p0sixspwn

p0sixspwn is an untethered jailbreak for iOS 6.1.3-6.1.6 by winocm, iH8sn0w and SquiffyPwn. It was initially made available as an Cydia package on Saurik's repo to untether already jailbroken devices. It works with all devices that support iOS 6.1.3-6.1.6 and 5.2.1 - 5.3 on Apple TV 2G. On 30 December 2013, a Mac OS X program was released to perform a jailbreak. A Windows program was released on 3 January 2014.

Cydia Package Changelog

• 1.0-5 the initial release of the untether
• 1.0-9 iPhone 4 (iPhone3,1) boot loop fix
• 1.1-1 Automatically reboot after 30 seconds if device did not boot. (iH8sn0w's repo only)
• 1.1-2 Automatically reboot after one minute if device did not boot due to 30 seconds was too quick. (iH8sn0w's repo only)
• 1.1-3 Automatically reboot after two minutes if device did not boot due to 60 seconds was too quick. (iH8sn0w's repo only)
• 1.2-1 Various bug fixes.
• 1.3-2 Fixes iMessage, LTE issues and Apple TV 2G support.
• 1.4-1 Support iOS 6.1.6.

Download

Version	OS	SHA-1 Hash	Download	Changes
1.0.0	OS X	b5a66f4e58ab4c813fc851d479b28188eb5115ec	MEGA	Initial release.
1.0.1		ae5b3907660b161b2ff94a2e2cfef97195404a89	MEGA	Resolves issues with iPod touch 5G not being detected.
1.0.2		259e95fd16468260c8831ca17186f50b7d14ba41	MEGA	Resolves issues with LTE/data.
1.0.3	Windows	060c95cda0e5ad861bd225ca19324e6ebd3c0a5d	MEGA	Initial release for Windows.
1.0.4		0a40a9780ba0dd9f0476d12950b4fb0026c8559a	MEGA	Added README and time adjustments for slow PC's.
1.0.5	OS X	b99fb1de846c406a15bbd710b623ddd78e139e5e	MEGA	Fixes some issues. Support for Mac OS X Snow Leopard.
	Windows	7c782a39ed123f70594e2438eaacc95340e363e3	MEGA
1.0.7	OS X	7f4f867a2e3739e8ee70f7bc7e47afe9871c69b6	MEGA	Fixes Cydia sometimes not showing up
	Windows	868a05ba26fd679a28c3eac0c4dc2c0cbb5e9529	MEGA
1.0.8	OS X	aa20c28c2e052c08893fdbf49d16f084df2f46e6	MEGA	Supports iOS 6.1.6 Fixes iTunes 11.1+ crashes
	Windows	5d2711a99433daa1800d1327207bfc870cd16698	MEGA

Exploits

• posix_spawn kernel information leak (by i0n1c)
• posix_spawn kernel exploit (CVE-2013-3954) (by i0n1c)
• mach_msg_ool_descriptor_ts for heap shaping
• AMFID_code_signing_evasi0n7
• DeveloperDiskImage race condition (by comex)
• launchd.conf untether

Interesting strings

These strings were found on the jailbroken device in /var/untether/untether:
"@iH8sn0w, @SquiffyPwn & @winocm have launched!"
"This untether was made with love and care in North America."
Lotsa love to @planetbeing for the smexy dyld bug & patches :-)
This suggests that there was plans to jailbreak Apple TVs:
This is an AppleTV. Special sandbox patches go here?

External Links

• iH8sn0w's blog post on the release.
• p0sixspwn
• Source Code on GitHub