View source for Diags (iBoot command)

The <code>diags</code> command is an iBoot command that loads an image from an address in memory after disabling all the GPIO devices. This is meant for loading [[Diags|diags]], so even unsigned images will be loaded. This command had no permission checks in 1.0-1.1.4 iBoots, so it was exploitable to load a patched iBoot, but in 2.0 iBoots, this command has a permission check to make sure it is not being run on a RELEASE fused CHIPID. In 3.1+, this command was removed entirely, but is still present in DEVELOPMENT iBoots. This command can also be set as the boot-command variable. In that case, as well as if you run diags without any args, it looks for the diags image in NOR/NAND, and also checks the diags-path value in NVRAM. If it doesn't find it, the command will fail.

==Credit==
[[iPhone Dev Team]]

==Exploit==
This is a very easy-to-use exploit on 1.x iBoots. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices.  You can run unsigned code on the [[S5L8900]] using this, but the GPIOs need to be restored if you intend to use any I/O again (such as the screen, serial, or USB). 

In 2.0 iBoots, they have a flag check on this command (checks bit 4 of the iBoot flags), and that flag will not be present on a RELEASE fused CHIPID, just a whitelisted engineering  CHIPID, so this exploit doesn't work on RELEASE fused devices after 2.0. However, the 1.1.4 [[iBSS]] can still be used on the [[M68AP|iPhone]], [[N82AP|iPhone 3G]], or [[N45AP|iPod touch]], and can be used to boot a modified 2.0+ [[iBoot (Bootloader)|iBoot]]. Therefore, it is still an open exploit for these devices.

[[Category:Exploits]] [[Category:iBoot commands]]