The iPhone Wiki - User contributions [en]

Firmware

2012-09-20T10:24:24Z

Ryanb93:

Latest Apple download links can be found [http://www.itunes.com/version here].

Unless otherwise stated, the jailbreak and unlock information report whether a device can be modified with publicly available software (read: no additional hardware required) if it was never jailbroken before.

== [[Apple TV]] ==
{{:Firmware/Apple TV 2G}}
{{:Firmware/Apple TV 3G}}

== [[iPad]] ==
{{:Firmware/iPad}}
=== [[iPad 2]] ===
{{:Firmware/iPad 2 Wi-Fi}}
{{:Firmware/iPad 2 GSM}}
{{:Firmware/iPad 2 CDMA}}
{{:Firmware/iPad 2 Wi-Fi R2}}
=== [[iPad 3]] ===
{{:Firmware/iPad 3 Wi-Fi}}
{{:Firmware/iPad 3 CDMA}}
{{:Firmware/iPad 3 Global}}

== [[iPhone]] ==
{{:Firmware/iPhone}}
{{:Firmware/iPhone 3G}}
{{:Firmware/iPhone 3GS}}
=== [[iPhone 4]] ===
{{:Firmware/iPhone 4 GSM}}
{{:Firmware/iPhone 4 CDMA}}
{{:Firmware/iPhone 4S}}
{{:Firmware/iPhone 5}}

== [[iPod touch]] ==
{{:Firmware/iPod touch}}
{{:Firmware/iPod touch 2G}}
{{:Firmware/iPod touch 3G}}
{{:Firmware/iPod touch 4G}}
{{:Firmware/iPod touch 5G}}

== See also ==
* [[Beta Firmware]]
* [[OTA Updates]]
* [[VFDecrypt]]
* [[VFDecrypt Keys]]

== External Links ==
* [http://www.trejan.com/projects/ipod/ Firmware List]
* [http://itunes.com/version Apple Firmware PLIST]
* [http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml Apple OTA Firmware PLIST]

Talk:Bootrom Dumper Utility

2012-01-20T11:47:20Z

Ryanb93: /* Dumping 3GS bootrom from OSX 10.7.2 */

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
:::::::: I am getting an arm-elf-as: No such file or directory error on OSX Lion. Do I need to get the full toolchain compiled or can I get this working with Xcode (for iOS) somehow with less hassle ?--[[User:M2m|M2m]] 04:22, 3 January 2012 (MST)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==
Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)
:Not until there is a jailbreak for A5 devices.--[[User:M2m|M2m]] 12:51, 2 January 2012 (MST)
:No. Limera1n doesn't work on A5 devices. --[[User:Http|http]] 13:04, 2 January 2012 (MST)
::It's kind of non-sense this tool so. To dump already hacked bootroms? --[[User:XiiiX|XiiiX]] 14:21, 2 January 2012 (MST)
:::No. Not really. You may find an exploit outside the bootrom which leads to a jailbreak which you can use to dump the bootrom which can help you to find exploits in the bootrom for later jailbreaks. Jailbreaks based on bootrom exploits can only be fixed with new hardware.--[[User:M2m|M2m]] 15:28, 2 January 2012 (MST)
:::There is no such thing as an "hacked BootROM". We cannot change the contents of the BootROM. Note "ROM" - Read Only Memory. -SquiffyPwn 17:10, 2 January 2012 (CST)
::::That's a better explanation. So we don't need a bootrom jailbreak to use this, just a user-land could work? Why is the necessity of a jailbreak to dump te bootrom? We need the offsets? --[[User:XiiiX|XiiiX]] 16:09, 2 January 2012 (MST)
Do you know what is dump? dump is a copy, to use this tool you MUST have a BootROM Exploit, look the source code, it send the exploit to allow acess to the read-only BootROM memory. Userland exploit here? what offsets?~zmaster

== Compatibility with older devices ==
I looked as payload.s, apparently, everything is in place for older devices (e.g., 0x8b7 for basically every old device). I can't check the actual BDU application, but I'd think it was updated with code needed for older devices as well. Can anyone confirm this? --[[User:Rdqronos|rdqronos]] 14:33, 3 January 2012 (MST)
:Can't get it working with an iPhone 3G with the following values:
EXPLOIT_LR 0x22000000 LOADADDR_SIZE 0x24000 RET_ADDR 0x8b7
:Output looks OK:
sudo ./bdu
______ Bootrom Dumper Utility (BDU) 1.0 ______

(c) pod2g october 2010

[.] Now executing arbitrary code using geohot's limera1n...
sent data to copy: 800
padded to 0x84023000
sent shellcode: 800 has real length 48
never freed: 800
sent exploit to heap overflow: FFFFFFF9
[.] Dump payload started.
[.] Now dumping bootrom to file bootrom.bin...
:But I get a zero sized (empty) bootrom.bin. --[[User:M2m|M2m]] 02:17, 4 January 2012 (MST)
::So it can read the BootROM, but not dump it. Okay. --[[User:Rdqronos|rdqronos]] 13:04, 4 January 2012 (MST)
:::Not sure if it can be read correctly or not. --[[User:M2m|M2m]] 17:16, 4 January 2012 (MST)

== Working on OSX? ==

Did anybody get this working on OSX? I could compile the payload.bin and tried with both the included binary and also with the recompiled one on a MacMini OSX 10.6.8 with an iPhone 4 (with iOS 5.0.1), libusb 1.0.8 is installed. I also tried with a 3GS and the forked code (just uses the different offsets). In all cases I always get "device stalled" and the bdu terminates. I know it worked on Linux for others, but anybody had success on OSX yet? I'm not sure where to start debugging, as I'm not a Mac user. -- [[User:Http|http]] 16:36, 11 January 2012 (MST)
: I compiled it under OSX Lion and can also run it but I only get a zero sized dump. May or may not be a problem of the program & Lion or that I only have iPhone2G & 3G to test.--[[User:M2m|M2m]] 04:15, 12 January 2012 (MST)

== Dumping 3GS bootrom from OSX 10.7.2 ==

sudo ./bdu
______ Bootrom Dumper Utility (BDU) 1.0 ______

(c) pod2g october 2010

[.] Now executing arbitrary code using geohot's limera1n...
sent data to copy: 800
padded to 0x84023000
sent shellcode: 800 has real length 48
never freed: 800
sent exploit to heap overflow: FFFFFFF9
[.] Dump payload started.
[.] Now dumping bootrom to file bootrom.bin...
Segmentation fault: 11

Any ideas? I've changed all the offsets to the ones in the wiki and yet still no success.

Talk:Bootrom Dumper Utility

2012-01-20T11:46:50Z

Ryanb93: /* Working on OSX? */

Talk:Bootrom Dumper Utility

2012-01-20T11:44:57Z

Ryanb93: /* Dumping 3GS bootrom from OSX 10.7.2 */

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
:::::::: I am getting an arm-elf-as: No such file or directory error on OSX Lion. Do I need to get the full toolchain compiled or can I get this working with Xcode (for iOS) somehow with less hassle ?--[[User:M2m|M2m]] 04:22, 3 January 2012 (MST)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==
Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)
:Not until there is a jailbreak for A5 devices.--[[User:M2m|M2m]] 12:51, 2 January 2012 (MST)
:No. Limera1n doesn't work on A5 devices. --[[User:Http|http]] 13:04, 2 January 2012 (MST)
::It's kind of non-sense this tool so. To dump already hacked bootroms? --[[User:XiiiX|XiiiX]] 14:21, 2 January 2012 (MST)
:::No. Not really. You may find an exploit outside the bootrom which leads to a jailbreak which you can use to dump the bootrom which can help you to find exploits in the bootrom for later jailbreaks. Jailbreaks based on bootrom exploits can only be fixed with new hardware.--[[User:M2m|M2m]] 15:28, 2 January 2012 (MST)
:::There is no such thing as an "hacked BootROM". We cannot change the contents of the BootROM. Note "ROM" - Read Only Memory. -SquiffyPwn 17:10, 2 January 2012 (CST)
::::That's a better explanation. So we don't need a bootrom jailbreak to use this, just a user-land could work? Why is the necessity of a jailbreak to dump te bootrom? We need the offsets? --[[User:XiiiX|XiiiX]] 16:09, 2 January 2012 (MST)
Do you know what is dump? dump is a copy, to use this tool you MUST have a BootROM Exploit, look the source code, it send the exploit to allow acess to the read-only BootROM memory. Userland exploit here? what offsets?~zmaster

== Compatibility with older devices ==
I looked as payload.s, apparently, everything is in place for older devices (e.g., 0x8b7 for basically every old device). I can't check the actual BDU application, but I'd think it was updated with code needed for older devices as well. Can anyone confirm this? --[[User:Rdqronos|rdqronos]] 14:33, 3 January 2012 (MST)
:Can't get it working with an iPhone 3G with the following values:
EXPLOIT_LR 0x22000000 LOADADDR_SIZE 0x24000 RET_ADDR 0x8b7
:Output looks OK:
sudo ./bdu
______ Bootrom Dumper Utility (BDU) 1.0 ______

(c) pod2g october 2010

[.] Now executing arbitrary code using geohot's limera1n...
sent data to copy: 800
padded to 0x84023000
sent shellcode: 800 has real length 48
never freed: 800
sent exploit to heap overflow: FFFFFFF9
[.] Dump payload started.
[.] Now dumping bootrom to file bootrom.bin...
:But I get a zero sized (empty) bootrom.bin. --[[User:M2m|M2m]] 02:17, 4 January 2012 (MST)
::So it can read the BootROM, but not dump it. Okay. --[[User:Rdqronos|rdqronos]] 13:04, 4 January 2012 (MST)
:::Not sure if it can be read correctly or not. --[[User:M2m|M2m]] 17:16, 4 January 2012 (MST)

== Working on OSX? ==

Did anybody get this working on OSX? I could compile the payload.bin and tried with both the included binary and also with the recompiled one on a MacMini OSX 10.6.8 with an iPhone 4 (with iOS 5.0.1), libusb 1.0.8 is installed. I also tried with a 3GS and the forked code (just uses the different offsets). In all cases I always get "device stalled" and the bdu terminates. I know it worked on Linux for others, but anybody had success on OSX yet? I'm not sure where to start debugging, as I'm not a Mac user. -- [[User:Http|http]] 16:36, 11 January 2012 (MST)
: I compiled it under OSX Lion and can also run it but I only get a zero sized dump. May or may not be a problem of the program & Lion or that I only have iPhone2G & 3G to test.--[[User:M2m|M2m]] 04:15, 12 January 2012 (MST)

== Dumping 3GS bootrom from OSX 10.7.2

bash-3.2# ./bdu
______ Bootrom Dumper Utility (BDU) 1.0 ______

(c) pod2g october 2010

[.] Now executing arbitrary code using geohot's limera1n...
sent data to copy: 800
padded to 0x84023000
sent shellcode: 800 has real length 48
never freed: 800
sent exploit to heap overflow: FFFFFFF9
[.] Dump payload started.
[.] Now dumping bootrom to file bootrom.bin...
Segmentation fault: 11 ==

Any ideas? I've changed all the offsets to the ones in the wiki and yet still no success.

Talk:Bootrom Dumper Utility

2012-01-20T11:44:27Z

Ryanb93: /* Dumping 3GS bootrom from OSX 10.7.2 */ new section

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
:::::::: I am getting an arm-elf-as: No such file or directory error on OSX Lion. Do I need to get the full toolchain compiled or can I get this working with Xcode (for iOS) somehow with less hassle ?--[[User:M2m|M2m]] 04:22, 3 January 2012 (MST)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==
Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)
:Not until there is a jailbreak for A5 devices.--[[User:M2m|M2m]] 12:51, 2 January 2012 (MST)
:No. Limera1n doesn't work on A5 devices. --[[User:Http|http]] 13:04, 2 January 2012 (MST)
::It's kind of non-sense this tool so. To dump already hacked bootroms? --[[User:XiiiX|XiiiX]] 14:21, 2 January 2012 (MST)
:::No. Not really. You may find an exploit outside the bootrom which leads to a jailbreak which you can use to dump the bootrom which can help you to find exploits in the bootrom for later jailbreaks. Jailbreaks based on bootrom exploits can only be fixed with new hardware.--[[User:M2m|M2m]] 15:28, 2 January 2012 (MST)
:::There is no such thing as an "hacked BootROM". We cannot change the contents of the BootROM. Note "ROM" - Read Only Memory. -SquiffyPwn 17:10, 2 January 2012 (CST)
::::That's a better explanation. So we don't need a bootrom jailbreak to use this, just a user-land could work? Why is the necessity of a jailbreak to dump te bootrom? We need the offsets? --[[User:XiiiX|XiiiX]] 16:09, 2 January 2012 (MST)
Do you know what is dump? dump is a copy, to use this tool you MUST have a BootROM Exploit, look the source code, it send the exploit to allow acess to the read-only BootROM memory. Userland exploit here? what offsets?~zmaster

== Compatibility with older devices ==
I looked as payload.s, apparently, everything is in place for older devices (e.g., 0x8b7 for basically every old device). I can't check the actual BDU application, but I'd think it was updated with code needed for older devices as well. Can anyone confirm this? --[[User:Rdqronos|rdqronos]] 14:33, 3 January 2012 (MST)
:Can't get it working with an iPhone 3G with the following values:
EXPLOIT_LR 0x22000000 LOADADDR_SIZE 0x24000 RET_ADDR 0x8b7
:Output looks OK:
sudo ./bdu
______ Bootrom Dumper Utility (BDU) 1.0 ______

(c) pod2g october 2010

[.] Now executing arbitrary code using geohot's limera1n...
sent data to copy: 800
padded to 0x84023000
sent shellcode: 800 has real length 48
never freed: 800
sent exploit to heap overflow: FFFFFFF9
[.] Dump payload started.
[.] Now dumping bootrom to file bootrom.bin...
:But I get a zero sized (empty) bootrom.bin. --[[User:M2m|M2m]] 02:17, 4 January 2012 (MST)
::So it can read the BootROM, but not dump it. Okay. --[[User:Rdqronos|rdqronos]] 13:04, 4 January 2012 (MST)
:::Not sure if it can be read correctly or not. --[[User:M2m|M2m]] 17:16, 4 January 2012 (MST)

== Working on OSX? ==

Did anybody get this working on OSX? I could compile the payload.bin and tried with both the included binary and also with the recompiled one on a MacMini OSX 10.6.8 with an iPhone 4 (with iOS 5.0.1), libusb 1.0.8 is installed. I also tried with a 3GS and the forked code (just uses the different offsets). In all cases I always get "device stalled" and the bdu terminates. I know it worked on Linux for others, but anybody had success on OSX yet? I'm not sure where to start debugging, as I'm not a Mac user. -- [[User:Http|http]] 16:36, 11 January 2012 (MST)
: I compiled it under OSX Lion and can also run it but I only get a zero sized dump. May or may not be a problem of the program & Lion or that I only have iPhone2G & 3G to test.--[[User:M2m|M2m]] 04:15, 12 January 2012 (MST)

== Dumping 3GS bootrom from OSX 10.7.2 ==

bash-3.2# ./bdu
______ Bootrom Dumper Utility (BDU) 1.0 ______

(c) pod2g october 2010

[.] Now executing arbitrary code using geohot's limera1n...
sent data to copy: 800
padded to 0x84023000
sent shellcode: 800 has real length 48
never freed: 800
sent exploit to heap overflow: FFFFFFF9
[.] Dump payload started.
[.] Now dumping bootrom to file bootrom.bin...
Segmentation fault: 11

Any ideas? I've changed all the offsets to the ones in the wiki and yet still no success.

The iPhone Wiki:Community portal

2012-01-14T19:22:49Z

Ryanb93: /* silversn0w */

{{Talk Archive|2010|2011|2012}}
This is the place to post tasks that need to be done on the wiki. Also this is the place for proposed changes. I heard about people wanting a favicon and arranging the main page into categories.

== Site Related Requests ==
=== Corona Info ===
We need to get Corona info integrated into the wiki. There's good info here: http://pod2g-ios.blogspot.com/2012/01/details-on-corona.html [[User:Beej|beej]] 21:54, 2 January 2012 (MST)beej

=== silversn0w ===
Am I allowed to propose a new page for my new program silversn0w? --[[User:Dylan Laws|Dylan Laws]] 23:48, 13 January 2012 (MST){{unsigned|Dylan Laws|14 January 2012, 5:44 GMT}}
:What does it do? --[[User:Http|http]] 23:27, 13 January 2012 (MST)
::Right now its a limera1n injector, you can upload files through iBoot (e.g iBSS, iBEC, ramdisks), but im working on making it a jailbreak.--[[User:Dylan Laws|Dylan Laws]] 23:48, 13 January 2012 (MST)
Is this ok? --[[User:Dylan Laws|Dylan Laws]] 11:29, 14 January 2012 (MST)
::You just posted it anyway and its crap, can someone delete the page? --[[User:Ryanb93|Ryanb93]] 12:22, 14 January 2012 (MST)

=== 2.2b1 ===
Is 2.2b1 5G26 or 5G27, because on [[Beta Firmware]], it says 5G27... --[[User:Balloonhead66|Balloonhead66]] 19:48, 6 August 2011 (MDT)

=== Key pages ===
I would like to propose a new rule: Do not create a key page (e.g.- [[Jasper 8C148 (iPad)]]) unless you can also provide at least one key. Key pages are meant to share decryption keys with others. Copying and pasting from a template page provides us with no information whatsoever, and also wastes time (both the poster's and the administrators'). Thoughts on this? --[[User:Dialexio|Dialexio]] 21:50, 4 November 2011 (MDT)
:I'm against that. While I agree we shouldn't create all empty pages to fill out later, I don't see any reason to have a rule for that. Or was that a problem recently and I missed it? I also created pages with very few content (like [[Siri]]), that other users picked up or hopefully will pick up and enhanced. Key pages are a little different though. And the page you reference was never empty (but had wrong keys initially). So if you feel a big need to have such a rule, go on. -- [[User:Http|http]] 05:06, 5 November 2011 (MDT)
::I was simply using that page as an example of a key page, for those that had no clue what I was talking about. I think that posting an article with little content is a bit different from an empty key page; at least a small amount of information is being provided. In addition, it's easier to tell whether a key page needs to be filled out or not if the key page's link is red because the page was never created. I'll wait for additional feedback from anybody else before I decide on whether or not to add this to the rules. --[[User:Dialexio|Dialexio]] 11:31, 5 November 2011 (MDT)
:::Ok --[[User:Balloonhead66|Balloonhead66]] 16:58, 12 December 2011 (MST)

=== New Upper Left Image ===
If someone has a good one, I'll change it. Who still has an iPhone 2G? --[[User:Geohot|geohot]] 13:11, 12 December 2011 (MST)
:[[:File:NewLogo.png]]? Problem is one like that doesnt scale well. Maybe a rotated (like this) image of an [[n94ap|iPhone 4S]] or an [[iPad 2]]. I have an image of a rotated iPhone 4S if you want... --[[User:Balloonhead66|Balloonhead66]] 14:04, 12 December 2011 (MST)
:Something with an iPhone and the [[:File:Iptwiki.png|iPhone wiki logo]] from the main page would look good. I'll see if I can make one up. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 23:06, 17 December 2011 (MST)
:why not the [http://en.wikipedia.org/wiki/File:Apple_iOS.svg iOS logo]? --[[User:M2m|M2m]] 10:02, 18 December 2011 (MST)
::I don't think we can use that because it's a copyrighted logo. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:06, 18 December 2011 (MST)
::Agreed --[[User:Balloonhead66|Balloonhead66]] 18:15, 18 December 2011 (MST)
:Mine requires a bit of [[User:thekirbylover/skin.css|extra CSS]] for it too look good. This can be added to [[Mediawiki:skin.css]]. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 17:59, 19 December 2011 (MST)
:i have an iPhone 2G geohot! --[[User:Zmaster|Zmaster]] 12:08, 24 December 2011 (MST)
:Ok, I got something from @iSurenix. He says: "In case you don't like it, I can always fix it up etc. but I think it looks new, fresh and updated." -- [[User:Http|http]] 13:40, 25 December 2011 (MST)
::Excellent! --[[User:balloonhead66|Cole Johnson]] 14:54, 25 December 2011 (MST)
::I think it blends into the background too much because the iPhone is white. Thats just my opinion thought. Otherwise I like it. --[[User:JacobVengeance|Jacob]] 16:18, 25 December 2011 (MST)
:::Maybe a black one? --[[User:balloonhead66|Cole Johnson]] 17:14, 25 December 2011 (MST)
:::I got a resized version from him and uploaded it. Some Mediawiki documentation said ideal size is 135x135 (max 150x150). And about the white he commented: "I like how I've used the white iPhone. It's lie I've said "new and fresh". Not a lot places use white iPhones. Let alone in that specific position. I like it." (@iSurenix). -- [[User:Http|http]] 17:09, 26 December 2011 (MST)
::::We could put a background behind the page if it's staying white... maybe the iOS textured background? [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 19:15, 26 December 2011 (MST)
::::[[User:thekirbylover/skin.css|Here's the css]] for the textured background I was talking about. To try it, copy and paste this to your address bar: <tt>javascript:void(importStylesheet("User:thekirbylover/skin.css"))</tt> [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:31, 31 December 2011 (MST)
:I like both of these! The white one seems a bit more "professional" so that's nice, but the text is a little pale. They're both better than the existing logo though, so I'd be happy with either. [[User:Britta|Britta]] 18:17, 31 December 2011 (MST)
:Why isn't the p in iPhone capitalized? Otherwise, I like the white one. I also like the skin, if general consensus is change the skin I will do it. --[[User:Geohot|geohot]] 16:54, 5 January 2012 (MST)
::He just updated to "iPhone" - new image uploaded. -- [[User:Http|http]] 17:15, 6 January 2012 (MST)
:::Thanks! Image has been changed --[[User:Geohot|geohot]] 22:42, 7 January 2012 (MST)
==== Proposed logos ====
These are thumbnails, click on them to view in normal size.
<gallery>
File:thekirbylover's iPhone Wiki logo.png|[[User:thekirbylover|thekirbylover]]
File:Theiphonewiki.png|{{twitter|iSurenix}}
</gallery>

=== Cydia links ===
Links to Cydia, such as cydia://package/com.example.test, don't seem to wanna be linkified by the wiki, but there's an internal setting you can change: <tt>$wgUrlProtocols[] = "cydia://";</tt>. You might also want to use [[MediaWiki:Vector.css]] to add a mini Cydia icon next to it. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:06, 18 December 2011 (MST)
:As for the ''localsettings.php'' change, this is [[user:geohot|geohot]]'s problem. As for the CSS change, we could use [http://theiphonewiki.com/wiki/images/thumb/9/91/Cydia.png/16px-Cydia.png Cydia.png@16px]. --[[User:Balloonhead66|Balloonhead66]] 18:15, 18 December 2011 (MST)
::Yep, I was gonna put that CSS in my [[User:thekirbylover/monobook.css]] after I posted that. Also, correct me if I'm wrong, but I think Monobook.css is used on Vector pages too. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:21, 18 December 2011 (MST)
:::I checked the source and the "/load.php?{CRAP}" are empty and for some reason, {{wp|Google Chrome}}'s "Inspect Element" show up styles... --[[User:Balloonhead66|Balloonhead66]] 18:29, 18 December 2011 (MST)
:::/skin.css is cross skin while /vector.css and /monobook.css are per-skin --[[User:Balloonhead66|Balloonhead66]] 18:31, 18 December 2011 (MST)
Support added --[[User:Geohot|geohot]] 16:54, 5 January 2012 (MST)
:Thanks! [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 20:04, 5 January 2012 (MST)

===Theme===
<s>Oh, also, can you please install the [[mediawikiwiki:Extension:Gadgets|gadgets]] extension and add these pages:
MediaWiki:Gadgets-definition <tt>* betatheme[ResourceLoader]|betatheme.css|betatheme.js</tt>
MediaWiki:Gadget-betatheme <tt>Beta theme (works best with the Vector theme)</tt>
MediaWiki:Gadget-betatheme.css <tt>@import "/wiki/index.php?title=[[User:thekirbylover/skin.css]]&action=raw&ctype=text/css";</tt>
MediaWiki:Gadget-betatheme.js <tt>importScript("[[User:thekirbylover/skin.js]]")</tt>
(or you can give me admin privileges and I'll take care of the mediawiki:gadget pages) [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 00:59, 7 January 2012 (MST)</s>
:Can't you just put the css in [[Mediawiki:Common.css]] and the js in [[Mediawiki:Common.js]]? It would make it so any admin can edit instead of just you, which might be better. --[[User:balloonhead66|Cole Johnson]] 11:25, 7 January 2012 (MST)
::Yeah, I thought of that a while after I posted it. Though I'd still need admin privileges to edit them. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 15:58, 7 January 2012 (MST)
:::I'm happy to point the global CSS to your page, reading about Gadget now...though a global js you can edit, particularly one that imports offsite js, will require some persuading? :P --[[User:Geohot|geohot]] 22:26, 7 January 2012 (MST)
:::I tried adding an import to the vector skin default css, didn't work. Still want me to do the gadget thing? --[[User:Geohot|geohot]] 22:42, 7 January 2012 (MST)
::::Add <tt>@import "//cdn.hbang.ws/css/iphonewiki.css";</tt> to [[MediaWiki:Vector.css]] and <tt>importScriptURI("//cdn.hbang.ws/js/iphonewiki.js");</tt> to [[MediaWiki:Common.js]] - both links are to my site and should be live in a few minutes. Also, you'll want to look at allowing more database connections - I've been getting "This wiki has a problem - max_connections reached" a lot lately. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 22:50, 7 January 2012 (MST)
::::css import still isn't working, did I do it right? External javascript is a security vuln, if there are really worthwhile things to be added in javascript(I don't really like the share buttons they add to everything these days, and wikipedia doesn't AJAX), then I'll add them directly on this site. I know about the database problem, looking into it now --[[User:Geohot|geohot]] 22:59, 7 January 2012 (MST)
:::::CSS's live now - check [http://cdn.hbang.ws/css/iphonewiki.css] to see if it comes up. I believe the internal css files are cached by MediaWiki, so maybe try the @import line in Vector.css, then clear your cache, shift+click on refresh in Chrome and Firefox.
:::::I'll remove the ajax/share js, though I still want to use js to make checkboxes into iOS switches, which could just be on [[MediaWiki:Common.js]]. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 23:12, 7 January 2012 (MST)
::::::Imports didn't work, no idea why, chrome didn't even try to load the imported css, so I pasted right in vector. Any downsides? And any way to give you edit rights to that page? I will e-mail about max_user_connections before I go to bed tonight, it's currently set at 15. It may also be time to move this wiki to a bigger server, my account gets CPU throttled all of the time(and as a result the page is a little slow), though I'm not sure where, this site gets about 2 qps. --[[User:Geohot|geohot]] 23:29, 7 January 2012 (MST)
:::::::Theme's working now, must have just been the wiki caching it. Do a ctrl+click refresh to clear your cache; tap refresh then refresh again on mobile safari. Is the site on shared hosting or VPS? When I get my server running, I'll be happy to run it from here. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 23:34, 7 January 2012 (MST)
I made a few minor tweaks to the CSS to resemble iOS 5 a little more (in browsers that have good CSS 3 support, anyways). I'll happily revert the changes if they're not well-received. (I think it looks better, but I am kinda biased on this. :P) And great job on the theme, guys! --[[User:Dialexio|Dialexio]] 01:58, 8 January 2012 (MST)
:Thanks ;) Your additions look cool, though I'm working on making the first heading look like a title bar on iOS. Also, looks like geohot put my css on [[MediaWiki:Vector.css]], which is now overriding the one on my server - can you please take it off and add <tt>@import "http://cdn.hbang.ws/css/iphonewiki.css";</tt> so it loads from my server? (I'll include your changes to my css.) Or someone can make me a sysop so I can edit it myself. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 02:20, 8 January 2012 (MST)
::Sure. I would like to keep everything on The iPhone Wiki though, so this may be a temporary thing until the theme feels complete and any kinks in the CSS are worked out. --[[User:Dialexio|Dialexio]] 11:42, 8 January 2012 (MST)
:::I tried the import last night, it didn't work. External css is fine temporarily, external js is never allowed. --[[User:Geohot|geohot]] 12:27, 8 January 2012 (MST)

I'd just like to throw my objection into the bucket here, because the new theme overwrote Vector and thus does not allow me to easily revert it. (MonoBook is the 500 year old wikipedia theme)

I also know someone who would gladly host this site so the database doesn't constantly time out, and has more open connections, for relatively low cost with good speed and uptime. If you'd like me to put you in touch geohot email me at my wiki username at gmail. --[[User:Acfrazier|Acfrazier]] 12:51, 8 January 2012 (MST)
:Yea, an option for theme could be added. I'm trying to deal with the max_user_connections now, though hostmonster claims it was always 15. The whole thing is fishy, since php is single threaded and there are only 10 php processes running. If I move, it'll probably be to EC2, like $500 per year but I get to be root on the server. --[[User:Geohot|geohot]] 13:01, 8 January 2012 (MST)
::At this point I'd be willing to pay for it, I've known this guy for ten years so I'd get a decent rate (we could probably get a dedicated so you'd have root). It's hard to do maintenance edits when it times out and this has been a problem for a few weeks that I've seen, that's why I haven't done much (but soon I'll have a lot of info to add). It's greatly upsetting that this entire wealth of information is here, but it's semi-inaccessible. --[[User:Acfrazier|Austen Frazier]] 13:09, 8 January 2012 (MST)
:::Yea, I'm digging into it now, it's only gotten bad recently. It looks like they messed with mysql on nov 22, 2011. It doesn't appear to be a bandwidth issue, it's a connection issue. For some reason, each php process is making two connections to the database. 10*2 = 20 > 15. Time to read some PHP, or figure out how to only launch 7 processes. --[[User:Geohot|geohot]] 13:18, 8 January 2012 (MST)
::::Well, my host suggested that you could use http://www.mediawiki.org/wiki/Extension:APC on his hosting and it'd give you a lot more breathing room. Most hosts limit you to 15 db connections (to prevent crashing the server with the 'slashdot effect' but hostgator's server is probably massively overloaded.) EC2 doesn't have good enough disk performance for database access. He told me he could have you moved today if you wanted to do it, I can get you in touch with him. The reason I primarily go with him is it's one to one, he runs his own stuff. If something comes up you have direct support. It's kind of hard being the middleman though, in my opinion he'd be worth talking to. (I'd appreciate it if you'd email me, with the timeout this is getting exceedingly hard to reply). --[[User:Acfrazier|Austen Frazier]] 13:31, 8 January 2012 (MST)
:::::Error is hopefully fixed! Edited mediawiki to use mysql_pconnect instead of mysql_connect and limited db connections to one per process. I'll send you an e-mail tonight about possibly moving the site, although I'm going to do a little profiling here first, I've been with hostmonster for a while and overall they have been good. Currently I don't have a cache, looking into APC or memcached as a middle layer between the db and php(yay php-memcached-mysql just like facebook). --[[User:Geohot|geohot]] 13:40, 8 January 2012 (MST)
::::::Nope. Hot an error on last save. Hostinginsiders. $7 a month. CPanel. Full control over the server. Etc. --[[User:balloonhead66|Cole Johnson]] 14:25, 8 January 2012 (MST)
:::::::I'm not particularly concerned with price as I am reliability, hence why I offered my host. (That's not to say he's expensive, but.. you get what you pay for.) It may be fixed, but page load times are still unnecessarily long. I look forward to your email, geohot. --[[User:Acfrazier|Austen Frazier]] 15:52, 8 January 2012 (MST)
:Re the theme, geohot can go to the skins folder, copy Vector.php -> iPhone.php and rename the class names to say iPhone instead of Vector (but not the css files), then move [[MediaWiki:Vector.css]] -> [[MediaWiki:Iphone.css]] and in LocalSettings.php, <tt>$wgDefaultSkin="iphone";</tt>. Then there will be an option to go back to regular Vector.
:With the slowdowns, it's probably 'cause MW 1.17 uses a load.php script (ResourceLoader) to combine css/js to be faster, but it also opens a new connection to the database to see what it can load from MediaWiki:Common.css, etc. I haven't run MW myself since 1.16, so I'm not entirely sure what to do there, but a cache extension should do the trick. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 19:20, 8 January 2012 (MST)
:Also, geohot, Chrome Web inspector says there's no client-side caching, meaning images get re-downloaded every time. Try putting [http://pastie.org/3151957 this code] into a .htaccess file in the wiki folder. It'll force caching of files, especially the images in the background of the theme. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]]
[[Special:Contributions/thekirbylover|lover]] 19:38, 8 January 2012 (MST)
::I see 304s for the images. This resourceloader thing is annoying, even to send a 304 it has to load the damn php environment(i'm using fastcgi, but still) for each js and css file. The db errors are gone, but at the cost of performance. I enabled mw filecache, but it doesn't solve the problem. I believe the slowness is caused by the CPU throttling. I need a real server. --[[User:Geohot|geohot]] 20:28, 8 January 2012 (MST)
The new icon looks fantastic! I just have a minor issue with the new theme: the grey pinstripe background reduces readability of the text by some degree, with decreased contrast and the pattern of the pinstripes. Can I nominate the lighter grey color and more subtle pinstriping of tables (like "Contents" boxes) as the main text background color? I guess then the Contents boxes would be the same color, or even lighter, and that seems OK too. It'd be a little bit of a departure from Apple style, but I think it'd be a worthwhile change for a text-focused site. Thanks! [[User:Britta|Britta]] 18:07, 8 January 2012 (MST)
:I'm planning to put the page into boxes, like the Settings app, so that should make it easier to read. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 19:20, 8 January 2012 (MST)
::OK! I imagine that boxes might be visually distracting...but I'll comment on it when I see it. :) Also, the left sidebar seems to be white at the moment instead of linen-textured; I imagine that just means that an image link is temporarily broken or something? Might also be helpful to have a backup background color listed in the CSS? [[User:Britta|Britta]] 20:47, 8 January 2012 (MST)
:::I might actually just go with a gradient background like iPad settings, instead of using boxes. With the sidebar, not sure exactly what's happening there, I guess I forgot to add a backup color :/ [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 20:56, 8 January 2012 (MST)
Could an admin please add [[User:thekirbylover/monobook.css]] to [[MediaWiki:Monobook.css]], so the logo is readable in that skin? [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 01:26, 13 January 2012 (MST)
:I added some CSS to improve the logo's readability a little more, but I chose not to add your CSS in case people don't like the iOS theming. --[[User:Dialexio|Dialexio]] 16:48, 13 January 2012 (MST)
08:34, 14 January 2012 (MST)08:34, 14 January 2012 (MST)
Why is there a weird reflection under the new top left image? Is that a code or someone edited it that made that? The reflection doesn't look right at all. Can someone remove that, please? Also, the top back linen area looks out of place when it crosses the top banner, which also looks off. I there a way to cut it JUST as it touched that banner? --Surenix
:Done. (The reflection was only CSS for WebKit-based browsers, by the way.) --[[User:Dialexio|Dialexio]] 11:18, 14 January 2012 (MST)

===Rename===
I was wondering if you can install [[mediawikiwiki:Extension:Renameuser|Renameuser]] and make me an admin? --[[User:balloonhead66|Cole Johnson]] 11:21, 7 January 2012 (MST)
:Installed, who do you want renamed? --[[User:Geohot|geohot]] 22:26, 7 January 2012 (MST)
::I wanted to be renamed to 5urd. My twitter account name --[[User:balloonhead66|Cole Johnson]] 14:16, 8 January 2012 (MST)

=== MD Bootrom ===
Editing the [[models]] page, I noticed that the new white [[iPod4,2|iPod touch 4]]s have MD bootroms. However, I'm not sure about the black models, so can someone with a black touch 4 bought after September please tell me which model is reported in Settings? Thanks. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 23:46, 22 December 2011 (MST)
:Those are not bootroms; those are model numbers. According to Apple's online store, the black iPod touch 4G still has the same "MC" model numbers as before. --[[User:Dialexio|Dialexio]] 10:27, 23 December 2011 (MST)
::Ah, I see. Thanks for checking. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 16:33, 23 December 2011 (MST)

=== Slowness ===
I've added a filecache to hopefully speed things up a bit, and I removed fastcgi. It's a bit more bearable now, post here if you feel otherwise. I believe the majority of the slowness is the CPU throttling of my webhost and PHP's love for eating up CPU. We'll see how it goes for the next few days. --[[User:Geohot|geohot]] 21:45, 8 January 2012 (MST)
:Thank you for everything! I do get this once-in-a-while though. (1 in 10 requests [not as bad as before]):
HTTP Error 500 (Internal Server Error): An unexpected condition was encountered while the server was attempting to fulfill the request.
:--[[User:balloonhead66|5urd]] 22:02, 8 January 2012 (MST)
:I also get 503 Service Temporarily Unavailable sometimes. The worst I've gotten is a completely blank page, not even any html. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 22:24, 8 January 2012 (MST)
:It's back to normal again; usable, but incredibly slow, with sometimes timeouts or other errors. Do you have access logs over time periods? Maybe it's just the increased traffic. For example pod2g's blog links here, so that normal users read some stuff. And related to caching, I've set the option in Preferences to not cache the pages. That doesn't help, but I'm still suffering the Mobile Safari caching bug. (Just don't make it worse.) Mobile Safari caching bug: when on the Recent Changes page (showing up to date content), clicking on some diff to show the changes, doing nothing and press browser Back button goes back to Recent Changes page, but (sometimes) showing data that is days old. --[[User:Http|http]] 01:22, 9 January 2012 (MST)
::(The Mobile Safari caching bug seems to be happening [https://www.google.com/search?q=iOS+5+safari+back+button+cache across many different sites].) [[User:Britta|Britta]] 05:42, 9 January 2012 (MST)
:Looking around the wiki, I noticed that I'll get a blank page if I visit a page that hasn't been visited since it was last edited (though I might be wrong), and the css (even the base vector css!) keeps going on-and-off. Geohot, have you tried the caching directions I [[#Theme|posted above]]? [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 07:39, 9 January 2012 (MST)
Hostmonster upgraded me to a better server. Seems fast now. Yay hostmonster! --[[User:Geohot|geohot]] 09:24, 10 January 2012 (MST)
:Definitely feels 1000 times faster! Thanks! [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]]
::Well, if you decide to move (if the site outgrows this server, again) you know where to find me. --[[User:Acfrazier|Austen Frazier]] 11:05, 10 January 2012 (MST)
:Wow, it's working again! Thank you! -- [[User:Http|http]] 16:15, 10 January 2012 (MST)

=== 1.18 ===
Mediawiki 1.18 is out and includes many security fixes. --[[User:balloonhead66|5urd]] 23:31, 8 January 2012 (MST)

SAM

2011-01-31T22:50:42Z

Ryanb93:

[[Image:45761.png|right|thumb|SAM]]
==Subscriber Artificial Module (SAM)==

This will allow you to do official activation on an [[iPhone]] without a stock SIM and without using [[hacktivation|hacktivation]].

The [[IPhone_Dev_Team|iPhone Dev team]] states that, “Subscriber Artificial Module (SAM)” tricks your [[iPhone]] and [[iTunes]] into creating legitimate activation tickets even though you’re unlocked with [[ultrasn0w]]. This means you get the full benefit of push applications."

==Benefits==

Unlike hacktivation, SAM does not seem to put extra strain on the battery life of the device or interfere with push notifications as an individual ticket is created per device.

2010-12-30T14:22:01Z

Ryanb93: uploaded a new version of "Image:AppleTV.jpg"

2010-12-30T14:10:03Z

Ryanb93: /* Packaged iOS Software */

K66AP

2010-12-30T14:09:48Z

Ryanb93: /* Packaged iOS Software */

K66AP

2010-12-30T14:08:22Z

Ryanb93: /* Packaged iOS Software */

K66AP

2010-12-30T13:46:01Z

Ryanb93:

K66AP

2010-12-29T12:21:18Z

Ryanb93: some parts of this didnt really look in the correct order, added a few new things

This is the Apple TV 2G.

==Introduction==
The second-generation Apple TV, a digital media receiver made and sold by Apple Inc., was unveiled during an Apple press conference on September 1, 2010. It is a small form factor network appliance designed to play digital content originating from the iTunes Store, Netflix, YouTube, Flickr, MobileMe, Online Radio or any Mac OS X or Windows computer running iTunes onto an enhanced-definition or high-definition widescreen television, and will accept music, video and photo streams from other iOS devices using Airplay in 4.2. It sold 250,000 in it's first two weeks available.

After being jailbroken it can stream music from Last.fm, browse the web, show RSS feeds, use the PLEX Client and run most previous iOS terminal applications via SSH until a local terminal application is created.

== Application Processor ==
It uses the [[S5L8930]] [[application processor]].

== Specifications ==
'''Size''': 23 mm (0.9 inches) (h), 98 mm (3.9 inches) (w), 98 mm (3.9 inches) (d) 
'''Weight''': 0.6 pounds 
'''I/O''': HDMI, Optical audio, 10/100 Mbps Ethernet, IR receiver, Micro-USB port 
'''Storage Capacity''': 8 Gigabytes (Not directly usable)

*Samsung K9LCG08U1M 8GB NAND Flash chip
*256 MB RAM
*Apple 343S0479 1005 005BB
*M430 F2350 TI E03K C0GP G4
*SMSC 8710A-EZK B1023-A2 (10/100 Ethernet Transceiver)
*TXC MUGT 27.000
*TXCPCUM3 50.000
*Apple 338S0891

The Apple TV uses the dual-band [[BCM4329]] for Wi-Fi communications; it supports 802.11 a/b/g/n on both frequencies (2.4 GHz and 5 GHz).

== Packaged iOS Software ==
Lowtide is the application running on the AppleTV. It is essentially an updated "FrontRow" system that handles all user interaction, video playback, streaming, etc. It has been shown to run on other iOS hardware such as the iPod Touch.

== Dock Connector ==
The Apple TV 2G has [http://guide-images.ifixit.net/igi/GyAEfCsoVVLJD3a5.medium a predetermined spot that is apparently for a 30-pin dock connector]. This is most probably here for Apple's in-house developer units.

The default Apple TV hardware does not allow you to use the HDMI port and the micro-USB port at the same time. Adding a dock to the spot will bypass this hardware restriction, allowing both hacking and viewing.

Soldering to the dock terminals on pins 2 and 3 failed to get analog audio out. It is not know if this is because of a hardware or software limitation. Sound was able to be produced out of the HDMI port but no sound came out of the dock pins corresponding to audio out on other iOS devices.

== Jailbreak Status ==

Currently, Cydia's Graphical User Interface has not been ported to the Backrow Frappliance model, however the Command Line tools such as 'apt-get' are fully intact and functional.

As all iOS-devices are concerned, SSH exposes full access to your devices. As such, it is important to make sure that you change your root password ('alpine') as soon as possible.

You can do this by logging into your Apple TV via SSH as root.

su
alpine
passwd
Enter new password

Currently, the vast majority of GUI Applications provided by Cydia will not run on the AppleTV due to missing libraries and lacking a launcher. Several developers have committed to updating their Applications to run on the AppleTV and make use of the Remote as a valid Input Device.

Tests show that Applications that support a hardware keyboard (Bluetooth or the iPad Dock) can make use of the Apple IR Remote.

It is also possible to install an updated BTStack to the device through NitoTV's installer by searching for BTStack. Once installed it enables the use of a bluetooth keyboard. Useful as it takes a while to write using the included Apple remote.

== Jailbreak Tools ==

'''[[PwnageTool]] 4.1.2''' uses the limera1n exploit to jailbreak as well as auto-install Cydia, SSH and afc2. Some people are reporting problems with PwnageTool creating a correct ipsw file and recognising the correct firmware file. People without their 4.0 SHSH blobs will not be able to use PwnageTool any more to make a custom firmware for 4.0 as they are needed to restore.

'''Greenp0ison''' also makes use of the limera1n exploit. RC5 is being prepared to have Apple TV support. Preview screenshots have been posted by [[Chronic Dev (team)|Chronic Dev]] showing altered menus and a software injector. [http://yfrog.com/bbxdmj]

''Exploits'':

*'''SHAtter''': [[User:pod2g|pod2g]]'s SHAtter exploit has been showcased by [[User:MuscleNerd|MuscleNerd]] and [[User:posixninja|posixninja]] as capable of jailbreaking the Apple TV 2G, but this exploit will not be released for a while due to the release of limera1n's exploit. It is mentioned here mainly for posterity.

*'''[[limera1n]]''': [[User:geohot|geohot]] released the limera1n exploit which is capable of jailbreaking the AppleTV, but as of right now it doesn't install AFC2 or SSH so it is of little practical use for any average Apple TV user, or even most Apple TV seasoned hackers. It never mounts or installs anything, ostensibly not making any changes at all to the Apple TV filesystem.

== Useful Links ==
*[http://nitosoft.com/ATV2/ATV_4.1_2.0_DHFTW.zip Complete Proper Headers for OS 4.1]
*[http://nitosoft.com/ATV2/frappliance_test.zip Sample frappliance template]
*[http://nitosoft.com/ATV2/helloWorld.zip New and Improved Sample frappliance]
*[http://github.com/DHowett/beigelist Dustin Howett's beigelist]
*[http://www.ifixit.com/Teardown/Apple-TV-2nd-Generation-Teardown/3625/1 iFixit Teardown]
*[http://netputing.com/2010/10/01/how-to-save-apple-tv-2g-ios-4-1-shsh-blobs/ How to save SHSH blob]
*[http://pastie.org/1231241 dyldcache listing]
*[http://www.iclarified.com/entry/index.php?enid=12374 Buildable / linkable sample project for ATV-2 via NitoTV]

== 3rd Party Apple TV iOS Software ==
*[http://firecore.com/ Fire Core], a software development group who have released software for the Apple TV (1st Gen), is actively working on a product [http://firecore.com/category/blog-tags/atv-flash-black aTV Flash black] and a corresponding SDK.

*[http://wiki.awkwardtv.org/wiki/NitoTV NitoTV], a popular application and standard set of tools to enhance the functionality for the original Apple TV. [http://www.iclarified.com/entry/index.php?enid=12361 NitoTV is the first publicly disclosed Application running on the AppleTV 2].

Currently, the NitoTV Take 3 release for the current generation Apple TV provides a Weather Forecast and an RSS Reader application within it's own Frappliance wrapper. Its developer has stated that these first two applications were intended as Proof-of-Concepts, as well as serve as a testbed for further development for the [[iOS]]-Based Apple TV.

For more information regarding the state of development, as well as get an installation guide for installing NitoTV to your AppleTV 2, please see: http://wiki.awkwardtv.org/wiki/NitoTV_Take_3

K66AP

2010-12-29T11:59:39Z

Ryanb93:

This is the Apple TV 2G.

==Introduction==
The second-generation Apple TV, a digital media receiver made and sold by Apple Inc., was unveiled during an Apple press conference on September 1, 2010. It is a small form factor network appliance designed to play digital content originating from the iTunes Store, Netflix, YouTube, Flickr, MobileMe, Online Radio or any Mac OS X or Windows computer running iTunes onto an enhanced-definition or high-definition widescreen television, and will accept music, video and photo streams from other iOS devices using Airplay in 4.2. It sold 250,000 in it's first two weeks available.

After being jailbroken it can stream music from Last.fm, browse the web, show RSS feeds, use the PLEX Client and run most previous iOS terminal applications via SSH until a local terminal application is created.

== Application Processor ==
It uses the [[S5L8930]] [[application processor]].

== Specifications ==
'''Size''': 23 mm (0.9 inches) (h), 98 mm (3.9 inches) (w), 98 mm (3.9 inches) (d) 
'''Weight''': 0.6 pounds 
'''I/O''': HDMI, Optical audio, 10/100 Mbps Ethernet, IR receiver, Micro-USB port 
'''Storage Capacity''': 8 Gigabytes (Not directly usable)

*Samsung K9LCG08U1M 8GB NAND Flash chip
*256 MB RAM
*Apple 343S0479 1005 005BB
*M430 F2350 TI E03K C0GP G4
*SMSC 8710A-EZK B1023-A2 (10/100 Ethernet Transceiver)
*TXC MUGT 27.000
*TXCPCUM3 50.000
*Apple 338S0891

The Apple TV uses the dual-band [[BCM4329]] for Wi-Fi communications; it supports 802.11 a/b/g/n on both frequencies (2.4 GHz and 5 GHz).

== Packaged iOS Software ==
Lowtide is the application running on the AppleTV. It is essentially an updated "FrontRow" system that handles all user interaction, video playback, streaming, etc. It has been shown to run on other iOS hardware such as the iPod Touch.

== Dock Connector ==
The Apple TV 2G has [http://guide-images.ifixit.net/igi/GyAEfCsoVVLJD3a5.medium a predetermined spot that is apparently for a 30-pin dock connector]. This is most probably here for Apple's in-house developer units.

The default Apple TV hardware does not allow you to use the HDMI port and the micro-USB port at the same time. Adding a dock to the spot will bypass this hardware restriction, allowing both hacking and viewing.

Soldering to the dock terminals on pins 2 and 3 failed to get analog audio out. It is not know if this is because of a hardware or software limitation. Sound was able to be produced out of the HDMI port but no sound came out of the dock pins corresponding to audio out on other iOS devices.

== Useful Links ==
*[http://nitosoft.com/ATV2/ATV_4.1_2.0_DHFTW.zip Complete Proper Headers for OS 4.1]
*[http://nitosoft.com/ATV2/frappliance_test.zip Sample frappliance template]
*[http://nitosoft.com/ATV2/helloWorld.zip New and Improved Sample frappliance]
*[http://github.com/DHowett/beigelist Dustin Howett's beigelist]
*[http://www.ifixit.com/Teardown/Apple-TV-2nd-Generation-Teardown/3625/1 iFixit Teardown]
*[http://netputing.com/2010/10/01/how-to-save-apple-tv-2g-ios-4-1-shsh-blobs/ How to save SHSH blob]
*[http://pastie.org/1231241 dyldcache listing]
*[http://www.iclarified.com/entry/index.php?enid=12374 Buildable / linkable sample project for ATV-2 via NitoTV]

== Jailbreak Status ==
'''[[PwnageTool]] 4.1.2''' uses the limera1n exploit to jailbreak as well as auto-install Cydia, SSH and afc2.

Currently, Cydia's Graphical User Interface has not been ported to the Backrow Frappliance model, however the Command Line tools such as 'apt-get' are fully intact and functional.

As all iOS-devices are concerned, SSH exposes full access to your devices. As such, it is important to make sure that you change your root password ('alpine') as soon as possible.

Currently, the vast majority of GUI Applications provided by Cydia will not run on the AppleTV due to missing libraries and lacking a launcher. Several developers have committed to updating their Applications to run on the AppleTV and make use of the Remote as a valid Input Device.

Tests show that Applications that support a hardware keyboard (Bluetooth or the iPad Dock) can make use of the Apple IR Remote.

'''Greenp0ison''' also makes use of the limera1n exploit. RC5 is being prepared to have Apple TV support. Preview screenshots have been posted by [[Chronic Dev (team)|Chronic Dev]] showing altered menus and a software injector. [http://yfrog.com/bbxdmj]

''Older Developments'':

*'''SHAtter''': [[User:pod2g|pod2g]]'s SHAtter exploit has been showcased by [[User:MuscleNerd|MuscleNerd]] and [[User:posixninja|posixninja]] as capable of jailbreaking the Apple TV 2G, but this exploit will not be released for a while due to the release of limera1n's exploit. It is mentioned here mainly for posterity.

*'''[[limera1n]]''': [[User:geohot|geohot]] released the limera1n exploit which is capable of jailbreaking the AppleTV, but as of right now it doesn't install AFC2 or SSH so it is of little practical use for any average Apple TV user, or even most Apple TV seasoned hackers. It never mounts or installs anything, ostensibly not making any changes at all to the Apple TV filesystem.

== 3rd Party Apple TV iOS Software ==
*[http://firecore.com/ Fire Core], a software development group who have released software for the Apple TV (1st Gen), is actively working on a product [http://firecore.com/category/blog-tags/atv-flash-black aTV Flash black] and a corresponding SDK.

*[http://wiki.awkwardtv.org/wiki/NitoTV NitoTV], a popular application and standard set of tools to enhance the functionality for the original Apple TV. [http://www.iclarified.com/entry/index.php?enid=12361 NitoTV is the first publicly disclosed Application running on the AppleTV 2].

Currently, the NitoTV Take 3 release for the current generation Apple TV provides a Weather Forecast and an RSS Reader application within it's own Frappliance wrapper. Its developer has stated that these first two applications were intended as Proof-of-Concepts, as well as serve as a testbed for further development for the [[iOS]]-Based Apple TV.

For more information regarding the state of development, as well as get an installation guide for installing NitoTV to your AppleTV 2, please see: http://wiki.awkwardtv.org/wiki/NitoTV_Take_3

List of Apple TVs

2010-12-29T11:55:31Z

Ryanb93:

Apple TV is Apple's self-described hobby. It serves as a media center, so you can access online media through your TV.

== First generation ==
[[Image:AppleTv1g.jpg|thumb|223px|This is the original Apple TV.]]
The original Apple TV (codenamed iTV) was released in 2007. It had component video, HDMI and analog audio output. It ran a modified version of [[wikipedia:Mac OS X Tiger|Mac OS X Tiger]] and contained an Intel processor.

== [[K66ap|Second generation]] ==
[[Image:AppleTv2g.jpg|thumb|300px|This is the second generation Apple TV.]]

The second-generation Apple TV, a digital media receiver made and sold by Apple Inc., was unveiled during an Apple press conference on September 1, 2010. It is a small form factor network appliance designed to play digital content originating from the iTunes Store, Netflix, YouTube, Flickr, MobileMe or any Mac OS X or Windows computer running iTunes onto an enhanced-definition or high-definition widescreen television, and will accept music, video and photo streams from other iOS devices using Airplay in 4.2. It sold 250,000 in it's first two weeks available.

List of Apple TVs

2010-12-29T11:51:08Z

Ryanb93:

Apple TV is Apple's self-described hobby. It serves as a media center, so you can access online media through your TV.

== First generation ==
[[Image:AppleTv1g.jpg|thumb|223px|This is the original Apple TV.]]
The original Apple TV (codenamed iTV) was released in 2007. It had component video, HDMI and analog audio output. It ran a modified version of [[wikipedia:Mac OS X Tiger|Mac OS X Tiger]] and contained an Intel processor.

== Second generation ==
[[Image:AppleTv2g.jpg|thumb|300px|This is the second generation Apple TV.]]

The second-generation Apple TV, a digital media receiver made and sold by Apple Inc., was unveiled during an Apple press conference on September 1, 2010. It is a small form factor network appliance designed to play digital content originating from the iTunes Store, Netflix, YouTube, Flickr, MobileMe or any Mac OS X or Windows computer running iTunes onto an enhanced-definition or high-definition widescreen television, and will accept music, video and photo streams from other iOS devices using Airplay in 4.2. It sold 250,000 in it's first two weeks available.