, aka i'm a kid :O) --[[User:Qwertyoruiop|Qwertyoruiop]] 19:03, 1 November 2010 (UTC)

== Apple TV ==
We could add the Apple TV to the hardware section on the main page as we have other pages for it in the wiki as well --[[User:M2m|M2m]] 07:42, 28 September 2010 (UTC)
:Done [[User:Balloonhead66|Balloonhead66]] 15:19, 3 October 2010 (UTC)

== firmware keys ==
We need a "standard" for firmware key posting so that we can stay organized. Who likes this method?
* [[Kirkwood 7A341 (iPhone 3G)]]
* [[Kirkwood 7A341 (iPod touch 2G)]]
{{unsigned|ChronicDev|02:28, June 18, 2009}}
-----

Love it. -drg

anything is better then what we got now --[[User:Posixninja|posixninja]] 05:16, 18 June 2009 (UTC)

Nice job with the reorganization --[[User:Geohot|geohot]]

I know this thread is old, but I like the template on [[Apex 8A400 (iPod touch 3G)]] frankly because I helped to make it, and it links to all parts of the FW so people know what the **** a kernelcache or VFDecrypt is. :P --drake

== [[Talk:Main Page/Should iH8sn0w be listed as a hacker?|Should iH8sn0w be listed as a hacker?]] ==

== Hardware section names ==

Chronic, you started a name change in the hardware section. Such changes should be agreed on first. It's not even complete. Either we change it everywhere or revert back to how it was (my opinion). I also never liked the iAbc2,6 notation. Nobody knows what that is. Other opinions? -- [[User:Http|http]] 12:08, 28 September 2010 (UTC)

:Would prefer the old naming (ipod touch 2g, 3g, etc..) Would name the iOS Apple TV Apple TV 2G - even though this is not official name. Just my opinion. --[[User:M2m|M2m]] 14:56, 28 September 2010 (UTC)

::Personally I would say leave it with the Prod#,# as, lets face it, if you're looking for info on it here you probably know what it is by any name, and if not it doesn't take a whole lot to figure it out. Worst someone would have to do is follow the link to check. -- [[User:OMEGA_RAZER|OMEGA_RAZER]]

:::I'd prefer if every device was referred to by name (i.e.- "iPod touch 3G"). One thing is certain, though: it looks bizarre to have the iPhones listed by name, while the other devices are not. --[[User:Dialexio|Dialexio]] 18:50, 28 September 2010 (UTC)

::::Ok, so 3:1 to change it back to full names. -- [[User:Http|http]] 23:40, 30 September 2010 (UTC)

== SHAtter ==

I was thinking we should add SHAtter to the Jailbreak tools [[User:Balloonhead66|Balloonhead66]] 02:11, 8 October 2010 (UTC)
:SHAtter is the name of the exploit, not a jailbreak tool. :) --[[User:Dialexio|Dialexio]] 02:31, 8 October 2010 (UTC)
::Greenpois0n will be added when it is released and more is known about it I hope. --[[User:JacobVengeance|JakeAnthraX]] 04:45, 8 October 2010 (UTC)
:::Ok, well what about adding Limera1n? {{unsigned|Balloonhead66|23:25, October 8, 2010 (UTC)}}

== The colored boxes ==

Why are there colored boxes and what do they represent as color? {{unsigned|Balloonhead66|18:26, October 9, 2010 (UTC)}}
:The colored boxes are supposed to represent progress made in each category. Orange (previously red, but changed due to readability issues) means it's nowhere near the goal. Yellow means progress is being/was made. Green means it's done and publicly available. --[[User:Dialexio|Dialexio]] 18:52, 9 October 2010 (UTC)

== VFDecrypt ==

I think we should have a section on VFDecrypt and the keys... --{{unsigned|Balloonhead66|18:28, 23 October 2010 (UTC)}}
:For the pages you just added exists a deletion request (see [[Talk:VFDecrypt_Keys#Remove_Request]]). So I don't think it's a good idea to put them to the main page. --[[User:Http|http]] 21:50, 23 October 2010 (UTC)
::I think that they should just be deleted or cached as HTML or protected as I like having the keys --[[User:Balloonhead66|Balloonhead66]] 00:39, 24 October 2010 (UTC)
Why are the keys listed on front page? Wouldn't it be better to not have the front page bloated with unimportant information? --[[User:JacobVengeance|JakeAnthraX]] 00:56, 27 October 2010 (UTC)
:I suppose we can put [[VFDecrypt Keys]] under "Keys" (so it would be alongside [[AES Keys]], [[CERT|Apple Certificate]], [[Baseband RSA Keys]], et. al.). --[[User:Dialexio|Dialexio]] 01:07, 27 October 2010 (UTC)
::I just don't think the front page should be bloated up with random things like 6 lines of VFDecrypt --[[User:JacobVengeance|JakeAnthraX]] 01:21, 27 October 2010 (UTC)

User:Qwertyoruiop

2010-10-10T00:43:10Z

Qwertyoruiop: Removing all content from page

Talk:Incomplete Codesign Exploit

2010-10-10T00:42:19Z

Qwertyoruiop: added a \n

This has to be one of the most puzzling exploits in iOS. Since it was revealed in 3.1.3/3.2, Apple has yet to close it in 4.0, 4.02, or 4.1 or even 4.2 betas.

Somehow, once you stick a dynamic library or other goody with some sort of "incomplete codesign" magic in the right location and add a startup service, iOS will execute it. Perhaps Apple has no way to fix this without breaking other things?
[[User:Iemit737|Iemit737]] 00:23, 10 October 2010 (UTC)

AFAIK IncompleteCodesignExploit is an exploit in WWDR Cert Checking that allows ppl to create fake entitlements. Obviously I'm not sure it works in this way. --[[User:Qwertyoruiop|Qwertyoruiop]] 00:41, 10 October 2010 (UTC)

Talk:Incomplete Codesign Exploit

2010-10-10T00:41:44Z

Qwertyoruiop:

This has to be one of the most puzzling exploits in iOS. Since it was revealed in 3.1.3/3.2, Apple has yet to close it in 4.0, 4.02, or 4.1 or even 4.2 betas.

Somehow, once you stick a dynamic library or other goody with some sort of "incomplete codesign" magic in the right location and add a startup service, iOS will execute it. Perhaps Apple has no way to fix this without breaking other things?
[[User:Iemit737|Iemit737]] 00:23, 10 October 2010 (UTC)
AFAIK IncompleteCodesignExploit is an exploit in WWDR Cert Checking that allows ppl to create fake entitlements. Obviously I'm not sure it works in this way. --[[User:Qwertyoruiop|Qwertyoruiop]] 00:41, 10 October 2010 (UTC)

Usb control msg(0x21, 2) Exploit

2010-07-14T12:46:35Z

Qwertyoruiop:

{{DISPLAYTITLE:usb_control_msg(0x21, 2) Exploit}}
This vulnerability exists in the versions of [[iBoot]] found in firmwares 3.1/3.1.1 and 3.1.2 (and presumably everything before) on all iDevices. It was fixed in [[iBoot-636.66.33]], which was included with 3.1.3. [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]]) and [[N18ap|iPod touch 3G]] owners who saved their [[SHSH]] for the aforementioned firmwares, and MC-model [[N72ap|iPod touch 2G]] owners can use it for a [[tethered]] [[jailbreak]] on 4.0. [http://ih8sn0wforums.com/viewtopic.php?f=56&t=1928] [http://blog.qwertyoruiop.com/?p=154]

== Credit (Alphabetical) ==
* '''vulnerability''': pod2g and westbaer, also discovered independently by gray, also discovered independently by [[geohot]]
* '''exploitation''': ius, chronic, pod2g, and posixninja
* '''payload ([[greenpois0n]])''': chronic and posixninja

== Vulnerability ==
'''pod2g''' and '''westbaer''' discovered, via some reversing + fuzzing, you could overwrite the content of 0x0 thanks to Apple not checking the contents of a register they should have, shown in the disassm below. Now, the reason that this is useful is because the MMU maps whatever is running ([[LLB]], [[iBoot]], etc.) to 0x0 so that if an exception vector is triggered, it would jump to the one designed to be used with what is running, versus jumping to what is normally located at 0x0, the [[S5L8920 (Bootrom)|bootrom]].

All you need to do is send the following (assuming you're using libusb 0.1.x)...
usb_control_msg(iDev, 0x21, 2, 0, 0, 0, 0, 1000);
And thanks to our vulnerability, it will do this:
memcpy(0, LOAD_ADDR, 0x2000);

As you can see, we have full control over the first 0x2000 bytes of iBoot.

=== Disassm ===
<pre>
// R5: a pointer to a buffer is here if requesttype==0xA1.
// however, if requesttype==0x21, R5 is undefined.

SRAM:22009ED2 code_1 ; CODE XREF: handle_file_io_control_req+62�j
SRAM:22009ED2 014 36 49 LDR R1, =usb_file_loadaddr
SRAM:22009ED4 014 36 4B LDR R3, =usb_file_offset
SRAM:22009ED6 014 28 68 LDR R0, [R5]
SRAM:22009ED8 014 09 68 LDR R1, [R1]
SRAM:22009EDA 014 1B 68 LDR R3, [R3]
SRAM:22009EDC 014 22 1C ADDS R2, R4, #0
SRAM:22009EDE 014 C9 18 ADDS R1, R1, R3
SRAM:22009EE0 014 07 F0 94 EF BLX memcpy
SRAM:22009EE4 014 00 2E CMP R6, #0
SRAM:22009EE6 014 53 D0 BEQ return
SRAM:22009EE8 014 01 23 MOVS R3, #1
SRAM:22009EEA 014 33 60 STR R3, [R6]
SRAM:22009EEC 014 50 E0 B return
</pre>

== Exploitation ==
So, how do you actually run code with this? Well, '''chronic''' suggested that since the irq vector was in constant use, we try that, so we were able to simply replace the address of the irq vector handler (0x00000038) in the 0x2000 [[iBoot]] chunk that we send with 0x41002000, and then just tack our payload to the end of that chunk. Of course, since we are hijacking the irq exception, you must disable interrupts first. Here is the basic procedure:
* Call enter_critical_task(); disabling interrupts, so that your code can reliably execute.
* Restore 0x38 (irq handler) with the original irq vector address
* '''DO WHAT YOU WANT AT THIS POINT, YOU MAY NOT USE INTERRUPTS'''.
* Call exit_critical_task(); re-enabling interrupts.
* Call the irq handler so that the interrupt request that you hijacked can execute.

=== Roadblocks ===
* If what you send is not 0x2000 bytes, the remainder is filled in with zeroes, which is bad.
* Due to the above rule, you need the first 0x2000 of a decrypted iBoot by the time your payload is done running.
* You must disable interrupts to reliably execute your payload. Due to this, this will rule out the possibility of reading the 0x2000 iBoot chunk needed from NOR, since nor_read(); requires interrupts.

One way to get around the need of sending the 0x2000 [[iBoot]] chunk is to hook the image_load(); function in the LLB which is sitting intact in memory. This was successfully done in [[blackra1n]].

The [[PwnageTool]] method requires an [[IPSW]] to be input in order to create a custom firmware anyway, so the 0x2000 chunk is not an issue. It can just be copied from the [[iBoot]] in the [[IPSW]].

=== Implementation ===
[[blackra1n]]

[[Category:Exploits]]

ApexVail 8A230m (iPod2,1)

2010-04-14T14:09:39Z

Qwertyoruiop: copied layout from n18ap apexvail page, but with an error

iPod touch 2G firmware 4.0 BETA 1

==Decryption Keys==
=== Root Filesystem ===
* '''VFDecrypt''': d88fa434f6a8c50fd49cd0923879da5c3079c59c0e534cff521a9cecbcad48d84b4daef0

===Restore Ramdisk===
* '''IV''': d7b27f785cd6420e17e2b33f8db7cc10
* '''Key''': 0a255f207a0e48fa1b9741d1e29b53a3