Difference between revisions of "Absinthe"

From The iPhone Wiki
Jump to: navigation, search
m (assumption about naming)
(Absinthe name origin)
Line 4: Line 4:
 
*A future integration with [[redsn0w]]
 
*A future integration with [[redsn0w]]
   
The reason for naming the jailbreak Absinthe is not currently known, but it is probably named after a daemon named [[/usr/sbin/absinthed|absinthed.XXX]].
+
The name Absinthe was chosen as an homage to Greenp0ison, Chronic Dev Team's earlier jailbreak software. Absinthe is an alcoholic beverage that is often greenish in color and is poisonous in quantity. There is also a daemon named [[/usr/sbin/absinthed|absinthed.XXX]].
   
 
==Installation==
 
==Installation==

Revision as of 17:01, 30 January 2012

Absinthe is the S5L8940 userland jailbreak tool for iPhone 4S and iPad 2 on iOS 5.0 (iPhone 4S only), 5.0.1 (9A405) and iOS 5.0.1 build 9A406 on iPhone 4S. This tool was released on January 20, 2012, and is available in three incarnations:

The name Absinthe was chosen as an homage to Greenp0ison, Chronic Dev Team's earlier jailbreak software. Absinthe is an alcoholic beverage that is often greenish in color and is poisonous in quantity. There is also a daemon named absinthed.XXX.

Installation

The jailbreak packs Corona for the S5L8940 and the rest of the firmware patches in a regular iTunes backup and then restores this backup on to the device, which injects the required files. It is then completed by opening a web clip added to the home screen by Absinthe. If this doesn't work, for example, because the greenpois0n website is down due to the number of people attempting to jailbreak, an alternative is to enable a specially crafted VPN connection in the Settings app.

Exploit

Main article: Corona


This jailbreak uses the Racoon String Format Overflow Exploit and HFS Heap Overflow from Corona for untether. The exact exploit to jailbreak the two devices is not known yet, but it is assumed that the web clip loads a page that requires an IPsec VPN connection, which causes the racoon daemon to start and run the jailbreak payload.

However, some poking reveals some unique means of injection. At some point in the jailbreak process, BackupAgent is intentionally crashed to produce a crash log. The jailbreak payload reads this crash log in order to obtain the memory address of libcopyfile.dylib to continue with the exploit.

Opening the webclip_Info.plist file included with the GUI tool, which is the definition file for the web clip, a URL to the greenpois0n website is found, which shows a please wait message. The interesting part is the source code of this page has an image linked to http://127.0.0.1/trigger.png, meaning a web server is running on the device and requires the trigger image to be loaded to finish the process.