The iPhone Wiki - User contributions [en]

User:WEsTbAeR--

2009-03-21T10:45:49Z

WEsTbAeR--: Removing all content from page

X-Gold 608 Unlock

2009-01-01T20:33:47Z

WEsTbAeR--: 25c3 not 25cc nub

Currently, the 3G (software) [[unlock]] which is not baseband-dependent is the biggest missing piece of the iPhone community. It is more difficult than the previous unlocks due to the fact that the [[Baseband_Bootloader | baseband bootloader]] is signature checked. [[The dev team]] has successfully unlocked all baseband versions, by a somehow patching the baseband on-the-fly (in RAM), therefore at boot the baseband bootrom can validate the bootloader, the bootloader can validate the baseband, and not until after the boot up will it be patched. The unlock (called [[yellowsn0w]]) was released on 01/01/09. [http://blog.iphone-dev.org/post/67797811/dont-eat-yellowsn0w]

==Possible Methods==
===Class 1===
* Find an exploit in the [[Baseband Bootrom|bootrom]] to break the chain of trust
* Improve by several orders of magnitude the [[NCK Brute Force|NCK brute forcer]], and find a way to extract the CHIPID and NORID
* Find the theorized algorithm of NCK generation
===Class 2===
* Use a [[SIM hacks|SIM hack]] such as the [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]]
* Find a way to patch running memory to "unlock" the phone on every bootup. The [[dev team]] has accomplished this for bb version 02.28.00 with [[yellowsn0w]]

==Resources==
* Read about the [[X-Gold 608]]
* Read geohot's [http://iphonejtag.blogspot.com/2008/07/infineon-we-have-problem.html blog post]
* 25C3 presentation [http://events.ccc.de/congress/2008/Fahrplan/events/2976.en.html "Hacking the iPhone"] video [http://vimeo.com/2646755?pg=embed&sec=2646755 here]

N72AP

2008-09-09T20:59:46Z

WEsTbAeR--:

This is the new iPod touch a.k.a iPod2,1.

Application / MainOS Processor: s5l8720x

Main Page

2008-09-09T19:40:08Z

WEsTbAeR--:

<table border=1 width=100%><tr>
<td bgcolor=#64ff64 width=50%><center><b>[[PwnageTool|Jailbreak]]</b></center></td>
<td bgcolor=#ff6464 width=50%><center><b>[[Unlock 2.0|Unlock]]</b></center></td>
</tr>
<tr>
<td colspan=2>
<center>[[Disclaimer]]</center>
</td>
</tr>
</table><BR>


{| cellspacing="3" width="100%"
|- valign="top"
|width="20%" class="MainPageBG" style="border: 1px #999999; color: #000; background-color: rgb(255,255,255)"|
<div style="padding: .3em .7em .7em"> <BR> <BR> __TOC__ </div>
|width="80%" class="MainPageBG" style="border: 1px #c6c9ff; color: #000; background-color: #f0f0ff"|
<div style="padding: .3em .7em .7em"> {{Welcome}} </div>
|}
==Software==
* [[Filesystem]]
* [[Device Nodes]]
* [[System Log]]

==Hardware==
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]

==App Processor (Jailbreak)==
The iPhone makes use of the [[S5L8900]] platform as application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband (Unlock)==

The [[Baseband Device]] is where the [[unlock]] applies.

==File formats==
* [[8900 File Format]]
* [[IMG2 File Format]]
* [[IMG3 File Format]]
* [[secpack]]
* [[secpack 2.0]]
* [[seczone]]

==Protocols==
* [[Recovery Mode 0x1280]]
* [[Recovery Mode 0x1281]]
* [[DFU 0x1222]]
* [[WTF 0x1227]]
* [[Normal Mode 0x1290]]
* [[Restore Mode]]
* [[Baseband Bootrom Protocol]]
* [[Interactive Mode|Baseband Bootloader Protocol]]

==Keys==
* [[AES Keys]]
* [[Apple Certificate]]
* [[Baseband RSA Keys]]
* [[Baseband TEA Keys]]
* [[IMG3 Keys / IVs]]
* [[NCK]]
* [[VFDecrypt Keys|Root Filesystem DMG Keys]]

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Tutorials==
see [[Tutorials|here]]

==Useful Links==
see [[Useful Links|here]]

==Definitions==
* [[jailbreak]]
* [[activation]]
* [[unlock]]
* [[Baseband Device|baseband]]
* [[Baseband Bootloader|bootloader]]
* [[DFU]]
* [[NORID]]
* [[CHIPID]]

N72AP

2008-09-09T19:39:15Z

WEsTbAeR--: Created iPod touch 2G Page

This is the new iPod touch a.k.a iPod2,1.

Useful Links

2008-08-27T01:14:14Z

WEsTbAeR--: No Advertising kthx

== Wikis ==
* [http://www.deloware.com/iphone/doku.php iPhone Information Wiki (Outdated)]
* [http://wikee.iphwn.org/ iPhone Dev Team Portal]
* [http://iphonedevwiki.scribblewiki.com Snapshot of original Dev Team fiveforty wiki]
* [http://chronic-dev.org/userwiki/ Chronic Dev User Wiki]
* [http://www.modmyifone.com/wiki/index.php/Main_Page ModMyiFone Wiki] (Good n00b starting point)

== Forums ==
* [http://www.hackint0sh.org/forum/forumdisplay.php?f=123 Hackint0sh Forums (iPhone)]
* [http://www.hackint0sh.org/forum/forumdisplay.php?f=135 Hackint0sh Forums (iPod Touch)]
* [http://www.modmyifone.com/forums/ ModMyiFone Forums]
* [http://www.iphone-hacks.com/forums/ iPhone Hacks Forums]

== International ==
* [http://iPhone-Forums.de/ iPhone forum for the German community]
* [http://i-phone.ir/forums/ iPhone Forum for the Persian Community]
* [http://iPhones.ru/forum/ iPhone forum for the Russian community]
* [http://www.iphonedo.com/ iPhone blog for the Turkish community]
* [http://www.iphonemod.com.br/ iPhone forum for the Brazilian community]

== iPhone Downloads ==
* [http://www.iphone-hacks.com/downloads iPhone Hacking Downloads]

== Websites ==
* [http://iphonejtag.blogspot.com/ geohot's blog on the iPhone]
* [http://blog.iphone-dev.org/ dev team's blog on the iPhone]
* [http://www.iclarified.com/tutorials/iphone/index.php iClarified iPhone tutorials]
* [http://george.insideiphone.com George Zhu's Blog]
* [http://www.rapidrepair.com/guides/iphone3g/iphone3grepairguide.html Disassembling iPhone-3G]

== File Resources ==
* [http://www.iphonefix.de/ Large iPhone and iPod related Filebase]

Useful Links

2008-08-18T09:49:18Z

WEsTbAeR--: no warez and ziphone kthx

== Wikis ==
* [http://www.deloware.com/iphone/doku.php iPhone Information Wiki (Outdated)]
* [http://wikee.iphwn.org/ iPhone Dev Team Portal]
* [http://iphonedevwiki.scribblewiki.com Snapshot of original Dev Team fiveforty wiki]
* [http://chronic-dev.org/userwiki/ Chronic Dev User Wiki]
* [http://www.modmyifone.com/wiki/index.php/Main_Page ModMyiFone Wiki] (Good n00b starting point)

== Forums ==
* [http://www.hackint0sh.org/forum/forumdisplay.php?f=123 Hackint0sh Forums (iPhone)]
* [http://www.hackint0sh.org/forum/forumdisplay.php?f=135 Hackint0sh Forums (iPod Touch)]
* [http://www.modmyifone.com/forums/ ModMyiFone Forums]
* [http://www.iphone-hacks.com/forums/ iPhone Hacks Forums]

== International ==
* [http://iPhone-Forums.de/ iPhone forum for the German community]
* [http://iPhones.ru/forum/ iPhone forum for the Russian community]
* [http://www.iphonedo.com/ iPhone blog for the Turkish community]

== iPhone Downloads ==
* [http://www.iphone-hacks.com/downloads iPhone Hacking Downloads]

== Websites ==
* [http://iphonejtag.blogspot.com/ geohot's blog on the iPhone]
* [http://blog.iphone-dev.org/ dev team's blog on the iPhone]
* [http://www.iclarified.com/tutorials/iphone/index.php iClarified iPhone tutorials]
* [http://george.insideiphone.com George Zhu's Blog]
* [http://hacktheiphoneitouch.blogspot.com/ Everything and anything on iPhone and iPod Touch (Beginner's Page)]
* [http://www.rapidrepair.com/guides/iphone3g/iphone3grepairguide.html Disassembling iPhone-3G]
* [http://www.iphone-freak.com KiPhone by kIREmK ]

== File Resources ==
* [http://www.iphonefix.de/ Large iPhone and iPod related Filebase]

Talk:X-Gold 608 Unlock

2008-08-07T13:51:40Z

WEsTbAeR--:

== current 3G unlock status?? ==

just citing:

:'''Q:''' You can take 1.45.00 (or at least 1.43.00), patch it somewhere, flash this file and it's run? Yes or no?

:'''A:''' No(t yet as easy as that, but be sure we're on it) :p Zf

So, that's very good news :) -caique2001-

To speak more technical... The X-Gold 608 has TPM features. So normally one would expect it only to run signed code. This in turn means, it doesn't matter if the code is interchangeable, because only original Apple code can be run. The crucial hack needed is the hack to run ''unsigned'' code, say patched code (as Apple's private key to sign is not known of course).

TPM doesn't come into play here. We're running unsigned code, and convincing s-gold3 bootrom we deserve a downgrade. It happily complies.

Wow! Even more good news :-) Where do we have to send the beer to :-) ?? If it should not go to much into detail, could you shortly explain what issue you are currently working on? The fact you have the possibility to run patched unsigned code, does it imply you are currently working on a patch that actually does the unlock? And does TPM come into play here or are there other issues to be solved? caique2001

I would assume that with unsigned code, you could patch the 3G equivalant of Simple Unlock. IIRC, geohot has already found the bits. we just need a way to patch them. About bypassing TPM...it would be interesting to see how this is done. Perhaps a malformed sig like with pwnage 2.0 and DFU mode? guess we will just have to wait and see :P [[User:ChronicDev|ChronicDev]]

== opensource baseband? ==
Is to make one? With 3G support? or modify the 4.6 baseband to have have 3g support?

4.6 is on different platform, you cannot modify that for 3G.

== get unlocked bootloader ?? ==

as in countrys like belgium, the 3g is sold without any carrier lock. (belgium law)

wouldnt it be possible to get the bootloader from such an iphone and transfer it to any other device ??

/harald

"Bootloader" has NOTHING todo with official unlock (or unlock). Official Unlock is IMHO done by IMEI and NCK. ~wEsTbAeR--

Firmware

2008-08-05T09:45:23Z

WEsTbAeR--: Improved 2.0.1

This is the Mac OS X system the iPhone runs. Latest Apple download links can be found [http://ax.phobos.apple.com.edgesuite.net/WebObjects/MZStore.woa/wa/com.apple.jingle.appserver.client.MZITunesClientCheck/version here].

==Comparison of firmware versions==
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! Device
! Version
! Build
! [[Baseband]]
! IPSW filename
! Comments
! Can be [[jailbreak|jailbroken]]?
! Can be [[unlock|unlocked]]?
|-
| iPhone
| 1.0.0
| Heavenly 1A543a
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| Initial US shipment.
| {{yes}}
| {{yes}}
|-
| iPhone
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
|
| {{yes}}
| {{yes}}
|-
| iPhone
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
|
| {{yes}}
| {{yes}}
|-
| iPhone
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
|
| {{yes}}
| {{yes}}
|-
| iPhone
| 1.1.2
| Oktoberfest 3B48a
| 04.02.13_G
| No download available
| Initial Euro shipment.
| {{yes}}
| {{yes}}
|-
| iPhone
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
|
| {{yes}}
| {{yes}}
|-
| iPhone
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
|
| {{yes}}
| {{yes}}
|-
| iPhone
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
|
| {{yes}}
| {{yes}}
|-
| iPhone
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
|
| {{yes}}
| {{yes|Yes (downgrade to lower version)}}
|-
| iPhone
| 2.0.1
| BigBear5B108
| 04.??.??_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
|
| {{no}}
| {{no}}
|-
| iPhone 3G
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| Initial iPhone 3G shipment.
| {{yes}}
| {{no}}
|-
| iPhone 3G
| 2.0.1
| BigBear5B108
| 01.??.??
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
|
| {{no}}
| {{no}}
|-
| iPod Touch
| 1.1.0
| Snowbird 3A100a
| N/A
| No download available
| Initial shipment.
| {{yes}}
| N/A
|-
| iPod Touch
| 1.1.0
| Snowbird 3A101a
| N/A
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
|
| {{yes}}
| N/A
|-
| iPod Touch
| 1.1.1
| Snowbird 3A110a
| N/A
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
|
| {{yes}}
| N/A
|-
| iPod Touch
| 1.1.2
| Oktoberfest 3B48b
| N/A
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
|
| {{yes}}
| N/A
|-
| iPod Touch
| 1.1.3
| Little Bear 4A93
| N/A
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
|
| {{yes}}
| N/A
|-
| iPod Touch
| 1.1.4
| Little Bear 4A102
| N/A
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
|
| {{yes}}
| N/A
|-
| iPod Touch
| 1.1.5
| Little Bear 4B1
| N/A
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
|
| {{yes}}
| N/A
|-
| iPod Touch
| 2.0
| Big Bear 5A347
| N/A
| No download available (protected)
|
| {{yes}}
| N/A
|-
| iPod Touch
| 2.0.1
| Unknown 5B108
| N/A
| No download available (protected)
|
| {{no}}
| N/A
|}

==Resources==
[http://www.trejan.com/projects/ipod/ Firmware List]

[http://www.iphones.ru/forum/index.php?showtopic=7115 iPhone FW's Links (Russian)]

[http://www.iphones.ru/forum/index.php?showtopic=13934 iTouch FW's Links (Russian)]

Firmware Keys

2008-08-05T08:16:27Z

WEsTbAeR--: Added 2.1 Key

== Introduction ==
These keys are for use with the 'vfdecrypt' tool to decrypt the main filesystem dmg found in every iPhone/iPhone3G/iPod Touch .ipsw file. Every key will work on the main filesystem dmg for that build, regardless if it is for the iPhone or iPod Touch. The dmg that you are after is the bigger one, in the case of current builds of 2.0, it can sometimes be 200mb+!

== VFDecrypt Usage ==
./vfdecrypt -i <dmg> -o decrypted_fs.dmg -k <key>

== Gaps ==
As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there <b>people could get in trouble, and we do not want that</b>. Thanks for contributing!

== Downloads ==
[[http://chronic-dev.org/tools/vfdecrypt Download VFDecrypt]]

== 1.0.1 (Build 1C25) ==
28c909fc6d322fa18940f03279d70880e59a4507998347c70d5b8ca7ef090ecccc15e82d

== 1.0.2 (Build 1C28) ==
7d5962d0b582ec2557c2cade50de90f4353a1c1de07b74212513fef9cc71fb890574bfe5

== 1.1.1 (Build 3A109a) ==
f45de7637a62b200950e550f4144696d7ff3dc5f0b19c8efdf194c88f3bc2fa808fea3b3

== 1.1.1 (Build 3A110a) ==
d45b837ddd85bdae0ec82a033ba00ea03ceb8c827040034f7554c65d6376472844b8dc6a

== 1.1.2 (Build 3B48b) ==
70e11d7209602ada5b15fbecc1709ad4910d0ad010bb9a9125b78f9f50e25f3e05c595e2

== 1.1.3 (Build 4A93) ==
11070c11d93b9be5069b643204451ed95aad37df7b332d10e48fd3d23c62fca517055816

== 1.1.4 (Build 4A102) ==
d0a0c0977bd4b6350b256d6650ec9eca419b6f961f593e74b7e5b93e010b698ca6cca1fe

== 1.1.5 (Build 4B1) ==
c7973558e8f6af22e38d4573737d1533f1d5eec202bf86a32d941975d76f8906c7f0afe4

== 1.2 (Beta 1) (Build 5A147p) ==
86bec353ddfbe3fb750e9d7905801f79791e69acf65d16930d288e697644c76f16c4f16d

== 2.0 (Beta 2) (Build 5A225c) ==
ea14f3ec624c7fdbd52e108aa92d13b16f6b0b940c841f7bbc7792099dae45da928d13e7

== 2.0 (Beta 3) (Build 5A240d) ==
e24bfab40a2e5d3dc25e089291846e5615b640897ae8b424946c587bcf53b201a1041d36

== 2.0 (Beta 4) (Build 5A258f) ==
198d6602ba2ad2d427adf7058045fff5f20d05846622c186cca3d423ad03b5bc3f43c61c

== 2.0 (Beta 5) (Build 5a274d) ==
589df25eaa4ff0a5e29e1425fb99bf50957888ff098ba2fcb72cf130f40e15e00bcf2fc7

== 2.0 (Beta 6 Pre-Release) (Build 5a292g) ==
890b1fbf22975e0d4be2ea3f9bc5c87f38fd8158394fd31cf80a43ad25547573bbd0ec4e

== 2.0 (Beta 6 Final) (Build 5a308) ==
3964ca8d8bf5d3715cdc172986f2d9606672c54d5e0aa3f3a892166b4e54e4cefef21279

== 2.0 (Beta 7) (Build 5a331) ==
3d9a9832a108fc5084fc9329d6e84e38edf06e380554c49376b70e951f8a8d1ed943f819

== 2.0 (Build 5a347) ==
Ramdisk Key: 85 0A FC 27 11 32 D1 5A E6 98 95 65 56 7E 65 BF
Ramdisk IV: 29 68 1F 62 5D 1F 61 27 1E C3 11 66 01 B8 BC DE
2cfca55aabb22fde7746e6a034f738b7795458be9902726002a8341995558990f41e3755

== 2.1 (Beta 1) (Build 5F90) ==
Ramdisk Key: 78 29 32 89 1F 0D 76 DB 49 0F DD CA 02 7A 13 B2
Ramdisk IV: 6B EA 32 6D 0F 41 10 51 59 F0 AE A8 F9 9F E7 77
f61c14aa0d53386dd42c49163686e8ccdeb86d14aafdecfe99c2e12c41a7f9f2811daa3d

== 2.1 (Build 5B108) ==
2cfca55aabb22fde7746e6a034f738b7795458be9902726002a8341995558990f41e3755

Talk:Research: Re-allowing unsigned ramdisks and boot-args with the 2.* iBoot

2008-08-02T15:00:44Z

WEsTbAeR--: boot-command

boot-command works, I already tested it with my RecoveryInterface for 0x1281. -wEsTbAeR--

Talk:BurnIn

2008-08-01T03:07:28Z

WEsTbAeR--:

Where did these pictures come from? ~geohot

Chronic found these pictures from a guy at hackint0sh who sent in his 3G for repair. -wEsTbAeR--

geohot, the only flaw with your ramdisk hypothosis is that someone got their iphone back with that on it. plus, could all the needed frameworks for a GUI application fit on a ramdisk?
[[User:ChronicDev|ChronicDev]]

Chronic, maybe on a 32MB Zibri ZramdiskZ. :P
Actually this is a really bad-ass GUI, so it should fit in these 32MB or something.

-wEsTbAeR--

Talk:BurnIn

2008-08-01T03:06:58Z

WEsTbAeR--:

Where did these pictures come from? ~geohot

Chronic found these pictures from a guy at hackint0sh who sent in his 3G for repair. -wEsTbAeR--

geohot, the only flaw with your ramdisk hypothosis is that someone got their iphone back with that on it. plus, could all the needed frameworks for a GUI application fit on a ramdisk?
[[User:ChronicDev|ChronicDev]]

Chronic, maybe on a 32MB Zibri ZramdiskZ. :P -wEsTbAeR--
Actually this is a really bad-ass GUI, so it should fit in these 32MB or something.

Talk:IPoiT

2008-07-31T22:09:27Z

WEsTbAeR--:

What do you mean with "IP over iTunes"? -wEsTbAeR--

Talk:IPoiT

2008-07-31T22:07:36Z

WEsTbAeR--: New page: What do you mean (geohot) with "IP over iTunes"? -wEsTbAeR--

What do you mean (geohot) with "IP over iTunes"? -wEsTbAeR--

Talk:BurnIn

2008-07-31T22:03:57Z

WEsTbAeR--:

Where did these pictures come from? ~geohot

Chronic found these pictures from a guy at hackint0sh who sent in his 3G for repair. -wEsTbAeR--

Talk:Ramdisk Hack

2008-07-29T13:44:33Z

WEsTbAeR--:

This is just a 'overall' explanations to give someone that is not involved a 'clue'.

Could please someone explain more specifically to enable an experienced user to follow the hack?

== Ramdisk Hack ==

It's not difficult at all. You just send a file to 1.1.4 or lower iBoot (iphuc: sendfiletophone or something) then "change" some boot-args. -wEsTbAeR--

I believe that it is not difficult. But where do you put the file and how do you change boot args. And how you put the file there, because at this point it isn't jailbreaked yet!? -caique2001-

== Re: Ramdisk Hack ==

We don't talk to the iPhone via AFC. We talk to the iBoot (Recovery Mode), which is implemented in iPHUC too.
In iBoot you upload a file to RAM (no jailbreak required) and then change boot-args to boot it.

* setenv boot-args rd=md0 -s -x pmd0=0x9340000.0xA00000
* saveenv
* fsboot

I'm not sure about the last command, you must try it. If it does not work, try 'bootx'.

- wEsTbAeR--

Talk:Ramdisk Hack

2008-07-29T13:43:45Z

WEsTbAeR--:

This is just a 'overall' explanations to give someone that is not involved a 'clue'.

Could please someone explain more specifically to enable an experienced user to follow the hack?

== Ramdisk Hack ==

It's not difficult at all. You just send a file to 1.1.4 or lower iBoot (iphuc: sendfiletophone or something) then "change" some boot-args. -wEsTbAeR--

I believe that it is not difficult. But where do you put the file and how do you change boot args. And how you put the file there, because at this point it isn't jailbreaked yet!? -caique2001-

== Re: Ramdisk Hack ==

We don't talk to the iPhone via AFC. We talk to the iBoot (Recovery Mode), which is implemented in iPHUC too.
In iBoot you upload a file to RAM (no jailbreak required) and then change boot-args to boot it.

* setenv boot-args rd=md0 -s -x pmd0=0x09CC2000.0x0133D000
* saveenv
* fsboot

I'm not sure about the last command, you must try it. If it does not work, try 'bootx'.

- wEsTbAeR--

Talk:Ramdisk Hack

2008-07-29T13:41:38Z

WEsTbAeR--: /* Re: Ramdisk Hack */ new section

This is just a 'overall' explanations to give someone that is not involved a 'clue'.

Could please someone explain more specifically to enable an experienced user to follow the hack?

== Ramdisk Hack ==

It's not difficult at all. You just send a file to 1.1.4 or lower iBoot (iphuc: sendfiletophone or something) then "change" some boot-args. -wEsTbAeR--

I believe that it is not difficult. But where do you put the file and how do you change boot args. And how you put the file there, because at this point it isn't jailbreaked yet!? -caique2001-

== Re: Ramdisk Hack ==

We don't talk to the iPhone via AFC. We talk to the iBoot (Recovery Mode), which is implemented in iPHUC tool.
In iBoot you upload a file to RAM (no jailbreak required) and then change boot-args to boot it.

setenv boot-args rd=md0 -s -x pmd0=0x09CC2000.0x0133D000
saveenv
fsboot

I'm not sure about the last command, you must try it. If it does not work, try 'bootx'.

- wEsTbAeR--

User:Zibri

2008-07-29T12:56:12Z

WEsTbAeR--:

The creator of [[ZiPhone]] and the first who published [[Key_0x837]].

Talk:Ramdisk Hack

2008-07-29T12:51:21Z

WEsTbAeR--:

Talk:Ramdisk Hack

2008-07-29T12:51:05Z

WEsTbAeR--: /* Ramdisk Hack */ new section

Talk:M68AP

2008-07-29T03:09:22Z

WEsTbAeR--:

== Screenshot ==

Isn't that screenshot from the wrong version? -Vaumnou

== Re: Screenshot ==

It's 2.0 on a 3G iPhone. But 2.0 3G is the same as 2.0 M68AP so it doesn't matter.

- wEsTbAeR--

Talk:M68AP

2008-07-29T03:09:14Z

WEsTbAeR--:

== Screenshot ==

Isn't that screenshot from the wrong version? -Vaumnou

== Re: Screenshort ==

It's 2.0 on a 3G iPhone. But 2.0 3G is the same as 2.0 M68AP so it doesn't matter.

- wEsTbAeR--

Talk:M68AP

2008-07-29T03:08:53Z

WEsTbAeR--: /* wEsTbAeR-- */ new section

== Screenshot ==

Isn't that screenshot from the wrong version? -Vaumnou

== wEsTbAeR-- ==

It's 2.0 on a 3G iPhone. But 2.0 3G is the same as 2.0 M68AP so it doesn't matter.

User talk:Zibri

2008-07-28T20:55:11Z

WEsTbAeR--:

Let's keep things civilized ;) -drg

He leaked it, not published it ;) -wEsTbAeR--

User:Zibri

2008-07-28T20:28:28Z

WEsTbAeR--:

A hard working hacker who discovered such things as the [[Ramdisk Hack]], the [[Minus 0x20000 with Back Extend Erase]], the [[Key_0x837]] and [[ZiPhone]].

Hardware unlock

2008-07-28T16:30:15Z

WEsTbAeR--:

This was the earliest unlock and variation of the [[FakeBlank]] exploit. It involved opening up the iPhone and doing a testpoint on A17 gate.

Timeline

2008-07-28T16:23:51Z

WEsTbAeR--: added virginizer

* June 29, 2007 -- [[iPhone]] is released. World's most hyped consumer product.
* July 3, 2007 -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription
* July 9, 2007 -- dev team releases [[jailbreak]] method. The first use of this is ringtones
* July 20, 2007 -- nightwatch ports a [[toolchain]] to the iPhone. The first apps are compiled. (but see "Revisions needed" note below)
* August 14, 2007 -- First phones are used with other carriers by means of a [[SIM hack]]
* August 21, 2007 -- Installer.app is released, first GUI apps are distributed
* August 23, 2007 -- geohot and team release [[hardware unlock]] method.
* September 10, 2007 -- [[IPSF]] releases first software unlock method for money.
* September 11, 2007 -- dev team releases [[iUnlock]], first free software unlock
* Oktober, 23, 2007 -- iPhone-Elite Team releases [[Virginizer]]
* November 2, 2007 -- [[jailbreakme]] is released, bringing jailbreaking to the mainstream iPhone user
* November 15, 2007 -- [[Bootloader 4.6|New bootloader]] comes out, new iPhones can't be unlocked.
* February 8, 2008 -- geohot releases software unlock for 4.6, Apple states 25% of phones were never activated with AT&T
* February 11, 2008 -- Zibri releases [[ZiPhone]], the all in one unlock, activate, jailbreak solution.
* March 4, 2008 -- George Zhu (n000b) released iLiberty.
* April 3, 2008 -- Devteam releases [[PwnageTool]] 1.0, making use of the ramdisk exploit, to write to the kernel, to write to the NOR
* July 11, 2008 -- [[iPhone 3G]] is released
* July 19, 2008 -- Devteam releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the iPhone 2G and jailbreaking the 2.0 software on the iPhone 3G. This exploited DFU mode this time and it can only be fixed via a hardware revision

Revisions needed: Nighwatch didn't "port a toolchain". Also needed are references to iAsign, iNdependence, sam+daeken bruteforce. Software 3.9 NORdump. TA_Mobile 4.6 NORdump. 4.6 GPIO block unlock.

Timeline

2008-07-28T16:22:54Z

WEsTbAeR--:

* June 29, 2007 -- [[iPhone]] is released. World's most hyped consumer product.
* July 3, 2007 -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription
* July 9, 2007 -- dev team releases [[jailbreak]] method. The first use of this is ringtones
* July 20, 2007 -- nightwatch ports a [[toolchain]] to the iPhone. The first apps are compiled. (but see "Revisions needed" note below)
* August 14, 2007 -- First phones are used with other carriers by means of a [[SIM hack]]
* August 21, 2007 -- Installer.app is released, first GUI apps are distributed
* August 23, 2007 -- geohot and team release [[hardware unlock]] method.
* September 10, 2007 -- [[IPSF]] releases first software unlock method for money.
* September 11, 2007 -- dev team releases [[iUnlock]], first free software unlock
* Oktober, 23, 2007 -- iPhone-Elite releases [[Virginizer]]
* November 2, 2007 -- [[jailbreakme]] is released, bringing jailbreaking to the mainstream iPhone user
* November 15, 2007 -- [[Bootloader 4.6|New bootloader]] comes out, new iPhones can't be unlocked.
* February 8, 2008 -- geohot releases software unlock for 4.6, Apple states 25% of phones were never activated with AT&T
* February 11, 2008 -- Zibri releases [[ZiPhone]], the all in one unlock, activate, jailbreak solution.
* March 4, 2008 -- George Zhu (n000b) released iLiberty.
* April 3, 2008 -- Devteam releases [[PwnageTool]] 1.0, making use of the ramdisk exploit, to write to the kernel, to write to the NOR
* July 11, 2008 -- [[iPhone 3G]] is released
* July 19, 2008 -- Devteam releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the iPhone 2G and jailbreaking the 2.0 software on the iPhone 3G. This exploited DFU mode this time and it can only be fixed via a hardware revision

Revisions needed: Nighwatch didn't "port a toolchain". Also needed are references to iAsign, iNdependence, sam+daeken bruteforce. Software 3.9 NORdump. TA_Mobile 4.6 NORdump. 4.6 GPIO block unlock.

Timeline

2008-07-28T16:10:07Z

WEsTbAeR--: Added iLiberty

* June 29, 2007 -- [[iPhone]] is released. World's most hyped consumer product.
* July 3, 2007 -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription
* July 9, 2007 -- dev team releases [[jailbreak]] method. The first use of this is ringtones
* July 20, 2007 -- nightwatch ports a [[toolchain]] to the iPhone. The first apps are compiled. (but see "Revisions needed" note below)
* August 14, 2007 -- First phones are used with other carriers by means of a [[SIM hack]]
* August 21, 2007 -- Installer.app is released, first GUI apps are distributed
* August 23, 2007 -- geohot and team release [[hardware unlock]] method.
* September 10, 2007 -- [[IPSF]] releases first software unlock method for money.
* September 11, 2007 -- dev team releases [[iUnlock]], first free software unlock
* November 2, 2007 -- [[jailbreakme]] is released, bringing jailbreaking to the mainstream iPhone user
* November 15, 2007 -- [[Bootloader 4.6|New bootloader]] comes out, new iPhones can't be unlocked.
* February 8, 2008 -- geohot releases software unlock for 4.6, Apple states 25% of phones were never activated with AT&T
* February 11, 2008 -- Zibri releases [[ZiPhone]], the all in one unlock, activate, jailbreak solution.
* March 4, 2008 -- George Zhu (n000b) released iLiberty.
* April 3, 2008 -- Devteam releases [[PwnageTool]] 1.0, making use of the ramdisk exploit, to write to the kernel, to write to the NOR
* July 11, 2008 -- [[iPhone 3G]] is released
* July 19, 2008 -- Devteam releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the iPhone 2G and jailbreaking the 2.0 software on the iPhone 3G. This exploited DFU mode this time and it can only be fixed via a hardware revision

Revisions needed: Nighwatch didn't "port a toolchain". Also needed are references to iAsign, iNdependence, virgintool, sam+daeken bruteforce. Software 3.9 NORdump. TA_Mobile 4.6 NORdump. 4.6 GPIO block unlock.

JailbreakMe

2008-07-28T13:14:33Z

WEsTbAeR--: found by cmw

This was the exploit used to easily jailbreak 1.1.1 phones.

==Credit==
metasploit, rezn, dinopio, drudge, kroo, pumpkin, davidc, dunham, planetbeing, NerveGas

Originally found by cmw.

==Exploit==
There was a buffer overflow in the iPhone's libtiff. This was exploited to run a small application to jailbreak and patch libtiff. This exploit was also used in the PSP.

ZiPhone

2008-07-28T13:07:32Z

WEsTbAeR--:

[[Zibri]]'s tool to unlock, jailbreak, and activate.

His tool is Uber-Secure and it has never bricked an iPhone. It was all written by himself and tested on over 100 iPhones (day by day) in great Italy.

Tutorial:Mounting the Ramdisk of IPSW in Betas 4-7

2008-07-28T13:00:35Z

WEsTbAeR--:

'''How to decrypt beta 4-7 ramdisks'''

First unzip your ipsw, and take out the ramdisk file (it will be around 18mb). Then put it on your desktop
In Terminal...

Launch /Applications/Utilities/Terminal.app

Then type the following:

* cd Desktop
* echo `hexdump -s12 -n4 -e '"%d\n"' ramdisks-hould-just-be-a-bunch-of-numbers.dmg ` / 32 | bc

A number should appear. For example, in the case of beta 5, it would be 604800.

So you will type the following command now:

* dd if=ramdisk-name-aka-a-bunch-of-numbers.dmg of=ramdiskb5.dmg bs=32 skip=1 count=**NUMBERS-GO-HERE** conv=sync

After this, you will have a file called ramdiskb5.dmg on your desktop. Just double click this file and it should mount fine.
Example: Beta 5 Ramdisk

* Macintosh:~ xxxxxxxxx$ cd /Users/xxxxxxx/Desktop/iPhone1,1_2.0_5A274d_Resto (THIS IS WHERE I UNZIPPED MY IPSW. I was a bit sloppy and did it the quick but annoying way, and accidently deleted some letters. But my point is that this is a folder name. You'd probably be better off just unzipping the ramdisk to your desktop rather than to a folder)
* Macintosh:iPhone1,1_2.0_5A274d_Resto xxxxxxx$ echo `hexdump -s12 -n4 -e '"%d\n"' 018-3615-6.dmg ` / 32 | bc (**THIS GETS ME THE NUMBER I NEED FOR THE NEXT STETP**)
* 604800 (**THIS IS THE NUMBER I NEED FOR THE NEXT COMMAND**)
* Macintosh:iPhone1,1_2.0_5A274d_Resto xxxxxxxx$ dd if=018-3615-6.dmg of=ramdiskb5.dmg bs=32 skip=1 count=604800 conv=sync
* 604800+0 records in
* 604800+0 records out
* 19353600 bytes transferred in 5.721840 secs (3382408 bytes/sec) (**THIS MADE MY RAMDISK MOUNTABLE**)
* (**AT THIS POINT, THE DECRYPTED RAMDISK WAS ON MY DESKTOP, READY FOR USE**)

source: [http://www.chronic-dev.org ChronicDev User Wiki]

Tutorial:Mounting the Ramdisk of IPSW in Betas 4-7

2008-07-28T12:59:46Z

WEsTbAeR--:

'''How to decrypt beta 4-7 ramdisks'''

First unzip your ipsw, and take out the ramdisk file (it will be around 18mb). Then put it on your desktop
In Terminal...

Launch /Applications/Utilities/Terminal.app

Then type the following:

* cd Desktop
* echo `hexdump -s12 -n4 -e '"%d\n"' ramdisks-hould-just-be-a-bunch-of-numbers.dmg ` / 32 | bc

A number should appear. For example, in the case of beta 5, it would be 604800.

So you will type the following command now:

* dd if=ramdisk-name-aka-a-bunch-of-numbers.dmg of=ramdiskb5.dmg bs=32 skip=1 count=**NUMBERS-GO-HERE** conv=sync

After this, you will have a file called ramdiskb5.dmg on your desktop. Just double click this file and it should mount fine.
Example: Beta 5 Ramdisk

Last login: Tue May 6 21:37:15 on ttys000

Macintosh:~ xxxxxxxxx$ cd /Users/xxxxxxx/Desktop/iPhone1,1_2.0_5A274d_Resto (THIS IS WHERE I UNZIPPED MY IPSW. I was a bit sloppy and did it the quick but annoying way, and accidently deleted some letters. But my point is that this is a folder name. You'd probably be better off just unzipping the ramdisk to your desktop rather than to a folder)
* Macintosh:iPhone1,1_2.0_5A274d_Resto xxxxxxx$ echo `hexdump -s12 -n4 -e '"%d\n"' 018-3615-6.dmg ` / 32 | bc (**THIS GETS ME THE NUMBER I NEED FOR THE NEXT STETP**)
* 604800 (**THIS IS THE NUMBER I NEED FOR THE NEXT COMMAND**)
* Macintosh:iPhone1,1_2.0_5A274d_Resto xxxxxxxx$ dd if=018-3615-6.dmg of=ramdiskb5.dmg bs=32 skip=1 count=604800 conv=sync
* 604800+0 records in
* 604800+0 records out
* 19353600 bytes transferred in 5.721840 secs (3382408 bytes/sec) (**THIS MADE MY RAMDISK MOUNTABLE**)
* (**AT THIS POINT, THE DECRYPTED RAMDISK WAS ON MY DESKTOP, READY FOR USE**)

source: [http://www.chronic-dev.org ChronicDev User Wiki]

User:WEsTbAeR--

2008-07-28T03:07:05Z

WEsTbAeR--: New page: From Vienna / Austria.

From Vienna / Austria.

User:Zibri

2008-07-28T02:15:06Z

WEsTbAeR--: Added key837

A hard working hacker who discovered such things as the [[Ramdisk Hack]], the [[Minus 0x20000 with Back Extend Erase]], the [[Key_0x837]] and the [[iPhone 3G]].

DFU Mode

2008-07-28T02:08:18Z

WEsTbAeR--:

Also called '''Device Firmware Upgrade Mode'''.

This allows the [[S5L8900]] to be restored from any state. It resides in the [[VROM]]

The [[pwnage 2.0]] exploit is here.

DFU Mode

2008-07-28T02:07:48Z

WEsTbAeR--: Sorry, wrong definition, should be correct now

Also called or '''Device Firmware Upgrade Mode'''.

This allows the [[S5L8900]] to be restored from any state. It resides in the [[VROM]]

The [[pwnage 2.0]] exploit is here.

DFU Mode

2008-07-28T01:51:57Z

WEsTbAeR--: Added Name definition

Also called '''Device Failsafe Utility''' or '''Device Firmware Upgrade'''.

This allows the [[S5L8900]] to be restored from any state. It resides in the [[VROM]]

The [[pwnage 2.0]] exploit is here.