Difference between revisions of "SHA-1 Image Segment Overflow"

From The iPhone Wiki
Jump to: navigation, search
m (I know it needs cleaning :))
 
m
Line 1: Line 1:
SHAtter was an exploit found by [[pod2g]] that allowed unsigned code execution from a flaw in the bootrom. It was never used in a public jailbreak due to the exploit used in [[limera1n]] being released first.
+
SHAtter was an exploit that allowed unsigned code execution from a flaw in the bootrom. It was never used in a public jailbreak due to the exploit used in [[limera1n]] being released first.
   
  +
== Credit ==
  +
*[[pod2g]]
  +
  +
== Vulnerability ==
  +
Explaination by [[p0sixninja]] at [[MyGreatFest]]:
   
== Explanation ==
 
 
It tricked the bootrom to think the size of the image uploading was larger then what it actually was.Then when it would try to load the image, it would see that it was wrong. Then it would try to wipe out the entire image with all 0s and go past it and start wiping out bootrom.
 
It tricked the bootrom to think the size of the image uploading was larger then what it actually was.Then when it would try to load the image, it would see that it was wrong. Then it would try to wipe out the entire image with all 0s and go past it and start wiping out bootrom.
   

Revision as of 14:33, 17 September 2011

SHAtter was an exploit that allowed unsigned code execution from a flaw in the bootrom. It was never used in a public jailbreak due to the exploit used in limera1n being released first.

Credit

Vulnerability

Explaination by p0sixninja at MyGreatFest:

It tricked the bootrom to think the size of the image uploading was larger then what it actually was.Then when it would try to load the image, it would see that it was wrong. Then it would try to wipe out the entire image with all 0s and go past it and start wiping out bootrom.

Explotation was done by overwriting sha1 hardware pointers to zeros so then when it went to check images it would copy part of image into 0x0. (where the bootrom is) It would take the image uploaded and copy it over top of the bootrom. (which turns out to be writable over the data portion)