S5L8900 - Revision history

Spydar007 at 18:22, 22 March 2017

2017-03-22T18:22:30Z

IAdam1n: Updating.

2015-10-08T08:02:32Z

Updating.

IAdam1n: Consistency please.

2014-10-19T10:02:52Z

Consistency please.

IAdam1n: It's not an iPhone "2G"

2014-10-05T12:01:14Z

It's not an iPhone "2G"

5urd: ups

2013-11-14T16:26:02Z

ups

J. J. at 13:27, 2 November 2013

2013-11-02T13:27:48Z

IAdam1n at 17:03, 3 July 2013

2013-07-03T17:03:27Z

Http: fix links (no space there!)

2013-05-03T20:44:06Z

fix links (no space there!)

5urd: /* DFU Mode */

2012-11-23T03:38:27Z

‎DFU Mode

5urd: /* DFU Mode */ apparently the U+2325 meant 0x2325. How could I forget that

2012-11-23T03:35:17Z

‎DFU Mode: apparently the U+2325 meant 0x2325. How could I forget that

@@ Line 1: / Line 1: @@
 {{float toc|right}}
-The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[M68AP|iPhone]], [[N45AP|iPod touch]], and the [[N82AP|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[N72AP|iPod touch 2G]] and the [[S5L8920]] in the [[N88AP|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
+The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[M68AP|iPhone]], [[N45AP|iPod touch]], and the [[N82AP|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[N72AP|iPod touch (2nd generation)]] and the [[S5L8920]] in the [[N88AP|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
 == [[VROM (S5L8900)|VROM]] Exploits ==

@@ Line 1: / Line 1: @@
 {{float toc|right}}
-The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[m68ap|iPhone]], [[n45ap|iPod touch]], and the [[n82ap|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[n72ap|iPod touch 2G]] and the [[S5L8920]] in the [[n88ap|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
+The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[M68AP|iPhone]], [[N45AP|iPod touch]], and the [[N82AP|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[N72AP|iPod touch 2G]] and the [[S5L8920]] in the [[N88AP|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
 == [[VROM (S5L8900)|VROM]] Exploits ==
@@ Line 39: / Line 39: @@
 In order to flash an older version of [[iOS|iPhone OS]] onto the device, you need to enter [[DFU Mode]]. The entry into DFU Mode is in the [[iDevice|device]]'s circuitry and the processor itself. This allows a non-responsive device to enter DFU Mode nearly anywhere, essentially making it improbable to [[bricked|brick]] the device.
-Once in [[DFU Mode]], [[iTunes]] will notify you of a device in [[Restore Mode]], even though it isn't. This is common across all devices. In iTunes, you just hold the [[wikipedia:Option key|Option key]] ([[wikipedia:File:Third-party option key.JPG|&#x2325;]]) on [[wikipedia:OS X|OS X]] or the [[wikipedia:Shift key|shift key]] on [[wikipedia:Microsoft Windows|Windows]] while clicking the "Restore" button. Just navigate to the [[IPSW File Format|IPSW]] for the specific version you want. As [[SHSH|SHSH blobs]] didn't exist before [[iOS|iPhone OS]] 3.0 with the [[S5L8920]] on the [[n88ap|iPhone 3GS]], you are only limited by your ability to obtain the [[firmware]] IPSW.
+Once in [[DFU Mode]], [[iTunes]] will notify you of a device in [[Restore Mode]], even though it isn't. This is common across all devices. In iTunes, you just hold the [[wikipedia:Option key|Option key]] ([[wikipedia:File:Third-party option key.JPG|&#x2325;]]) on [[wikipedia:OS X|OS X]] or the [[wikipedia:Shift key|shift key]] on [[wikipedia:Microsoft Windows|Windows]] while clicking the "Restore" button. Just navigate to the [[IPSW File Format|IPSW]] for the specific version you want. As [[SHSH|SHSH blobs]] didn't exist before [[iOS|iPhone OS]] 3.0 with the [[S5L8920]] on the [[N88AP|iPhone 3GS]], you are only limited by your ability to obtain the [[firmware]] IPSW.
 The boot chain is a very simple one:

@@ Line 1: / Line 1: @@
 {{float toc|right}}
-The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[m68ap|iPhone]], [[n45ap|iPod touch 1G]], and the [[n82ap|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[n72ap|iPod touch 2G]] and the [[S5L8920]] in the [[n88ap|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
+The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[m68ap|iPhone]], [[n45ap|iPod touch]], and the [[n82ap|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[n72ap|iPod touch 2G]] and the [[S5L8920]] in the [[n88ap|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
 == [[VROM (S5L8900)|VROM]] Exploits ==

@@ Line 1: / Line 1: @@
 {{float toc|right}}
-The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[m68ap|iPhone 2G]], [[n45ap|iPod touch 1G]], and the [[n82ap|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[n72ap|iPod touch 2G]] and the [[S5L8920]] in the [[n88ap|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
+The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[m68ap|iPhone]], [[n45ap|iPod touch 1G]], and the [[n82ap|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[n72ap|iPod touch 2G]] and the [[S5L8920]] in the [[n88ap|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
 == [[VROM (S5L8900)|VROM]] Exploits ==

@@ Line 1: / Line 1: @@
 {{float toc|right}}
-The '''S5L8900''' in the technical name of the [[application processor]] shared between the [[m68ap|iPhone 2G]], [[n45ap|iPod touch 1G]], and the [[n82ap|iPhone 3G]]. Not much is known about it through official sources. According to [[saurik]], this is an "arm1176jzf-s". This processor has been replaced by the [[S5L8720]] in the [[n72ap|iPod touch 2G]] and the [[S5L8920]] in the [[n88ap|iPhone 3GS]]. Those have subsequently been replaced by newer [[Application processor|processors]].
+The '''S5L8900''' in the technical name of the [[Application Processor|application processor]] shared between the [[m68ap|iPhone 2G]], [[n45ap|iPod touch 1G]], and the [[n82ap|iPhone 3G]]. Not much is known about it, even through official sources. According to [[saurik]], this is an [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf <code>arm1176jzf-s</code>]. This processor was succeded by the [[S5L8720]] used in the [[n72ap|iPod touch 2G]] and the [[S5L8920]] in the [[n88ap|iPhone 3GS]]. Those have subsequently been succeded by newer processors.
 == [[VROM (S5L8900)|VROM]] Exploits ==
@@ Line 12: / Line 12: @@
 * [[Kernel]]
 * [[/|System Software]]
 === [[iDroid]] ===
 One of the many goals of the [[iDroid]] project is to modify the boot chain immediately after the bootrom:
@@ Line 47: / Line 48: @@
 * [[VROM (S5L8900)]]
 ** [[Bootrom Rev.2]]
 [[Category:Application Processors]]

@@ Line 36: / Line 36: @@
 === [[DFU Mode]] ===
-In order to flash an older version of [[iOS|iPhone OS]] onto the device, you need to enter [[DFU Mode]]. The entry into DFU Mode is in the [[iDevice|device]]'s circuitry and the processor itself. This allows a non-responsive device to enter DFU Mode nearly anywhere, essentially making it improbable to [[brick]] the device.
+In order to flash an older version of [[iOS|iPhone OS]] onto the device, you need to enter [[DFU Mode]]. The entry into DFU Mode is in the [[iDevice|device]]'s circuitry and the processor itself. This allows a non-responsive device to enter DFU Mode nearly anywhere, essentially making it improbable to [[bricked|brick]] the device.
 Once in [[DFU Mode]], [[iTunes]] will notify you of a device in [[Restore Mode]], even though it isn't. This is common across all devices. In iTunes, you just hold the [[wikipedia:Option key|Option key]] ([[wikipedia:File:Third-party option key.JPG|&#x2325;]]) on [[wikipedia:OS X|OS X]] or the [[wikipedia:Shift key|shift key]] on [[wikipedia:Microsoft Windows|Windows]] while clicking the "Restore" button. Just navigate to the [[IPSW File Format|IPSW]] for the specific version you want. As [[SHSH|SHSH blobs]] didn't exist before [[iOS|iPhone OS]] 3.0 with the [[S5L8920]] on the [[n88ap|iPhone 3GS]], you are only limited by your ability to obtain the [[firmware]] IPSW.

@@ Line 9: / Line 9: @@
 == Boot Chain ==
-* [[VROM (S5L8900)|VROM]] ([[Bootrom Rev. 2]])
+* [[VROM (S5L8900)|VROM]] ([[Bootrom Rev.2]])
 * [[LLB]]
 * [[iBoot (Bootloader)|iBoot]]
@@ Line 16: / Line 16: @@
 === [[iDroid]] ===
 One of the many goals of the [[iDroid]] project is to modify the boot chain immediately after the bootrom:
-* VROM (Bootrom Rev. 2)
+* VROM ([[Bootrom Rev.2]])
 * [[OpeniBoot]]
 * [http://www.kernel.org Linux Kernel]
@@ Line 22: / Line 22: @@
 * [[wikipedia:X Window System|X Window System]] (X11)
-This is possible thanks to the [[Pwnage]] and [[Pwnage 2.0]] exploits discovered by the [[iPhone Dev Team]]. The exploit in a nutshell exploits the fact that the [[VROM (S5L8900)|VROM]] ([[Bootrom Rev. 2]]) doesn't signature check the [[LLB]], and as such, by uploading a maliciously crafted LLB, one can gain control of the entire device.
+This is possible thanks to the [[Pwnage]] and [[Pwnage 2.0]] exploits discovered by the [[iPhone Dev Team]]. The exploit in a nutshell exploits the fact that the [[VROM (S5L8900)|VROM]] ([[Bootrom Rev.2]]) doesn't signature check the [[LLB]], and as such, by uploading a maliciously crafted LLB, one can gain control of the entire device.
 Despite many years of work, it appears that the project will never be finished, much akin to many other big open source projects, such as [[wikipedia:ReactOS|ReactOS]] and the [[wikipedia:GNU Project|GNU]]'s own kernel, the [http://www.gnu.org/software/hurd/hurd.html Hurd].
@@ Line 29: / Line 29: @@
 === [[Restore Mode]] ===
 The restore process of the processor is:
-* [[VROM (S5L8900)|VROM]] ([[Bootrom Rev. 2]])
+* [[VROM (S5L8900)|VROM]] ([[Bootrom Rev.2]])
 * [[DFU Mode]]
 * [[WTF]]
@@ Line 43: / Line 43: @@
 The boot chain is a very simple one:
-* [[VROM (S5L8900)|VROM]] ([[Bootrom Rev. 2]])
+* [[VROM (S5L8900)|VROM]] ([[Bootrom Rev.2]])
 * [[DFU Mode]]
 == See Also ==
 * [[VROM (S5L8900)]]
-** [[Bootrom Rev. 2]]
+** [[Bootrom Rev.2]]
 * [[Application processor]]

@@ Line 40: / Line 40: @@
 In order to flash an older version of [[iOS|iPhone OS]] onto the device, you need to enter [[DFU Mode]]. The entry into DFU Mode is in the [[iDevice|device]]'s circuitry and the processor itself. This allows a non-responsive device to enter DFU Mode nearly anywhere, essentially making it improbable to [[brick]] the device.
-Once in [[DFU Mode]], [[iTunes]] will notify you of a device in [[Restore Mode]], even though it isn't. This is common across all devices. In iTunes, you just hold the [[wikipedia:Option key|Option key]] (&#x0915;) on [[wikipedia:OS X|OS X]] or the [[wikipedia:Shift key|shift key]] on [[wikipedia:Microsoft Windows|Windows]] while clicking the "Restore" button. Just navigate to the [[IPSW File Format|IPSW]] for the specific version you want. As [[SHSH|SHSH blobs]] didn't exist before [[iOS|iPhone OS]] 3.0 with the [[S5L8920]] on the [[n88ap|iPhone 3GS]], you are only limited by your ability to obtain the [[firmware]] IPSW.
+Once in [[DFU Mode]], [[iTunes]] will notify you of a device in [[Restore Mode]], even though it isn't. This is common across all devices. In iTunes, you just hold the [[wikipedia:Option key|Option key]] (&#x2325;) on [[wikipedia:OS X|OS X]] or the [[wikipedia:Shift key|shift key]] on [[wikipedia:Microsoft Windows|Windows]] while clicking the "Restore" button. Just navigate to the [[IPSW File Format|IPSW]] for the specific version you want. As [[SHSH|SHSH blobs]] didn't exist before [[iOS|iPhone OS]] 3.0 with the [[S5L8920]] on the [[n88ap|iPhone 3GS]], you are only limited by your ability to obtain the [[firmware]] IPSW.
 The boot chain is a very simple one: