The iPhone Wiki - User contributions [en]

Bugging Debuggers

2011-06-23T13:46:25Z

Tempelorg: Yay, just learned to avoid using "here" in links. Thanks!

Background:

On jailbroken iOS devices crackers have made it possible to remove the DRM from sold applications so that they can be copied to any device without having to pay for them.

As explained in [[Copy Protection Overview]], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.

On of the methods used by crackers is to let the application run in a debugger (gdb) and then save the then unencrypted app image to disk.

This page explains how to foil this method.

== The ptrace() Trick ==

'''IMPORTANT NOTE: This trick has been worked around by pirates. Don't rely on it!'''

GDB is the stock debugger used by most hackers. On darwin (OSX and iPhone OS), GDB will not attach to processes that have asked not to be attached to. Instead, it will crash or crash the target process. This is useful for defeating Crackulous and most tutorial-followers.

On OSX, one would need the following piece of code, as close as possible to the start of main().

ptrace(PT_DENY_ATTACH, 0, 0, 0);

A couple of includes are also in order:

#include <sys/ptrace.h>
#include <sys/types.h>

On the iPhone, however, <sys/ptrace.h> is not available. Fortunately, that can be worked around:

#import <dlfcn.h>
#import <sys/types.h>

typedef int (*ptrace_ptr_t)(int _request, pid_t _pid, caddr_t _addr, int _data);
#if !defined(PT_DENY_ATTACH)
#define PT_DENY_ATTACH 31
#endif // !defined(PT_DENY_ATTACH)

void disable_gdb() {
void* handle = dlopen(0, RTLD_GLOBAL | RTLD_NOW);
ptrace_ptr_t ptrace_ptr = dlsym(handle, "ptrace");
ptrace_ptr(PT_DENY_ATTACH, 0, 0, 0);
dlclose(handle);
}

The following are needed to complete the code, and are left as an exercise for the reader:
* disable_gdb() should return for debug builds (hint: preprocessor macros)
* the string "ptrace" is a dead giveaway, and should probably be obfuscated a bit

User talk:5urd

2011-06-23T13:45:32Z

Tempelorg: /* Rephrase */

==Pictures==
And for the new pictures for the stub pages, you probably just copied them from somewhere on the Internet. Please draw your own images instead of stealing it from somewhere. I'll delete them otherwise. We cannot have the official Apple logo just as a mark for general Apple issues. We might be able to use official product photos or the Apple logo on a page describing Apple, but nothing else. Treat images the same way as software. The jailbreak image probably comes from a scammers page, but it's still not yours, even if they do bad things. [[User:geohot|Geohot]] has enough trouble right now, so don't add copyrighted material to this wiki. I'll delete the images tomorrow if you haven't replaced them by then. Thanks. --[[User:Http|http]] 17:23, 19 February 2011 (UTC)
:Ok, i'll replace the copywrited images with Public domain. --[[User:Balloonhead66|Balloonhead66]] 17:31, 19 February 2011 (UTC)
::Thanks. (I had to laugh when I saw your new Apple!) --[[User:Http|http]] 17:39, 19 February 2011 (UTC)
:::Images:
::::[[:Image:Android logo.png|Android logo.png]] - public domain, kept [[commons:File:Android_robot.svg|On Commons]]
::::[[:Image:Generic iPhone.png|Generic iPhone.png]] - public domain, kept [[commons:File:iPhone.svg|On Commons]]
::::[[:Image:Apple-logo.png|Apple-logo.png]] - logo, copyrited, replaced with [[commons:File:Apple Mac.png|Apple Mac.png from Commons]]
::::[[:Image:Jailbreak.jpg|Jailbreak.jpg]] - unknown license, replaced with [[:Image:Gp.png|Gp.png]]
::::[[:Image:Filesystem Listing.png|Filesystem Listing.jpg]] - from [http://www.hp9845.net/9845/projects/hpdir/ blog], unknown license, replaced with [http://cole.freehostingcloud.com/wiki/File:iphonefw.png Iphonefw.png from my site]
::::[[:Image:Hacking.png|Hacking.png]] - icon from {{wp|GNOME}} project - unreplaced
::::[[:Image:Software Icon.png|Software Icon.png]] - icon, copyrited, replaced wth [[commons:File:Crystal Clear device cdrom unmount.png|Crystal Clear device cdrom unmound.png from Commons]]
::::[[:Image:P2P.gif|P2P.gif]] - unknown license, replaced with [[commons:File:P2P-network.svg|P2P-network.svg from Commons (2000px)]] at [[:Image:P2P.png|P2P.png]]
:::--[[User:Balloonhead66|Balloonhead66]] 17:53, 19 February 2011 (UTC)

== Flooding ==
Please stop flooding the wiki with your changes about your vfdecrypt GUI (one of what like 200?) all the recent changes most of the time are from you about little menial stuff that i doubt most people care about, i had to stop following the wiki twitter account because it seemed like 99.99% of the updates were from you, all useless. PLEASE STOP --[[User:Nito|Nito]] 19:53, 26 May 2011 (UTC)
:Obviously keeping the wiki up to date is more important than inconveniencing anyone regarding their twitter feeds. The more accurate the wiki, the better. [[User:MuscleNerd|MuscleNerd]] 20:40, 26 May 2011 (UTC)
::Yes but when his updates are about stupid crap re: ANOTHER vfdecrypt GUI then i think it does a disservice to everyone who uses the wiki. --[[User:Nito|Nito]] 20:37, 26 May 2011 (UTC)
:::I think it's better not to judge *anyone's* contributions, large or small. This is a community of contributors. [[User:MuscleNerd|MuscleNerd]] 20:40, 26 May 2011 (UTC)
:::: I understand that, but mostly every time i look in the recent changes pages its filled up with garbage about idecryptit or whatever, rendering "recent changes" 99.99% useless imo. --[[User:Nito|Nito]] 20:42, 26 May 2011 (UTC)
::::: The more active the wiki, the better. It means (1) people are contributing (2) info is being refined and corrected. Even if it's the tiniest details, over time that makes a big difference. [[User:MuscleNerd|MuscleNerd]] 20:44, 26 May 2011 (UTC)
::::::Yes, because people learn a lot from a GUI. He uses the wiki as an advertisement for it. --[[User:Cj|cj]] 20:50, 26 May 2011 (UTC)
:::::::If it's a valid wiki topic, then it "deserves" to be updated as much as any other topic. If it's not a valid topic, ask to have it removed. He's actually marking all of his minor edits properly (that bold "m"). Perhaps whoever owns that twitter account shouldn't rebroadcast edits marked as minor like that. [[User:MuscleNerd|MuscleNerd]] 20:54, 26 May 2011 (UTC)
:::::::: I think it straddles the line of "valid" i definitely remember reading somewhere that geo didn't want the wiki to be used as an advertisement for apps --[[User:Nito|Nito]] 20:56, 26 May 2011 (UTC)
::::::::: The rule is actually "don't create a page just to advertise your new website please". More details on the Ground Rules page. [[User:MuscleNerd|MuscleNerd]] 21:02, 26 May 2011 (UTC)
::::::::: I am not advertising. I am just posting relevant info on an iPhone related app. Also, now that is it published, I am done. Whenever a new firmware comes out, the recent changes is flooded with about 30 edits! --[[User:Balloonhead66|Balloonhead66]] 23:16, 26 May 2011 (UTC)
:::::::::: Don't worry about it...feel free to make any changes whenever they're needed. You're actually doing a good job marking minor changes as "m", and those can be filtered from the Recent Changes page via a single click in the user preference panel. (Whoever's running that twitter bot should filter away "m" changes.) [[User:MuscleNerd|MuscleNerd]] 23:29, 26 May 2011 (UTC)
::::::::::: Thanks! I only try to contribute. I never advertise (except with AdWords) and I always try to do my best to make sure this wiki has the latest info. --[[User:Balloonhead66|Balloonhead66]] 23:35, 26 May 2011 (UTC)
:::::::::::: Yep, there can never be "too much" latest info :) The more contributors the better! [[User:MuscleNerd|MuscleNerd]] 23:40, 26 May 2011 (UTC)
::::::::::::: I agree. Thank you for your support in this. If you want to follow the updates, check [[Special:Recentchanges]]. --[[User:Balloonhead66|Balloonhead66]] 02:52, 27 May 2011 (UTC)

== Rephrase ==
Hi, thanks for fixing my bad link on the [[Bugging Debuggers]] page. But what did you mean by your comment "please rephrase that, here is what makes google hate us". What part needs rephrasing? --[[User:Tempelorg|Tempelorg]] 17:20, 21 June 2011 (UTC)
:"Here", "Click here", etc. brings a sites ratings down. It also makes the page more clearer. --[[User:Balloonhead66|Balloonhead66]] 18:55, 21 June 2011 (UTC)
::Ah, I see what you mean now. You should have put "here" in quotes, then I would have understood that you referred using that particular word. Will fix it now. Thanks. [[User:Tempelorg|Tempelorg]] 13:45, 23 June 2011 (UTC)

User talk:5urd

2011-06-21T17:20:21Z

Tempelorg: /* rephrase */ new section

==Pictures==
And for the new pictures for the stub pages, you probably just copied them from somewhere on the Internet. Please draw your own images instead of stealing it from somewhere. I'll delete them otherwise. We cannot have the official Apple logo just as a mark for general Apple issues. We might be able to use official product photos or the Apple logo on a page describing Apple, but nothing else. Treat images the same way as software. The jailbreak image probably comes from a scammers page, but it's still not yours, even if they do bad things. [[User:geohot|Geohot]] has enough trouble right now, so don't add copyrighted material to this wiki. I'll delete the images tomorrow if you haven't replaced them by then. Thanks. --[[User:Http|http]] 17:23, 19 February 2011 (UTC)
:Ok, i'll replace the copywrited images with Public domain. --[[User:Balloonhead66|Balloonhead66]] 17:31, 19 February 2011 (UTC)
::Thanks. (I had to laugh when I saw your new Apple!) --[[User:Http|http]] 17:39, 19 February 2011 (UTC)
:::Images:
::::[[:Image:Android logo.png|Android logo.png]] - public domain, kept [[commons:File:Android_robot.svg|On Commons]]
::::[[:Image:Generic iPhone.png|Generic iPhone.png]] - public domain, kept [[commons:File:iPhone.svg|On Commons]]
::::[[:Image:Apple-logo.png|Apple-logo.png]] - logo, copyrited, replaced with [[commons:File:Apple Mac.png|Apple Mac.png from Commons]]
::::[[:Image:Jailbreak.jpg|Jailbreak.jpg]] - unknown license, replaced with [[:Image:Gp.png|Gp.png]]
::::[[:Image:Filesystem Listing.png|Filesystem Listing.jpg]] - from [http://www.hp9845.net/9845/projects/hpdir/ blog], unknown license, replaced with [http://cole.freehostingcloud.com/wiki/File:iphonefw.png Iphonefw.png from my site]
::::[[:Image:Hacking.png|Hacking.png]] - icon from {{wp|GNOME}} project - unreplaced
::::[[:Image:Software Icon.png|Software Icon.png]] - icon, copyrited, replaced wth [[commons:File:Crystal Clear device cdrom unmount.png|Crystal Clear device cdrom unmound.png from Commons]]
::::[[:Image:P2P.gif|P2P.gif]] - unknown license, replaced with [[commons:File:P2P-network.svg|P2P-network.svg from Commons (2000px)]] at [[:Image:P2P.png|P2P.png]]
:::--[[User:Balloonhead66|Balloonhead66]] 17:53, 19 February 2011 (UTC)

== Flooding ==
Please stop flooding the wiki with your changes about your vfdecrypt GUI (one of what like 200?) all the recent changes most of the time are from you about little menial stuff that i doubt most people care about, i had to stop following the wiki twitter account because it seemed like 99.99% of the updates were from you, all useless. PLEASE STOP --[[User:Nito|Nito]] 19:53, 26 May 2011 (UTC)
:Obviously keeping the wiki up to date is more important than inconveniencing anyone regarding their twitter feeds. The more accurate the wiki, the better. [[User:MuscleNerd|MuscleNerd]] 20:40, 26 May 2011 (UTC)
::Yes but when his updates are about stupid crap re: ANOTHER vfdecrypt GUI then i think it does a disservice to everyone who uses the wiki. --[[User:Nito|Nito]] 20:37, 26 May 2011 (UTC)
:::I think it's better not to judge *anyone's* contributions, large or small. This is a community of contributors. [[User:MuscleNerd|MuscleNerd]] 20:40, 26 May 2011 (UTC)
:::: I understand that, but mostly every time i look in the recent changes pages its filled up with garbage about idecryptit or whatever, rendering "recent changes" 99.99% useless imo. --[[User:Nito|Nito]] 20:42, 26 May 2011 (UTC)
::::: The more active the wiki, the better. It means (1) people are contributing (2) info is being refined and corrected. Even if it's the tiniest details, over time that makes a big difference. [[User:MuscleNerd|MuscleNerd]] 20:44, 26 May 2011 (UTC)
::::::Yes, because people learn a lot from a GUI. He uses the wiki as an advertisement for it. --[[User:Cj|cj]] 20:50, 26 May 2011 (UTC)
:::::::If it's a valid wiki topic, then it "deserves" to be updated as much as any other topic. If it's not a valid topic, ask to have it removed. He's actually marking all of his minor edits properly (that bold "m"). Perhaps whoever owns that twitter account shouldn't rebroadcast edits marked as minor like that. [[User:MuscleNerd|MuscleNerd]] 20:54, 26 May 2011 (UTC)
:::::::: I think it straddles the line of "valid" i definitely remember reading somewhere that geo didn't want the wiki to be used as an advertisement for apps --[[User:Nito|Nito]] 20:56, 26 May 2011 (UTC)
::::::::: The rule is actually "don't create a page just to advertise your new website please". More details on the Ground Rules page. [[User:MuscleNerd|MuscleNerd]] 21:02, 26 May 2011 (UTC)
::::::::: I am not advertising. I am just posting relevant info on an iPhone related app. Also, now that is it published, I am done. Whenever a new firmware comes out, the recent changes is flooded with about 30 edits! --[[User:Balloonhead66|Balloonhead66]] 23:16, 26 May 2011 (UTC)
:::::::::: Don't worry about it...feel free to make any changes whenever they're needed. You're actually doing a good job marking minor changes as "m", and those can be filtered from the Recent Changes page via a single click in the user preference panel. (Whoever's running that twitter bot should filter away "m" changes.) [[User:MuscleNerd|MuscleNerd]] 23:29, 26 May 2011 (UTC)
::::::::::: Thanks! I only try to contribute. I never advertise (except with AdWords) and I always try to do my best to make sure this wiki has the latest info. --[[User:Balloonhead66|Balloonhead66]] 23:35, 26 May 2011 (UTC)
:::::::::::: Yep, there can never be "too much" latest info :) The more contributors the better! [[User:MuscleNerd|MuscleNerd]] 23:40, 26 May 2011 (UTC)
::::::::::::: I agree. Thank you for your support in this. If you want to follow the updates, check [[Special:Recentchanges]]. --[[User:Balloonhead66|Balloonhead66]] 02:52, 27 May 2011 (UTC)

== rephrase ==

Hi, thanks for fixing my bad link on the [[Bugging Debuggers]] page. But what did you mean by your comment "please rephrase that, here is what makes google hate us". What part needs rephrasing?
[[User:Tempelorg|Tempelorg]] 17:20, 21 June 2011 (UTC)

Talk:Main Page

2011-06-21T17:17:00Z

Tempelorg: /* Please explain that it's currently not open to new sign-ups */

{{Talk Archive|2010|2011}}

== Please explain that it's currently not open to new sign-ups ==
Hi, thanks for helping me get an account here. I had wanted to sign up and found that it didn't work - without any explanation why.
Eventually I managed to get in contact with one of the sysops via Twitter and was told that it was closed because of spammers taking over. 
It would be nice if you could add a little note on this on the main page. There it still says that anyone can join. That should be changed. Maybe even with a hint at how someone could still sign up by contacting someone, if he can explain why he needs to be in. 
--[[User:Tempelorg|Tempelorg]] 13:03, 21 June 2011 (UTC)
:I placed a message on the user login page. That should do the trick. :) --[[User:Dialexio|Dialexio]] 16:00, 21 June 2011 (UTC)
::Yes, that should do it. I also noticed that you provided an email address now. Thanks a lot for the quick fix [[User:Tempelorg|Tempelorg]] 17:17, 21 June 2011 (UTC)

== HW Developer related stuff goes where? ==
I am working on a project in which I want to use the Dock connector's serial lines to communicate with an external device. Since Apple makes this very difficult (tried to get into the MFi program with no luck), I found that I probably need to jailbreak the device in order to use these lines directly. 
Finding help in the www was quite disappointing so far (the one by Collin Meyer is quite outdated). So when I figured a few things out now, I'd like to share them. I'd post explanations on how to use these lines on the Dock and how to program them. 
I wonder if this is the right site for such information. The main page claim to be about _anything_ iPhone, but all I find so far is Jailbreak-related. So, what is this about? Shall I post my findings here or do they better fit somewhere else, e.g. the iphonedevwiki? Sadly I can't sign up with iphonedevwiki, either. Gosh, why is it so hard to find a place to share programming on jailbroken devices? Any other suggestions, please? 
--[[User:Tempelorg|Tempelorg]] 13:41, 21 June 2011 (UTC)
:I think it is. This is more appropriate on the [[The iPhone Wiki:Community Portal|Community Portal]], not the [[Main Page]] though --[[User:Balloonhead66|Balloonhead66]] 16:16, 21 June 2011 (UTC)

Talk:Main Page

2011-06-21T13:41:38Z

Tempelorg: /* HW Developer related stuff goes where? */ new section

{{Talk Archive|2010|2011}}

== Please explain that it's currently not open to new sign-ups ==

Hi, thanks for helping me get an account here. I had wanted to sign up and found that it didn't work - without any explanation why.
Eventually I managed to get in contact with one of the sysops via Twitter and was told that it was closed because of spammers taking over.

It would be nice if you could add a little note on this on the main page. There it still says that anyone can join. That should be changed. Maybe even with a hint at how someone could still sign up by contacting someone, if he can explain why he needs to be in.
[[User:Tempelorg|Tempelorg]] 13:03, 21 June 2011 (UTC)

== HW Developer related stuff goes where? ==

I am working on a project in which I want to use the Dock connector's serial lines to communicate with an external device. Since Apple makes this very difficult (tried to get into the MFi program with no luck), I found that I probably need to jailbreak the device in order to use these lines directly.

Finding help in the www was quite disappointing so far (the one by Collin Meyer is quite outdated). So when I figured a few things out now, I'd like to share them. I'd post explanations on how to use these lines on the Dock and how to program them.

I wonder if this is the right site for such information. The main page claim to be about _anything_ iPhone, but all I find so far is Jailbreak-related. So, what is this about? Shall I post my findings here or do they better fit somewhere else, e.g. the iphonedevwiki? Sadly I can't sign up with iphonedevwiki, either. Gosh, why is it so hard to find a place to share programming on jailbroken devices? Any other suggestions, please?

[[User:Tempelorg|Tempelorg]] 13:41, 21 June 2011 (UTC)

Device Nodes

2011-06-21T13:30:47Z

Tempelorg: link to /dev

The underlying unix OS that powers the iPhone has a number of device nodes.
These nodes can be read from or written to by the OS or applications.

See also [[/dev]].

==Overview==
A iPhone 3G 2.0.2 contains:

crw-rw-rw- 1 root wheel 21, 0 Aug 28 15:35 aes_0
crw------- 1 root wheel 23, 0 Aug 28 18:56 bpf0
crw------- 1 root wheel 23, 1 Aug 28 18:56 bpf1
crw------- 1 root wheel 23, 2 Aug 28 15:35 bpf2
crw------- 1 root wheel 23, 3 Aug 28 15:35 bpf3
c------r-- 1 root wheel 11, 0 Aug 28 15:35 btreset
crw--w--w- 1 root wheel 0, 0 Aug 28 15:35 console
crw-rw-rw- 1 root wheel 1, 5 Aug 28 18:56 cu.bluetooth
crw-rw-rw- 1 root wheel 1, 7 Aug 28 15:35 cu.debug
crw-rw-rw- 1 root wheel 1, 1 Aug 28 15:35 cu.iap
crw-rw-rw- 1 root wheel 1, 3 Aug 28 15:35 cu.umts
brw-r----- 1 root operator 14, 0 Aug 28 15:35 disk0
brw-r----- 1 root operator 14, 1 Aug 28 15:35 disk0s1
brw-r----- 1 root operator 14, 2 Aug 28 15:35 disk0s2
crw------- 1 root wheel 9, 0 Aug 28 15:35 dlci.spi-baseband.0
crw------- 1 root wheel 9, 1 Aug 28 18:56 dlci.spi-baseband.1
crw------- 1 root wheel 9, 10 Aug 28 15:35 dlci.spi-baseband.10
crw------- 1 root wheel 9, 11 Aug 28 15:35 dlci.spi-baseband.11
crw------- 1 root wheel 9, 12 Aug 28 15:35 dlci.spi-baseband.12
crw------- 1 root wheel 9, 13 Aug 28 15:35 dlci.spi-baseband.13
crw------- 1 root wheel 9, 14 Aug 28 15:35 dlci.spi-baseband.14
crw------- 1 root wheel 9, 15 Aug 28 15:35 dlci.spi-baseband.15
crw------- 1 root wheel 9, 2 Aug 28 19:13 dlci.spi-baseband.2
crw------- 1 root wheel 9, 3 Aug 28 18:56 dlci.spi-baseband.3
crw------- 1 root wheel 9, 4 Aug 28 18:56 dlci.spi-baseband.4
crw------- 1 root wheel 9, 5 Aug 28 18:56 dlci.spi-baseband.5
crw------- 1 root wheel 9, 6 Aug 28 18:56 dlci.spi-baseband.6
crw------- 1 root wheel 9, 7 Aug 28 18:56 dlci.spi-baseband.7
crw------- 1 root wheel 9, 8 Aug 28 18:56 dlci.spi-baseband.8
crw------- 1 root wheel 9, 9 Aug 28 18:56 dlci.spi-baseband.9
crw------- 1 root wheel 6, 0 Aug 28 15:35 klog
cr--r--r-- 1 root wheel 13, 3 Aug 28 15:35 mrvl868x0
crw------- 1 root wheel 9, 0 Aug 28 15:35 mux.spi-baseband
crw-rw-rw- 1 root wheel 3, 2 Aug 28 18:56 null
crw-rw-rw- 1 root tty 15, 1 Aug 28 19:13 ptmx
crw-rw-rw- 1 root wheel 5, 0 Aug 28 15:35 ptyp0
crw-rw-rw- 1 root wheel 5, 1 Aug 28 15:35 ptyp1
crw-rw-rw- 1 root wheel 5, 2 Aug 28 15:35 ptyp2
crw-rw-rw- 1 root wheel 5, 3 Aug 28 15:35 ptyp3
crw-rw-rw- 1 root wheel 5, 4 Aug 28 15:35 ptyp4
crw-rw-rw- 1 root wheel 5, 5 Aug 28 15:35 ptyp5
crw-rw-rw- 1 root wheel 5, 6 Aug 28 15:35 ptyp6
crw-rw-rw- 1 root wheel 5, 7 Aug 28 15:35 ptyp7
crw-rw-rw- 1 root wheel 8, 0 Aug 28 15:35 random
crw-r----- 1 root operator 14, 0 Aug 28 15:35 rdisk0
crw-r----- 1 root operator 14, 1 Aug 28 15:35 rdisk0s1
crw-r----- 1 root operator 14, 2 Aug 28 15:35 rdisk0s2
crw-rw-rw- 1 root wheel 20, 0 Aug 28 15:35 sha1_0
crw-rw-rw- 1 root wheel 2, 0 Aug 28 15:35 tty
crw-rw-rw- 1 root wheel 1, 4 Aug 28 15:35 tty.bluetooth
crw-rw-rw- 1 root wheel 1, 6 Aug 28 15:35 tty.debug
crw-rw-rw- 1 root wheel 1, 0 Aug 28 15:35 tty.iap
crw-rw-rw- 1 root wheel 1, 2 Aug 28 15:35 tty.umts
crw-rw-rw- 1 root wheel 4, 0 Aug 28 15:35 ttyp0
crw-rw-rw- 1 root wheel 4, 1 Aug 28 15:35 ttyp1
crw-rw-rw- 1 root wheel 4, 2 Aug 28 15:35 ttyp2
crw-rw-rw- 1 root wheel 4, 3 Aug 28 15:35 ttyp3
crw-rw-rw- 1 root wheel 4, 4 Aug 28 15:35 ttyp4
crw-rw-rw- 1 root wheel 4, 5 Aug 28 15:35 ttyp5
crw-rw-rw- 1 root wheel 4, 6 Aug 28 15:35 ttyp6
crw-rw-rw- 1 root wheel 4, 7 Aug 28 15:35 ttyp7
crw--w---- 1 root tty 16, 0 Aug 28 19:13 ttys000
crw-rw-rw- 1 root wheel 10, 2 Aug 28 15:35 uart.bluetooth
crw-rw-rw- 1 root wheel 10, 3 Aug 28 15:35 uart.debug
crw-rw-rw- 1 root wheel 10, 0 Aug 28 15:35 uart.iap
crw-rw-rw- 1 root wheel 10, 1 Aug 28 15:35 uart.umts
crw-rw-rw- 1 root wheel 8, 1 Aug 28 15:35 urandom
brw------- 1 root operator 1, 0 Aug 28 15:35 vn0
brw------- 1 root operator 1, 1 Aug 28 15:35 vn1
crw-rw-rw- 1 root wheel 3, 3 Aug 28 15:35 zero

==Block Devices==
{| border="1" cellpadding="20" cellspacing="0"
|disk0
|iPhone flash memory (4, 8 or 16GB)
|-
| disk0s1
| OS partition. Stores / root file system.
|-
| disk0s2
| User space. Stores Music, Photos, Videos, Podcasts, Ringtones and Apps. Mounted as /private/var.
|-
| disk1
| Unless you previously mounted something on purpose, this is going to be the DeveloperDiskImage from XCode, which is uploaded to your device and mounted every time you plug in with XCode running. It is signature checked against /System/Library/Lockdown/iPhoneDebug.pem.
|-
| vn0
| unknown
|-
| vn1
| unknown
|-
|}

==Interesting Character Devices==
{|border="1" cellpadding="20" cellspacing="0"
|Dev Node
|Description
|Children
|-
| rdisk0
| RAW Disk; to access the Flash
| rdisk0s1 (root) rdisk0s2 (data)
|-
| dlci.spi-baseband
| iPhone Baseband Radio
| dlci.spi-baseband.0 - dlci.spi-baseband.15
|-
| tty.iap
| serial connection (pins 12 and 13 of the Dock connector)
|-
| uart.umts
| Serial connection to the Utms radio (?)
|-
| dlci.spi-baseband.9
| GPS device (read from by /usr/libexec/locationd82 for CoreLocation services)
|-
| mem
| Raw access to RAM (has been blocked since 1.1.2) Memory devices can be re-enabled with single WORD change within kernel.
| kmem, Raw access to Kernel Memory (also blocked since 1.1.2)
|-
| aes_0
| Access to AES engine. Works via complicated ioctl handshake. Not known why it exists, as use of the IOKit interface is much simpler.
|-
|}

===How to access /dev/mem and /dev/kmem===
All you need to do is patch the kernel. See [http://code.google.com/p/chronicdev/wiki/GetBackMemAndKmem here] for up to date patches according to the firmware revision that you are on. Basically, the last one patches the setup_kmem flag itself, and the others just patch the checks to it.

/dev

2011-06-21T13:29:51Z

Tempelorg: /* Summary */ rephrased

== Summary ==

[[Device Nodes]] are here, as with any other standard UNIX system. The directory is read-only.

== Children ==
=== Files ===








{| class="sortable" style="table-layout: fixed; text-align: center; border-collapse: collapse;" border="1"
|-
! Node
! Description
! width="80"| [[m68ap|iPhone]]
! width="80"| [[n82ap|iPhone3G]]
! width="80"| [[n88ap|iPhone 3GS]]
! width="80"| [[n90ap|iPhone 4]]
! width="80"| [[n45ap|iPod touch]]
! width="80"| [[n72ap|iPod touch 2G]]
! width="80"| [[n18ap|iPod touch 3G]]
! width="80"| [[n81ap|iPod touch 4G]]
! width="80"| [[k48ap|iPad 1G]]
! width="80"| [[k66ap|Apple TV 2G]]
|-
|[[/dev/zero|zero]]
|(Outputs 0x0, discards input)
|colspan="10" {{yes}}
|-
|[[/dev/vn1|vn1]]
|?
|colspan="10" {{yes|made by jailbreak}}
|-
|[[/dev/vn0|vn0]]
|?
|colspan="10" {{yes|made by jailbreak}}
|-
|[[/dev/urandom|urandom]]
|(Outputs pseudo-random data)
|colspan="10" {{yes}}
|-
|[[/dev/uart.umts|uart.utms]]
|(new data line added on the iPhone 4)
|colspan="3" {{partial|?}}
|{{yes}}
|colspan="6" {{partial|?}}
|-
|[[/dev/uart.iap|uart.iap]]
|([http://devdot.wikispaces.com/Iphone+Serial+Port+Tutorial Dock connector serial interface])
|colspan="10" {{yes}}
|-
|[[/dev/uart.highland-park|uart.highland-park]]
|?
|colspan="10" {{partial|?}}
|-
|[[/dev/uart.gps|uart.gps]]
|(Something with GPS)
|{{no}}
|colspan="3" {{yes}}
|colspan="4" {{no}}
|{{partial|iPad 3G}}
|{{no}}
|-
|[[/dev/uart.gas-gauge|uart.gas-gauge]]
|(Battery meter)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="3" {{yes}}
|{{no}}
|-
|[[/dev/uart.debug|uart.debug]]
|[[Baseband_Commands|(Baseband)]]
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|iPad 3G}}
|{{no}}
|-
|[[/dev/uart.bluetooth|uart.bluetooth]]
|(Bluetooth Dev Node disabled by the kernel for power saving)
|colspan="4" {{yes}}
|{{no}}
|colspan="5" {{yes}}
|-
|[[/dev/ttypf|ttypf]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttype|ttype]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttypd|ttypd]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttypc|ttypc]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttypb|ttypb]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttypa|ttypa]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttyp9|ttyp9]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttyp8|ttyp8]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttyp7|ttyp7]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp6|ttyp6]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp5|ttyp5]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp4|ttyp4]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp3|ttyp3]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp2|ttyp2]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp1|ttyp1]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp0|ttyp0]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/tty.umts|tty.umts]]
|?
|{{no}}
|colspan="3" {{yes}}
|colspan="4" {{no}}
|{{partial|iPad 3G}}
|{{no}}
|-
|[[/dev/tty.iap|tty.iap]]
|([http://devdot.wikispaces.com/Iphone+Serial+Port+Tutorial Dock connector serial interface])
|colspan="10" {{yes}}
|-
|[[/dev/tty.highland-park|tty.highland-park]]
|?
|colspan="10" {{partial|?}}
|-
|[[/dev/tty.gas-gauge|tty.gas-gauge]]
|(Battery meter)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="3" {{yes}}
|{{no}}
|-
|[[/dev/tty.debug|tty.debug]]
|[[Baseband_Commands|(Baseband)]]
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|iPad 3G}}
|{{no}}
|-
|[[/dev/tty.bluetooth|tty.bluetooth]]
|(Bluetooth Node)
|colspan="4" {{yes}}
|{{no}}
|colspan="5" {{yes}}
|-
|[[/dev/tty|tty]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/sha1_0|sha1_0]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/rdisk0s2|rdisk0s2s1]]
|(Character device equivalent of disk0s2s1)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/rdisk0s2|rdisk0s2]]
|(Character device equivalent of disk0s2)
|colspan="10" {{yes}}
|-
|[[/dev/rdisk0s1|rdisk0s1]]
|(Character device equivalent of disk0s1)
|colspan="10" {{yes}}
|-
|[[/dev/rdisk0|rdisk0]]
|(Character device equivalent of disk0)
|colspan="10" {{yes}}
|-
|[[/dev/random|random]]
|(Outputs random data)
|colspan="10" {{yes}}
|-
|[[/dev/ptypf|ptypf]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptype|ptype]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptypd|ptypd]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptypc|ptypc]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptypb|ptypb]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptypa|ptypa]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptyp9|ptyp9]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptyp8|ptyp8]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptyp7|ptyp7]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp6|ptyp6]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp5|ptyp5]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp4|ptyp4]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp3|ptyp3]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp2|ptyp2]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp1|ptyp1]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp0|ptyp0]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptmx|ptmx]]
|( Posix terminal )
|colspan="10" {{yes|made by jailbreak}}
|-
|[[/dev/pf|pf]]
|( [[wikipedia:PF (firewall)|firewall]] )
|colspan="10" {{yes}}
|-
|[[/dev/null|null]]
|(Doesn't output, discards input)
|colspan="10" {{yes}}
|-
|[[/dev/mem|mem]]
|(Memory)
|colspan="10" {{partial|On patched kernels}}
|-
|[[/dev/klog|klog]]
|part of the kernel used to receive kernel panic count
|colspan="10" {{yes}}
|-
|[[/dev/kmem|kmem]]
|(Kernel memory)
|colspan="10" {{partial|On patched kernels}}
|-
|[[/dev/io8logmt|io8logmt]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/io8log|io8log]]
|( replied AT S7=45 S0=0 L1 V1 X4 &c1 E1 Q0 when opened [http://yfrog.com/hta56p] )
|colspan="10" {{yes}}
|-
|[[/dev/dlci.spi-baseband.sms|dlci.spi-baseband.sms]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.reg|dlci.spi-baseband.reg]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_ctl|dlci.spi-baseband.pdp_ctl]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_3|dlci.spi-baseband.pdp_3]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_2|dlci.spi-baseband.pdp_2]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_1|dlci.spi-baseband.pdp_1]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_0|dlci.spi-baseband.pdp_0]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.low|dlci.spi-baseband.low]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.iq|dlci.spi-baseband.iq]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.extra_13|dlci.spi-baseband.extra_13]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.cl1|dlci.spi-bseband.cl1]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.chatty|dlci.spi-baseband.chatty]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.call|dlci.spi-baseband.call]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/disk1|disk1]]
|([[/Developer|Virtual drive for SDK tools image]])
|colspan="10" {{yes}}
|-
|[[/dev/disk0s2s1|disk0s2s1]]
|(Encrypted user partition on 3GS?)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="3" {{no}}
|colspan="3" {{yes}}
|-
|[[/dev/disk0s2|disk0s2]]
|(NAND, [[/private/var|user partition]])
|colspan="10" {{yes}}
|-
|[[/dev/disk0s1|disk0s1]]
|(NAND, [[/|system partition]])
|colspan="10" {{yes}}
|-
|[[/dev/disk0|disk0]]
|([[NAND]])
|colspan="10" {{yes}}
|-
|[[/dev/cu.umts|cu.umts]]
|?
|colspan="10" {{partial|?}}
|-
|[[/dev/cu.iap|cu.iap]]
|([http://devdot.wikispaces.com/Iphone+Serial+Port+Tutorial Dock connector serial interface])
|colspan="10" {{yes}}
|-
|[[/dev/cu.highland-park|cu.highland-park]]
|(Camera)
|colspan="10" {{partial|?}}
|-
|[[/dev/cu.gps|cu.gps]]
|(Something with GPS)
|{{no}}
|colspan="3" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/cu.gas-gauge|cu.gas-gauge]]
|(Exclusive access to the battery meter)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="3" {{yes}}
|{{no}}
|-
|[[/dev/cu.debug|cu.debug]]
|[[Baseband_Commands|(Exclusive access to Baseband used, for example, by BBUpdater)]]
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/cu.bluetooth|cu.bluetooth]]
|(primary Dev Node to comunicate with the bluetooth chip)
|colspan="4" {{yes}}
|{{no}}
|colspan="5" {{yes}}
|-
|[[/dev/console|console]]
|(System console, displayed during a verbose boot)
|colspan="10" {{yes}}
|-
|[[/dev/compass2_0|compass2_0]]
|([[Gyroscope]])
|colspan="3" {{no}}
|{{yes}}
|colspan="3" {{no}}
|{{yes}}
|colspan="2" {{no}}
|-
|[[/dev/compass1_0|compass1_0]]
|(This may exist as [[Accelerometer]])
|colspan="10" {{partial|?}}
|-
|[[/dev/compass_0|compass_0]]
|([[Magnetometer]])
|{{no}}
|colspan="2" {{yes}}
|colspan="5" {{no}}
|{{yes}}
|{{no}}
|-
|[[/dev/btwake|btwake]]
|(sent to switch the bluetooth chip on from standby)
|colspan="10" {{yes}}
|-
|[[/dev/btreset|btreset]]
|(used if the bluetooth chip becomes unresponsive)
|colspan="10" {{yes}}
|-
|[[/dev/bpf3|bpf3]]
|({{wp|Berkeley Packet Filter}})
|colspan="10" {{yes}}
|-
|[[/dev/bpf2|bpf2]]
|({{wp|Berkeley Packet Filter}})
|colspan="10" {{yes}}
|-
|[[/dev/bpf1|bpf1]]
|({{wp|Berkeley Packet Filter}})
|colspan="10" {{yes}}
|-
|[[/dev/bpf0|bpf0]]
|({{wp|Berkeley Packet Filter}})
|colspan="10" {{yes}}
|-
|[[/dev/aes_0|aes_0]]
|(used with a crypto bundle provided in [[XPwn]] to utilize the [[AES Keys]] in userland)
|colspan="10" {{yes}}
|-
|}

== Parents ==
*[[/]]

Bugging Debuggers

2011-06-21T13:27:20Z

Tempelorg: Added an intro, since not everyone understands what the problem is. It's generally good to always state the problem before providing the solution.

Background:

On jailbroken iOS devices crackers have made it possible to remove the DRM from sold applications so that they can be copied to any device without having to pay for them.

As explained [Copy_Protection_Overview|here], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.

On of the methods used by crackers is to let the application run in a debugger (gdb) and then save the then unencrypted app image to disk.

This page explains how to foil this method.

== The ptrace() Trick ==

'''IMPORTANT NOTE: This trick has been worked around by pirates. Don't rely on it!'''

GDB is the stock debugger used by most hackers. On darwin (OSX and iPhone OS), GDB will not attach to processes that have asked not to be attached to. Instead, it will crash or crash the target process. This is useful for defeating Crackulous and most tutorial-followers.

On OSX, one would need the following piece of code, as close as possible to the start of main().

ptrace(PT_DENY_ATTACH, 0, 0, 0);

A couple of includes are also in order:

#include <sys/ptrace.h>
#include <sys/types.h>

On the iPhone, however, <sys/ptrace.h> is not available. Fortunately, that can be worked around:

#import <dlfcn.h>
#import <sys/types.h>

typedef int (*ptrace_ptr_t)(int _request, pid_t _pid, caddr_t _addr, int _data);
#if !defined(PT_DENY_ATTACH)
#define PT_DENY_ATTACH 31
#endif // !defined(PT_DENY_ATTACH)

void disable_gdb() {
void* handle = dlopen(0, RTLD_GLOBAL | RTLD_NOW);
ptrace_ptr_t ptrace_ptr = dlsym(handle, "ptrace");
ptrace_ptr(PT_DENY_ATTACH, 0, 0, 0);
dlclose(handle);
}

The following are needed to complete the code, and are left as an exercise for the reader:
* disable_gdb() should return for debug builds (hint: preprocessor macros)
* the string "ptrace" is a dead giveaway, and should probably be obfuscated a bit

Copy Protection Overview

2011-06-21T13:04:25Z

Tempelorg: added a link

== Landscape and Motivation ==
Applications downloaded from the iTunes App Store are protected by FairPlay DRM. The FairPlay copy protection has been cracked some time ago [http://www.ipodandiphone.com/2008/08/start-to-finish-iphone-app-crack-release/]. What's worse, the copy removal method has been automated by the infamous Crackulous application [http://gizmodo.com/5144751/crackulous-allows-for-app-store-piracy]. The silver lining is that removing the copy protection from applications invalidates Apple's signature, so these applications cannot be run on phones without the jailbreak.

iPhone application piracy is significant [http://blog.costan.us/2009/04/iphone-piracy-hard-numbers-for-soft.html][http://www.icombatgame.com/2009/05/08/my-experience-getting-owned-by-app-store-pirates/][http://www.iphonesavior.com/2009/02/-developer-loses-thousands-to-app-store-piracy.html], so relying on Apple's protection scheme is not a solution for most developers.

Fighting one particular automated process for removing copy protection is easy [http://thwart-ipa-cracks.blogspot.com/2008/11/detection.html], but curbing iPhone application cracking is difficult, because of the many undocumented moving pieces (Apple's signatures, protection mechanism, application approval process, and iTunes distribution). Learning all this is a lot of work, which is currently duplicated by all independent developers. If developers pool their knowledge into the iPhone Wiki, the learning effort will not be duplicated anymore, and applications will have higher overall quality. Ideally, developers will produce an open-source obfuscation mechanism that is trivial to apply to applications, but takes a non-trivial amount of time to reverse.

== Copy Protection Removal Overview ==
Developers that want to guard against copy protection removal must understand how it works. [http://www.ipodandiphone.com/2008/08/start-to-finish-iphone-app-crack-release/] documents the process in a tutorial fashion. A summary follows.

The only encrypted part in an iPhone application is the executable file. The cracking process starts the victim application, then uses a debugger to suspend it. The application's executable code lies unprotected in RAM, and the debugger dumps it on disk. Then, the encrypted part of the executable file is replaced with the unencrypted code dumped from memory.

The application's Info.plist is modified so that the jailbroken iPhone kernel does not check the application's signature, which is invalidated by the modification of the executable file. A more rigurous cracking process could remove Apple's signatures and certificates, and replace them with a self-signed certificate, as is done when developing with the jailbroken toolchain.

== Defeating Copy Protection Removal ==
RIPdev suggests the following methods to counter copy protection removal.

* [[Bugging_Debuggers|preventing debuggers from attaching to the application]]
* loading the executable code in stages, such that it's never completely present in RAM, unprotected
* integrity checks throughout the application

== Methods ==

=== Covert Exit ===
You can use:
<pre>
__asm__ volatile("swi 0x11");
</pre>
instead of calling exit(); since that it more obvious, but you may want to have the "swi 0x11" part be a NOP then use STRB to reconstruct it opcode by opcode. The reason I did not include an example of "reconstructing" it in the above snippet is simple. If everyone uses it, then it would be reduced to a simple byte search by crackers. If everyone does it in a different way, then it would be much tougher.

=== Integrity Checks ===
An increasing trend among application developers is to use inexpensive integrity checks, and revert into a trial mode or shut down the application, some time after the integrity checks fail. An essential step is making sure the application does not act too soon, so that "crackers" do not notice the integrity checking process, and release the application as cracked immediately after removing the FairPlay encryption.

[http://thwart-ipa-cracks.blogspot.com/2008/11/detection.html] suggests examining the Info.plist file, and checking for the existence of the SignerIdentity key that is added in the cracking process, and would not exist on any applications originating from the App Store. However, this is not advisible, as it can be patched simply by the cracker searching for either the "SignerIdentity" string in your code, or a bunch of MOVs if you used stringWithFormat to construct the string character by character. Anyway, it would probably be more beneficial if you checked the size and sha1 of the Info.plist, as although people will find this, it just makes it a bit harder than it would have been. Hell, with the check for the existence of SignerIdentity Check, someone could put together a program to automatically search for that string and then put patch it to be "SignerIdentitx" or something, so that your program obviously won't find it in the Info.plist. [http://landonf.bikemonkey.org/code/iphone/iPhone_Preventing_Piracy.20090213.html] suggests reading the executable file, and checking for the Mach-O directives for an encrypted section, as FairPlay introduces an encrypted section which is removed by cracked applications.

These methods are cheap to implement. They are also easy to break, once the cracker is aware of them. This explains the need for introducing a delay between the crack detection and the delivery of the punishment, which can be as mild as popping a dialog box appealing to the user to purchase the application [http://benchatelain.com/2009/03/07/cracked-copies-of-full-screen-web-browser-function-as-demos/].

Talk:Main Page

2011-06-21T13:03:07Z

Tempelorg: /* Please explain that it's currently not open to new sign-ups */ new section

User:Tempelorg

2011-06-21T12:58:40Z

Tempelorg: New page: This is Thomas Tempelmann. Software developer since the early 80s. In the old times, I reverse engineered a few things such as the Commodore 1541's DOS, then wrote F-Copy and a Fast Load...

This is Thomas Tempelmann.

Software developer since the early 80s.

In the old times, I reverse engineered a few things such as the Commodore 1541's DOS, then wrote F-Copy and a Fast Loader based on it.
I also cracked a money gambing machine in Germany ([http://stackoverflow.com/questions/193016/reverse-engineering-war-stories see story]).
Wrote Templemon, a machine level debugger for the Atari ST, created one of the first virtual machines (MagiCMac, to run Atari ST apps on a Mac), have a lot of experience with various file system formats, helped with the iPodLinux project for a while, helping to make a nicer boot loader that also supports HFS, and much more.
Nowadays I'm a rather lazy programmer, preferring REALbasic over low level coding for my projects that involve any UI.
Yet, I still write apps for iOS and keep doing embedded work.

I'm also a quite difficult person to many due to my insistance in "correctness" about anything I get involved with. And I like to get involved with everything.
Sorry. Consider it a German treat ;^)