From The iPhone Wiki
Revision as of 21:25, 3 August 2008 by ChronicDev (talk | contribs)
Jump to: navigation, search

This was an exploit in pre 2.0 versions of iBoot


The dev team


The diags function can be passed a parameter. It jumps to that parameter, but not before trashing the I/O table. You can run unsigned code using this, but there's no guarantee about the state of the processor

In 2.0 iBoots, they check the permission register for this command, so the exploit doesn't work.