Talk:ARM7 Go - Revision history

Geohot at 21:53, 7 July 2009

2009-07-07T21:53:14Z

IZsh at 19:35, 7 July 2009

2009-07-07T19:35:57Z

ChronicDev at 19:16, 7 July 2009

2009-07-07T19:16:00Z

Geohot at 18:44, 7 July 2009

2009-07-07T18:44:46Z

IZsh at 17:15, 7 July 2009

2009-07-07T17:15:49Z

IZsh at 17:15, 7 July 2009

2009-07-07T17:15:02Z

ChronicDev: /* We may have something! */ new section

2009-01-19T22:55:32Z

‎We may have something!: new section

Pod2g: /* Chronic, I may have found the way to use arm7_go */

2009-01-19T22:03:59Z

‎Chronic, I may have found the way to use arm7_go

Pod2g at 22:03, 19 January 2009

2009-01-19T22:03:11Z

ChronicDev: /* Wel... */ new section

2009-01-18T02:41:58Z

‎Wel...: new section

← Older revision		Revision as of 21:53, 7 July 2009
Line 17:		Line 17:

	@geo: I can ensure you we definitely found it independently and implemented way before you released purplera!n. And I agree that re-implementing a different exploit once you know a vuln to be workable is not credit-able. Only fully independent discovery/implementation is.		@geo: I can ensure you we definitely found it independently and implemented way before you released purplera!n. And I agree that re-implementing a different exploit once you know a vuln to be workable is not credit-able. Only fully independent discovery/implementation is.
		+
		+	I believe you now, but I'm a little surprised you don't have hashes. Your "exploit" is quite a bit different, and theres no way you would've wrote something that complicated after seeing the simplicity of rain. jkjk, nice job guys, and feel free to add your name and a writeup to the [[IBoot Environment Variable Overflow]] page --[[User:Geohot\|geohot]] 21:53, 7 July 2009 (UTC)

← Older revision		Revision as of 19:35, 7 July 2009
Line 15:		Line 15:

	iZsh, when I wrote this article I was a little less experienced, and have adjusted it a bit. That being said, if you check the chronic dev google code svn, you will see that I did implement it in a payload called "0wnboot". But yes, I did confuse the "exploit" and "vulnerability" definitions. [[User:ChronicDev\|ChronicDev]] 19:16, 7 July 2009 (UTC)		iZsh, when I wrote this article I was a little less experienced, and have adjusted it a bit. That being said, if you check the chronic dev google code svn, you will see that I did implement it in a payload called "0wnboot". But yes, I did confuse the "exploit" and "vulnerability" definitions. [[User:ChronicDev\|ChronicDev]] 19:16, 7 July 2009 (UTC)
		+
		+	@geo: I can ensure you we definitely found it independently and implemented way before you released purplera!n. And I agree that re-implementing a different exploit once you know a vuln to be workable is not credit-able. Only fully independent discovery/implementation is.

@@ Line 1: / Line 1: @@
 == Vulnerability vs. Exploit and Credits ==
 @Chronic: I'm fine with you adding that you found it independently, but you have to be careful with the wording in general.
@@ Line 94: / Line 13: @@
 Theres one thing to be said for finding a vuln and seeing it crash, sure, thats usually not where the skill is and I'm not sure how much credit it deserves. But after an exploit is out using the vuln, it's a lot easier to get yourself to write another exploit since you have confirmation that the vuln is exploitable. The iBoot envvar one happened to be reasonably easy to find yet reasonably hard to exploit. If you really had your exploit working pre ra1n then props. But if you wrote an exploit post ra1n it's a lot easier knowing that this vuln can work. --[[User:Geohot|geohot]] 18:44, 7 July 2009 (UTC)

← Older revision		Revision as of 18:44, 7 July 2009
Line 92:		Line 92:

	Anyway, I think this page contains misusage of the word exploit, and other pages too, and I just wanted to point it.		Anyway, I think this page contains misusage of the word exploit, and other pages too, and I just wanted to point it.
		+
		+	Theres one thing to be said for finding a vuln and seeing it crash, sure, thats usually not where the skill is and I'm not sure how much credit it deserves. But after an exploit is out using the vuln, it's a lot easier to get yourself to write another exploit since you have confirmation that the vuln is exploitable. The iBoot envvar one happened to be reasonably easy to find yet reasonably hard to exploit. If you really had your exploit working pre ra1n then props. But if you wrote an exploit post ra1n it's a lot easier knowing that this vuln can work. --[[User:Geohot\|geohot]] 18:44, 7 July 2009 (UTC)

@@ Line 80: / Line 80: @@
 Just tried again, and it turned green :O
 @Chronic: I'm fine with you adding that you found it independently, but you have to be careful with the wording in general.
 It seems there are a great deal of misusages of the word "exploit" vs. vulnerability in this community. So if you don't mind, I'd like to clarify:

← Older revision		Revision as of 17:15, 7 July 2009
Line 79:		Line 79:

	Just tried again, and it turned green :O		Just tried again, and it turned green :O
		+
		+	@Chronic: I'm fine with you adding that you found it independently, but you have to be careful with the wording in general.
		+	It seems there are a great deal of misusages of the word "exploit" vs. vulnerability in this community. So if you don't mind, I'd like to clarify:
		+
		+	'''A vulnerability is the actual bug/security hole, whereas an exploit is the actual implementation which allows one to exploit the vulnerability.'''
		+
		+	For instance in the following sentence from the wiki:
		+	"The actual exploit is that, in the iPod Touch 2G 2.1.1 firmware, they left behind two commands: arm7_stop and arm7_go", the word "exploit" is not used properly. You are here talking about the vulnerability, not the exploit.
		+
		+	In my opinion, credits for vulnerability and exploit should be separated in general (I'm not talking about this one in particular, but I'm talking about vuln/exploit in general). One can find a vulnerability without exploiting it (because he doesn't want to, doesn't have the time, or it's too complicated and he doesn't manage actually to exploit it), and likewise someone can implement an actual exploit without discovering the initial vulnerability. IMHO, '''most of the time''', the exploit is where the skills really are, because it's one thing to understand why something is a security vulnerability, it's often another to make it actually real with a POC code (because of sanity checks, checking, filters and so on). Although sometimes, I do agree that finding the vulnerability itself requires mad skillz (as an example, prop' to Bleichenbacher for finding his RSA attack), it is my belief that most of the time, the exploit is where the difficulty lies.
		+
		+	Anyway, I think this page contains misusage of the word exploit, and other pages too, and I just wanted to point it.

← Older revision		Revision as of 22:55, 19 January 2009
Line 67:		Line 67:

	They noted they are looking for a way around that.		They noted they are looking for a way around that.
		+
		+	== We may have something! ==
		+
		+	I tried what iPod2G said.
		+
		+	Now, after running my payload...well...things are acting really WEIRD. the first time I tried,it crashed, and now...
		+
		+	http://pastie.org/private/gpsvfcve6yqnm3uk4qzouq
		+
		+	mdb is messed up. Oh, and my screen turned blue for some reason.
		+
		+	Just tried again, and it turned green :O

@@ Line 39: / Line 39: @@
 ==Chronic, I may have found the way to use arm7_go==
 Try to add the size of your payload just before it as an 32bit integer.
 . without size :
   I assembled your payload with gas then tried to upload it at 0x09000000 and start arm7_go.
@@ Line 48: / Line 49: @@
 ~[[User:pod2g|pod2g]]
 ==How do you pass the bootrom RSA checks?==

← Older revision		Revision as of 22:03, 19 January 2009
Line 36:		Line 36:

	[[User:ChronicDev\|ChronicDev]] 19:45, 16 January 2009 (UTC)		[[User:ChronicDev\|ChronicDev]] 19:45, 16 January 2009 (UTC)
		+
		+	==Chronic, I may have found the way to use arm7_go==
		+	Try to add the size of your payload just before it as an 32bit integer.
		+	1. without size :
		+	I assembled your payload with gas then tried to upload it at 0x09000000 and start arm7_go.
		+	It did nothing.
		+	2. with size before : 0x00000048 then your payload uploaded at 0x09000000.
		+	arm7_go => it crashed my ipod 2G.
		+
		+	I hope it can help. I am continuing my reasearches.
		+
		+	~[[User:pod2g\|pod2g]]
		+

	==How do you pass the bootrom RSA checks?==		==How do you pass the bootrom RSA checks?==

← Older revision		Revision as of 02:41, 18 January 2009
Line 50:		Line 50:

	~[[User:Oranav\|Oranav]]		~[[User:Oranav\|Oranav]]
		+
		+	== Wel... ==
		+
		+	They noted they are looking for a way around that.