Difference between revisions of "Diags"

From The iPhone Wiki
Jump to: navigation, search
(This is a wiki, right?)
m
Line 2: Line 2:
   
 
==Credit==
 
==Credit==
[[The dev team]]
+
[[iPhone Dev Team]]
   
 
==Exploit==
 
==Exploit==

Revision as of 22:39, 16 July 2010

This was an exploit that allowed the running of unsigned code at iBoot level, present in pre-2.0 versions of iBoot.

Credit

iPhone Dev Team

Exploit

This is a very easy-to-use exploit. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices. You can run unsigned code on the S5L8900 using this, but the GPIOs need to be restored if you intend to use any I/O again (such as the screen, serial, or USB).

In 2.0 iBoots, they have a flag check on this command (checks bit 4 of the iBoot flags), and that flag will not be present on a retail device, just an engineering one with a 'whitelisted' CHIPID, so this exploit doesn't work. However, the 1.1.4 iBSS can still be used on the iPhone, iPhone 3G, or iPod touch 1G, and can be used to boot a modified 2.0+ iBoot. Therefore, it is still an open exploit for the iPhone until Apple releases a new model with IMG3 encryption starting at the bootrom.