Alloc8 Exploit - Revision history

Inflatable Man: Added alloc8 CVE ID

2020-10-21T23:03:09Z

Added alloc8 CVE ID

Http: fix typo

2020-01-01T08:30:42Z

fix typo

Techguy9: No longer the last bootrom exploit

2019-10-02T21:20:45Z

No longer the last bootrom exploit

JPS at 15:48, 31 August 2017

2017-08-31T15:48:43Z

Spydar007 at 07:48, 14 April 2017

2017-04-14T07:48:13Z

WikiEditor01 at 09:51, 12 April 2017

2017-04-12T09:51:59Z

Spydar007: clean up

2017-04-12T06:40:09Z

clean up

Dialexio at 04:35, 12 April 2017

2017-04-12T04:35:46Z

WikiEditor01 at 00:13, 12 April 2017

2017-04-12T00:13:42Z

WikiEditor01 at 00:03, 12 April 2017

2017-04-12T00:03:26Z

@@ Line 1: / Line 1: @@
 {{lowercase}}
-The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS.
+The '''alloc8 exploit''' is a [[bootrom]] exploit with a CVE ID of CVE-2019-9536 used to run unsigned code on both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS.
 [[User:axi0mX|axi0mX]] published a detailed analysis of alloc8 at [https://github.com/axi0mX/alloc8/blob/master/README GitHub] following his discovery of the exploit.

@@ Line 1: / Line 1: @@
 {{lowercase}}
-The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS.
+The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS.
 [[User:axi0mX|axi0mX]] published a detailed analysis of alloc8 at [https://github.com/axi0mX/alloc8/blob/master/README GitHub] following his discovery of the exploit.

@@ Line 1: / Line 1: @@
 {{lowercase}}
-The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS, and the last publicly disclosed [[bootrom]] exploit of all devices (as of this article's writing).
+The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS.
 [[User:axi0mX|axi0mX]] published a detailed analysis of alloc8 at [https://github.com/axi0mX/alloc8/blob/master/README GitHub] following his discovery of the exploit.

@@ Line 1: / Line 1: @@
 {{lowercase}}
-The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS, and the last publicly disclosed [[bootrom]] exploit of all devices.
+The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS, and the last publicly disclosed [[bootrom]] exploit of all devices (as of this article's writing).
 [[User:axi0mX|axi0mX]] published a detailed analysis of alloc8 at [https://github.com/axi0mX/alloc8/blob/master/README GitHub] following his discovery of the exploit.

@@ Line 2: / Line 2: @@
 The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS, and the last publicly disclosed [[bootrom]] exploit of all devices.
-'''axi0mX''' published a detailed analysis of alloc8 at [https://github.com/axi0mX/alloc8/blob/master/README GitHub] following his discovery of the exploit.
+[[User:axi0mX|axi0mX]] published a detailed analysis of alloc8 at [https://github.com/axi0mX/alloc8/blob/master/README GitHub] following his discovery of the exploit.
 [[ipwndfu]] is currently the primary and most simple way of using the alloc8 exploit.

@@ Line 1: / Line 1: @@
 {{lowercase}}
-The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the [[N88AP|iPhone 3GS]] (and thereby jailbreak it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the new bootrom ([[Bootrom 359.3.2]]) iPhone 3GS, and was first used in the [[ipwndfu]] tool by axi0mX, making untethered downgrades possible for the iPhone 3GS.
+The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the both the [[Bootrom 359.3.2|new bootrom]] and the [[Bootrom 359.3|old bootrom]] [[N88AP|iPhone 3GS]] (and thereby [[jailbreak]] it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the [[Bootrom 359.3.2|new bootrom]] iPhone 3GS.
-'''axi0mX''' himself has produced a detailed analysis of alloc8.[https://github.com/axi0mX/alloc8]
+'''axi0mX''', the discoverer of the exploit, produced a detailed analysis of alloc8, which was published on [https://github.com/axi0mX/alloc8/blob/master/README GitHub].
 [[Category:Exploits]]

@@ Line 1: / Line 1: @@
 {{lowercase}}
-The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code (and thereby jailbreak) the [[N88AP|iPhone 3GS]]. It is the first public [[untethered]] [[bootrom]] exploit for the '''new [[bootrom]]''' ([[Bootrom 359.3.2]]) [[N88AP|iPhone 3GS]], and was first used in the [[ipwndfu]] tool by '''axi0mX''', making '''[[untethered]]''' downgrades possible on the aforementioned device. It is the most recent publicly disclosed [[bootrom]] exploit.
+The '''alloc8 exploit''' is a [[bootrom]] exploit used to run unsigned code on the [[N88AP|iPhone 3GS]] (and thereby jailbreak it). It is the first public [[Untethered jailbreak|untethered]] [[bootrom]] exploit for the new bootrom ([[Bootrom 359.3.2]]) iPhone 3GS, and was first used in the [[ipwndfu]] tool by axi0mX, making untethered downgrades possible for the iPhone 3GS.
-'''axi0mX''' himself has produced a detailed analysis of alloc8 found at https://github.com/axi0mX/alloc8.
+'''axi0mX''' himself has produced a detailed analysis of alloc8.[https://github.com/axi0mX/alloc8]
 ==Vulnerability==
 "This is not a typical heap bug. This is a bug in implementation of the heap itself.
-void *malloc(size_t size);
+ void *malloc(size_t size);
 In C programming language, function malloc should return NULL if it is unable to allocate memory of the requested size. Caller should check if returned pointer is NULL and handle the error:
-void *pointer = malloc(size);
+ void *pointer = malloc(size);
 ==Exploitation==
 "First, we must be able to allocate enough data on the heap to make it run out of memory. Apple seems to have done a good job in reducing the attack surface of the bootrom, and it is far from certain that this can be achieved.
@@ Line 43: / Line 41: @@
 ==Shellcode==
 "First 52 bytes of NOR contain an IMG2 header with NOR metadata that should not be changed. Before bootrom starts parsing images in NOR, the first 512 bytes of NOR are copied to memory allocated on the heap, but only 52 bytes are actually used. The remaining 460 bytes are unused and can be safely used for shellcode. Memory address where this data gets allocated is always the same."
 ==Post Exploitation==
 "To clean up, shellcode returns from exception, sets a new stack top, restores the original pointer for data abort handler, and frees 44-byte structures which are occupying most of the heap, leaving only the one required for normal boot, LLB.