0x24000 Segment Overflow - Revision history

AknipGD: changed "us" in the first line to "people"

2021-10-22T17:13:05Z

changed "us" in the first line to "people"

IAdam1n at 14:04, 17 September 2021

2021-09-17T14:04:04Z

Kirb: /* Exploit */ rescue dead pastie link

2019-09-29T07:00:27Z

‎Exploit: rescue dead pastie link

Spydar007 at 09:51, 26 March 2017

2017-03-26T09:51:27Z

Spydar007 at 11:13, 24 March 2017

2017-03-24T11:13:24Z

IAdam1n: Updating

2015-10-13T08:31:49Z

Updating

IAdam1n: Updating

2015-10-11T09:53:40Z

Updating

IAdam1n: /* 3GS Implementation */ -.-

2013-10-24T18:05:44Z

‎3GS Implementation: -.-

Fallen at 17:59, 24 October 2013

2013-10-24T17:59:16Z

5urd: redirect fix

2012-10-30T22:34:14Z

redirect fix

← Older revision		Revision as of 17:13, 22 October 2021
Line 1:		Line 1:
−	Also known by its codename, 24Kpwn, this was the first exploit in the [[S5L8720]] that allowed us to bypass the bootrom signature checks on [[LLB]] and create what is known as an [[untethered jailbreak]].	+	Also known by its codename, 24Kpwn, this was the first exploit in the [[S5L8720]] that allowed people to bypass the bootrom signature checks on [[LLB]] and create what is known as an [[untethered jailbreak]].

	As of {{date\|2009\|10}}, seven months after the exposure of this hole, Apple sold updated [[N88AP\|iPhone 3GS]] and [[N72AP\|iPod touch (2nd generation)]] units with new bootroms that have this vulnerability patched.		As of {{date\|2009\|10}}, seven months after the exposure of this hole, Apple sold updated [[N88AP\|iPhone 3GS]] and [[N72AP\|iPod touch (2nd generation)]] units with new bootroms that have this vulnerability patched.

@@ Line 1: / Line 1: @@
 Also known by its codename, 24Kpwn, this was the first exploit in the [[S5L8720]] that allowed us to bypass the bootrom signature checks on [[LLB]] and create what is known as an [[untethered jailbreak]].
-As of October 2009, seven months after the exposure of this hole, Apple sold updated [[N88AP|iPhone 3GS]] and [[N72AP|iPod touch (2nd generation)]] units with new bootroms that have this vulnerability patched.
+As of {{date|2009|10}}, seven months after the exposure of this hole, Apple sold updated [[N88AP|iPhone 3GS]] and [[N72AP|iPod touch (2nd generation)]] units with new bootroms that have this vulnerability patched.
 ==Credit==

@@ Line 19: / Line 19: @@
 The exploit, as proposed by [[User:Planetbeing|planetbeing]], uses the overflow to overwrite one of the addresses of the SHA1 registers. The particular register is the only one that directly copies data to be hashed into the hardware (or into an arbitrary memory location, once the destination address has been overwritten). Code execution is achieved by writing data into the stack, specifically by overwriting the LR of the function performing the write to the "SHA1 register" so that instead of returning to the main SHA1 routine, it returns to a chosen location in memory that contains the payload code. The location chosen is within the range of memory that is filled with the [[LLB]]'s [[IMG3 File Format|IMG3]], so that the payload code can be placed within the LLB's IMG3.
-The challenge is determining what to put in as the SHA1 register location so that the right portion of stack can be overwritten with the payload LR. This can be challenging without having access to any sort of exception dump (crash register dumps in the [[S5L8720|bootrom]] had been disabled by Apple). [[User:Planetbeing|Planetbeing]] performed a static analysis of a very detailed IDB produced by [[User:ChronicDev|chronic]] and CPICH and determined the theoretical call stack for both of the invocations of the SHA1 hardware within the bootrom code [http://pastie.org/414981].
+The challenge is determining what to put in as the SHA1 register location so that the right portion of stack can be overwritten with the payload LR. This can be challenging without having access to any sort of exception dump (crash register dumps in the [[S5L8720|bootrom]] had been disabled by Apple). [[User:Planetbeing|Planetbeing]] performed a static analysis of a very detailed IDB produced by [[User:ChronicDev|chronic]] and CPICH and determined the theoretical call stack for both of the invocations of the SHA1 hardware within the bootrom code [http://web.archive.org/web/20140410202729/http://pastie.org/414981].
 In-situ verification of the LR location was performed by [[User:Posixninja|posixninja]]. CPICH discovered a way to alter the [[IMG3 File Format|IMG3]] DER so that the second invocation of the SHA-1 hardware was not performed without affecting the first, allowing better confirmation that this step was performed properly.

@@ Line 44: / Line 44: @@
 This exploit would have allowed the [[pwnage]] of the [[N88AP|iPhone 3GS]] without the discovery of an additional code execution vulnerability (required to write the exploit [[LLB]]), provided that the bug still existed in the 3GS's [[S5L8920|bootrom]]. Even though it was too late to patch the bootrom, it was not too late for Apple to change the restore process in the stock IPSW, removing the method used to get the exploitive [[LLB]] onto the device. Before, Apple would have no reason to fix this, since writing arbitrary data to [[NOR]] does not negate their chain of trust. However, now that a way has been found, they were able to prioritize a fix for this oversight thus making the permanent [[pwnage]] of future devices significantly more difficult.
-Thanks to irresponsible handling of the exploit by a third-party company known as [[NitroKey]] who was interested in making financial gain from the work of others, this eventuality became a near-certainty and pretty much erased the possibility of a day-of-release jailbreak for the [[N88AP|iPhone 3GS]] and the [[N18AP|iPod touch 3G]]. In addition, to counteract the exploit, with the early exposure of the exploit, Apple was able to add the [[ECID]] tag to the [[IMG3 File Format]] in the [[N88AP|iPhone 3GS]]. The early leak of the exploit allowed Apple to understand that an [[iBoot]] exploit would be necessary to flash the required oversized [[LLB]] and through doing so, Apple have prevented this exploit from allowing the [[N88AP|iPhone 3GS]] to be permanently jailbroken through this exploit unless new [[iBoot]] exploits (allowing unsigned code to be run) can be found in every firmware release or a signed copy of an (older) vulnerable version of [[iBoot]] is stored.
+Thanks to irresponsible handling of the exploit by a third-party company known as [[NitroKey]] who was interested in making financial gain from the work of others, this eventuality became a near-certainty and pretty much erased the possibility of a day-of-release jailbreak for the [[N88AP|iPhone 3GS]] and the [[N18AP|iPod touch (3rd generation)]]. In addition, to counteract the exploit, with the early exposure of the exploit, Apple was able to add the [[ECID]] tag to the [[IMG3 File Format]] in the [[N88AP|iPhone 3GS]]. The early leak of the exploit allowed Apple to understand that an [[iBoot]] exploit would be necessary to flash the required oversized [[LLB]] and through doing so, Apple have prevented this exploit from allowing the [[N88AP|iPhone 3GS]] to be permanently jailbroken through this exploit unless new [[iBoot]] exploits (allowing unsigned code to be run) can be found in every firmware release or a signed copy of an (older) vulnerable version of [[iBoot]] is stored.
 May the bastards of [[NitroKey]] burn in hell for all eternity.

@@ Line 1: / Line 1: @@
 Also known by its codename, 24Kpwn, this was the first exploit in the [[S5L8720]] that allowed us to bypass the bootrom signature checks on [[LLB]] and create what is known as an [[untethered jailbreak]].
-As of October 2009, seven months after the exposure of this hole, Apple sold updated [[N88AP|iPhone 3GS]] and [[N72AP|iPod touch 2G]] units with new bootroms that have this vulnerability patched.
+As of October 2009, seven months after the exposure of this hole, Apple sold updated [[N88AP|iPhone 3GS]] and [[N72AP|iPod touch (2nd generation)]] units with new bootroms that have this vulnerability patched.
 ==Credit==

@@ Line 42: / Line 42: @@
 ==Timing Impact==
-This exploit would have allowed the [[pwnage]] of the [[n88ap|iPhone 3GS]] without the discovery of an additional code execution vulnerability (required to write the exploit [[LLB]]), provided that the bug still existed in the 3GS's [[S5L8920|bootrom]]. Even though it was too late to patch the bootrom, it was not too late for Apple to change the restore process in the stock IPSW, removing the method used to get the exploitive [[LLB]] onto the device. Before, Apple would have no reason to fix this, since writing arbitrary data to [[NOR]] does not negate their chain of trust. However, now that a way has been found, they were able to prioritize a fix for this oversight thus making the permanent [[pwnage]] of future devices significantly more difficult.
+This exploit would have allowed the [[pwnage]] of the [[N88AP|iPhone 3GS]] without the discovery of an additional code execution vulnerability (required to write the exploit [[LLB]]), provided that the bug still existed in the 3GS's [[S5L8920|bootrom]]. Even though it was too late to patch the bootrom, it was not too late for Apple to change the restore process in the stock IPSW, removing the method used to get the exploitive [[LLB]] onto the device. Before, Apple would have no reason to fix this, since writing arbitrary data to [[NOR]] does not negate their chain of trust. However, now that a way has been found, they were able to prioritize a fix for this oversight thus making the permanent [[pwnage]] of future devices significantly more difficult.
 Thanks to irresponsible handling of the exploit by a third-party company known as [[NitroKey]] who was interested in making financial gain from the work of others, this eventuality became a near-certainty and pretty much erased the possibility of a day-of-release jailbreak for the [[N88AP|iPhone 3GS]] and the [[N18AP|iPod touch 3G]]. In addition, to counteract the exploit, with the early exposure of the exploit, Apple was able to add the [[ECID]] tag to the [[IMG3 File Format]] in the [[N88AP|iPhone 3GS]]. The early leak of the exploit allowed Apple to understand that an [[iBoot]] exploit would be necessary to flash the required oversized [[LLB]] and through doing so, Apple have prevented this exploit from allowing the [[N88AP|iPhone 3GS]] to be permanently jailbroken through this exploit unless new [[iBoot]] exploits (allowing unsigned code to be run) can be found in every firmware release or a signed copy of an (older) vulnerable version of [[iBoot]] is stored.

@@ Line 51: / Line 51: @@
 Early-run models of the [[n88ap|iPhone 3GS]] are still affected by this vulnerability. In these models, the exploit remains the same in spirit.
-The call tree and stacks analysis is very similar although a few bytes here and there changed it slightly. It was again done manually but afterward, and out of fun, an IDA Python Script was written to automate the process. The new static analysis can be seen here [http://pastie.org/551212], and the IDA Python Script for it there [http://github.com/iZsh/IDA-Python-Scripts/].
+The call tree and stacks analysis is very similar although a few bytes here and there changed it slightly. It was again done manually but afterward, and out of fun, an IDA Python Script was written to automate the process. The new static analysis can be seen [http://pastie.org/551212 here], and the IDA Python Script for it [http://github.com/iZsh/IDA-Python-Scripts/ there].
 The main differences are:

← Older revision		Revision as of 17:59, 24 October 2013
Line 1:		Line 1:
−	Also known by its codename, ~~24kPwn~~, this was the first exploit in the [[S5L8720]] that allowed us to bypass the bootrom signature checks on [[LLB]] and create what is known as an [[untethered jailbreak]].	+	Also known by its codename, 24Kpwn, this was the first exploit in the [[S5L8720]] that allowed us to bypass the bootrom signature checks on [[LLB]] and create what is known as an [[untethered jailbreak]].

	As of October 2009, seven months after the exposure of this hole, Apple sold updated [[n88ap\|iPhone 3GS]] and [[n72ap\|iPod touch 2G]] units with new bootroms that have this vulnerability patched.		As of October 2009, seven months after the exposure of this hole, Apple sold updated [[n88ap\|iPhone 3GS]] and [[n72ap\|iPod touch 2G]] units with new bootroms that have this vulnerability patched.