Difference between revisions of "Untethered jailbreak"

From The iPhone Wiki
Jump to: navigation, search
(Device support: Fixed limera1n, lowercased lt)
(Rewrite page, include examples of utilities, more information about specific methods)
 
(40 intermediate revisions by 15 users not shown)
Line 1: Line 1:
An untethered jailbreak is a type of [[jailbreak]] where your device does not require you to reboot with a connection to an external device capable of executing commands on the device.
+
An '''untethered jailbreak''' is a jailbreak wherein a user can reboot their device at will, and have their device start up with the jailbreak automatically applied without the assistance of a computer or a utility on the device.
   
  +
These jailbreaks can be applied via multiple different methods, the most common of which being kernel exploits.
== Device support ==
 
Many device/firmware combinations can use an untethered jailbreak. [[Firmware]]s 3.1.2 through 4.0.1 (except 3.2.2) on compatible iDevices ([[N90ap|iPhone 4]] and earlier) can be jailbroken via [[Star]].
 
   
  +
== Kernel exploits ==
The most current versions of iOS (3.2.2 and 4.1), as well as the [[N81ap|iPod touch 4G]], can be jailbroken already with [[limera1n]].
 
   
  +
Most untethered jailbreaks rely on vulnerabilities in the kernel and early boot process, typically using a combination of codesigning bypasses and manipulating the system into executing a binary early in the boot process (or obtaining unsigned code execution via a vulnerability in an existing startup process). Once code execution has been obtained, a kernel exploit is used in order to patch the currently loaded kernel to allow for the rootfs to be remounted as read/write, and to allow for unsigned code execution.
Devices as old as (or older than) the [[N88ap|iPhone 3GS]] with the [[iBoot-359.3|old bootrom]] have known [[bootrom]] exploits, so [[PwnageTool]] can be leveraged to break the device's chain of trust. Newer devices, which include some [[N88ap|iPhone 3GS]] units, as well as all "MC" model [[N72ap|iPod touch 2G]] units, [[N18ap|iPod touch 3G]] units and any subsequently released devices, contain [[bootrom]]s that close the [[0x24000 Segment Overflow|utilized exploit]]. limera1n has a bootroom exploit that can jaiblreak iPhone 3GS and iPod Touch 3G MC models.
 
   
  +
Tools that use kernel exploits to achieve untethered jailbreaks:
== Operating System ==
 
[[Star]] runs on the device itself (not a computer program), so it is completely independent from a computer's operating system.
 
   
  +
*[[Spirit]]
[[PwnageTool]] can only be used on Mac OS X.
 
  +
*[[Star|JailbreakMe 2.0 (star)]]/[[Saffron|JailbreakMe 3.0 (saffron)]]
  +
*[[limera1n]]
  +
*[[greenpois0n]]
  +
*[[Absinthe]]
  +
*[[unthredera1n]]
  +
*[[evasi0n]]
  +
*[[p0sixspwn]]
  +
*[[evasi0n7]]
  +
*[[Pangu]]
  +
*[[Pangu8]]
  +
*[[TaiG]]
  +
*[[etasonJB]]
  +
*[[UntetherHomeDepot]]
  +
*[[Pangu9]]
  +
  +
== BootROM exploits ==
  +
  +
Older devices, such as the iPhone 3GS, iPod touch 2 (old bootrom) and earlier, have had vulnerabilities discovered in the [[BootROM]] that are able to be executed without the assistance of DFU mode (such as via a malformed image in the NOR) allowing for stages of the boot chain to be overwritten with custom code, such as a patched LLB/iBoot to allow for an unsigned kernel, and a custom boot logo. Examples of bootrom exploits that allow for untethered code execution are [[Pwnage]], [[0x24000 Segment Overflow|24kpwn]] and [[alloc8 Exploit|alloc8]].
  +
  +
Tools that use bootROM exploits to achieve untethered jailbreaks:
  +
  +
*[[redsn0w]]
  +
*[[sn0wbreeze]]
  +
*[[PwnageTool]]
  +
*[[ipwndfu]]
  +
  +
== iBoot exploits ==
  +
  +
Some jailbreaks abuse vulnerabilities in the currently installed [[iBoot]] in order to patch out signature checks or load an alternative iBoot, therefore being able to load a patched and jailbroken kernel. Very few jailbreak utilities opt to use this method, as iBoot exploits are rare to come across and are able to be patched by Apple with software updates, thereby only being able to be used if blobs have been saved, or if the device was discontinued before Apple released a patch.
  +
  +
==See also==
  +
*[[Jailbreak]]
  +
*[[Jailbreak Exploits]]
  +
*[[Tethered jailbreak]]
  +
*[[Semi-tethered jailbreak]]
  +
*[[Semi-untethered jailbreak]]
  +
  +
[[Category:Jailbreaking]]

Latest revision as of 02:39, 26 April 2021

An untethered jailbreak is a jailbreak wherein a user can reboot their device at will, and have their device start up with the jailbreak automatically applied without the assistance of a computer or a utility on the device.

These jailbreaks can be applied via multiple different methods, the most common of which being kernel exploits.

Kernel exploits

Most untethered jailbreaks rely on vulnerabilities in the kernel and early boot process, typically using a combination of codesigning bypasses and manipulating the system into executing a binary early in the boot process (or obtaining unsigned code execution via a vulnerability in an existing startup process). Once code execution has been obtained, a kernel exploit is used in order to patch the currently loaded kernel to allow for the rootfs to be remounted as read/write, and to allow for unsigned code execution.

Tools that use kernel exploits to achieve untethered jailbreaks:

BootROM exploits

Older devices, such as the iPhone 3GS, iPod touch 2 (old bootrom) and earlier, have had vulnerabilities discovered in the BootROM that are able to be executed without the assistance of DFU mode (such as via a malformed image in the NOR) allowing for stages of the boot chain to be overwritten with custom code, such as a patched LLB/iBoot to allow for an unsigned kernel, and a custom boot logo. Examples of bootrom exploits that allow for untethered code execution are Pwnage, 24kpwn and alloc8.

Tools that use bootROM exploits to achieve untethered jailbreaks:

iBoot exploits

Some jailbreaks abuse vulnerabilities in the currently installed iBoot in order to patch out signature checks or load an alternative iBoot, therefore being able to load a patched and jailbroken kernel. Very few jailbreak utilities opt to use this method, as iBoot exploits are rare to come across and are able to be patched by Apple with software updates, thereby only being able to be used if blobs have been saved, or if the device was discontinued before Apple released a patch.

See also