The iPhone Wiki - User contributions [en]

Firmware Keys

2010-10-17T17:15:39Z

Shengis14:

''vfdecrypt'' redirects here. For other things with vfdecrypt in it's name, go to [[vfdecrypt (disabiguation)]].

== Introduction ==
These keys are for use with the 'vfdecrypt' tool to decrypt the main filesystem DMG found in every iPhone/iPhone 3G/iPod touch .ipsw file. Every key will work on the main filesystem DMG for that build, regardless if it is for the iPhone or iPod touch unless specified. The DMG that you are after is the bigger one, in the case of current builds of 2.0, it can sometimes be 200+ MB!

== VFDecrypt Usage ==
mac: ./vfdecrypt -i <dmg> -o decrypted_fs.dmg -k <key>
windows: vfdecrypt.exe -i <dmg> -o decrypted_fs.dmg -k <key>

== Gaps ==
As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there '''people could get in trouble, and we do not want that'''. Thanks for contributing!

==Coming Soon==
A GUI release of VFDecrypt (called Firmware Decrypter) will be available very soon. It is being made right now and will probably be done in the next two weeks. As a pre-release, a newer easier to use VFdecrypt 2.0 will also be released by Friday October 1st which will allow drag and drop + one click decryption. No more inputting code into terminal as it will be done automatically. However it will be only available on OSX as there is already a Windows Decrypter =D

AutoDecrypt is another program currently being developed, it is a GUI ( with Terminal/CMD optional ) that will automatically decrypt the .dmg comparing it against a database of known vfdecrypt keys. It is being developed originally for Windows but a Linux version will follow soon ( and possibly Mac is someone will port it)

== Downloads ==

* http://rgov.org/files/vfdecrypt-mac.zip (Mac OS X Universal)
* http://iphoneelite.googlecode.com/files/vfdecrypt.zip (Windows)
* http://github.com/dra1nerdrake/VFDecrypt (Maintained fork.)
* Source Credit: http://lorenzo.yellowspace.net/corrupt-sparseimage.html

Also see [[iDecrypt]] for a Windows GUI version or [[iDecrypter]].'

Heres the GUI Vfdecrypt extension (DMG Decrypter) for Mac OS X created by MCTD81. Its in initial release stages but will be updated frequently for bug fixes and new add ons. If you find a bug and would like to report it please contact mcc40295@gmail.com.

http://www.sendspace.com/file/pvuib6

== Firmwares ==
* [[VFDecrypt Keys: 1.x|1.x]]
* [[VFDecrypt Keys: 2.x|2.x]]
* [[VFDecrypt Keys: 3.x BETA|3.x Beta]]
* [[VFDecrypt Keys: 3.x|3.x]]
* [[VFDecrypt Keys: 4.x BETA|4.x Beta]]
* [[VFDecrypt Keys: 4.x|4.x]]

== See also ==
* [[Firmware]] - a page with links to download the firmware images

[[Category:VFDecrypt]]

Greenpois0n (jailbreak)

2010-10-12T10:11:30Z

Shengis14:

Greenpois0n is both a cross-platform hacker toolkit (that helps users to find their own exploits for jailbreaks, write custom ramdisks, and create custom firmwares) as well as [[jailbreak]] tool for iDevices written by the Chronic Dev Team.

== Current Toolset ==

*[http://github.com/chronicdev/cyanide GreenPois0n Cyanide]: [[iBoot]] payload toolkit to help developers discover new vulnerabilities and design super fast, low-level iBoot jailbreaks and exploit payloads, much like the way [[blackra1n]]/[[purplera1n]] works.

*[http://github.com/chronicdev/libdioxin GreenPois0n Dioxin]: MobileDevice toolkit designed to help developers design awesome userland jailbreaks, like how [[Spirit]] works.

*[http://github.com/chronicdev/anthrax GreenPois0n Anthrax]: iPhone ramdisk toolkit to help developers design extremely stable and portable ramdisk jailbreaks, much like the same way [[QuickPwn]]/[[redsn0w]] works.

*[http://github.com/chronicdev/arsenic GreenPois0n Arsenic]: custom firmware toolkit to help developers design jailbreaks to help preserve [[Baseband Firmware|baseband]] and keep unlocks, much in the same way [[PwnageTool]]/[[sn0wbreeze]] works.

== Jailbreak ==
Greenpois0n was originally written using two exploits; the [[SHAtter]] [[bootrom]] [[exploit]] as well as a userland [[exploit]] provided by [[Comex]] to make the jailbreak untethered. A release date of 10/10/10 10:10:10 AM (GMT) was announced, as well as the list of supported devices. Due to the nature of the [[SHAtter]] exploit, only iDevices using the [[S5L8930|Apple A4 Processor]] were supported.
[[user:geohot|geohot]] later released another jailbreak ([[limera1n]] using a different [[bootrom exploit]]) on 9 October 2010, delaying the release of [[Greenpois0n]] together with the [[SHAtter]] exploit.

Greenpois0n has now been released at greenpois0n.com although apparantly it does not work (according to people at ipodtouchfans.com and discussions on IRC (irc.osx86.hu) today)
Greenpois0n is very similar to [[limera1n]], not only do they both use [[Geohot]]s [[bootrom]] [[exploit]] and [[comex]]s [[userland]] [[exploit]] (to untether)
they both have no customization options
=== Controversy ===
There was much controversy surrounding the sudden release of [[limera1n]] and the motives behind it. The main reasons for the [[limera1n]] release were:

#Use an exploit that Apple already knew about (newer iBoots shows the exploit patched)
#Supports more iDevices than [[SHAtter]]
#Hopefully save the [[SHAtter]] [[bootrom]] [[exploit]] for future iDevices

The reason for this is [[bootrom]] [[exploit]]s are not patchable with software updates. It requires new hardware to fix the security hole. Since the [[limera1n]] hole was already discovered and patched Apple, it benefits the community if [[SHAtter]] is saved in hopes of using it with new hardware, like the 5th Generation iPhone/iPod Touch and the 2nd Generation iPad.

Talk:BCM4329

2010-10-11T16:41:12Z

Shengis14: New page: == iPod Touch 3g == Has there been any progress on enabling "N" wifi for the iPod touch 3g? Makes me wish I wasn't so no0by and I could actually help :/ ~~~~

== iPod Touch 3g ==
Has there been any progress on enabling "N" wifi for the iPod touch 3g?
Makes me wish I wasn't so no0by and I could actually help :/ [[User:Shengis14|Shengis14]] 16:41, 11 October 2010 (UTC)

Talk:Limera1n

2010-10-09T19:36:20Z

Shengis14: /* Image Taken Down */

== Drop size on image ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out [[SHAtter]] and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].
Also (if it's real) why is [[User:Geohot|Geohots]] exploit not used and keep [[SHAtter]] for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)

== Image Taken Down ==

I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)

it is now very real [[greenpois0n]] will be cancelled ( said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077] ) and [[Limera1n]] will be used to jailbreak on 4.1 but apple know about both exploit's but geohot's has already being patched ( patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891] ) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)

The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip
[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)

Talk:Limera1n

2010-10-09T07:16:05Z

Shengis14:

== suspicious ==
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that geohot has worked out SHAtter and use it on the three A4 devices that are there and just used the photos app for the 3G(s)
Also (if it's real) why is Geohots exploit not used and keep SHAtter for when there are mire A4 devices around ? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)

== Misc. ==
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)

== Release ==

I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake

== SIGN YOUR COMMENTS ON THE TALK PAGE ==
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake

== Latest edit to [[Limera1n]] ==

How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)

== Who is John Galt? ==

Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)

== Explanation ==

So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake

I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]]

I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)

===UPDATE:===
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)
::: This is a grand waste of a bootrom exploit though. ~Drake
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)

Talk:IBooty

2010-10-04T15:46:11Z

Shengis14: /* Theory */

== Theory ==
This application has caused me to realize that provided one with a late-bootrom device has their SHSH blobs for iOS 3.1.2, they can jailbreak their device indefinitely, using this tethered method. --[[User:Dra1nerdrake|dra1nerdrake]] 15:37, 12 August 2010 (UTC)

Not true this seems to have been fixed since 4.0.1 when apple rewrote the USB handling. --[[User:GreySyntax|GreySyntax]] 17:18, 12 August 2010 (UTC)

: :/ --[[User:Dra1nerdrake|dra1nerdrake]] 17:21, 12 August 2010 (UTC)

But does this block the method use to keep the jailbreak or does it just need rewriten? --[[User:Shengis14|Shengis14]] 15:46, 4 October 2010 (UTC)

Talk:IDecrypt

2010-09-29T12:18:40Z

Shengis14: /* Hosting */ new section

Hi, i (i1029ai) work for some time also on a similar tool

Currently it only runs on the console.
The whole is in beta and is available for x86 for disposal. It consists of the basic tools of xpwn.

Video: http://vimeo.com/12262861
Download: http://idecrypt.hack2learn.org/

{{unsigned|i1029ai|08:59, August 24, 2010 (UTC)}}

==blonde question==
On window, once you decrypt it what tools are available to mount the main filesystem on windows? [[User:Iemit737|Iemit737]] 15:43, 29 August 2010 (UTC)

HFSExplorer is what I use :) [[User:MaybachMan|MaybachMan]] 15:47, 29 August 2010 (UTC)

== Hosting ==

hey, any chance you could host on another site, MediaFire wont work and i cant find a mirror anywhere

--[[User:Shengis14|Shengis14]] 12:18, 29 September 2010 (UTC)