The iPhone Wiki - User contributions [en]

Talk:NorthstarTwo 7E18 (iPhone)

2012-11-28T16:35:41Z

Rdqronos: Created page with "Hey friends, if I got the VFDecrypt keys for this, would it be unmarked for deletion? --~~~~"

Hey friends, if I got the VFDecrypt keys for this, would it be unmarked for deletion? --[[User:Rdqronos|rdqronos]] 09:35, 28 November 2012 (MST)

Talk:Nonce

2012-10-15T20:06:25Z

Rdqronos: Created page with "Stupid question, but, in my iPhone Restore logs, I keep seeing the recurring message "2012-10-07 20:59:07.000 iTunes[1236:1000b]: device software does not support nonce generatio..."

Stupid question, but, in my iPhone Restore logs, I keep seeing the recurring message "2012-10-07 20:59:07.000 iTunes[1236:1000b]: device software does not support nonce generation"

Is this due to the fact that the bootrom automatically supplies the nonce? Or is this something else?

--[[User:Rdqronos|rdqronos]] 14:06, 15 October 2012 (MDT)

User:Rdqronos

2012-10-12T14:08:01Z

Rdqronos:

== Devices ==
* MacBook Pro 13" Mid-2012
* '''[[N94ap|iPhone 4S]]

Backboardd

2012-10-11T16:26:40Z

Rdqronos:

A daemon that appears to run alongside the SpringBoard daemon. Found listed in an iOS 6 log file for an unmodified iPhone 4S.

Backboardd

2012-10-11T16:26:20Z

Rdqronos: backboardd - does anyone know what this is?

A daemon that appears to run alongside SpringBoardd. Found listed in an iOS 6 log file for an unmodified iPhone 4S.

Shoebox.app

2012-08-12T13:04:12Z

Rdqronos:

Shoebox.app is a new application present in iOS 6. It appears to be the new Passbook app.

Talk:Shoebox.app

2012-08-12T13:02:23Z

Rdqronos:

Guessing from the PNG icon the bundle comes with I think this is the Passbook Application.--[[User:M2m|M2m]] 22:34, 11 August 2012 (MDT)
:Alright - I was browsing through an OTA update folder when I saw it, so I didn't see a PNG. Should the page be updated to explain this? --[[User:Rdqronos|rdqronos]] 07:02, 12 August 2012 (MDT)

Shoebox.app

2012-08-11T18:34:28Z

Rdqronos: created page about Shoebox.app

Shoebox.app is a new application/application bundle present in the iOS 6 OTA update for the iPhone 4S. Nothing is known about it.

Talk:Phone.app codes

2012-05-17T01:32:43Z

Rdqronos:

'''*#30''X''#'''[[Image:Phone.png]], where ''X''=1..9 - generate fake incoming call; the phone will become kind of messed up, thinking that it's on a call until you restart. Can be used to stream music to Bluetooth headset.
This is either carrier or OS dependent: it never worked on my 3GS that I use in Italy. --[[User:Ryccardo|Ryccardo]] 15:36, 1 December 2010 (UTC)
:The page as it is now was last updated in 2008, there was certainly no 3GS back then. It worked on my 2G running 2.X at the time. If you could test other codes and update the page accordingly, it would be greatly appreciated. --[[User:Blackbox|Blackbox]] 16:40, 1 December 2010 (UTC)

Do any of these actually work anymore? I tested a few of them on my 4S (5.1.1) and most everything gave me a spinning wheel and no other response. #301# - *#309# gave me my "USSD" which just displayed my phone number. --[[User:Rdqronos|rdqronos]] 19:32, 16 May 2012 (MDT)

Talk:VFDecrypt

2012-05-15T01:19:07Z

Rdqronos:

==GUI removal request==
Since this is now a [[VFDecrypt]] page can we remove the links to the GUI's? --[[User:GreySyntax|GreySyntax]] 22:15, 10 November 2010 (UTC)
:but they are part of [[VFDecrypt]] they all use the same code and it will help new people who don't know how to Decrypt --[[User:Liamchat|liamchat]] 22:36, 10 November 2010 (UTC)
::Decrypting the filesystem from a command-line interface is simple; VFDecrypt only needs three parameters to decrypt it. I think multiple GUI programs (let alone one) is quite unnecessary for that. I will most likely remove them over the weekend. (Before this goes any further, I feel obligated to mention this: get into a fight now, and you'll get ban-hammered.) --[[User:Dialexio|Dialexio]] 23:22, 10 November 2010 (UTC)
:::Still, some people dont have terminal access on mac and a gui for mac is good as it doesn't require terminal access to run a cmd-line program from a gui... --[[User:Balloonhead66|Balloonhead66]] 01:16, 11 November 2010 (UTC)
:::I agree with removing the big fat table with all useless infos about these tools. If really necessary we can still add a section with "other tools" or so. What I miss here are links to download the Windows exe and more deeper infos. BTW: Now we can change back all links that are now pointing to the keys page. -- [[User:Http|http]] 01:36, 11 November 2010 (UTC)

== Error ==

Hi, I just tried this again after a long time (on Windows 7-64). I used the following command:
vfdecrypt -i "c:\temp\ATVtest\038-0955-007.dmg" -k "f607711d4db94bba7a4866f095aed082c8485bfbcd0f411f1e65158f585915edd5cfeec1" -o "c:\temp\ATVtest\output.dmg"
and I just get
Must specify one of -k or -p
Incorrect arguments.
Usage: vfdecrypt -i in-file [-p password] [-k key] -o out-file
This file is from [[DurangoTide 8F305 (Apple TV 2G)]]. I tried with/without quotes, changing the order, leaving -o part away, ran as Admin, etc, all without luck. Anything obvious what am I doing wrong here? --[[User:Http|http]] 15:55, 14 May 2012 (MDT)
:Try using this. http://theiphonewiki.com/wiki/index.php?title=IDecrypt --[[User:Rdqronos|rdqronos]] 19:19, 14 May 2012 (MDT)

Talk:XCon

2012-05-10T02:19:48Z

Rdqronos:

{{lowercase}}
== Skype ==
Upon installing Skype on my unjailbroken device, it gave me the notification that it doesnt work. After jailbreaking, it still worked. --[[User:5urd|5urd]] 10:04, 21 March 2012 (MDT)
:Skype hasn't changed that warning since the 3.x days. It was probably back when Spirit did some serious kernel modding and Skype just knew it wouldn't work. Jailbreaks have changed since then. --[[User:Rdqronos|rdqronos]] 14:11, 21 March 2012 (MDT)
::Nope they check for Cycorder, MobileSubstrate, and I think one other thing. Not sure what the limitations are beyond the little notice at the beginning, but I patched over the checks anyway. (Someone told me they block video calling on jailbroken devices, confirm/deny?) --[[User:n00neimp0rtant|n00neimp0rtant]] 17:43, 3 April 2012 (EDT)
:::Video calling works for me --[[User:5urd|5urd]] 18:48, 3 April 2012 (MDT)
:Worked for me, at least in the 4.x days. --[[User:Rdqronos|rdqronos]] 16:13, 3 April 2012 (MDT)

== Action Movie FX ==
Exactly what does Action Movie FX do if it detects a jailbroken device? I use it a lot on my jailbroken devices and never get a warning, etc, though sometimes it crashes whenever you try and make a movie, though a reboot always fixes it.--[[User:JonathanSeals|JonathanSeals]] 14:00, 22 March 2012 (MDT)
: I haven't been having a good experience with the app, whenever i make a new movie it crashes. --[[User:Dylan Laws|Dylan Laws]] 23:40, 21 March 2012 (MDT)
:: It seems like more of a RAM issue than jailbreak detection. --[[User:JonathanSeals|JonathanSeals]] 14:00, 22 March 2012 (MDT)
::Yes --[[User:5urd|5urd]] 21:55, 24 March 2012 (MDT)
:I scoured the binary and there's absolutely no jailbreak detection anywhere in it. If all its doing is crashing, you've got yourself a memory issue. --[[User:n00neimp0rtnat|n00neimp0rtant]] 17:47, 3 April 2012 (EDT)

== New Column ==
Can we add a new column for xCon App list, that describes what the limitations are if not fixed? --[[User:Http|http]] 06:48, 22 March 2012 (MDT)
:I would like that --[[User:5urd|5urd]] 21:55, 24 March 2012 (MDT)
:That's exactly what the "Notes" column on the right is for. --[[User:n00neimp0rtant|n00neimp0rtant]] 17:41, 3 April 2012 (EDT)

==iBooks==
I'm pretty sure iBooks STILL does jailbreak detection, right? That's why there's always a new iBooks patch in Cydia... --[[User:Rdqronos|rdqronos]] 19:30, 9 May 2012 (MDT)
:YES --[[User:5urd|5urd]] 19:40, 9 May 2012 (MDT)
:Thank you! Christ, that guy is getting annoying...--[[User:Rdqronos|rdqronos]] 20:19, 9 May 2012 (MDT)

Talk:XCon

2012-05-10T01:30:04Z

Rdqronos:

{{lowercase}}
== Skype ==
Upon installing Skype on my unjailbroken device, it gave me the notification that it doesnt work. After jailbreaking, it still worked. --[[User:5urd|5urd]] 10:04, 21 March 2012 (MDT)
:Skype hasn't changed that warning since the 3.x days. It was probably back when Spirit did some serious kernel modding and Skype just knew it wouldn't work. Jailbreaks have changed since then. --[[User:Rdqronos|rdqronos]] 14:11, 21 March 2012 (MDT)
::Nope they check for Cycorder, MobileSubstrate, and I think one other thing. Not sure what the limitations are beyond the little notice at the beginning, but I patched over the checks anyway. (Someone told me they block video calling on jailbroken devices, confirm/deny?) --[[User:n00neimp0rtant|n00neimp0rtant]] 17:43, 3 April 2012 (EDT)
:::Video calling works for me --[[User:5urd|5urd]] 18:48, 3 April 2012 (MDT)
:Worked for me, at least in the 4.x days. --[[User:Rdqronos|rdqronos]] 16:13, 3 April 2012 (MDT)

== Action Movie FX ==
Exactly what does Action Movie FX do if it detects a jailbroken device? I use it a lot on my jailbroken devices and never get a warning, etc, though sometimes it crashes whenever you try and make a movie, though a reboot always fixes it.--[[User:JonathanSeals|JonathanSeals]] 14:00, 22 March 2012 (MDT)
: I haven't been having a good experience with the app, whenever i make a new movie it crashes. --[[User:Dylan Laws|Dylan Laws]] 23:40, 21 March 2012 (MDT)
:: It seems like more of a RAM issue than jailbreak detection. --[[User:JonathanSeals|JonathanSeals]] 14:00, 22 March 2012 (MDT)
::Yes --[[User:5urd|5urd]] 21:55, 24 March 2012 (MDT)
:I scoured the binary and there's absolutely no jailbreak detection anywhere in it. If all its doing is crashing, you've got yourself a memory issue. --[[User:n00neimp0rtnat|n00neimp0rtant]] 17:47, 3 April 2012 (EDT)

== New Column ==
Can we add a new column for xCon App list, that describes what the limitations are if not fixed? --[[User:Http|http]] 06:48, 22 March 2012 (MDT)
:I would like that --[[User:5urd|5urd]] 21:55, 24 March 2012 (MDT)
:That's exactly what the "Notes" column on the right is for. --[[User:n00neimp0rtant|n00neimp0rtant]] 17:41, 3 April 2012 (EDT)

==iBooks==
I'm pretty iBooks STILL does jailbreak detection, right? That's why there's always a new iBooks patch in Cydia... --[[User:Rdqronos|rdqronos]] 19:30, 9 May 2012 (MDT)

SHSH Protocol

2012-05-02T21:25:45Z

Rdqronos: new gs.apple.com IP

Here is a description about the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is gs.apple.com (IP 17.171.36.30) and runs on the common [[wikipedia:Hypertext Transfer Protocol|HTTP]] [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

===Sending data (request)===
POST /TSS/controller?action=2 HTTP/1.1
Accept: */*
Cache-Control: no-cache
Content-type: text/xml; charset="utf-8"
User-Agent: InetURL/1.0
Content-Length: 12345
Host: gs.apple.com

(here comes the Plist request file)

===Receiving data (answer)===
HTTP/1.1 200 OK
Date: Sun, 15 Aug 2010 19:25:18 GMT
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.5.GA (build: CVSTag=Branch_4_0 date=200610162339)/Tomcat-5.5
Content-Type: text/html
Content-Length: 123456
MS-Author-Via: DAV

STATUS=0&MESSAGE=SUCCESS&REQUEST_STRING=(here comes the requested [[SHSH]] file)

===Plist request file===
'''NOTE: ''This template is only for devices other than the iPhone 4'''''

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">

<plist version="1.0">
<dict>
<key>@APTicket</key>
<true/>
<key>@HostIpAddress</key>
<string>192.168.0.1</string>
<key>@HostPlatformInfo</key>
<string>windows</string> -------> "darwin" without quotes for Mac/Linux Systems
<key>@Locality</key>
<string>en_US</string>
<key>@VersionInfo</key>
<string>libauthinstall-34</string> -------> "3.8" without quotes for Mac/Linux Systems
<key>ApBoardID</key>
<integer>____</integer>
<key>ApChipID</key>
<integer>____</integer>
<key>ApECID</key>
<string>*************</string> ------------> This is your own [[ECID]]
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>_____</integer>
<key>UniqueBuildID</key>
<data>_________________________</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging1</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>BatteryFull</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>BatteryLow0</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>BatteryLow1</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>BatteryPlugin</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>DeviceTree</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>KernelCache</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>_________________________</string>
<key>PartialDigest</key>
<data>_________________________</data>
</dict>
<key>RecoveryMode</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>RestoreDeviceTree</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>RestoreKernelCache</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>RestoreLogo</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>RestoreRamDisk</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
<key>iBEC</key>
<dict>
<key>BuildString</key>
<string>_________________________</string>
<key>PartialDigest</key>
<data>_________________________</data>
</dict>
<key>iBSS</key>
<dict>
<key>BuildString</key>
<string>_________________________</string>
<key>PartialDigest</key>
<data>_________________________</data>
</dict>
<key>iBoot</key>
<dict>
<key>Digest</key>
<data>_________________________</data>
<key>PartialDigest</key>
<data>_________________________</data>
<key>Trusted</key>
<true />
</dict>
</dict>
</plist>

The underlined values( _______ ) can be found from the BuildManifest.plist which is located inside a IPSW file.

===Status responses===
*STATUS=0&MESSAGE=SUCCESS
*STATUS=94&MESSAGE=This device isn't eligible for the requested build.
*STATUS=100&MESSAGE=An internal error occurred.
*STATUS=511&MESSAGE=No data in the request
*STATUS=551&MESSAGE=Error occured while importing config packet with cpsn:
*STATUS=5000&MESSAGE=Invalid Option!

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*action=2 in the request. What other values exist and what is their meaning?
*ApProductionMode What does this mean? Is there a test environment?
*ApSecurityDomain Meaning?
*Trusted What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

[[Category:Firmware Tags]]

XCon

2012-05-02T21:21:06Z

Rdqronos:

{{lowercase}}
xCon is a collaborative project by [http://twitter.com/unimp0rtanttech n00neimp0rtant] and [http://twitter.com/olunatiko Lunatik] that aims to be an all-in-one solution for hooking every known method and function responsible for informing an application of a jailbroken device. At first, the project aimed to patch applications on a per-app basis, but now it uses lower-level hooks to cover any apps that attempt to use the same procedure, even patching apps not explicitly reversed by the developers. Originally an open-source project, it remains closed-source now to discourage App Store developers from working around xCon's hooks.

xCon is available free of charge in Cydia. No configuration is needed; just install and go.

For general infos, see [[Bypassing Jailbreak Detection]].

== App Patching Status ==
''You can find an app's current release version in its iTunes listing page, linked below in the app names. If an app's current release version is newer than the "Last Confirmed Working Version," please help by testing it out yourself with the latest release of xCon and updating the table as necessary.''

{| class="wikitable" style="text-align:center; width:100%;"
|-
! App Name
! Bundle Identifier
! Patched?
! Last Confirmed Working Version
! Notes
|-
| [http://itunes.apple.com/gb/app/barclays-pingit/id496552142?mt=8 Barclays PingIt]
| uk.co.barclays.PingIt
| {{yes}}
| 1.0.2
|
|-
| [http://itunes.apple.com/us/app/optimum/id387231038?mt=8 Cablevision Optimum]
| com.cablevision.rDVR
| {{yes}}
| 2.1.2
|
|-
| [http://itunes.apple.com/us/app/optimum-for-ipad/id424612367?mt=8 Cablevision Optimum (iPad)]
| com.cablevision.iOTV
| {{yes}}
| 2.1.1
|
|-
| [http://itunes.apple.com/gb/app/capital-one-uk/id481679012?mt=8 Capital One UK]
| com.ukcapitalone.capitalone
| {{yes}}
| 5.1
|
|-
| [http://itunes.apple.com/au/app/commbank-kaching/id475728226?mt=8 Commbank Kaching]
| au.com.commbank.kaching
| {{yes}}
| 1.1.0
|
|-
| [http://itunes.apple.com/us/app/cox-tv-connect-for-ipad/id474096909?mt=8 Cox TV Connect]
| com.cox.ios.ipad.tvconnect
| {{yes}}
| 1.0.1
|
|-
| [http://itunes.apple.com/us/app/directv-app-for-ipad/id421547368?mt=8 DirecTV for iPad]
| com.directv.mobile.ipad.navigator.production
| {{yes}}
| 1.3.4-1.5.0
|
|-
| [http://itunes.apple.com/us/app/directv-nomad/id448679509?mt=8 DirecTV Nomad]
| com.directv.mobile.iphone.nomad.production
| {{yes}}
| 1.8.1
| 2.0.0 in beta
|-
| [http://itunes.apple.com/za/app/dstv-mobile-decoder/id403946447?mt=8 DStv Mobile Decoder]
| com.multichoice.DStvMobileDVBH
| {{yes}}
| 1.01.07
|
|-
| [http://itunes.apple.com/us/app/movies-by-flixster-rotten/id284235722?mt=8 Flixster/Movies/Ultraviolet]
| com.jeffreygrossman.moviesapp
| {{yes}}
| 5.22
|
|-
| [http://itunes.apple.com/us/app/golden-screen-cinemas/id413024972?mt=8 Golden Screen Cinemas]
| com.sinodynamic.gsc
| {{yes}}
| 1.4
|
|-
| [http://itunes.apple.com/us/app/good-for-enterprise/id333202351?l=es&mt=8 Good For Enterprise]
| com.good.gmmiphone
| {{yes}}
| 1.9.8
| App works but admin console still reports jailbreak
|-
| [http://itunes.apple.com/us/app/ibooks/id364709193?mt=8 iBooks]
| com.apple.ibooks(2?)
| {{no}}
| ?
| Patch(es) available in Cydia
|-
| [http://itunes.apple.com/us/app/kbseutabaengking/id373742138?mt=8 KB star]
| com.kbstar.kbbank
| {{yes}}
| 1.14.1
|
|-
| [http://itunes.apple.com/us/app/kb-starplus/id381065734?mt=8 KB starPlus]
| com.kbstar.starplus
| {{yes}}
| 1.2.0
|
|-
| [http://itunes.apple.com/gb/app/lovefilm-player-for-ipad/id454468674?mt=8 LOVEFiLM Player for iPad]
| com.lovefilm.watchnow.ipad
| {{yes}}
| 1.0
|
|-
| [http://itunes.apple.com/us/app/maxis-movies/id369867024?mt=8 Maxis Movies]
| com.maxis.moviebooking
| {{yes}}
| 1.1.6
|
|-
| [http://itunes.apple.com/us/app/maxis-movies-for-ipad/id418096484?mt=8 Maxis Movies (iPad)]
| com.maxis.moviebookingipad
| {{yes}}
| 1.1.2
|
|-
| [http://itunes.apple.com/us/app/mcafee-enterprise-mobility/id322111072?mt=8 McAfee EMM]
| com.trustdigital.iTDClient
| {{yes}}
| 4.7.1
|
|-
| [http://itunes.apple.com/us/app/mobileiron-myphone-work-client/id320659794?mt=8 MobileIron MyPhone@Work]
| com.mobileiron.phoneatwork
| {{yes}}
| 4.5.12
|
|-
| [http://itunes.apple.com/us/app/skype/id304878510?mt=8 Skype]
| com.skype.skype
| {{yes}}
| 3.7
|
|-
| [http://itunes.apple.com/gb/app/sky-go/id446086440?mt=8 Sky Go]
| com.bskyb.skygo
| {{yes}}
| 2.1
|
|-
| [http://itunes.apple.com/us/app/square/id335393788?mt=8 Square]
| com.squareup.square
| {{yes}}
| 2.2.5
|
|-
| [http://itunes.apple.com/ca/app/telus-optik-tv-hd/id467260646?mt=8 Telus Optik TV]
| com.telus.nscreen
| {{yes}}
| 1.1.2
|
|-
| [http://itunes.apple.com/us/app/tv-live-de-la-orange/id390896393?mt=8 TV live de la Orange]
| com.orange.TVOrange
| {{yes}}
| 1.0
|
|-
| [http://itunes.apple.com/us/app/twc-tv/id420455839?mt=8 TWC TV]
| com.timewarnercable.simulcast
| {{yes}}
| 2.6.1
|
|-
| [http://itunes.apple.com/us/app/verizon-media-manager/id460536890?mt=8 Verizon Media Manager]
| com.verizon.ams.flexview
| {{yes}}
| 2.0.29.26
|
|-
| [http://itunes.apple.com/no/app/voddler/id409806444?mt=8 Voddler]
| com.voddler.VoddlerHD
| {{yes}}
| 1.2.1
|
|}

XCon

2012-05-02T21:20:09Z

Rdqronos: Undo revision 25536 by Lunatik (talk) (iBooks DOES check for a jailbreak, hence why a patch is released in Cydia every time iBooks is updated)

{{lowercase}}
xCon is a collaborative project by [http://twitter.com/unimp0rtanttech n00neimp0rtant] and [http://twitter.com/olunatiko Lunatik] that aims to be an all-in-one solution for hooking every known method and function responsible for informing an application of a jailbroken device. At first, the project aimed to patch applications on a per-app basis, but now it uses lower-level hooks to cover any apps that attempt to use the same procedure, even patching apps not explicitly reversed by the developers. Originally an open-source project, it remains closed-source now to discourage App Store developers from working around xCon's hooks.

xCon is available free of charge in Cydia. No configuration is needed; just install and go.

For general infos, see [[Bypassing Jailbreak Detection]].

== App Patching Status ==
''You can find an app's current release version in its iTunes listing page, linked below in the app names. If an app's current release version is newer than the "Last Confirmed Working Version," please help by testing it out yourself with the latest release of xCon and updating the table as necessary.''

{| class="wikitable" style="text-align:center; width:100%;"
|-
! App Name
! Bundle Identifier
! Patched?
! Last Confirmed Working Version
! Notes
|-
| [http://itunes.apple.com/gb/app/barclays-pingit/id496552142?mt=8 Barclays PingIt]
| uk.co.barclays.PingIt
| {{yes}}
| 1.0.2
|
|-
| [http://itunes.apple.com/us/app/optimum/id387231038?mt=8 Cablevision Optimum]
| com.cablevision.rDVR
| {{yes}}
| 2.1.2
|
|-
| [http://itunes.apple.com/us/app/optimum-for-ipad/id424612367?mt=8 Cablevision Optimum (iPad)]
| com.cablevision.iOTV
| {{yes}}
| 2.1.1
|
|-
| [http://itunes.apple.com/gb/app/capital-one-uk/id481679012?mt=8 Capital One UK]
| com.ukcapitalone.capitalone
| {{yes}}
| 5.1
|
|-
| [http://itunes.apple.com/au/app/commbank-kaching/id475728226?mt=8 Commbank Kaching]
| au.com.commbank.kaching
| {{yes}}
| 1.1.0
|
|-
| [http://itunes.apple.com/us/app/cox-tv-connect-for-ipad/id474096909?mt=8 Cox TV Connect]
| com.cox.ios.ipad.tvconnect
| {{yes}}
| 1.0.1
|
|-
| [http://itunes.apple.com/us/app/directv-app-for-ipad/id421547368?mt=8 DirecTV for iPad]
| com.directv.mobile.ipad.navigator.production
| {{yes}}
| 1.3.4-1.5.0
|
|-
| [http://itunes.apple.com/us/app/directv-nomad/id448679509?mt=8 DirecTV Nomad]
| com.directv.mobile.iphone.nomad.production
| {{yes}}
| 1.8.1
| 2.0.0 in beta
|-
| [http://itunes.apple.com/za/app/dstv-mobile-decoder/id403946447?mt=8 DStv Mobile Decoder]
| com.multichoice.DStvMobileDVBH
| {{yes}}
| 1.01.07
|
|-
| [http://itunes.apple.com/us/app/movies-by-flixster-rotten/id284235722?mt=8 Flixster/Movies/Ultraviolet]
| com.jeffreygrossman.moviesapp
| {{yes}}
| 5.22
|
|-
| [http://itunes.apple.com/us/app/golden-screen-cinemas/id413024972?mt=8 Golden Screen Cinemas]
| com.sinodynamic.gsc
| {{yes}}
| 1.4
|
|-
| [http://itunes.apple.com/us/app/good-for-enterprise/id333202351?l=es&mt=8 Good For Enterprise]
| com.good.gmmiphone
| {{yes}}
| 1.9.8
| App works but admin console still reports jailbreak
|-
| [http://itunes.apple.com/us/app/ibooks/id364709193?mt=8 iBooks]
| com.apple.ibooks(2?)
| {{no}}
| ?
|
|-
| [http://itunes.apple.com/us/app/kbseutabaengking/id373742138?mt=8 KB star]
| com.kbstar.kbbank
| {{yes}}
| 1.14.1
|
|-
| [http://itunes.apple.com/us/app/kb-starplus/id381065734?mt=8 KB starPlus]
| com.kbstar.starplus
| {{yes}}
| 1.2.0
|
|-
| [http://itunes.apple.com/gb/app/lovefilm-player-for-ipad/id454468674?mt=8 LOVEFiLM Player for iPad]
| com.lovefilm.watchnow.ipad
| {{yes}}
| 1.0
|
|-
| [http://itunes.apple.com/us/app/maxis-movies/id369867024?mt=8 Maxis Movies]
| com.maxis.moviebooking
| {{yes}}
| 1.1.6
|
|-
| [http://itunes.apple.com/us/app/maxis-movies-for-ipad/id418096484?mt=8 Maxis Movies (iPad)]
| com.maxis.moviebookingipad
| {{yes}}
| 1.1.2
|
|-
| [http://itunes.apple.com/us/app/mcafee-enterprise-mobility/id322111072?mt=8 McAfee EMM]
| com.trustdigital.iTDClient
| {{yes}}
| 4.7.1
|
|-
| [http://itunes.apple.com/us/app/mobileiron-myphone-work-client/id320659794?mt=8 MobileIron MyPhone@Work]
| com.mobileiron.phoneatwork
| {{yes}}
| 4.5.12
|
|-
| [http://itunes.apple.com/us/app/skype/id304878510?mt=8 Skype]
| com.skype.skype
| {{yes}}
| 3.7
|
|-
| [http://itunes.apple.com/gb/app/sky-go/id446086440?mt=8 Sky Go]
| com.bskyb.skygo
| {{yes}}
| 2.1
|
|-
| [http://itunes.apple.com/us/app/square/id335393788?mt=8 Square]
| com.squareup.square
| {{yes}}
| 2.2.5
|
|-
| [http://itunes.apple.com/ca/app/telus-optik-tv-hd/id467260646?mt=8 Telus Optik TV]
| com.telus.nscreen
| {{yes}}
| 1.1.2
|
|-
| [http://itunes.apple.com/us/app/tv-live-de-la-orange/id390896393?mt=8 TV live de la Orange]
| com.orange.TVOrange
| {{yes}}
| 1.0
|
|-
| [http://itunes.apple.com/us/app/twc-tv/id420455839?mt=8 TWC TV]
| com.timewarnercable.simulcast
| {{yes}}
| 2.6.1
|
|-
| [http://itunes.apple.com/us/app/verizon-media-manager/id460536890?mt=8 Verizon Media Manager]
| com.verizon.ams.flexview
| {{yes}}
| 2.0.29.26
|
|-
| [http://itunes.apple.com/no/app/voddler/id409806444?mt=8 Voddler]
| com.voddler.VoddlerHD
| {{yes}}
| 1.2.1
|
|}

Talk:Internal Settings

2012-04-18T20:34:56Z

Rdqronos:

== Internal Settings ==
Any more Info on how this can be enabled ? --[[User:M2m|M2m]] 19:23, 5 August 2011 (MDT)
:Yes, I have my hands on the Files :) http://img.ly/images/SonnyDickson --[[User:Sonny788]] 19:30, 5 August 2011 (MDT)
::Do you now? Those would be helpful :D --[[User:Rdqronos|rdqronos]] 19:58, 5 August 2011 (MDT)
::Anyway to enable this with out issues of intellectual properties ?--[[User:M2m|M2m]] 11:14, 6 August 2011 (MDT)
:::Impossible, sorry. Internal Settings.bundle is a preference bundle with an executable, which can be easily taken down due to copyright issues. Unless you want plists of this bundle, these can't be copyrighted as far as I know ;] --pjakuszew 11:22, 6 August 2011 (MDT)
Sorry Guys ;( --{{unsigned|Sonny778|1:16, 14 August 2011 (UTC)}}
:SIGN YOUR TALK PAGE ENTRIES :) --[[User:Rdqronos|rdqronos]] 21:04, 13 August 2011 (MDT)
So it doesn't appear in Apple internal builds, in /AppleInternal/Library/PrefrenceBundles along with carrier settings ? --[[User:M2m|M2m]] 08:57, 28 August 2011 (MDT)
::It does. Why the information about location of the bundle was deleted? Preferences.app actually looks into this directory if it exists, and SpringBoard uses the sound file from it when baseband crashes. Go and check the SpringBoard binary strings, you'll find a reference to /AppleInternal/Library/PreferenceBundles/Internal Settings.bundle/4_note_rising.aiff --pjakuszew 18:12, 28 August 2011 (MDT)
:::Oh, I mixed up. The file that SB uses when baseband crashes is called baseband.aiff, it's a 1 second long sound of 56K modem connecting to network. --pjakuszew 01:24, 29 August 2011 (MDT)

== Internal Settings ==
Some people have it too, yet they don't paste it here... It's nice that you want to share this with people, but please refrain from pasting components of this bundle here, legality of such actions is unclear. Screenshots seem to be OK, I would do some and post them but my copy of bundle is missing one file and it doesn't work :/ --pjakuszew 01:09, 29 August 2011 (MDT)
: May I ask what file? --[[User:Dylan Laws|Dylan Laws]] 01:48, 3 March 2012 (MST)
== Help? ==
I've gotten my hands on all the files needed, But when its put into the /AppleInternal/Library/PreferenceBundles folder Settings gives me a preference load error. Any suggestions? --[[User:Dylan Laws|Dylan Laws]] 01:44, 26 February 2012 (MST)
:Probably you don't have all needed files. Let me guess, you have the files from 5.0b2? Most of settings won't work because there is one very important file missing --pjakuszew 03:22, 26 February 2012 (MST)
You guessed wrong :P I have the bundles with the executables. So again, Any help? {{unsigned|Dylan Laws|18:10, February 26, 2012 (MST)}}
:If it contains UsageSettings files, it's from 5.0. OR, you may also have .patch files from one of Carrier OTA updates, which are useless too. Anyway, if you really have the legit Internal Settings executable, try setting its permissions to 755. --pjakuszew 15:07, 26 February 2012 (MST)
:: This guy told me to edit the Preference Settings.plist file to link the bundle with it, Any idea? --[[User:Dylan Laws|Dylan Laws]] 19:08, 26 February 2012 (MST)
:::There's no need of editing anything to get Internal Settings working. Actual bundle just works after copying it to its location, Preferences.app is coded in that way so it automatically picks up the bundle. What you and other people are trying to do is forcibly attach defunctional settings keys into Preferences. Run "strings" on the executable of your bundle and compare it to UsageSettings, you'll see that it's fake --pjakuszew 04:32, 27 February 2012 (MST)

== Screen Shots ==
If needed I can provide more screen shots, My friend got it working. :D --[[User:Dylan Laws|Dylan Laws]] 21:59, 1 March 2012 (MST)

==Installation==
I have all the required files for the bundle, is it possible to install this bundle without a jailbreak? My 4S is on 5.1 (my fault), but I want to test this out. --[[User:Rdqronos|rdqronos]] 19:16, 14 April 2012 (MDT)
:: Doing a tricky backup where you find the keys then mess up the FS on the backup then restore to the backup without a jailbreak? Just my theory. --[[User:Dylan Laws|Dylan Laws]] 15:05, 15 April 2012 (MDT)
:::If you want to try that, look at the [[iTunes Backup|backup format]]. Could get quite tricky. --[[User:Http|http]] 15:48, 15 April 2012 (MDT)
::That sounds scary... would it be possible to mess with the FS in the actual IPSW? Or would that require an exploit of some sort to repack/resign it? --[[User:Rdqronos|rdqronos]] 05:25, 16 April 2012 (MDT)
::: Im thinking the same as you. --[[User:Dylan Laws|Dylan Laws]] 21:12, 16 April 2012 (MDT)
:::Wait... if I've read the article enough (which I have...) all you need is the rootFS key, right? And then you just use xpwn to resign it so that it works with iTunes. Right? Or am I an idiot? --[[User:Rdqronos|rdqronos]] 14:02, 17 April 2012 (MDT)
:::: If you wanna email me I'll help you out, I want this to work :P --[[User:Dylan Laws|Dylan Laws]] 17:07, 17 April 2012 (MDT)
::::Uhhh.... mine's jamesbrosephalavosus@gmail.com (and yes I'm okay with that being up here). Can't seem to find yours anywhere (hehe) --[[User:Rdqronos|rdqronos]] 14:34, 18 April 2012 (MDT)

Talk:Internal Settings

2012-04-17T20:02:44Z

Rdqronos:

Talk:Internal Settings

2012-04-16T11:25:10Z

Rdqronos:

Talk:Internal Settings

2012-04-15T01:16:25Z

Rdqronos: question

Talk:XCon

2012-04-03T22:13:58Z

Rdqronos:

{{lowercase}}
== Skype ==
Upon installing Skype on my unjailbroken device, it gave me the notification that it doesnt work. After jailbreaking, it still worked. --[[User:5urd|5urd]] 10:04, 21 March 2012 (MDT)
:Skype hasn't changed that warning since the 3.x days. It was probably back when Spirit did some serious kernel modding and Skype just knew it wouldn't work. Jailbreaks have changed since then. --[[User:Rdqronos|rdqronos]] 14:11, 21 March 2012 (MDT)
::Nope they check for Cycorder, MobileSubstrate, and I think one other thing. Not sure what the limitations are beyond the little notice at the beginning, but I patched over the checks anyway. (Someone told me they block video calling on jailbroken devices, confirm/deny?) --[[User:n00neimp0rtant|n00neimp0rtant]] 17:43, 3 April 2012 (EDT)
:Worked for me, at least in the 4.x days. --[[User:Rdqronos|rdqronos]] 16:13, 3 April 2012 (MDT)
== Action Movie FX ==
Exactly what does Action Movie FX do if it detects a jailbroken device? I use it a lot on my jailbroken devices and never get a warning, etc, though sometimes it crashes whenever you try and make a movie, though a reboot always fixes it.--[[User:JonathanSeals|JonathanSeals]] 14:00, 22 March 2012 (MDT)
: I haven't been having a good experience with the app, whenever i make a new movie it crashes. --[[User:Dylan Laws|Dylan Laws]] 23:40, 21 March 2012 (MDT)
:: It seems like more of a RAM issue than jailbreak detection. --[[User:JonathanSeals|JonathanSeals]] 14:00, 22 March 2012 (MDT)
::Yes --[[User:5urd|5urd]] 21:55, 24 March 2012 (MDT)
:I scoured the binary and there's absolutely no jailbreak detection anywhere in it. If all its doing is crashing, you've got yourself a memory issue. --[[User:n00neimp0rtnat|n00neimp0rtant]] 17:47, 3 April 2012 (EDT)

== New Column ==
Can we add a new column for xCon App list, that describes what the limitations are if not fixed? --[[User:Http|http]] 06:48, 22 March 2012 (MDT)
:I would like that --[[User:5urd|5urd]] 21:55, 24 March 2012 (MDT)
:That's exactly what the "Notes" column on the right is for. --[[User:n00neimp0rtant|n00neimp0rtant]] 17:41, 3 April 2012 (EDT)

04.11.08

2012-04-02T09:55:44Z

Rdqronos:

This is the [[XMM 6180]] baseband provided with iOS 5.0b6, 5.0b7 , 5.0[[Golden Master|GM]] ,5.0.1b1, 5.0.1b2 and 5.0.1. It has both the [[AT+XAPP Vulnerability]] and the [[interposer exploit]] patched, therefore can not be unlocked. This baseband also contains the 2.13 [[Baseband Bootloader|bootloader]], like [[iOS]]. This baseband can be found in the 5.0 [[IPSW File Format|IPSW]] for [[k94ap|iPad 2 GSM]], [[N90ap|iPhone 4 GSM]] and also the [[N94ap|iPhone 4S]] due to a goof on Apple's side.

{{stub|firmware}}

Talk:MDM6610

2012-03-30T16:11:31Z

Rdqronos: /* Datasheet */ new section

=== GSM and CDMA ===
As mentioned by somebody, both GSM and CDMA are on the same chip, so this would mean this chip has internally two chips and two baseband versions. If this is true, how should we integrate this information? The GSM baseband version would be [[04.11.08]] as far as I know (that page also needs an update then). -- [[User:Http|http]] 15:14, 13 October 2011 (MDT)
:You're looking into this a bit too much. :P 04.11.08 is the X-Gold 618's baseband, and I don't think it's cost-effective for Qualcomm to reverse-engineer Infineon's X-Gold 618 so the MDM6610 uses the same firmware. ;) --[[User:Dialexio|Dialexio]] 15:48, 13 October 2011 (MDT)
::Oh, the other is Infineon. Yes, that doesn't make sense then. So then both chips are in there? That wouldn't make sense either as the MDM6610 supports both GSM and CDMA already. Or why are both versions listed here: [[Firmware/iPhone_4S]]? (see also the discussion page) I assume that is just a copy-paste bug there then? --[[User:Http|http]] 16:50, 13 October 2011 (MDT)
::: Well the 4s ipsw comes with 2 baseband firmwares for whatever reason.--[[User:M2m|M2m]] 17:53, 13 October 2011 (MDT)
:::It's probably a goof on Apple's side. iOS 4.2.6-4.2.10 (for the CDMA iPhone 4) contained what appeared to be a prerelease X-Gold 618 baseband, and then Apple stopped including it as of iOS 5.0. --[[User:Dialexio|Dialexio]] 18:06, 13 October 2011 (MDT)
:::: The BuildManifest also doesn't include any refernce to 04.11.08. So probably really a goof on Apple's side.--[[User:M2m|M2m]] 01:55, 5 January 2012 (MST)

== Datasheet ==

Anyone got a link to the data sheet for this? --[[User:Rdqronos|rdqronos]] 10:11, 30 March 2012 (MDT)

Talk:OTA Updates

2012-03-26T22:19:13Z

Rdqronos:

== Encryption ==
Are the updates encrypted in any way ([[VFDecrypt]]?) --[[User:Balloonhead66|Balloonhead66]] 18:31, 30 August 2011 (MDT)
:No. Just regular Zips. --[[User:M2m|M2m]] 22:36, 30 August 2011 (MDT)
:Only NOR payloads and RAM disks are encrypted, rest of the "asset" is unencrypted --pjakuszew 04:19, 31 August 2011 (MDT)
::But if you need to update iTunes to 'decrypt' the newest firmware (as iTunes contains the 'password' to do so), then that means that the encrypted stuff has a 'password' that is somewhere on the file system. Maybe if we could access it, we could get them. (maybe disassembling iTunes could get us them also :D) --[[User:Balloonhead66|Balloonhead66]] 11:12, 31 August 2011 (MDT)
:::iTunes doesn't contain any "passwords" Balloonhead66. Everything is done on the device and usually uses the device's built in hardware AES crypt keys. -- [[User:iH8sn0w|iH8sn0w]] 13:32, 31 August 2011 (EST)
::::Dang, but then why do we need to update iTunes to update our device? --[[User:Balloonhead66|Balloonhead66]] 11:35, 31 August 2011 (MDT)
:::::Its purpose is to send out firmware files to the device, and only that. --pjakuszew 11:36, 31 August 2011 (MDT)
::::::I still don't get the point of updating iTunes (other than avoiding an error) --[[User:Balloonhead66|Balloonhead66]] 11:45, 31 August 2011 (MDT)
:::::::Updating is required because of incompatibilites with newer iOS versions. I think it's about Fairplay and encryption of iPod library database. Another example is support of new hardware; how would you update a 3GS with iTunes 7.5? --pjakuszew 11:56, 31 August 2011 (MDT)
::::::::Ok, that makes sense. Thanks! --[[User:Balloonhead66|Balloonhead66]] 12:14, 31 August 2011 (MDT)

== Tracker ==
Anyone into making a watchguard that tracks mesu.apple.com for changes (and records them)? --[[User:M2m|M2m]] 00:55, 12 November 2011 (MST)
:I did a [http://cole.freehostingcloud.com/scripts/Apple%20OTA%20Update%20Checker.php crude one]. It works by comparing against a list of already done URLs in an array --[[User:Balloonhead66|Balloonhead66]] 13:16, 12 November 2011 (MST)
:::I would just curl --user-agent="softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0" http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml -o OTA.xml and pipe it into shasum. In case shasum change, save as new version with date and time (and display)... --[[User:M2m|M2m]] 19:00, 12 November 2011 (MST)
::::One problem with that is that I can't test it on my computer here at my house as I am on windows. To test it with curl I would need to upload it to my website. What I did was open a connection with fsockopen(), sent some request headers, then read the response to a string. After that, I parsed the [[PLIST File Format|plist]] to an array. Unfortunately, the parser leaves some artifacts on the hash as it is a compressed hash. So I decided to use the file location instead. It still works pretty well. I had to remove the URL form area as it messed with the array in unwanted ways. I am working on moving it from an array to just line by line URLs preventing the failure as I just append the line to it. When I finish it, I will post the code on [http://cole.freehostinglcoud.com/cms/Scripts:PHP/Apple_OTA_Update_Checker my website]. --[[User:Balloonhead66|Balloonhead66]] 21:43, 12 November 2011 (MST)
::::: curl is avialable for windows[http://curl.haxx.se/download.html] --[[User:M2m|M2m]] 04:43, 13 November 2011 (MST)
:::::: doesn't matter, it already works and spits out a nice table. --[[User:Balloonhead66|Balloonhead66]] 16:05, 13 November 2011 (MST)
::::::: So is your tracker available online already ? --[[User:M2m|M2m]] 19:59, 26 November 2011 (MST)
:::::::: Yes. When you add a link to the wiki, you can add it to the textbox one per line and click submit and it wont show up again. --[[User:Balloonhead66|Balloonhead66]] 13:37, 27 November 2011 (MST)
:::::::: [http://pastie.org/2930838 Spammers]. It doesn't work because it works like this:
for (
$i = 0;
$i < sizeof(array_keys($plist['Assets']));
$i++)
{
if (
!in_array(
$plist['Assets'][$i]['__BaseURL'] . $plist['Assets'][$i]['__RelativePath'],
$usedurls)
)
{
// Output table
}
}
:::::::: --[[User:Balloonhead66|Balloonhead66]] 17:34, 27 November 2011 (MST)
::::::::: Should do the trick to make a backup of OTA.xml's whenever there is a change
#!/bin/bash
SHA_OLD=1
while true; do
SHA_CUR=$(curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml | shasum)

if [ "$SHA_OLD" = "$SHA_CUR" ]; then
echo nothing to do
else
NOW=$(date +"%F")
NOWT=$(date +"%T")
echo download
curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml -o OTA_$NOW-$NOWT.xml

SHA_OLD=$(curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml | shasum)
fi
sleep 600
done

:::::::::--[[User:M2m|M2m]] 08:33, 24 March 2012 (MDT)

== Carrier Beta ==

What is a carrier beta? --[[User:balloonhead66|5urd]] 18:33, 9 January 2012 (MST)
:Most likely a beta for carrier provisions. --[[User:Rdqronos|rdqronos]] 16:19, 26 March 2012 (MDT)

Talk:Bypassing Jailbreak Detection

2012-03-21T20:11:42Z

Rdqronos:

== List of known apps ==

May I suggest a section where it lists the known apps? For one could be Skype. (pardon my spelling and grammar I'm typing this on my iPod) --[[User:Dylan Laws|Dylan Laws]] 16:02, 20 March 2012 (MDT)
:Sounds fine to me. (P.S.- Last time I checked, Skype doesn't cease to work on jailbroken devices; it just shows an alert if MobileSubstrate is installed, since the two had compatibility issues a few years ago.) --[[User:Dialexio|Dialexio]] 16:40, 20 March 2012 (MDT)
:: It says it cant support "modified", i guess the polite way of saying "YO FOOL WHY YOU JAILBROKE?", but it works fine. --[[User:Dylan Laws|Dylan Laws]] 17:02, 20 March 2012 (MDT)

== Skype ==

Upon installing Skype on my unjailbroken device, it gave me the notification that it doesnt work. After jailbreaking, it still worked. --[[User:5urd|5urd]] 10:04, 21 March 2012 (MDT)
:Skype hasn't changed that warning since the 3.x days. It was probably back when Spirit did some serious kernel modding and Skype just knew it would work. Jailbreaks have changed since then. --[[User:Rdqronos|rdqronos]] 14:11, 21 March 2012 (MDT)

Talk:UDID

2012-03-20T01:36:37Z

Rdqronos:

Isn't the serial 12 characters long? --[[User:Rdqronos|rdqronos]] 18:14, 17 March 2012 (MDT)
:Yes. Actually looking at my old iPod and new one. The old device are 11 characters and the new are 12. I don't know when it started since I only own iPod touch 2G and 4G. --[[User:Jacob|Jacob]] 18:58, 17 March 2012 (MDT)
:So then how does one calculate the hash? I tried it with the Serial+ECID+MAC+Bluetooth MAC SHA1 calculation and it was completely different... maybe someone should update this... --[[User:Rdqronos|rdqronos]] 20:54, 17 March 2012 (MDT)
::I can confirm it's not working. I tried with ECID in both upper/lower case, with/without leading zeroes, even in decimal. --[[User:Http|http]] 07:46, 18 March 2012 (MDT)
:::What about with first 11 digits of the serial? --[[User:Jacob|Jacob]] 14:50, 18 March 2012 (MDT)
::I can confirm that it is working at least on my iPad 2 and my iPhone 4 --[[User:Rud0lf77|rud0lf77]] 12:15, 18 March 2012 (MDT)
:::What format of the ECID did you use? (I don't have Xcode handy.) Hex or dec? Leading zeroes? Upper or lower case? I was trying with my 4S, maybe it has changed again. --[[User:Http|http]] 15:05, 18 March 2012 (MDT)
:::: You can get both with redsn0w if people are wondering. Both Hex and Dec. --[[User:Dylan Laws|Dylan Laws]] 15:39, 18 March 2012 (MDT)
::::Also, what format for MAC addresses should one use? xx:xx:xx:xx:xx or xxxxxxxx --[[User:Rdqronos|rdqronos]] 15:46, 18 March 2012 (MDT)
:::::To [[User:Rdqronos|rdqronos]]: The format for MAC addresses should be clear (see description) if it hasn't changed: including the colons and the letters in lower case. --[[User:Http|http]] 18:56, 18 March 2012 (MDT)
:::::Alright. Thanks --[[User:Rdqronos|rdqronos]] 19:36, 19 March 2012 (MDT)

UDID

2012-03-18T21:52:29Z

Rdqronos: reflecting i0n1c's tweets

[[UDID]] is the short form for '''U'''nique '''D'''evice '''Id'''entifier. It is a 40-character long hex value (20 bytes). The [[UDID]] is being used by developers to register devices for testing their Apps. Only on registered devices developers can run Apps that are not in Apple's AppStore yet. Also, beta firmware can be installed only on registered devices. Developers currently have 100 [[UDID]]s they can register. The UDID can actually be changed if your device's MAC address (WiFi or Bluetooth) changes, which isn't likely but still possible.

Instead of calculating the value, it can be read from [[iTunes]], when the device is connected, by clicking on the text '''Serial Number'''.

== Calculation ==
The [[UDID]] is being calculated like this:
*Create a 60-character long or 59-character long (on newer devices) text string (see below)
*Calculate the [[wikipedia:SHA-1|SHA1]] hash of the text string. The result is the [[UDID]].

To create the text string, append the following four strings:
*11-character long or 12-character long (on newer devices) '''serial number''' (exactly like it is written in the Settings app)
*15-character long '''IMEI number''' (without spaces); empty string for iPod touch and Wi-Fi model iPads (on older devices) OR on newer devices 13-character long "ECID" in decimal (like shown in Xcode)
*17-character long '''Wi-Fi MAC address''' (letters in lower case, including colons); for the [[N45ap|iPod touch first generation]] use "00:00:00:00:00:00"
*17-character long '''Bluetooth MAC address''' (letters in lower case, including colons)

== In short ==
For older devices:
UDID = SHA1($serial + $IMEI + $WiFiMac + $BluetoothMac)

On the [[N92ap|Verizon iPhone 4]] and newer it is instead computed with this formula:
UDID = SHA1($serial + $ECID + $WiFiMac + $BluetoothMac)

Talk:UDID

2012-03-18T21:46:44Z

Rdqronos:

Isn't the serial 12 characters long? --[[User:Rdqronos|rdqronos]] 18:14, 17 March 2012 (MDT)
:Yes. Actually looking at my old iPod and new one. The old device are 11 characters and the new are 12. I don't know when it started since I only own iPod touch 2G and 4G. --[[User:Jacob|Jacob]] 18:58, 17 March 2012 (MDT)
:So then how does one calculate the hash? I tried it with the Serial+ECID+MAC+Bluetooth MAC SHA1 calculation and it was completely different... maybe someone should update this... --[[User:Rdqronos|rdqronos]] 20:54, 17 March 2012 (MDT)
::I can confirm it's not working. I tried with ECID in both upper/lower case, with/without leading zeroes, even in decimal. --[[User:Http|http]] 07:46, 18 March 2012 (MDT)
:::What about with first 11 digits of the serial? --[[User:Jacob|Jacob]] 14:50, 18 March 2012 (MDT)
:Also, what format for MAC addresses should one use? xx:xx:xx:xx:xx or xxxxxxxx --[[User:Rdqronos|rdqronos]] 15:46, 18 March 2012 (MDT)
::I can confirm that it is working at least on my iPad 2 and my iPhone 4 --[[User:Rud0lf77|rud0lf77]] 12:15, 18 March 2012 (MDT)
:::What format of the ECID did you use? (I don't have Xcode handy.) Hex or dec? Leading zeroes? Upper or lower case? I was trying with my 4S, maybe it has changed again. --[[User:Http|http]] 15:05, 18 March 2012 (MDT)
:::: You can get both with redsn0w if people are wondering. Both Hex and Dec. --[[User:Dylan Laws|Dylan Laws]] 15:39, 18 March 2012 (MDT)

Talk:UDID

2012-03-18T02:54:21Z

Rdqronos:

SHSH

2012-03-18T00:25:22Z

Rdqronos: added A5 details, strangely they weren't here.

0x80 byte RSA signature of a firmware image.

This often also refers to the backup file with the signature. This signature is needed to restore a specific firmware version. The signature is being created by Apple and is being generated based on some hardware keys of the device and the hash of the firmware. Using a [[wikipedia:replay attack|replay attack]], with the saved signature old firmware can be restored, although Apple doesn't issue the signatures anymore and therefore disallows installing older firmware. Therefore it is recommended to save the signature for your device as long as Apple issues it.
Unfortunately, due to changes in the A5 bootROM, downgrading A5 devices ([[iPhone 4S]], [[iPad 2]]) to earlier 5.x firmwares is impossible, even with iFaith. Until a bootROM exploit is found in the A5 processor, it is recommended to stay on a jailbreakable firmware (at time of writing 5.0.1) until such time that the latest firmware is jailbroken.

To downgrade the firmware, simply change your hosts file to map any request to an Apple server to point to [[Saurik]]'s server instead, if your certificate is there. If you have the file yourself, run [[TinyUmbrella]]'s TSS Server on your local machine. Note, though, that downgrades to iOS 5 or newer are currently not available.

Not all devices have this check built in. Older devices allow installation of any correctly signed firmware, so no backup of the certificate is necessary. Devices that need Apple signatures are: [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[K48ap|iPad]], [[iPad 2]], [[n81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]] and all newer devices. The [[N88ap|iPhone 3G]] and [[N72ap|iPod touch 2G]] bootroms do not require these SHSHs; however, newer versions of iOS require them (unless the chain of trust is broken and custom firmwares are installed). To restore to arbitrary versions of iOS 4.0, the SHSH is also needed for the [[N72ap|iPod touch 2G]] and [[N82ap|iPhone 3G]]. Not only does [[DFU Mode]] require the [[iBSS]]/[[iBEC]] files to be signed with an SHSH that includes the device's [[ECID]], but the normal boot-chain requires the [[LLB]] to be fully signed with an [[ECID]]+SHSH, so a downgrade [[IPSW File Format|IPSW]] is not possible without a bootrom exploit of normal boot-chain (e.g. [[0x24000 Segment Overflow]]). See also the [http://blog.iphone-dev.org/post/833937433 Dev Team Blog post] about this.

With the tools mentioned below it is possible to backup the signature. It is not necessary that the device is jailbroken to do the backup. Usually the SHSH signature file is stored on [[Cydia Server|Saurik's server]]. If it is stored there, then you can see in the top of [[Cydia Application|Cydia]] (on jailbroken devices) for which version a backup exists.

Users usually make the mistake that (even if they understand all this) they think the SHSH firmware version they back up depends on the firmware version they have installed on their device. This is the case for [[iFaith]], but not for TinyUmbrella. iFaith dumps the SHSHs from your device's storage (whatever's installed on your device, e.g. 4.3.3), while TinyUmbrella gets SHSHs from Apple's servers (whatever firmwares Apple is currently signing).

==Timeline==
{| class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! width="50" | iOS
! width="480" | for Device(s)
! width="130" | From
! width="130" | Until
! width="130" | Status
|-
| <= 3.0
| [[N72ap|iPod touch 2G]]
| Unused
| Unused
| {{partial|Unused}}
|-
| <= 3.1.3
| [[M68ap|iPhone 2G]], [[N82ap|iPhone 3G]], [[N45ap|iPod touch 1G]]
| Unused
| Unused
| {{partial|Unused}}
|-
| 3.0
| rowspan="3" | [[N88ap|iPhone 3GS]]
| 19 June 2009
| 9 September 2009
| {{no|Closed}}
|-
| 3.0.1
| 31 July 2009
| 9 September 2009
| {{no|Closed}}
|-
| 3.1
| 9 September 2009
| 8 October 2009
| {{no|Closed}}
|-
| 3.1.1
| [[N72ap|iPod touch 2G]]
| 9 September 2009
| 21 June 2010
| {{no|Closed}}
|-
| 3.1.1
| [[N18ap|iPod touch 3G]]
| 9 September 2009
| 8 October 2009
| {{no|Closed}}
|-
| 3.1.2
| [[N72ap|iPod touch 2G]]
| 8 October 2009
| 21 June 2010
| {{no|Closed}}
|-
| 3.1.2
| [[N88ap|iPhone 3GS]], [[N18ap|iPod touch 3G]]
| 8 October 2009
| 2 February 2010
| {{no|Closed}}
|-
| 3.1.3
| [[N72ap|iPod touch 2G]]
| 2 February 2010
| 21 June 2010
| {{no|Closed}}
|-
| 3.1.3
| [[N88ap|iPhone 3GS]], [[N18ap|iPod touch 3G]]
| 2 February 2010
| 21 June 2010
| {{no|Closed}}
|-
| 3.2
| rowspan="3" | [[K48ap|iPad]]
| 3 April 2010
| 15 July 2010
| {{no|Closed}}
|-
| 3.2.1
| 15 July 2010
| 19 August 2010
| {{no|Closed}}
|-
| 3.2.2
| 11 August 2010
| 2 December 2010 (?)
| {{no|Closed}}
|-
| 4.0
| [[N72ap|iPod touch 2G]]
| 21 June 2010
| 9 September 2010
| {{no|Closed}}
|-
| 4.0
| [[N18ap|iPod touch 3G]]
| 21 June 2010
| 19 August 2010
| {{no|Closed}}
|-
| 4.0
| [[N82ap|iPhone 3G]], [[N88ap|iPhone 3GS]]
| 21 June 2010
| 15 July 2010
| {{no|Closed}}
|-
| 4.0
| [[N90ap|iPhone 4 GSM]]
| 24 June 2010
| 15 July 2010
| {{no|Closed}}
|-
| 4.0.1
| [[N82ap|iPhone 3G]]
| 15 July 2010
| 9 September 2010
| {{no|Closed}}
|-
| 4.0.1
| [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4 GSM]]
| 15 July 2010
| 19 August 2010
| {{no|Closed}}
|-
| 4.0.2
| [[N82ap|iPhone 3G]], [[N72ap|iPod touch 2G]]
| 11 August 2010
| 18 September 2010
| {{no|Closed}}
|-
| 4.0.2
| [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4 GSM]], [[N18ap|iPod touch 3G]]
| 11 August 2010
| 9 September 2010
| {{no|Closed}}
|-
| 4.1
| [[N82ap|iPhone 3G]], [[N88ap|iPhone 3GS]], [[N72ap|iPod touch 2G]], [[N18ap|iPod touch 3G]]
| 8 September 2010
| -
| {{yes|Open}}
|-
| 4.1
| [[N90ap|iPhone 4 GSM]], [[N81ap|iPod touch 4G]]
| 8 September 2010
| 2 December 2010 (?)
| {{no|Closed}}
|-
| {{nowrap|4.1 (4.0)}}
| rowspan="2" | [[K66ap|Apple TV 2G]]
| 29 September 2010
| 2 December 2010 (?)
| {{no|Closed}}
|-
| {{nowrap|4.2 (4.1)}}
| 22 November 2010
| 14 December 2010
| {{no|Closed}}
|-
| 4.2.1
| [[K48ap|iPad]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4 GSM]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 22 November 2010
| 11 March 2011
| {{No|Closed}}
|-
| 4.2.1
| [[N82ap|iPhone 3G]], [[N72ap|iPod touch 2G]]
| 22 November 2010
| -
| {{yes|Open}}
|-
| {{nowrap|4.2.1 (4.1.1)}}
| [[K66ap|Apple TV 2G]]
| 14 December 2010
| 28 May 2011 (?)
| {{No|Closed}}
|-
| 4.2.5
| rowspan="6" | [[N92ap|iPhone 4 CDMA]]
| 11 January 2011
| closed before product release
| {{No|Closed}}
|-
| 4.2.6
| 1 February 2011
| 19 April 2011 (?)
| {{No|Closed}}
|-
| 4.2.7
| 14 April 2011
| 6 May 2011
| {{No|Closed}}
|-
| 4.2.8
| 4 May 2011
| 18 July 2011
| {{no|Closed}}
|-
| 4.2.9
| 15 July 2011
| 27 July 2011
| {{no|Closed}}
|-
| 4.2.10
| 25 July 2011
| 18 October 2011
| {{no|Closed}}
|-
| 4.3
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4 GSM]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 9 March 2011
| 27 March 2011 (?)
| {{No|Closed}}
|-
| {{nowrap|4.3 (4.2)}}
| rowspan="4" | [[K66ap|Apple TV 2G]]
| 9 March 2011
| 22 March 2011 (?)
| {{No|Closed}}
|-
| {{nowrap|4.3 (4.2.1)}}
| 22 March 2011
| 28 May 2011 (?)
| {{No|Closed}}
|-
| {{nowrap|4.3 (4.2.2)}}
| 11 May 2011
| 18 October 2011 (?)
| {{no|Closed}}
|-
| {{nowrap|4.3 (4.3)}}
| 1 August 2011
| ?
| {{no|Closed}}
|-
| 4.3.1
| rowspan="5" | [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4 GSM]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 25 March 2011
| 19 April 2011 (?)
| {{No|Closed}}
|-
| 4.3.2
| 14 April 2011
| 6 May 2011
| {{No|Closed}}
|-
| 4.3.3
| 4 May 2011
| 18 July 2011
| {{no|Closed}}
|-
| 4.3.4
| 15 July 2011
| 27 July 2011
| {{no|Closed}}
|-
| 4.3.5
| 25 July 2011
| 18 October 2011
| {{no|Closed}}
|-
| 4.4
| rowspan="5" | [[k66ap|Apple TV 2G]]
| 4 October 2011
| ?
| {{no|Closed}}
|-
| 4.4.1
| 17 October 2011
| ?
| {{no|Closed}}
|-
| 4.4.2
| 24 October 2011
| 11 January 2012(?)
| {{no|Closed}}
|-
| 4.4.3
| 17 November 2011
| 11 January 2012(?)
| {{no|Closed}}
|-
| 4.4.4
| 15 December 2011
| 8 March 2012
| {{no|Closed}}
|-
| 5.0
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[iPhone 4]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 4 October 2011
| 10 November 2011(?)
| {{no|Closed}}
|-
| 5.0
| [[N94ap|iPhone 4S]]
| 14 October 2011
| 10 November 2011(?)
| {{no|Closed}}
|-
| 5.0
| [[k66ap|Apple TV 2G]], [[j33ap|Apple TV 3]]
| 7 March 2012
| -
| {{yes|Open}}
|-
| 5.0.1
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[iPhone 4]], [[N94ap|iPhone 4S]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 9 November 2011
| 8 March 2012
| {{no|Closed}}
|-
| 5.1
| [[K48ap|iPad]], [[iPad 2]], [[iPad 3]], [[N88ap|iPhone 3GS]], [[iPhone 4]], [[N94ap|iPhone 4S]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 7 March 2012
| -
| {{yes|Open}}
|}

==Protocol==
To request a SHSH blob from Apple, a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] request can be made. For a full description, please see the separate article [[SHSH Protocol]] and [[Baseband SHSH Protocol]].

==Links and Tools==
* [[TinyUmbrella]] (Java needed)
* [http://www.saurik.com/id/12 Detailed background info from Saurik]

[[Category:Firmware Tags]]

Talk:UDID

2012-03-18T00:14:31Z

Rdqronos: Created page with "Isn't the serial 12 characters long? --~~~~"

Isn't the serial 12 characters long? --[[User:Rdqronos|rdqronos]] 18:14, 17 March 2012 (MDT)

NCK

2012-03-11T12:24:36Z

Rdqronos: I'm assuming the NCK Brute Force can still work on newer devices, Apple takes a view of "if it ain't broke don't fix it"

'''N'''etwork '''C'''ontrol '''K'''ey or '''NCK''' is a 15-digit key required to "legitimately" [[unlock]] an iPhone. The mechanism to unlock the phone with a valid NCK is still present and usable in [[X-Gold 608]] and presumably [[X-Gold 618|later]] basebands. It is, however, superseded by the policies set in the [[WildcardTicket]] that is generated during the activation process. An unlocked phone receives a wildcard ticket that has no restrictions set.

{{stub|jailbreaking}}

[[Category:Baseband]]

Talk:Alpine 1A420

2012-03-02T23:03:52Z

Rdqronos:

== Anybody have a ipsw? ==
Yeah, so does anyone have a ipsw for this unencrypted hopefully? I want to get the SkankPhone and AppleInternal stuff ;) --[[User:Dylan Laws|Dylan Laws]] 22:04, 1 March 2012 (MST)
:: I have the files from the root filesystem, but not the ipsw..
::There is no IPSW --pjakuszew 14:26, 2 March 2012 (MST)
::Then how does one use it? --[[User:Rdqronos|rdqronos]] 16:03, 2 March 2012 (MST)
== Disassembler Frameworks? ==

Has anyone noticed the ARMDisassembler, NDISASM and PPCDisasm PrivateFrameworks? --[[User:Oranav|Oranav]] 13:07, 21 July 2009 (UTC)

Yeah, at least the PPC Disasm is funny I think. Wouldn't use my iPhone for that --[[User:M2m|M2m]] 14:49, 21 July 2009 (UTC)

Those frameworks plus a lot of the other stuff here is put on the device if you have a dev membership, when the Developer Disk Image gets sent over [[User:ChronicDev|ChronicDev]] 00:16, 22 July 2009 (UTC)

== Revision Name? ==

btw, I think you should add the nickname to those revision SkankPhone or PurpleSkank. I think PurpleSkank is actually the name of something on the device, and SkankPhone the actual name, not 100% sure though. but the numbers + letters shit is kinda annoying and... bleh --[[User:Posixninja|posixninja]] 00:51, 22 July 2009 (UTC)

I'm not sure if it has an official Name like Kirkwood, Timberline, etc. I wonder if the name is somewhere "hidden" in the bunch of files.
SkankPhone is an App on the device. But if there's no objection we could name it "PurpleSkank 1A420" until the official name is found...--[[User:M2m|M2m]] 02:38, 22 July 2009 (UTC)

PurpleSkank 1A420 sounds great to me! --[[User:Posixninja|posixninja]] 04:03, 22 July 2009 (UTC)

Actually the file /private/var/db/dyld/update-prebinding-paths.txt begins with # Alpine1A420. So could this release be called Alpine ? In current firmwares the root pw is alpine, but it used to be dottie afaik. --[[User:M2m|M2m]] 11:13, 22 July 2009 (UTC)

weird, never seen that. honestly I still like PurpleSkank more. --[[User:Posixninja|posixninja]] 17:29, 22 July 2009 (UTC)

I checked /private/var/db/dyld/update-prebinding-paths.txt of FW 1.1.4 - begins with ''# LittleBear4A102''. I checked 1.0.1 and it begins with ''# SUHeavenlyJuly1C25''. So I think the official name of this FW is ''Alpine 1A420''. --[[User:M2m|M2m]] 12:59, 23 July 2009 (UTC)

The password to the root account is and has always been alpine, and the password to the mobile account is and has always been dottie (there was a mobile account even before Apple began running apps under it) [[User:AriX|AriX]] 15:33, 24 July 2009 (UTC)

Thanks for the clarification --[[User:M2m|M2m]] 04:32, 25 July 2009 (UTC)

== Boot the Kernel? ==

None of the kernel or kernelcache files is 8900 packed/encrypted. So the kernel refuses to boot on my 2G iPhone. Any Ideas ? --[[User:M2m|M2m]] 13:11, 23 July 2009 (UTC)

does the iboot from it even require it to be packed/encrypted? I wasn't around in the 8900 days, but I'm pretty sure the framework is still there in xpwn to pack 8900 files if you want to hack something together. --[[User:Posixninja|posixninja]] 14:27, 23 July 2009 (UTC)

I don't have the iboot from the Prototype. At least not as an iboot file. Maybe it could be extracted from the NOR Dump.. who know. Will have a look at xpwn. Maybe I can find a 8900 packer/encryptor there --[[User:M2m|M2m]] 02:59, 24 July 2009 (UTC)

M2m, If you still need help dumping anything or figuring stuff out. geohot@gmail I'll be around at 5:30 EST tonight --[[User:Geohot|geohot]] 14:07, 24 July 2009 (UTC)

I have not even tried to go as far as booting the kernel, because 1.1.4 is mostly compatible with SkankPhone and stuff... I've copied over a lot of the stuff from the prototype FW and it works pretty well. At some point maybe I'll get my act together and see if I can flash the NOR and stuff, but SkankPhone is cool enough for me :p (Mine is currently set up as a dual boot system where one partition is the 1.1.4/Prototype fw, and the other partition is a plain 1.1.4 partition... I wonder if I could set it up to dual boot 3.0 instead? It wouldn't really work with iTunes easily.) [[User:AriX|AriX]] 15:36, 24 July 2009 (UTC)

Geohot, everything is already dumped. I think I talked to you about this firmware last March [[User:ChronicDev|ChronicDev]] 23:55, 24 July 2009 (UTC)

Pwned

2012-02-07T11:00:31Z

Rdqronos: general punching up

An "Already Pwned" device is a device which has already been flashed with a patched [[LLB]] and [[iBoot]], and therefore doesn't sign check the code uploaded and can have custom firmwares restored from [[Recovery Mode]]. The exploits which can pwn devices are [[Pwnage]] and [[0x24000 Segment Overflow]]

==Software support==
Some jailbreak softwares support speacil jailbreak mode for "Already Pwned" Devices:
*[[Redsn0w]] (0.7-0.9.5)]
*[[Pwnagetool]]
*[[Sn0wbreeze]]

Pwned

2012-02-07T10:58:10Z

Rdqronos:

An '''Already Pwned''' device is a device which has already been flashed with a patched [[LLB]] and [[iBoot]] therefore doesn't sign check the code uploaded and can have custom firmwares restored form [[Recovery Mode]]. The exploits which can pwn devices are [[Pwnage]] and [[0x24000 Segment Overflow]]

==Software support==
Some jailbreak softwares support speacil jailbreak mode for "Already Pwned" Devices:
*Redsn0w (0.7-0.9.5)]
*Pwnagetool
* [[Sn0wbreeze]]

Sandbox

2012-01-31T03:01:49Z

Rdqronos:

Apple's software based [[Wikipedia:Mandatory access control|mandatory access control]] that was introduced in [[iOS]] 2.0. It is a higher level layer on top of the XNU implementation of the TrustedBSD MAC framework.

== Problems ==
*In addition to the new set of frameworks in 2.0, applications had to be tweaked to use the new sandbox.
*For applications to run, they need to have a folder called [[_Codesign]] with a file inside called [[CodeResources]]
*If a [[userland]] exploit was discovered in an [[App Store]] app, the [[CodeResources]] would become invalid when a file was injected.
*The checks are not as hard on built in applications in the [[firmware]] [http://pastebin.com/6C55pTxf] (only version.plist is checked to prevent a [[soft upgrade]] )

== Exploits ==
The dependency on the [[CodeResources]] file makes it vulnerable to the [[Incomplete Codesign Exploit]]

== More Info ==
http://iphonedevwiki.net/index.php/Seatbelt

Protoypes

2012-01-27T02:36:46Z

Rdqronos:

Many '''prototype''' devices have leaked from Apple. Some of them are listed below:

== iPhone Prototypes ==
=== MacRumors iPhone 2G ===
Jan 03, 2009:

iPhone 2G prototypes first reported by a user on the [http://forums.macrumors.com/showthread.php?t=627449 macrumors] forums.

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Serial Number
| YM650xxxxxx, YM649xxxxxx
|
|-
! Modem Firmware
| [[03.06.01_G]]
| The firmware dump comes (in [[:/usr/local/standalone/firmware/]]) with [[03.06.00_G]]
|-
|}
{{clear}}

=== Gizmodo iPhone 4 ===
Apr 19, 2010:

iPhone4 prototype first reported by [http://gizmodo.com/5520164/this-is-apples-next-iphone Gizmodo]. Brian Hogan, a 21-year-old student at the time, admitted to finding the phone at the Gourmet Haus Staudt in Redwood City, California, after it was left behind by an Apple engineer named Gray Powell, and later selling it to Gizmodo [http://www.wired.com/threatlevel/2011/10/brian-hogan-sentenced/].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model (back)
| XXXXX
|
|-
! FCC ID
| BCGAXXXXX
|
|-
! IC ID
| 579C-AXXXXX
|
|-
|}
{{clear}}

=== 64GB iPhone 4 ===
[[File:64GB_iPhone4_01.jpg|thumb|64Gb iPhone4 prototype]]

Mar 8, 2011:

An iPhone 4 (GSM) prototype first reported by [http://micgadget.com/11604/exclusive-64gb-iphone-4-hands-on-video/ micgadget.com]. Further details on [http://techmento.com/2011/03/10/iphone-prototype-64gb-memory-leaked/ techmento.com].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model No. (back)
| XXXXX
| Same as the one from Gizmodo.
|-
! FCC ID
| BCGAXXXXX
| Same as the one from Gizmodo.
|-
! IC ID
| 579C-AXXXXX
| Same as the one from Gizmodo.
|-
! Capacity
| 59.1
| A 64GB iPhone 4 was never released.
|-
! Version
| [[Baker_8B117_(iPhone_4)|4.1 (8B117)]]
| The released iOS version comes with different Modem Firmware.
|-
! [[Carrier_bundle|Carrier]]
| SMC-Voda 8.0
|
|-
! [[Models|Model]] (in Settings)
| 995-6049LL
| Different to official numbering scheme of [[Models]].
|-
! Serial Number
| 8800902DEX3
|
|-
! Wi-Fi Address
| 00:25:00:FC:F6:9D
| 00-25-00 is a prefix registered to Apple at [http://standards.ieee.org/develop/regauth/oui/oui.txt IEEE].
|-
! Bluetooth
| 00:25:00:FC:F6:9C
|
|-
! IMEI
| 00 107200 281664 1
|
|-
! [[ICCID]]
|
| Empty ICCID is unusual
|-
! Modem Firmware
| [[01.59.00|01.59]]
| Based on the fact that prototype has the Modem Firmware for the XMM 6180 installed this defenitly is an 64GB iPhone 4 (GSM). However the iOS Version this device has installed (4.1) came oficially with Modem Firmware 02.10.04.
|-
|}
{{clear}}

=== White Vietnamese iPhone 4 ===
Apr 19, 2011:

First reported by [http://www.tinhte.vn/tin-tuc-gioi-thieu-118/tren-tay-giao-dien-da-nhiem-moi-tren-iphone-5-a-663854/ tinhte.vn] and further discussed on [http://www.macstories.net/news/vietnamese-videos-show-old-ios-4-build-with-several-unreleased-features/ macstories.net].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Capacity
| 58.2GB
| The released iPhone 4 has a lower available capacity due to iOS taking up more space.
|-
! Version
| 4.0 (8A216)
| Never officially released.
|-
|}
{{clear}}

=== US T-Mobile iPhone 4S ===
Apr 23, 2011:

This first was reported by [http://www.bgr.com/2011/04/23/exclusive-apple-testing-iphone-4-for-t-mobile-usa/ BGR].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Internal Model No.
| N94
| Based on the N94 Sticker on the back this is an iPhone 4S, whose internal number is [[N94ap]].
|-
|}
{{clear}}

=== TD-SCDMA iPhone 4 ===

[[File:CM TDSCDMA iphone01.jpg|thumb|China Mobile TD-SCDMA Prototype.]]

Jul 07, 2011:

iPhone 4 prototype first mentioned by [http://news.mydrivers.com/1/198/198552.htm mydrivers.com] (in chinese).

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! [[Carrier_bundle|Carrier]]
| 中国移动 13.0
| China Mobile 13.0. Officially there is only 中国移动 11.0 (China Mobile 11.0) available.
|-
! [[Models|Model]] (in Settings)
| MC'''6?0?'''3CM
| Probably MC603 - black 16GB iPhone 4 would match, but CM is not officially designated [[Model Regions|Model Region]] code.
|-
! Serial Number
| 5K0????????
|
|-
! Wi-Fi Address
| 5C:49:48:??:??:?2
| 5C-49-48 is not a registered prefix at [http://standards.ieee.org/develop/regauth/oui/oui.txt IEEE].
|-
! Bluetooth
| 5C:49:48:??:??:?1
|
|-
! IMEI
| 00 000000 000000 0
| IMEI can't usually be 0.
|-
! [[ICCID]]
| 89'''8?6?''' '''0?0?'''10 8110 0136 3637
|
|-
! Modem Firmware
| [[06.10.01]]
|
|-
|}
{{clear}}

=== Early iPhone 4 ===
[[File:IDevice proto01.png|thumb|Prototype Device Image in iTunes]]

Jul 17, 2011:

Prototype Device reported by [http://micgadget.com/13792/iphone-4s-prototype-leaked/ micgadget.com] which notably shows a different image when plugged into iTunes.

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Capacity
| 28.60
|
|-
! Software Version
| 4.0
|
|-
! Serial Number
| 8894805????
|
|-
|}
{{clear}}

=== White iPhone 4 DF3184 ===
Aug 22, 2011:

A white iPhone 4 prototype first reported by [http://www.flickr.com/photos/mars478/sets/72157627368941519/ Mathias Rios]. The iPhone has a DF3184 printing at the lower front right side. Mathias Rios purchased it from ebay where it was listed as broken. Compared to an original iPhone4 (black) this prototype has a smaller back camera and the flash is also slightly further away [http://www.flickr.com/photos/mars478/6069524165/in/set-72157627368941519/lightbox/]. In addition this protoype restore mode screen (Conncect to iTunes Screen) shows an old (iTunes9 - blue Note on CD) and pixalated iTunes icon [http://www.flickr.com/photos/mars478/6069517083/in/set-72157627368941519/lightbox/]. This prototype come with a sticker on the A4 denoting it as Design Verification Test Prototype (N90_DVT_I_0010). Appearently the A4 is marked differently than the actual A4 chip in shipping iPhone, and has the same marking as earlier iPod Touches and iPhones (the "K4X2G643GE" marking).

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model (back)
| XXXXX
| Same as the one from Gizmodo.
|-
! FCC ID
| BCGAXXXXX
| Same as the one from Gizmodo.
|-
! IC ID
| 579C-AXXXXX
| Same as the one from Gizmodo.
|-
|}
{{clear}}

=== San Francisco bar iPhone ===
Aug 31, 2011:

Probably an iPhone 4S prototype lost in a San Francisco bar first reported by [http://news.cnet.com/8301-13579_3-20099899-37/apple-loses-another-unreleased-iphone-exclusive/ CNET].
{{clear}}

=== Brazilian 8GB iPhone 4 ===
[[File:Brazil_8GB_iPhone4_01.jpg|thumb|Brazil 8GB iPhone4]]

Nov 24, 2011:

An 8GB iPhone 4 prototype produced in Brazil. First reported by [http://macmagazine.com.br/2011/11/24/leitor-afirma-ter-posto-as-maos-num-iphone-4-de-8gb-brasileiro-e-manda-fotos-para-comprovar/ macmagazine.com.br]. The iPhone also carries a Made in Bazil (Industria Brasilleira?) and an [http://www.anatel.gov.br/Portal/exibirPortalInternet.do Anatel] - which is the Brazilian Telecom regulation body - marking with number 1465-10-1993 at its back.

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model (back)
| A1332
|
|-
! EMC (back)
| 380A
| EMC marking hasn't been seen before
|-
! FCC ID
| BCG-E2380A
|
|-
! Capacity
| 6.4GB
|
|-
! Version
| 5.0 (9A334)
|
|-
! Carrier
| Claro Brazil 11.0
|
|-
! [[Models|Model]] (in Settings)
| MD198BR
|
|-
|}
{{clear}}

== iPod touch Prototypes ==
=== iPod touch 3rd Gen Prototype ===
[[File:IPod3G N18-PreEVTb.jpg|thumb|iPod touch 3G prototype]]

Jan 24, 2012:

The iPod touch 3rd generation prototype was first reported by [[iOS]] Hacker {{twitter|SonnyDickson|Sonny Dickson}}. The iPod is running [[SwitchBoard.app]] and [[Inferno 7C1023e]].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model No.
| MC008
|
|-
! FCC ID
| BCGA1XX
|
|-
! Capacity
| 32GB
|
|-
! Version
| 3.1
|
|-
! Serial Number
| 8K91300XXXX
|
|-
! Wi-Fi Address
| 00:24:36:f2:87:b9
| 00-24-36 is a prefix registered to Apple at [http://standards.ieee.org/develop/regauth/oui/oui.txt IEEE].
|-
! Bluetooth
| 00:00:00:00:00:00
|
|-
! iBoot
| iBoot-583.4
|
|-
|}
{{clear}}

Protoypes

2012-01-27T02:34:54Z

Rdqronos: spaces in-between iPhone and #, punch ups.

Many '''prototype''' devices have leaked from Apple. Some of them are listed below:

== iPhone Prototypes ==
=== MacRumors iPhone 2G ===
Jan 03, 2009:

iPhone 2G prototypes first reported by a user on the [http://forums.macrumors.com/showthread.php?t=627449 macrumors] forums.

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Serial Number
| YM650xxxxxx, YM649xxxxxx
|
|-
! Modem Firmware
| [[03.06.01_G]]
| The firmware dump comes (in [[:/usr/local/standalone/firmware/]]) with [[03.06.00_G]]
|-
|}
{{clear}}

=== Gizmodo iPhone 4 ===
Apr 19, 2010:

iPhone4 prototype first reported by [http://gizmodo.com/5520164/this-is-apples-next-iphone Gizmodo]. Brian Hogan, a 21-year-old student at the time, admitted to finding the phone at the Gourmet Haus Staudt in Redwood City, California, after it was left behind by an Apple engineer named Gray Powell, and later selling it to Gizmodo [http://www.wired.com/threatlevel/2011/10/brian-hogan-sentenced/].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model (back)
| XXXXX
|
|-
! FCC ID
| BCGAXXXXX
|
|-
! IC ID
| 579C-AXXXXX
|
|-
|}
{{clear}}

=== 64GB iPhone 4 ===
[[File:64GB_iPhone4_01.jpg|thumb|64Gb iPhone4 prototype]]

Mar 8, 2011:

A iPhone4 (GSM) prototype first reported by [http://micgadget.com/11604/exclusive-64gb-iphone-4-hands-on-video/ micgadget.com]. Further details on [http://techmento.com/2011/03/10/iphone-prototype-64gb-memory-leaked/ techmento.com].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model No. (back)
| XXXXX
| Same as the one from Gizmodo.
|-
! FCC ID
| BCGAXXXXX
| Same as the one from Gizmodo.
|-
! IC ID
| 579C-AXXXXX
| Same as the one from Gizmodo.
|-
! Capacity
| 59.1
| A 64GB iPhone4 was never released.
|-
! Version
| [[Baker_8B117_(iPhone_4)|4.1 (8B117)]]
| The released iOS version comes with different Modem Firmware.
|-
! [[Carrier_bundle|Carrier]]
| SMC-Voda 8.0
|
|-
! [[Models|Model]] (in Settings)
| 995-6049LL
| Different to official numbering scheme of [[Models]].
|-
! Serial Number
| 8800902DEX3
|
|-
! Wi-Fi Address
| 00:25:00:FC:F6:9D
| 00-25-00 is a prefix registered to Apple at [http://standards.ieee.org/develop/regauth/oui/oui.txt IEEE].
|-
! Bluetooth
| 00:25:00:FC:F6:9C
|
|-
! IMEI
| 00 107200 281664 1
|
|-
! [[ICCID]]
|
| Empty ICCID is unusual
|-
! Modem Firmware
| [[01.59.00|01.59]]
| Based on the fact that prototype has the Modem Firmware for the XMM 6180 installed this defenitly is an 64GB iPhone4 (GSM). However the iOS Version this device has installed (4.1) came oficially with Modem Firmware 02.10.04.
|-
|}
{{clear}}

=== White Vietnamese iPhone 4 ===
Apr 19, 2011:

First reported by [http://www.tinhte.vn/tin-tuc-gioi-thieu-118/tren-tay-giao-dien-da-nhiem-moi-tren-iphone-5-a-663854/ tinhte.vn] and further discussed on [http://www.macstories.net/news/vietnamese-videos-show-old-ios-4-build-with-several-unreleased-features/ macstories.net].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Capacity
| 58.2GB
| The released iPhone 4 has a lower available capacity due to iOS taking up more space.
|-
! Version
| 4.0 (8A216)
| Never officially released.
|-
|}
{{clear}}

=== US T-Mobile iPhone 4S ===
Apr 23, 2011:

This first was reported by [http://www.bgr.com/2011/04/23/exclusive-apple-testing-iphone-4-for-t-mobile-usa/ BGR].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Internal Model No.
| N94
| Based on the N94 Sticker on the back this is an iPhone 4S, whose internal number is [[N94ap]].
|-
|}
{{clear}}

=== TD-SCDMA iPhone 4 ===

[[File:CM TDSCDMA iphone01.jpg|thumb|China Mobile TD-SCDMA Prototype.]]

Jul 07, 2011:

iPhone 4 prototype first mentioned by [http://news.mydrivers.com/1/198/198552.htm mydrivers.com] (in chinese).

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! [[Carrier_bundle|Carrier]]
| 中国移动 13.0
| China Mobile 13.0. Officially there is only 中国移动 11.0 (China Mobile 11.0) available.
|-
! [[Models|Model]] (in Settings)
| MC'''6?0?'''3CM
| Probably MC603 - black 16GB iPhone 4 would match, but CM is not officially designated [[Model Regions|Model Region]] code.
|-
! Serial Number
| 5K0????????
|
|-
! Wi-Fi Address
| 5C:49:48:??:??:?2
| 5C-49-48 is not a registered prefix at [http://standards.ieee.org/develop/regauth/oui/oui.txt IEEE].
|-
! Bluetooth
| 5C:49:48:??:??:?1
|
|-
! IMEI
| 00 000000 000000 0
| IMEI can't usually be 0.
|-
! [[ICCID]]
| 89'''8?6?''' '''0?0?'''10 8110 0136 3637
|
|-
! Modem Firmware
| [[06.10.01]]
|
|-
|}
{{clear}}

=== Early iPhone 4 ===
[[File:IDevice proto01.png|thumb|Prototype Device Image in iTunes]]

Jul 17, 2011:

Prototype Device reported by [http://micgadget.com/13792/iphone-4s-prototype-leaked/ micgadget.com] which notably shows a different image when plugged into iTunes.

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Capacity
| 28.60
|
|-
! Software Version
| 4.0
|
|-
! Serial Number
| 8894805????
|
|-
|}
{{clear}}

=== White iPhone 4 DF3184 ===
Aug 22, 2011:

A white iPhone 4 prototype first reported by [http://www.flickr.com/photos/mars478/sets/72157627368941519/ Mathias Rios]. The iPhone has a DF3184 printing at the lower front right side. Mathias Rios purchased it from ebay where it was listed as broken. Compared to an original iPhone4 (black) this prototype has a smaller back camera and the flash is also slightly further away [http://www.flickr.com/photos/mars478/6069524165/in/set-72157627368941519/lightbox/]. In addition this protoype restore mode screen (Conncect to iTunes Screen) shows an old (iTunes9 - blue Note on CD) and pixalated iTunes icon [http://www.flickr.com/photos/mars478/6069517083/in/set-72157627368941519/lightbox/]. This prototype come with a sticker on the A4 denoting it as Design Verification Test Prototype (N90_DVT_I_0010). Appearently the A4 is marked differently than the actual A4 chip in shipping iPhone, and has the same marking as earlier iPod Touches and iPhones (the "K4X2G643GE" marking).

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model (back)
| XXXXX
| Same as the one from Gizmodo.
|-
! FCC ID
| BCGAXXXXX
| Same as the one from Gizmodo.
|-
! IC ID
| 579C-AXXXXX
| Same as the one from Gizmodo.
|-
|}
{{clear}}

=== San Francisco bar iPhone ===
Aug 31, 2011:

Probably an iPhone 4S prototype lost in a San Francisco bar first reported by [http://news.cnet.com/8301-13579_3-20099899-37/apple-loses-another-unreleased-iphone-exclusive/ CNET].
{{clear}}

=== Brazilian 8GB iPhone 4 ===
[[File:Brazil_8GB_iPhone4_01.jpg|thumb|Brazil 8GB iPhone4]]

Nov 24, 2011:

An 8GB iPhone 4 prototype produced in Brazil. First reported by [http://macmagazine.com.br/2011/11/24/leitor-afirma-ter-posto-as-maos-num-iphone-4-de-8gb-brasileiro-e-manda-fotos-para-comprovar/ macmagazine.com.br]. The iPhone also carries a Made in Bazil (Industria Brasilleira?) and an [http://www.anatel.gov.br/Portal/exibirPortalInternet.do Anatel] - which is the Brazilian Telecom regulation body - marking with number 1465-10-1993 at its back.

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model (back)
| A1332
|
|-
! EMC (back)
| 380A
| EMC marking hasn't been seen before
|-
! FCC ID
| BCG-E2380A
|
|-
! Capacity
| 6.4GB
|
|-
! Version
| 5.0 (9A334)
|
|-
! Carrier
| Claro Brazil 11.0
|
|-
! [[Models|Model]] (in Settings)
| MD198BR
|
|-
|}
{{clear}}

== iPod touch Prototypes ==
=== iPod touch 3rd Gen Prototype ===
[[File:IPod3G N18-PreEVTb.jpg|thumb|iPod touch 3G prototype]]

Jan 24, 2012:

The iPod touch 3rd generation prototype was first reported by [[iOS]] Hacker {{twitter|SonnyDickson|Sonny Dickson}}. The iPod is running [[SwitchBoard.app]] and [[Inferno 7C1023e]].

{| class="wikitable" style="font-size:smaller;border-collapse:collapse;"
! style="background-color:#E9E9E9;text-align:center;width:100px;" |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Prototype
! style="background-color:#E9E9E9;text-align:center;" | Comment
|-
! Model No.
| MC008
|
|-
! FCC ID
| BCGA1XX
|
|-
! Capacity
| 32GB
|
|-
! Version
| 3.1
|
|-
! Serial Number
| 8K91300XXXX
|
|-
! Wi-Fi Address
| 00:24:36:f2:87:b9
| 00-24-36 is a prefix registered to Apple at [http://standards.ieee.org/develop/regauth/oui/oui.txt IEEE].
|-
! Bluetooth
| 00:00:00:00:00:00
|
|-
! iBoot
| iBoot-583.4
|
|-
|}
{{clear}}

Talk:IPhone Tracker

2012-01-25T02:29:17Z

Rdqronos:

Anymore information? --[[User:Dylan Laws|Dylan Laws]] 19:17, 24 January 2012 (MST)
:Is more info necessary? --[[User:Rdqronos|rdqronos]] 19:29, 24 January 2012 (MST)

05.16.05

2012-01-24T20:28:39Z

Rdqronos:

The [[X-Gold 608]] ([[n88ap|iPhone 3GS]] only) for iOS 5.0b6 through 5.1b3. There is no public unlock for it (It has the [[AT+XAPP vulnerability]], [[AT+XEMN vulnerability]], [[AT+FNS]] and the [[AT+XLOG vulnerability]] patched) but can be overwritten with [[06.15.00]] for unlock with [[ultrasn0w]]. This baseband is compatible with iPhone 3G, but has never been available for it because 4.2.1 is the final firmware supported on [[n82ap|iPhone 3G]]. This is very likely the final baseband update on the [[n88ap|iPhone 3GS]].

ICloud

2012-01-24T01:20:08Z

Rdqronos:

iCloud is a service that was launched together with iOS 5. It is the successor to [[MobileMe]]. Allows for wireless backups of iDevices, and does a much better job at keeping contacts, calendars, and other things synced between devices. It also allows for purchases made on one device (such as an iPad) to show up on the users iTunes, iPhone, and iPod Touch, without performing any extra steps.
===Limitations===
Free storage space is limited to only 5GB. While not everything counts (bought applications and songs for example) on a 64GB device full of photos and application data, this limit is reached quickly.

Also music cannot be stored in the cloud (but there are other services, like iTunes Match).

And for applications that you bought, but have been removed from the App Store (like [[wikipedia:VLC_media_player|VLC]]), these applications just disappear when you restore, so you still need a computer based backup.

ICloud

2012-01-23T14:17:45Z

Rdqronos:

Talk:Recovery Mode (Protocols)

2012-01-21T22:38:06Z

Rdqronos:

I got iRecovery to connect to DFU, as the output said that it connected, but iRecovery also spit out "error claiming interface." any way to that? --[[User:Rdqronos|rdqronos]] 14:31, 20 January 2012 (MST)

Are you trying to start a shell in DFU mode? This is impossible until you send an iBSS/iBEC/iBoot payload to the device... --pjakuszew 04:59, 21 January 2012 (MST)

Yup, I am. So, where would one get one of these fabled payloads? --[[User:Rdqronos|rdqronos]] 08:34, 21 January 2012 (MST)
:Get a pwn'd iBSS, upload it, then jump to it. --Squiffypwn 10:21, 21 January 2012 (CST)
:So I'm guessing it wouldn't work on the 4S, seeing as a pwn'd anything above userland requires a bootrom exploit. --[[User:Rdqronos|rdqronos]] 12:21, 21 January 2012 (MST)

:These files are in every IPSW file, in Firmware/dfu/ folder, if you need them. Apple stopped including advanced commands in RELEASE-type iBoots since iOS 4.0, so these files aren't very useful now. --pjakuszew 13:29, 21 January 2012 (MST)
:in iboot, but what about DFU mode? Or are they the exact same thing in terms of commands? --[[User:Rdqronos|rdqronos]] 15:38, 21 January 2012 (MST)

Talk:Recovery Mode (Protocols)

2012-01-21T19:21:45Z

Rdqronos:

Talk:Recovery Mode (Protocols)

2012-01-21T15:34:00Z

Rdqronos:

Talk:Recovery Mode (Protocols)

2012-01-20T21:31:09Z

Rdqronos: change question

Talk:Recovery Mode (Protocols)

2012-01-20T21:27:44Z

Rdqronos: Created page with "So connecting to recovery mode is easy to do with iRecovery, how does one connect to (and talk to) DFU Mode? --~~~~"

So connecting to recovery mode is easy to do with iRecovery, how does one connect to (and talk to) DFU Mode? --[[User:Rdqronos|rdqronos]] 14:27, 20 January 2012 (MST)

Talk:Plutil

2012-01-17T16:45:43Z

Rdqronos:

Download link? --[[User:Rdqronos|rdqronos]] 17:13, 16 January 2012 (MST)
:It is found in <code>C:\Program Files[ (x86)]\Common Files\Apple\Apple Application Support</code> --[[User:5urd|5urd]] 17:25, 16 January 2012 (MST)
::Mac? --[[User:Rdqronos|rdqronos]] 17:46, 16 January 2012 (MST)
:::Maybe inside the iTunes executable or under /Library --[[User:5urd|5urd]] 17:53, 16 January 2012 (MST)
:::<code>/usr/bin/plutil</code> --[[User:Dialexio|Dialexio]] 18:33, 16 January 2012 (MST)
::Thanks Dialexio --[[User:Rdqronos|rdqronos]] 09:45, 17 January 2012 (MST)

Talk:Plutil

2012-01-17T00:46:06Z

Rdqronos:

Talk:Plutil

2012-01-17T00:13:45Z

Rdqronos: Created page with "Download link? --~~~~"

Download link? --[[User:Rdqronos|rdqronos]] 17:13, 16 January 2012 (MST)

X-Gold 608 Unlock

2012-01-10T23:17:06Z

Rdqronos:

The 3G software [[unlock]] proved more difficult than the previous unlocks due to the fact that the [[Baseband Bootloader|baseband bootloader]] is signature checked by the bootrom. The [[iPhone Dev Team]] has successfully unlocked baseband firmwares by overriding carrier locks on-the-fly in RAM, therefore at boot the baseband bootrom can validate the bootloader, and the bootloader can validate the baseband.

==RAM Unlock History==
On December 21, 2008, [[User:MuscleNerd|MuscleNerd]] demonstrated [[yellowsn0w]], the first unlock.[http://qik.com/video/729275] Originally, yellowsn0w was designed for basebands [[2.04.03]] and earlier, until [[User:Geohot|geohot]] shared the [[AT+stkprof Exploit]] with them. On January 27, 2009, Apple released iOS 2.2.1, which contained baseband [[2.30.03]] and patched said exploit.

[[User:Oranav|Oranav]] discovered another exploit (the [[AT+XLOG Vulnerability]]), and shared it with the iPhone Dev Team for the next unlock. The iPhone Dev Team kept it under wraps to target firmware 3.0 and the [[N88ap|iPhone 3GS]]. The unlock, codenamed [[ultrasn0w]], was released to the public on 23 June 2009 for baseband [[4.26.08]] only. [http://blog.iphone-dev.org/post/128573459]

iOS 3.1 contained a baseband [[5.11.07]], which patched the [[AT+XLOG Vulnerability]]. The [[AT+XEMN Heap Overflow]] was exploited in a new unlock named [[blacksn0w]], released by [[User:Geohot|geohot]] on 3 November 2009. A few months later, the vulnerability was patched in baseband [[5.12.01]].

When iOS 4.0 was publicly released, an updated release of [[ultrasn0w]] was released, using the [[AT+XAPP Vulnerability]] to unlock all basebands found in firmwares 3.0 through 4.0. Apple countered this with [[5.14.02|a baseband update]] in iOS 4.1.

==Possible Methods==
===Class 1===
* Find an exploit in the [[Baseband Bootrom|bootrom]] to break the chain of trust. The [[iPhone Dev Team|Dev-Team]] successfully dumped the [[Baseband Bootrom|bootrom]], but they won't release it as it's copyrighted code.
* Improve by several orders of magnitude the [[NCK Brute Force|NCK brute forcer]], and find a way to extract the [[CHIPID]] and [[NORID]]
* Find the theorized algorithm of [[NCK]] generation
* Factorize the [[Baseband_RSA_Keys|RSA keys]] used for signing
* Find a [[wikipedia:Preimage_attack|second preimage]] for a signature

===Class 2===
* Use a [[SIM hacks|SIM hack]] such as the [[Unlock iPhone 3G with TurboSim|TurboSIM Unlock]]
* Find a way to patch running memory to "unlock" the phone on every bootup. This is how [[ultrasn0w]] works.
* Find an exploit in the [[Baseband Bootloader]] so you can downgrade the baseband, then use ultrasn0w. [[User:Geohot|Geohot]] and the [[iPhone Dev Team]] found (independently) an exploit in bootloader 5.8, but it isn't useful enough as only very-early (week<30) iPhone 3G units have bootloader 5.8.

==Resources==
* Read about the [[X-Gold 608]]
* Read geohot's <s>[http://iphonejtag.blogspot.com/2008/07/infineon-we-have-problem.html blog post]</s> Currently hidden, only viewable by invite only.
* Read dogbert's [http://dogber1.blogspot.com/2010/06/how-to-protect-better-apple-iphone.html blog post]
* [[25C3 presentation "Hacking the iPhone"]]

[[Category:Baseband]]