Difference between revisions of "Research: Re-allowing unsigned ramdisks and boot-args with the 2.* iBoot"

From The iPhone Wiki
Jump to: navigation, search
m
m (Changed different to difference)
 
(2 intermediate revisions by one other user not shown)
Line 1: Line 1:
==Theory==
+
==Ramdisks==
  +
Ramdisks will run from the get go, just use xpwntool to pack / encrypt them using a vanilla ramdisk as the template. I am not sure if xpwntool will do this, so you may want to check the header to make sure the correct info (sizes etc) are there.
   
  +
==boot-args==
Without decompiling iBoot 2.x, we can use openiboot.
 
  +
They use a buffer that is passed on when booting a kernel for boot args, the difference in 2.x is that the boot-args NVRAM var is totally ignored. Not only would a 'patch' be needed, but some code would actually need to be added, somehow.
 
:*For boot-args through libibooter
 
:*Ramdisk exploitation
 
:*Or even to open up the NAND to be mounted through USB on your computer.
 

Latest revision as of 20:56, 25 September 2013

Ramdisks

Ramdisks will run from the get go, just use xpwntool to pack / encrypt them using a vanilla ramdisk as the template. I am not sure if xpwntool will do this, so you may want to check the header to make sure the correct info (sizes etc) are there.

boot-args

They use a buffer that is passed on when booting a kernel for boot args, the difference in 2.x is that the boot-args NVRAM var is totally ignored. Not only would a 'patch' be needed, but some code would actually need to be added, somehow.