S5L8920

This is the processor used in the iPhone 3GS.

S5L8920 using THUMB-2 instruction set as well as ARM and THUMB ones. Binaries included in iOS are compiled for only Armv7 are not compatible with older CPUs.

Exploits

iBoot / Kernel

• iBoot Environment Variable Overflow - Firmware 3.1b3 and below (Note: iBoot on the S5L8920 can be downgraded allowing the exploit to be used on future firmwares, but only if a backup of the device-specific Apple-signed 3.0 iBSS with unique ECID was made.)
• usb_control_msg(0x21, 2) Exploit - 3.1.2 and below.

Bootrom

• 0x24000 Segment Overflow

Userland

• MobileBackup Copy Exploit - Firmware 3.1.3 and below
• BPF STX Kernel Write Exploit - Firmware 3.1.3 and below

Boot Chain

Bootrom->LLB->iBoot->Kernel->System Software

See also

• S5L8920 (Bootrom)
• S5L8920 (Hardware)
• S5L8920 (Hardware - Quick Notes)

External Links

• Technical Reference Manual: Cortex A8