S5L8920

This is the processor used in the iPhone 3GS.

S5L8920 using THUMB-2 instruction set as well as ARM and THUMB ones. Binaries included in iOS are compiled for only Armv7 and are not compatible with older CPUs.

Exploits

iBoot

• iBoot Environment Variable Overflow - Works up to iOS 3.1 beta 3
• usb_control_msg(0x21, 2) Exploit - Works up to iOS 3.1.2

Bootrom

• 0x24000 Segment Overflow - only in iBoot-359.3

Kernel

• BPF STX Kernel Write Exploit - Works up to iOS 3.1.3
• IOSurface Kernel Exploit - Works up to iOS 4.0.1
• Packet Filter Kernel Exploit - Works up to iOS 4.1

Userland

• MobileBackup Copy Exploit - Works up to iOS 3.1.3
• Malformed CFF Vulnerability - Works up to iOS 4.0.1

Boot Chain

Bootrom->LLB->iBoot->Kernel->System Software

See also

• S5L8920 (Bootrom)
• S5L8920 (Hardware)
• S5L8920 (Hardware - Quick Notes)

External Links

• Technical Reference Manual: Cortex A8