The iPhone Wiki - User contributions [en]

Talk:SHSH

2011-05-26T03:27:28Z

Revolution:

== iDevices affected ==

Just to make sure (I don't have these devices): The [[N82ap|iPhone 3G]] (even the newer MC model) and the [[N72ap|iPod Touch 2nd generation]] (also newer models) don't have shsh checks. (I'm not talking about the new "soft" check.) Can someone confirm this? I always thought these mentioned newer devices also have this certificate check in the [[Bootrom]] built-in. But as someone removed my listed 3G (with a question mark), I assume no [[N82ap|3G]] has this check. What is actually the difference between the old and the new [[Bootrom]] then? Maybe someone can explain how this certificate check works exactly and which software part is doing it. Thanks. -- [[User:Http|http]] 11:25, 20 July 2010 (UTC)
:There's definitely no SHSH checking in the [[N82ap|iPhone 3G]] bootrom. If I'm not mistaken, its bootrom can't even read IMG3 files.

:I'm pretty sure the iPod touch 2G bootrom ''does'' check SHSHs, but only the one supplied in the IPSW; its restore process doesn't require getting a new SHSH from Apple's server. --[[User:Dialexio|Dialexio]] 20:08, 20 July 2010 (UTC)

== Firmware 3.1(.1) ==

What's the difference between 3.1 and 3.1.1? Were both released at the same time? Or is 3.1 just a "short form" for 3.1.1? If yes, we should always write the full name. -- [[User:Http|http]] 21:58, 20 July 2010 (UTC)
:3.1 was released for iPhones, while 3.1.1 was released for iPod touches. Other than that (and the build numbers), they're basically the same thing. --[[User:Dialexio|Dialexio]] 23:25, 20 July 2010 (UTC)

== Apple still signing 4.0.1 -- conspiracy? ==

It seems very un-apple for them to continue signing this firmware. Does anyone have any technical reasons/guesses as to why they are doing this?

I think it's sort of a truce -- in fear of yet another security problem being exploited and requiring a 4.0.3, and possibly de-incentivize the search for exploits. Possibly even more far fetched is an experiment to see if there is a boost in sales of people trying to get jailbreakable devices. Anyone have ideas? [[User:Iemit737|Iemit737]] 17:50, 15 August 2010 (UTC)

:My guess is that because many users upgrade without thinking or saving shsh try to jailbreak at some point in time. Because very many users did a jailbreak by this simple page, Apple would create lots of unsatisfied users. After Antennagate having more unsatisfied users, or those returning their device just to try again wouldn't be good for Apple. Also, I think 4.1 will be released soon (less than a month probably), so they can close signing then. -- [[User:Http|http]] 18:56, 15 August 2010 (UTC)

Good point -- lots of first time jail breakers and possible device returns and otherwise angry people. It still seems very unorthodox for them, being the evil iEmpire and all. I can't wait to see what exploits will be uncovered in 4.1. [[User:Iemit737|Iemit737]] 20:43, 15 August 2010 (UTC)

:It seems like Apple continues signing for the previously-issued firmware if the update is of a hotfix nature. (Remember that 3.0.1 was a hotfix for an SMS character vulnerability, and Apple continued signing for both 3.0 and 3.0.1 until 3.1 came along.) The only reason I can think of is they probably rushed the fix out of the door without testing thoroughly, so perhaps their attitude is "we tested this but not rigorously, so feel free to downgrade if it botches something up?" --[[User:Dialexio|Dialexio]] 21:13, 15 August 2010 (UTC)

==4.1 - Apple signing now?==
I believe they are signing the 4.1 GM seed and it does not have expirations or UDID restrictions, and works with windows iTunes, no? Which means if the final ipsw is the same, they will have been signing it since September 1. Albeit the GM is still considered apple confidential... But at the same time they are surely signing some kind of 4.1 for foxconn to put on touch 4G's... [[User:Iemit737|Iemit737]] 19:39, 4 September 2010 (UTC)

:Yes, they are probably signing 4.1 already, but we cannot confirm that, as we don't have any ipt4 yet and d/l of 4.1 is not possible for any other device yet. That's why I've put the product release date as start date. Regarding GM and final: even if the code is the same, it's probably a different ipsw and therefore a different shsh required. I don't know how beta signing works in detail. -- [[User:Http|http]] 22:06, 4 September 2010 (UTC)

::They're signing 4.1 GM. Just make sure to backup your SHSHs. --[[User:desertsn0w|desertsn0w]] 22:48, 4 September 2010 (UTC)

== Soft-SHSH checks ==

Since iTunes 9.2 (I think) SHSH are checked for iPhones 3G also, but only through iTunes, not by the phone's [[bootrom]]. iTunes 9.2 (I think) was the version that was introduced together with iOS 4.0. But I have a report that iOS 3.1.3 can be installed with iTunes 10. I don't know what his hosts file looks like, but he cannot have SHSH backup on Cydia, because those were issued only since iOS 4.0 (correct?). Does this mean that iTunes checks SHSH only if firmware is >= 4.0? If yes, this would mean that you could downgrade a 3G to any pre-4.0 firmware without using redsn0w. -- [[User:Http|http]] 18:40, 19 October 2010 (UTC)
:These were introduced at the same time as [[iOS] 4.0. I believe they kernel checks they are present and valid. If i'm correct this may mean system's like [[PwnageTool]] can patch out the checks. --[[User:GreySyntax|GreySyntax]] 19:13, 19 October 2010 (UTC)
::So the new SHSH checks are done by the kernel since iOS 4.0! I always thought it was done by iTunes. Reading the blog of the [[iPhone Dev Team]] again seems to confirm that. Aha. -- [[User:Http|http]] 19:44, 19 October 2010 (UTC)

== iOS 4.2 SHSH for Apple TV ==
As I see iOS 4.2 for Apple TV is still signed. I could save the SHSH of my new Apple TV 2G and I can restore it without any SHSH blobs from Saurik or TinyUmbrella to iOS 4.2. {{unsigned|Christoph|9:05, January 7, 2011}}
:Puzzling, maybe they are still signed, but Apple doesn't require them for restore... --[[User:Balloonhead66|Balloonhead66]] 23:18, 7 January 2011 (UTC)

== 3.1.x for iPod touch 2G ==

I need someone with an [[n72ap|iPod touch 2G]] ([[iBoot-240.4|old bootrom]]) to verify this... I believe Apple actually introduced soft SHSH checks with iOS 3.1.1 for the iPod touch 2G. Further evidence includes my inability to restore to iOS 3.1.1 and 3.1.2 (unless I use SHSHs that I apparently saved, or a custom IPSW), and iTunes says it will verify the restore with Apple. I know that Apple was still signing iOS 3.1.1 and 3.1.2 when they released iOS 3.1.3, though. Is anyone able to back up my info? '''Do not respond with "No, Apple introduced the SHSH check with 4.0" unless you have tested this yourself.''' --[[User:Dialexio|Dialexio]] 01:55, 14 February 2011 (UTC)

: I had thought there was something weird going on with this. I was guessing that iTunes phone'd home to Apple to see if the firmware was acceptable/current/safe before restoring it [provided the IPSW has the right tags to indicate it is a production firmware]. I think, but it is probably wrong, that when you point the your hosts file to Saurik he mimicks the response that the firmware is acceptable but does not actually give hashes for it. On the other hand I'm probably totally wrong because I remember tinyumbrella let you save hashes for 3.1.x. [[User:Iemit737|Iemit737]] 00:46, 15 February 2011 (UTC)

== Firmware for iPod Touch 2G ==
: I am unable to get hashes for my friend's MC iPod Touch 2G. iTunes simply will not issue them. I have tried restore and I keep getting error 3194, any suggestions? [[User:Revolution|Revolution]] 03:27, 26 May 2011 (UTC)

The iPhone Wiki:Spam

2011-04-21T18:44:38Z

Revolution:

Account signup has been blocked again due to spammers. Captcha didn't fix it

I propose one of three options, invites, account approval, or signup Thursdays. --[[User:Geohot|geohot]] 03:47, 19 April 2011 (UTC)
:I think account approval would be the best option (although the most work for everyone with sysop powers). People that want to sign up may have trouble asking current users for an invite, and it sounds like spammers would have no problem spamming the wiki on signup days. --[[User:Dialexio|Dialexio]] 04:20, 19 April 2011 (UTC)
:I think it's quite strange that the Captcha didn't work. For the current spam the best way would be a regular expression that detects these new pages (all look identical) and automatically denies the page creation and immediately blocks that user. But of course they can change the text and it's not solved anymore. What about their emails? Currently you don't have to provide a valid email. What if you enable the email verification? Maybe they still get around that somehow, but I think they use something highly automated and something that works on all wikis, not just here. If we would add a verification "word" in the verification email that they would have to reenter on the page, then that would be something nonstandard that might not work for them. If they still get around that, we can approve new users (best choice of your ideas), but based on what should we decide? If we just approve every new user, we also risk to approve spammers. --[[User:Http|http]] 05:00, 19 April 2011 (UTC)
::Well, CAPTCHA only does so much. I propose maybe implementing a CAPTCHA that uses a GIF animation since that breaks a lot of spambots. If not that, then maybe just account approval. [[User:LiNK|LiNK]] 05:29, 19 April 2011 (UTC)
::emails already have to be verified, I'm almost wondering if people are doing it. --[[User:Geohot|geohot]] 08:04, 19 April 2011 (UTC)
:::Are they (spam account emails) all from the same domain or nothing in common? May we can block users from certain domains (throwaway emails). --[[User:Http|http]] 10:16, 19 April 2011 (UTC)
::About the captcha could we make a problem into captcha like for example: the image will say: What is seven times eleven? (A flaw in this question is that the answer could be found via a google search, so there should be a little rewording.) Then the user would have to solve that simple math problem... I daresay that a user on a technologically advanced wiki should be able to do that math problem. Also could we make it so that instead of account approval any new user's post has to be approved? [[User:Revolution|Revolution]] 18:42, 21 April 2011 (UTC)
:This is confusing, the captcha block pages with new external links and all the spam pages use external link (<code><nowiki>[http://en.wikipedia.org/ Wikipedia]</nowiki></code>) instead of (<code><nowiki>[[wikipedia:|Wikipedia]]</nowiki></code>), so someonw has to be doing this manually or the captcha is not secure enough. For the emails, they may be using one of those [http://10minutemail.com 10 minute e-mail account] things. So we could block email addresses from that domain just in case. They might find a way around it anyway. --[[User:Balloonhead66|Balloonhead66]] 21:29, 19 April 2011 (UTC)

===Invite System===
How do we combat this recent spamming of this wiki? I suggest a possible invite system or similar? --[[User:Srts|Srts]] 02:24, 9 November 2009 (UTC)
:I have already blocked account signup, they must have had this account for a while. --[[User:Geohot|geohot]] 02:29, 9 November 2009 (UTC)
::Well if they don't stop, we can't have account creation disabled forever, defeats the purpose of the wiki. People like him are sad. Great work to all the sysops et all. keeping disruption to a minimal :D --[[User:Srts|Srts]] 02:34, 9 November 2009 (UTC)
:::Yea thanks a lot guys for putting up with this. We'll give a bit of time, and if they continue, we'll figure something out. This kid keep trying to reset my password for hosting and the wiki. Too bad he doesn't have a life. --[[User:Geohot|geohot]] 03:10, 9 November 2009 (UTC)
:::An invite system might not be a bad idea actually [[User:ChronicDev|Will Strafach]] 03:16, 9 November 2009 (UTC)
::::feel free to post their IP addresses, lol --[[User:Posixninja|posixninja]] 04:08, 9 November 2009 (UTC)
::::Well, if you need an extra admin to block them (and delete spam pages), I volunteer. --[[User:Dranfi|Dranfi]]
:::::Congrats, you're an admin --[[User:Geohot|geohot]] 13:22, 9 November 2009 (UTC)

===IP ranges, approval system===
How many different IPs are we dealing with? Is it within a specific range? For the time being, it may be possible to blacklist an entire subnet if they are all coming from the same place. But if a botnet is doing this, may be more difficult. Is it possible for MediaWiki to require admin approval of an edit prior to it being commited? Not well versed with MediaWiki administration, just thossing out some ideas. --[[User:Tsuehpsyde|tsuehpsyde]] 17:29, 9 November 2009 (UTC)
:It is not within a specific range. On my wiki, people post almost the exact same stuff as IP's and I get from 64.*.*.* al the way to 96.*.*.* I think it is a botnet --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)
:We could figure out where they come from and do the same to them. Secondly, we could create a filter that unless your part of a specific group you cannot do more than this many edits in this amount of time. We could try making a period where the admins have to approve the users. Lastly, we could make it so that in the first 12 hours of a user account that user could not edit pages so it would give time for the sysops to ban the users. [[User:Revolution|Revolution]] 00:02, 10 November 2009 (UTC)
::That might not be a good idea as we could get you butts sued. --[[User:Balloonhead66|Balloonhead66]]
:::Why don't we just do this Apple-style and have a group of moderators approve of every comment, page edit or revision? I would love to be a part of such group.
::::The extension for mediawiki [[mediawikiwiki:Extension:FlaggedRevs|FlaggedRevs]] is 1.14 and above. This wiki is running 1.12 :( --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)

Does this wiki currently take advantage of IP banning capability or would that just be subverted anyways? --[[User:Iemit737|Iemit737]] 03:48, 6 April 2011 (UTC)
:The wiki does indeed employ IP banning. The spambots are getting around it, though. --[[User:Dialexio|Dialexio]] 04:13, 6 April 2011 (UTC)
::IP bans are largely useless anyways as -Most Internet users have dynamic IP's and they could simply use a proxy anyways (It's relatively easy to create a VPN once you know where the option is in your OS). They'll also probably block innocent users. --[[User:Ryccardo|Ryccardo]] 14:54, 6 April 2011 (UTC)

===limitations, whitelistings===

If the ones you refer to as 'they' are the [http://code.google.com/p/pois0nhack pois0nhack] group then 'they' don't really seem to pose much of a threat in my opinion. I agree that for the time being we could impose some kind of 12/24 hr posting limitation (maybe no more than +-300 char changes?), but no more than that since this is, after all, a public wiki. Sorry if I'm intruding on some kind of admin/mod meeting, just figured I should have my say. --[[User:Rekoil|adriaaan]] 00:27, 10 November 2009 (UTC)
:I am in favor of a 12hr limit for new users, but since it's a public wiki, during this time, contributions would have to be approved by sysops. --Untagged
::Personally I think it would be good to have it so that all edits by new users a thrown into a moderation pool, then once a good amount of worthwhile contributions, that user can be "whitelisted".
::Maybe we could extend the Twitter-Service to display more information (i.e. "Main Page (-2,439) http://u.nu/5x2t3 " instead of "Main Page - http://u.nu/5x2t3"). That could allow fast detection (and reversal) of vandalism attempts because large edits by "unknown" would be easy to spot. May also add the username and/or the commit message, but then we'd have to check for anything Twitter might interpret or block. --[[User:CleanAir|CleanAir]] 13:58, 12 November 2009 (UTC)

===Captcha===

Can we add a Captcha to the logon process? I don't think all these recent spam pages are done manually. --[[User:Http|http]] 06:29, 15 March 2011 (UTC)
:Good idea [[User:Http|http]], add a Captcha to the logon process and the sign up process for some time --[[User:Whiteshinyapple|Whiteshinyapple]] 09:53, 16 March 2011 (UTC).
:Uhm better idea [[User:Http|http]], add a Captcha when making new pages. Having to fill in a captcha at every login seems to be a pain in the ass :/ the only thing the spam is doing is making new pages, (at least as far as i see.) --[[User:IMaximusX|IMaximusX]]
::What I meant was for the registration process (new user), not for every login. Only [[User:Geohot|geohot]] could implement that. --[[User:Http|http]] 17:37, 16 March 2011 (UTC)
::[http://recaptcha.net Recaptcha] might work. I requires 1.8+, but only works on the sign in, edits with a new external link (anon only), and passwork cracking. --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)
::[[User:http|http]] im pretty sure they already have accounts, :p --[[User:IMaximusX|IMaximusX]]

We have all these options but have any of them actually been implemented? Somebodys got to do something, The spam is getting out of control. --[[User:Grisolp|Grisolp]] 03:38, 9 April 2011 (UTC)
:As http said, it's up to geohot to add a CAPTCHA for account creation. IP banning is in use, but it appears futile. --[[User:Dialexio|Dialexio]] 03:52, 9 April 2011 (UTC)

The spam bots are taking overhand. We will continue to clean it manually, but I suggest to add a Captcha to the new user signup process. That should be sufficient. But you might need to update mediawiki. See [http://code.google.com/apis/recaptcha/docs/mediawiki.html]. -- [[User:Http|http]] 11:35, 1 April 2011 (UTC)
:I can help to clean up the mess as well since I'm from a different timezone (UTC+8). -- [[User:nannoid|nannoid]] 11:51, 1 April 2011 (UTC)
::What does time zone have to do with it? --[[User:Balloonhead66|Balloonhead66]] 00:00, 6 April 2011 (UTC)
:This is out of control. The captcha needs to be in place soon or eventually the recent changes will be flooded and me and the other monitors of it won't be able to keep track of it. --[[User:Balloonhead66|Balloonhead66]] 00:00, 6 April 2011 (UTC)

Recaptcha added, SONY sucks ass. --[[User:Geohot|geohot]] 03:55, 14 April 2011 (UTC)
:Sweet! Thanks for the reCAPTCHA addition; the (job) spam was getting tiresome. And... yeah, Sony really needs to lose its dictator mindset and treat consumers better. :\ --[[User:Dialexio|Dialexio]] 04:31, 14 April 2011 (UTC)

:Thanks. And great you got back from this trial stuff without bigger damage. Signup reCAPTCHA seems to be a good way to handle the spam. The spam that came afterwards was probably from accounts created earlier. We still have 1106 existing accounts (including the already blocked ones) with the typical syntax of the spam bot accounts. Hopefully not many of those are sleeping for this purpose. I assume the automatic spam will get much lower after a few days. We'll see. -- [[User:Http|http]] 22:58, 14 April 2011 (UTC)

:Shit. User Gilbberg that was used from this spam bot was created new. It was not in the wiki user list I created an hour earlier. So the spam bot either knows how to read the reCAPTCHA or there sits someone entering these captchas for every spam that gets created in a semi-automated way. This means we need something better or something non-standard. Ideas? -- [[User:Http|http]] 23:15, 14 April 2011 (UTC)

:I cannot see when user accounts were created, as I don't have access to the database. But shortly after [[User:Geohot|geohot]] added the reCAPTCHA to the new user signup process, I created a list of all users and saved this list. I can confirm that all spam accounts since then (Gilbberg, Giacnen, Frengra, Sarmaiz, Lyneelay, Hiruail, Zimemoor, Albuend, Audpep, Furmayt) were created after that. This means that they must use a semi-automated way to spam (or found a way around the reCAPTCHA). New ideas wanted. -- [[User:Http|http]] 08:26, 16 April 2011 (UTC)

::Why don't we add a captcha to the new page / editing submission? Once per session or whatever. Also captcha on signin. It's OTT but there aren't many alternatives =/ --[[User:Windows Helpdesk|blackthund3r]] 13:25, 16 April 2011 (UTC)

The iPhone Wiki:Spam

2011-04-21T18:42:16Z

Revolution:

Account signup has been blocked again due to spammers. Captcha didn't fix it

I propose one of three options, invites, account approval, or signup Thursdays. --[[User:Geohot|geohot]] 03:47, 19 April 2011 (UTC)
:I think account approval would be the best option (although the most work for everyone with sysop powers). People that want to sign up may have trouble asking current users for an invite, and it sounds like spammers would have no problem spamming the wiki on signup days. --[[User:Dialexio|Dialexio]] 04:20, 19 April 2011 (UTC)
:I think it's quite strange that the Captcha didn't work. For the current spam the best way would be a regular expression that detects these new pages (all look identical) and automatically denies the page creation and immediately blocks that user. But of course they can change the text and it's not solved anymore. What about their emails? Currently you don't have to provide a valid email. What if you enable the email verification? Maybe they still get around that somehow, but I think they use something highly automated and something that works on all wikis, not just here. If we would add a verification "word" in the verification email that they would have to reenter on the page, then that would be something nonstandard that might not work for them. If they still get around that, we can approve new users (best choice of your ideas), but based on what should we decide? If we just approve every new user, we also risk to approve spammers. --[[User:Http|http]] 05:00, 19 April 2011 (UTC)
::Well, CAPTCHA only does so much. I propose maybe implementing a CAPTCHA that uses a GIF animation since that breaks a lot of spambots. If not that, then maybe just account approval. [[User:LiNK|LiNK]] 05:29, 19 April 2011 (UTC)
::emails already have to be verified, I'm almost wondering if people are doing it. --[[User:Geohot|geohot]] 08:04, 19 April 2011 (UTC)
:::Are they (spam account emails) all from the same domain or nothing in common? May we can block users from certain domains (throwaway emails). --[[User:Http|http]] 10:16, 19 April 2011 (UTC)
::About the captcha could we make a problem into captcha like for example: the image will say: What is seven times eleven, except in the captcha? Also could we make it so that instead of account approval any new user's post has to be approved? [[User:Revolution|Revolution]] 18:42, 21 April 2011 (UTC)
:This is confusing, the captcha block pages with new external links and all the spam pages use external link (<code><nowiki>[http://en.wikipedia.org/ Wikipedia]</nowiki></code>) instead of (<code><nowiki>[[wikipedia:|Wikipedia]]</nowiki></code>), so someonw has to be doing this manually or the captcha is not secure enough. For the emails, they may be using one of those [http://10minutemail.com 10 minute e-mail account] things. So we could block email addresses from that domain just in case. They might find a way around it anyway. --[[User:Balloonhead66|Balloonhead66]] 21:29, 19 April 2011 (UTC)

===Invite System===
How do we combat this recent spamming of this wiki? I suggest a possible invite system or similar? --[[User:Srts|Srts]] 02:24, 9 November 2009 (UTC)
:I have already blocked account signup, they must have had this account for a while. --[[User:Geohot|geohot]] 02:29, 9 November 2009 (UTC)
::Well if they don't stop, we can't have account creation disabled forever, defeats the purpose of the wiki. People like him are sad. Great work to all the sysops et all. keeping disruption to a minimal :D --[[User:Srts|Srts]] 02:34, 9 November 2009 (UTC)
:::Yea thanks a lot guys for putting up with this. We'll give a bit of time, and if they continue, we'll figure something out. This kid keep trying to reset my password for hosting and the wiki. Too bad he doesn't have a life. --[[User:Geohot|geohot]] 03:10, 9 November 2009 (UTC)
:::An invite system might not be a bad idea actually [[User:ChronicDev|Will Strafach]] 03:16, 9 November 2009 (UTC)
::::feel free to post their IP addresses, lol --[[User:Posixninja|posixninja]] 04:08, 9 November 2009 (UTC)
::::Well, if you need an extra admin to block them (and delete spam pages), I volunteer. --[[User:Dranfi|Dranfi]]
:::::Congrats, you're an admin --[[User:Geohot|geohot]] 13:22, 9 November 2009 (UTC)

===IP ranges, approval system===
How many different IPs are we dealing with? Is it within a specific range? For the time being, it may be possible to blacklist an entire subnet if they are all coming from the same place. But if a botnet is doing this, may be more difficult. Is it possible for MediaWiki to require admin approval of an edit prior to it being commited? Not well versed with MediaWiki administration, just thossing out some ideas. --[[User:Tsuehpsyde|tsuehpsyde]] 17:29, 9 November 2009 (UTC)
:It is not within a specific range. On my wiki, people post almost the exact same stuff as IP's and I get from 64.*.*.* al the way to 96.*.*.* I think it is a botnet --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)
:We could figure out where they come from and do the same to them. Secondly, we could create a filter that unless your part of a specific group you cannot do more than this many edits in this amount of time. We could try making a period where the admins have to approve the users. Lastly, we could make it so that in the first 12 hours of a user account that user could not edit pages so it would give time for the sysops to ban the users. [[User:Revolution|Revolution]] 00:02, 10 November 2009 (UTC)
::That might not be a good idea as we could get you butts sued. --[[User:Balloonhead66|Balloonhead66]]
:::Why don't we just do this Apple-style and have a group of moderators approve of every comment, page edit or revision? I would love to be a part of such group.
::::The extension for mediawiki [[mediawikiwiki:Extension:FlaggedRevs|FlaggedRevs]] is 1.14 and above. This wiki is running 1.12 :( --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)

Does this wiki currently take advantage of IP banning capability or would that just be subverted anyways? --[[User:Iemit737|Iemit737]] 03:48, 6 April 2011 (UTC)
:The wiki does indeed employ IP banning. The spambots are getting around it, though. --[[User:Dialexio|Dialexio]] 04:13, 6 April 2011 (UTC)
::IP bans are largely useless anyways as -Most Internet users have dynamic IP's and they could simply use a proxy anyways (It's relatively easy to create a VPN once you know where the option is in your OS). They'll also probably block innocent users. --[[User:Ryccardo|Ryccardo]] 14:54, 6 April 2011 (UTC)

===limitations, whitelistings===

If the ones you refer to as 'they' are the [http://code.google.com/p/pois0nhack pois0nhack] group then 'they' don't really seem to pose much of a threat in my opinion. I agree that for the time being we could impose some kind of 12/24 hr posting limitation (maybe no more than +-300 char changes?), but no more than that since this is, after all, a public wiki. Sorry if I'm intruding on some kind of admin/mod meeting, just figured I should have my say. --[[User:Rekoil|adriaaan]] 00:27, 10 November 2009 (UTC)
:I am in favor of a 12hr limit for new users, but since it's a public wiki, during this time, contributions would have to be approved by sysops. --Untagged
::Personally I think it would be good to have it so that all edits by new users a thrown into a moderation pool, then once a good amount of worthwhile contributions, that user can be "whitelisted".
::Maybe we could extend the Twitter-Service to display more information (i.e. "Main Page (-2,439) http://u.nu/5x2t3 " instead of "Main Page - http://u.nu/5x2t3"). That could allow fast detection (and reversal) of vandalism attempts because large edits by "unknown" would be easy to spot. May also add the username and/or the commit message, but then we'd have to check for anything Twitter might interpret or block. --[[User:CleanAir|CleanAir]] 13:58, 12 November 2009 (UTC)

===Captcha===

Can we add a Captcha to the logon process? I don't think all these recent spam pages are done manually. --[[User:Http|http]] 06:29, 15 March 2011 (UTC)
:Good idea [[User:Http|http]], add a Captcha to the logon process and the sign up process for some time --[[User:Whiteshinyapple|Whiteshinyapple]] 09:53, 16 March 2011 (UTC).
:Uhm better idea [[User:Http|http]], add a Captcha when making new pages. Having to fill in a captcha at every login seems to be a pain in the ass :/ the only thing the spam is doing is making new pages, (at least as far as i see.) --[[User:IMaximusX|IMaximusX]]
::What I meant was for the registration process (new user), not for every login. Only [[User:Geohot|geohot]] could implement that. --[[User:Http|http]] 17:37, 16 March 2011 (UTC)
::[http://recaptcha.net Recaptcha] might work. I requires 1.8+, but only works on the sign in, edits with a new external link (anon only), and passwork cracking. --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)
::[[User:http|http]] im pretty sure they already have accounts, :p --[[User:IMaximusX|IMaximusX]]

We have all these options but have any of them actually been implemented? Somebodys got to do something, The spam is getting out of control. --[[User:Grisolp|Grisolp]] 03:38, 9 April 2011 (UTC)
:As http said, it's up to geohot to add a CAPTCHA for account creation. IP banning is in use, but it appears futile. --[[User:Dialexio|Dialexio]] 03:52, 9 April 2011 (UTC)

The spam bots are taking overhand. We will continue to clean it manually, but I suggest to add a Captcha to the new user signup process. That should be sufficient. But you might need to update mediawiki. See [http://code.google.com/apis/recaptcha/docs/mediawiki.html]. -- [[User:Http|http]] 11:35, 1 April 2011 (UTC)
:I can help to clean up the mess as well since I'm from a different timezone (UTC+8). -- [[User:nannoid|nannoid]] 11:51, 1 April 2011 (UTC)
::What does time zone have to do with it? --[[User:Balloonhead66|Balloonhead66]] 00:00, 6 April 2011 (UTC)
:This is out of control. The captcha needs to be in place soon or eventually the recent changes will be flooded and me and the other monitors of it won't be able to keep track of it. --[[User:Balloonhead66|Balloonhead66]] 00:00, 6 April 2011 (UTC)

Recaptcha added, SONY sucks ass. --[[User:Geohot|geohot]] 03:55, 14 April 2011 (UTC)
:Sweet! Thanks for the reCAPTCHA addition; the (job) spam was getting tiresome. And... yeah, Sony really needs to lose its dictator mindset and treat consumers better. :\ --[[User:Dialexio|Dialexio]] 04:31, 14 April 2011 (UTC)

:Thanks. And great you got back from this trial stuff without bigger damage. Signup reCAPTCHA seems to be a good way to handle the spam. The spam that came afterwards was probably from accounts created earlier. We still have 1106 existing accounts (including the already blocked ones) with the typical syntax of the spam bot accounts. Hopefully not many of those are sleeping for this purpose. I assume the automatic spam will get much lower after a few days. We'll see. -- [[User:Http|http]] 22:58, 14 April 2011 (UTC)

:Shit. User Gilbberg that was used from this spam bot was created new. It was not in the wiki user list I created an hour earlier. So the spam bot either knows how to read the reCAPTCHA or there sits someone entering these captchas for every spam that gets created in a semi-automated way. This means we need something better or something non-standard. Ideas? -- [[User:Http|http]] 23:15, 14 April 2011 (UTC)

:I cannot see when user accounts were created, as I don't have access to the database. But shortly after [[User:Geohot|geohot]] added the reCAPTCHA to the new user signup process, I created a list of all users and saved this list. I can confirm that all spam accounts since then (Gilbberg, Giacnen, Frengra, Sarmaiz, Lyneelay, Hiruail, Zimemoor, Albuend, Audpep, Furmayt) were created after that. This means that they must use a semi-automated way to spam (or found a way around the reCAPTCHA). New ideas wanted. -- [[User:Http|http]] 08:26, 16 April 2011 (UTC)

::Why don't we add a captcha to the new page / editing submission? Once per session or whatever. Also captcha on signin. It's OTT but there aren't many alternatives =/ --[[User:Windows Helpdesk|blackthund3r]] 13:25, 16 April 2011 (UTC)

Talk:Bootrom Dumper Utility

2011-02-24T21:11:20Z

Revolution:

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JakeAnthraX]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JakeAnthraX]] 03:38, 29 December 2010 (UTC)
:::i use sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc--[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JakeAnthraX]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev then run sudo build-toolchain.sh for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

Talk:Bootrom Dumper Utility

2011-02-20T16:51:27Z

Revolution:

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JakeAnthraX]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JakeAnthraX]] 03:38, 29 December 2010 (UTC)
:::i use sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc--[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JakeAnthraX]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev then run sudo build-toolchain.sh for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

Talk:Bootrom Dumper Utility

2011-02-19T19:02:28Z

Revolution:

Talk:Bootrom Dumper Utility

2011-02-19T17:51:56Z

Revolution:

If anyone gets it working for iPod touch 2G let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JakeAnthraX]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current iPod touch 2G openiBoot [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy steaks4uce version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JakeAnthraX]] 03:38, 29 December 2010 (UTC)
::: i use sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc--[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
:::: Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JakeAnthraX]] 22:45, 29 December 2010 (UTC)
:hey Liam I tried using your bootrom dumper but it won't compile on linux :( [[User:Revolution|Revolution]] 17:22, 19 February 2011 (UTC)
:: nvm i fixed it [[User:Revolution|Revolution]] 17:51, 19 February 2011 (UTC)
use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)

== vmware + windows ==

anyone tried this on vmware + windows? can't make it work. tried on iphone 4g & ipod 3g -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the limera1n exploit it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

Talk:Bootrom Dumper Utility

2011-02-19T17:22:38Z

Revolution:

If anyone gets it working for iPod touch 2G let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JakeAnthraX]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current iPod touch 2G openiBoot [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy steaks4uce version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JakeAnthraX]] 03:38, 29 December 2010 (UTC)
::: i use sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc--[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
:::: Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JakeAnthraX]] 22:45, 29 December 2010 (UTC)
:hey Liam I tried using your bootrom dumper but it won't compile on linux :( [[User:Revolution|Revolution]] 17:22, 19 February 2011 (UTC)
use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)

== vmware + windows ==

anyone tried this on vmware + windows? can't make it work. tried on iphone 4g & ipod 3g -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the limera1n exploit it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

NOR

2011-02-19T16:50:09Z

Revolution: LIttle Note

NOR typically refers to the NOR flash chip the application processor boots from. The baseband also uses a NOR flash.

==How to Access==
This can be accessed using a patched iBoot or a kernel hack. It can possibly be dumped using /dev/kmem

==Memory Map==
hope I did this right heh

<table border=1 width=100%>
<tr>
<td width=50%><center>Offset</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Configuration Data 
'''0x0''': "2GMI" fourcc 
'''0x4''': Block Size (0x40) 
'''0x8''': Images Section Location Offset 
'''0xC''': Images Section Location (In blocks) 
'''0x10''': Images Section Length 
'''0x30''': Checksum of this config data </center></td>
</tr>
<tr>
<td width=50%><center>0x4000</center></td>
<td width=50%><center>[[NOR (SysCfg)|SysCfg]] Section</center></td>
</tr>
<tr>
<td width=50%><center>0x8000</center></td>
<td width=50%><center>[[NOR (Firmware Images)|Images]] Section</center></td>
</tr>
<tr>
<td width=50%><center>0xFC000</center></td>
<td width=50%><center>[[NOR (NVRAM)|NVRAM]] Section (Note: This copy is the one iBoot uses)</center></td>
</tr>
<tr>
<td width=50%><center>0xFE000</center></td>
<td width=50%><center>[[NOR (NVRAM)|NVRAM]] Section (copy)</center></td>
</tr>
</table>

==Hardware==
* [[M68ap|iPhone]] -- some CFI compliant parallel nor
* [[N82ap|iPhone 3G]] -- 1MB SPI NOR flash
* [[N18ap|iPod touch 3G]] and beyond -- The NOR is replaced with a dedicated partition of NAND

Talk:NOR

2011-02-13T16:41:42Z

Revolution: /* Recovering SHSH */

== [[NOR]] on [[N90ap|iPhone 4]] ==

The [[N90ap|iPhone 4]] has a [[NOR]], only the [[N18ap|iPod touch 3G]] has a [[NAND]] [http://www.ifixit.com/Teardown/iPhone-4-Teardown/3130/3#s15354]. --[[User:Liamchat|liamchat]] 21:29, 29 October 2010 (UTC)

:Where the hell do you get all your misinformation from? Since the original iPhone, all devices have a NAND. Until the ipod touch 3G, they also had a NOR where the main bootloaders and graphics are stored. In ipod touch 3G and later, these files are also on the NAND. NOR in the case of iPhone 4 refers only to the baseband and its boot chain, which is not as "important". [[User:Iemit737|Iemit737]] 04:16, 30 October 2010 (UTC)

== Recovering SHSH ==

I just did a NOR dump of my ipod touch 2g with 4.2.1 and I found that it stores the SHSH blobs in the NOR. Could one possibly recover the SHSH blobs of iPod Touch 4g by dumping the NAND? [[User:Revolution|Revolution]] 16:41, 13 February 2011 (UTC)

Talk:NOR

2011-02-13T16:41:22Z

Revolution: SHSH Question

The iPhone Wiki:Spam

2009-11-10T00:02:01Z

Revolution:

How do we combat this recent spamming of this wiki? I suggest a possible invite system or similar? --[[User:Srts|Srts]] 02:24, 9 November 2009 (UTC)

I have already blocked account signup, they must have had this account for a while. --[[User:Geohot|geohot]] 02:29, 9 November 2009 (UTC)

Well if they don't stop, we can't have account creation disabled forever, defeats the purpose of the wiki. People like him are sad. Great work to all the sysops et all. keeping disruption to a minimal :D --[[User:Srts|Srts]] 02:34, 9 November 2009 (UTC)

Yea thanks a lot guys for putting up with this. We'll give a bit of time, and if they continue, we'll figure something out. This kid keep trying to reset my password for hosting and the wiki. Too bad he doesn't have a life. --[[User:Geohot|geohot]] 03:10, 9 November 2009 (UTC)

An invite system might not be a bad idea actually [[User:ChronicDev|Will Strafach]] 03:16, 9 November 2009 (UTC)

feel free to post their IP addresses, lol --[[User:Posixninja|posixninja]] 04:08, 9 November 2009 (UTC)

Well, if you need an extra admin to block them (and delete spam pages), I volunteer. --[[User:Dranfi|Dranfi]] Congrats, you're an admin --[[User:Geohot|geohot]] 13:22, 9 November 2009 (UTC)

How many different IPs are we dealing with? Is it within a specific range? For the time being, it may be possible to blacklist an entire subnet if they are all coming from the same place. But if a botnet is doing this, may be more difficult. Is it possible for MediaWiki to require admin approval of an edit prior to it being commited? Not well versed with MediaWiki administration, just thossing out some ideas. --[[User:Tsuehpsyde|tsuehpsyde]] 17:29, 9 November 2009 (UTC)

We could figure out where they come rom and do the same to them. Secondly, we could create a filter that unless your part of a specific group you cannot do more than this many edits in this amount of time. We could try making a period where the admins have to approve the users. Lastly, we could make it so that in the first 12 hours of a user account that user could not edit pages so it would give time for the sysops to ban the users. [[User:Revolution|Revolution]] 00:02, 10 November 2009 (UTC)

Main Page

2009-11-07T13:49:30Z

Revolution: Undo revision 5562 by Hockeyrules11 (Talk)

<center>[[Image:Iptwiki.jpg‎]]</center>

{{:Main Page/Welcome}}
<table border="1" width="100%"><tr>
<td style="background-color:orange; text-align:center; width:25%;">[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</td>
<td style="background-color:orange; text-align:center; width:25%;">[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</td>
</tr>
<tr>
<td colspan="4">
<center>[[Disclaimer]]</center>
</td>
</tr>
</table> 
==Software==
* [[/|Filesystem]]
* [[Firmware]]
* [[Keys]]
* [[Protocols]]
* [[System Log]]

==Hardware==
=== iPhone ===
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]

=== iPod touch ===
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]
* [[N18ap|iPod touch 3rd Generation (n18ap)]]

==App Processor ([[Jailbreak]])==
The [[iPhone]], [[iPod touch]], and [[iPhone 3G]] make use of the [[S5L8900]] platform as application processor. Current models, such as the [[iPod touch 2G]] and the [[N88AP|iPhone 3GS]], use newer processors. The [[S5L8720]] and [[S5L8920]] are used, respectively. The [[N18ap|iPod Touch 3G]] operates using the [[S5L8922]] application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband ([[Unlock]])==
The [[Baseband Device]] is where the [[unlock]] applies.

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Application Copy Protection==
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]

==Definitions==
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]

==Other==
* [[Bluetooth]]
* [[Glossary]]
* [[Tutorials]]
* [[Useful Links]]

Main Page

2009-11-07T13:49:13Z

Revolution: Undo revision 5563 by Hockeyrules11 (Talk)

<center>[[Image:Iptwiki.jpg‎]]</center>

{{:Main Page/Welcome}}
<table border="1" width="100%"><tr>
<td style="background-color:orange; text-align:center; width:25%;">[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</td>
<td style="background-color:orange; text-align:center; width:25%;">[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</td>
</tr>
<tr>
<td colspan="4">
<center>[[Disclaimer]]</center>
</td>
</tr>
</table> 

==Hardware==
=== iPhone ===
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]

=== iPod touch ===
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]
* [[N18ap|iPod touch 3rd Generation (n18ap)]]

==App Processor ([[Jailbreak]])==
The [[iPhone]], [[iPod touch]], and [[iPhone 3G]] make use of the [[S5L8900]] platform as application processor. Current models, such as the [[iPod touch 2G]] and the [[N88AP|iPhone 3GS]], use newer processors. The [[S5L8720]] and [[S5L8920]] are used, respectively. The [[N18ap|iPod Touch 3G]] operates using the [[S5L8922]] application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband ([[Unlock]])==
The [[Baseband Device]] is where the [[unlock]] applies.

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Application Copy Protection==
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]

==Definitions==
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]

==Other==
* [[Bluetooth]]
* [[Glossary]]
* [[Tutorials]]
* [[Useful Links]]

Main Page

2009-11-07T13:48:53Z

Revolution: Undo revision 5564 by Hockeyrules11 (Talk)

<center>[[Image:Iptwiki.jpg‎]]</center>

{{:Main Page/Welcome}}
<table border="1" width="100%"><tr>
<td style="background-color:orange; text-align:center; width:25%;">[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</td>
<td style="background-color:orange; text-align:center; width:25%;">[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</td>
</tr>
<tr>
<td colspan="4">
<center>[[Disclaimer]]</center>
</td>
</tr>
</table> 

==App Processor ([[Jailbreak]])==
The [[iPhone]], [[iPod touch]], and [[iPhone 3G]] make use of the [[S5L8900]] platform as application processor. Current models, such as the [[iPod touch 2G]] and the [[N88AP|iPhone 3GS]], use newer processors. The [[S5L8720]] and [[S5L8920]] are used, respectively. The [[N18ap|iPod Touch 3G]] operates using the [[S5L8922]] application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband ([[Unlock]])==
The [[Baseband Device]] is where the [[unlock]] applies.

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Application Copy Protection==
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]

==Definitions==
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]

==Other==
* [[Bluetooth]]
* [[Glossary]]
* [[Tutorials]]
* [[Useful Links]]

Main Page

2009-11-07T13:48:40Z

Revolution: Undo revision 5565 by Hockeyrules11 (Talk)

Main Page

2009-11-07T13:48:21Z

Revolution: Undo revision 5566 by Hockeyrules11 (Talk)

Main Page

2009-11-07T13:46:17Z

Revolution: Undo revision 5567 by Hockeyrules11 (Talk)

Main Page

2009-11-07T13:45:56Z

Revolution: Undo revision 5568 by Hockeyrules11 (Talk)

Main Page

2009-11-07T13:45:41Z

Revolution: Undo revision 5569 by Hockeyrules11 (Talk)

Talk:Tethered jailbreak

2009-10-16T04:02:58Z

Revolution:

I suggest no work should be done on making it untethered until the iphone 3,1 is released. {{unsigned|Revolution|01:01, October 15, 2009 (EST)}}

No work done until iPhone3,1? That's a stretch. How about no public-work / for release until iPhone 3,1. If no jailbreakable iPhone3,1 in July, then no upgrade (for me) from iPhone2,1 :) . [[User:Iemit737|Iemit737]] 02:49, 16 October 2009 (UTC)

thats probably what revolution implied :P [[User:ChronicDev|ChronicDev]] 03:05, 16 October 2009 (UTC)

Really I think no work at all since nitrokey published the exploit being kept in secret I think no work should be done so there is no risk of any compromise. and secondly if nitrokey got access to an unpublished exploit twice I think that there should be more security about all of this. Since nitrokey stole the a baseband exploit and a bootrom exploit. Soz about my rambling Im very tired [[User:Revolution|Revolution]] 04:02, 16 October 2009 (UTC)

Talk:Tethered jailbreak

2009-10-16T04:02:03Z

Revolution:

I suggest no work should be done on making it untethered until the iphone 3,1 is released. {{unsigned|Revolution|01:01, October 15, 2009 (EST)}}

No work done until iPhone3,1? That's a stretch. How about no public-work / for release until iPhone 3,1. If no jailbreakable iPhone3,1 in July, then no upgrade (for me) from iPhone2,1 :) . [[User:Iemit737|Iemit737]] 02:49, 16 October 2009 (UTC)

thats probably what revolution implied :P [[User:ChronicDev|ChronicDev]] 03:05, 16 October 2009 (UTC)

Really I think no work at all since nitrokey published the exploit being kept in secret I think no work should be done so there is no risk of any compromise. and secondly if nitrokey got access to an unpublished exploit twice I think that there should be more security about all of this. Since nitrokey stole the a baseband exploit and a bootrom exploit. [[User:Revolution|Revolution]] 04:02, 16 October 2009 (UTC)

Talk:IDroid

2009-10-16T01:09:49Z

Revolution: Question

'''Q:''' Hmmm... I install Ubuntu 8.10 on Parallels Desktop on my MacBook Pro, I've downloaded all required files, but after I run command
sudo ./oibc
Terminal says that I type incorrect syntax... WTF?

'''A:''' First of all, OpeniBoot might not work under a virtual machine (Parallel Desktop). And you are suppose to use loadibec BEFORE oibc to upload openiboot on the phone. Be sure to send the file corresponding to your device.

'''Q:''' Of course I've upload patched iBoot before I've run ./oibc command... And iPhone show me "standard patched bootloader screen", where I choose console iBoot. And after this steps I've try to run ./oibc, but ... (see first q's)

'''A:''' So, you need to have a pwn iBoot (just jailbreak on 2.x and you'll be fine), if you use the files comming with the linux demo, make sure you are at 2.x+ (pwned 1.1.4 or 1.1.5 won't work). Be sure to upload the correct version of OpeniBoot (2g, 3g or iPod for the first gen iPhone, the 3g iPhone and the iPod Touch 1G; no support for the iPod Touch 2G, yet). After launching loadibec, check your device's screen to see wether you have the same image as in [[iPhoneLinux]]. Then you can launch oibc. Beware, after launching loadibec, the device is recognised as a different usb device, so you might need to load it in Ubuntu from OS X in Parallel Desktop options.

'''Q:''' I've got pwned iPhone 3G with 2.2.1 firmware. All steps I do with manual [[iPhoneLinux]] in hands... Before I run oibc, of course, I've connect "another USB device" to virtual machine (and disconnect it from main system). I've see picture like [[iPhoneLinux]] manual, but after I run oibc nothing happen...

You can also check out the required libraries (I just added the list to the installation section) on the article :
* Required libraries (install as a package for Uuntu).:
** libpthread
** libncurses
** libusb
** libreadline

== Is this project dead? ==
So is this project still alive or is it dead now?

Talk:Tethered jailbreak

2009-10-16T01:01:08Z

Revolution: New page: I suggest no work should be done on making it untethered until the iphone 3,1 is released.

I suggest no work should be done on making it untethered until the iphone 3,1 is released.

Talk:Firmware

2009-10-15T12:11:07Z

Revolution: /* Tethered Jailbreak */

What do you mean by protected? iTunes has to dl it somehow

o yea, forgot you had to pay for it :-) i wonder if the iPhone one would run easily?

I've never had any luck myself, but I suppose anything's possible :-)
As for the actual word 'protected', the URLs in the XML are prefixed protected://. Perhaps those URLs are still of value?
BTW, as far as I know, having a 2.0 beta installed will still allow "free" upgrades to 2.0. --[[User:Haldo|Haldo]] 13:39, 5 August 2008 (UTC)

:After reading a post on Zibri's blog today, I tested (and confirmed) that the iPod touch 2.0.1 firmware could be downloaded from Apple's servers. Should this URL be provided on this page? -[[User:Dialexio|Dialexio]] 00:29, 6 August 2008 (UTC)

::That is a tough question... I may have to defer to geohot for that. It is unfortunately very much a gray area. Maybe we link to the file linked by Zibri? --[[User:Haldo|Haldo]] 20:47, 7 August 2008 (UTC)

:::My thinking is this. If Apple sells it, no download link should be posted here. But perhaps a link to Zibri's page about it in the resources area. ~geohot

== chex ==

itunes probably checks to see if u bought it somehow...

== yup ==

funny you should mention that. my friend np1011357 got a 2.0 fw working, but I don't think people are brave enough to test any further :P

I do know you have to be pwned for it to work though...

== hmm ==

well if its on apples servers, then we are not really 'hosting' warez, not could we be connected to hosting it at all, unlike if someone uploaded it to rapidshare, then there would be reason to believe we were involved. although its a community wiki, for something like this, it is geohot's call.

== totally free :) ==

ipod touch 1.1 (day it came out) -> 1.1.1 (command line jailbreak and jailbreakme.com) -> 1.1.2 symlink jailbreak -> 1.1.3 soft -> 1.1.3 ziphone -> 1.1.4 ijailbreak with jan. app pack -> 1.1.4 pwned and jan. app pack -> beta 1 and 2 pwned -> beta 8 -> 2.0 for free -> pwned 2.0 -> i downloaded 2.0.1 from itunes but i haven't updated yet

haven't wasted a dime cuz i'm a lazy, jobless 14 year old and all my money goes to my 3g plan (only pay $55 a month with unlimted data, 300 minutes, and unlimted) texts $9 movie tickets, and girls

== WOW ==

ffs guys. i was hoping someone would figure this out. Anyone at all could just type 'strings iTunes' on the iTunes binary, and see that there is a link saying http://itunes.com/version, then another directly after is '?touchUpdate=yes". It's not even that hard if u disassembeld it in IDA

== Add defunct firmwares? ==

There are some defunct firmware builds referenced in Apple's XML file (i.e.- iPhone 3A101a). Should these be added to this page, or not?
-[[User:Dialexio|Dialexio]] 20:05, 23 September 2008 (UTC)

== Clarification of "Can be unlocked" ? ==

I think we need a clarification what the "Can be unlocked?"-Column means. Because Northstar 7C144 on the 3G can be unlocked using pwnage (i.e. if you stay at BB 04.26.08). However if you'd upgrade to BB 05.11.07 it can't. --[[User:M2m|M2m]] 03:17, 16 September 2009 (UTC)

Quote Oranav: "There's no point for an "unlock" column if we write "yes, stay at X".

I totally agree on this, however the Columns also states ''"Yes (Upgrade to 04.26.08)"'' for BB 01.45.00 - 02.30.03, while technically currently a working implementation only is available for 04.26.08 (ultrasn0w - yellowsn0w is not available anymore AFAIK). Like this I would think for BB 01.45.00 - 02.30.03 it should also read ''"No (Though you can upgrade to 04.26.08)"'' - or something similar.
Therefore my statement/request for a clarification.
Regards --[[User:M2m|M2m]] 02:19, 17 September 2009 (UTC)

I am of the opinion that if the BB that ships with the given Apple IPSW is not unlock(ed/able) then it should be marked NO. It should be made clear elsewhere that 04.26.08 is suitable for devices looking for an unlock. [[User:Haldo|Haldo]] 13:53, 17 September 2009 (UTC)

The main difference here is that for older firmwares there's an upgrade path towards unlock. For example, if you buy a 3G phone now with 2.0 and BB 01.45.00, it can be easily upgraded to 3.0 and unlocked. On the other hand, if the phone has 3.1 and 05.11.07 pre-installed, there's no such upgrade path. --[[User:Blackbox|Blackbox]] 18:22, 17 September 2009 (UTC)

What about changing the title of the column to say "Can baseband be unlocked?" and then only answer yes if there is an unlock available for the baseband included in that version? [[User:Rekoil|Rekoil]] 21:26, 17 September 2009 (UTC)

I've changed it to say yes only on the rows with basebands that can be unlocked "OTB". No one should have problems figuring out that you can upgrade to a version that can be unlocked if you're at a version below that cannot be unlocked. But maybe a clarification that you cannot downgrade basebands? --[[User:Rekoil|adriaaan]] 15:16, 14 October 2009 (UTC)

== Tethered Jailbreak ==
at this point with ipt3g a tethered jailbreak may be the only option we have. the chances of another bootrom exploit being found are rather slim. And find an untethering exploit beyond that is stupid/pointless. I know a tethered exploit sucks, but there's a real chance that this may be the only thing that's left! Should we mark is as "yes jailbreakable" or not? I say take it and be happy with what you got!!
--[[User:Posixninja|posixninja]] 13:22, 12 October 2009 (UTC)

I see what you mean, and I tend to agree for the most part, but a tethered jailbreak just isn't a complete jailbreak in my opinion. Plus if people keep looking I know a tether-less jailbreak will be found eventually, nothing is unhackable ;) --[[User:Rekoil|adriaaan]] 19:39, 12 October 2009 (UTC)

I wish that was true, but most people average 1 exploit for every so many kilobytes, and bootrom really isn't very large. Even then there's a limited number of injection vectors to exploits. So the chances of bootrom becoming exploitable is actually a real risk!! every exploit that is found greatly decreases the chances another exploit will be found. Within the next 2-3 years jailbreaking on iphone will probably be extinct. 4 years max
--[[User:Posixninja|posixninja]] 04:36, 15 October 2009 (UTC)

Well then in the next two years we'll "borrow one of nsa's super computers and extract the private signing key :D. Or get hold of a developer model and maybe there will be some interesting stuff on it.

IBoot (Bootloader)

2009-10-06T19:00:01Z

Revolution: Added new exploit

{{DISPLAYTITLE:iBoot}}
This is Apple's stage 2 bootloader for all of the iDevices. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== Revisions ==
* [[iBoot-159]] (1.0.x)
* [[iBoot-204]] (1.1 and 1.1.1 3A109a)
* [[iBoot-204.0.2]] (1.1.1 3A110a)
* [[iBoot-204.2.9]] (1.1.2)
* [[iBoot-204.3.14]] (1.1.3 and 1.1.4)
* [[iBoot-204.3.16]] (1.1.5)
* [[iBoot-320.20]] (2.0.x)
* [[iBoot-385.22]] (2.1 and 2.1.1)
* [[iBoot-385.49]] (2.2 and 2.2.1)
* [[iBoot-596.24]] (3.0 and 3.0.1)
* [[iBoot-636.65]] (3.1 and 3.1.1)

==Commands used as an exploit vector==
* Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at written to 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* In the iPod Touch 2G firmware 2.1.1 iBoot (iBoot version 385.22), the [[ARM7 Go]] command could be used to run a payload on the ARM7 in the iPod Touch 2G.
* The [[iBoot Environment Variable Overflow]] exists in 3.0 iBoot, and is being used by [[purplera1n]] and [[redsn0w]] (as of version 0.8) in order to flash the oversized [[LLB]] which utilizes the [[24kPwn]] exploit to the iPhone 3GS. While this exploit is present on iPod Touch 2nd Gen, it is not used in favour of the [[ARM7 Go]] exploit.
* The [[usb_control_msg(0x21, 2) Exploit]] exists in 3.1 and 3.1.1 iBoot and is being used by [[greenpois0n]] in order to flash the oversized [[LLB]] which utilizes the [[24kPwn]] exploit to the iPhone 3GS and iPod Touch 3G. While this exploit is present on iPod Touch 2nd Gen, it is not used in favour of the [[ARM7 Go]] exploit.

==OpeniBoot==
There is an open source version of iBoot being made so that Linux on the iPhone will work. You can check out the source [http://github.com/planetbeing/iphonelinux/tree/master/openiboot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.

==Remappings==
<pre>
// n88
0x4FF00000 => 0x0
0x40000000 => 0xC0000000
</pre>

== See also ==
* [[iBoot (Enums)]]

IREB

2009-10-02T16:17:24Z

Revolution:

{{DISPLAYTITLE:iREB}}
A program created by iH8sn0w, that is used for [[S5L8900]] devices, which include:
*[[M68ap|iPhone 2G]]
*[[N82ap|iPhone 3G]]
*[[N45ap|iPod touch 1G]]

== What is iREB? ==
iREB is a GUI application that uses iDevice and dfu-util. It uploads 3 pwned files, so that iTunes can accept custom IPSW firmware/downgrade to lower firmwares.

iBSS.MODEL.RELEASE.dfu
WTF.MODEL.RELEASE.dfu
WTF.s5l8900xall.RELEASE.dfu

iREB does '''''NOT''''' jailbreak, it just disables [[iTunes]]'s ability to upload a patch to the ramdisk to block custom firmware made by [[PwnageTool]].

== Current Developers ==
*iH8sn0w (Windows + Mac)
*w3st05 (Windows)
*JohnnyFranks67 (Mac)

== Compatible Operating Systems: ==
Windows XP/Vista/7 
Mac OS X 10.4/10.5/10.6

== Changelog ==
===3.1-3 (Windows ONLY for now!)===
*Added iPhone 3G[S] 3.1 SHSH Grabber
*More Stable
*Added Credits
===3.1 (Windows ONLY for now!)===
*Added GUI
*Added Recovery Mode Loop Fixer
*Fixed Bug from 2.2
*Removed Popups
*Removed Command Prompt's
===2.2===
*Added Support for 3.1(7C144)/3.1.1(7C145)
*This version contains a bug, that will be fixed.
*Improved GUI (Windows)
*Added a bit more User-Friendly GUI (Mac)
*Snow Leopard compatibility (Mac)

===2.1===
*Added GUI
*All 3 supported devices are implemented.

===2.0===
*No longer required to rename ipsw to ih8sn0w.ipsw (Windows)
*No longer required to move ipsw to C:\ (Windows)

===1.0===
*Initial Release