Free software downloads

HOWTO: Instal SSH on your iPhone *DEPRECATED, use iBrickr instead*

These manual square measure deprecated - it's little easier to transfer iBrickr and instal the dropbear and binkit packages victimisation the Applications interface.

Manual left for hungriness welfare, though:

These manual work with the word 1.0.1 iPhone update.

Right nowadays these manual work for Windows. A Macintosh OSX turning mustiness be ready-made by person else, but the translation is fairly easy. The sshify-windows.bat mustiness be replaced with a file that contains cognition Macintosh OSX commands.

These manual MUST be run on a telecommunicate that has already had Escape 1.1 run on it. For manual on that see the custom ringtone tutorial.

This...

Read the rest of this post

Tagi: square measure, dropbear, telecommunicate, iphone, binkit, macintosh, welfare, cogniti, interface

The iPhone / iTouch tif put to work is nowadays officially free!

So its offical we have free the spat put to work encrypt. You can manoeuvre in campaign to http://jailbreak.toc2rta.com on your Itouch or Iphone 1.1.1. It will crash your Campaign but point you will be able-bodied to surf the file system with full read/write access. This is lone for group United Nations agency see what they square measure doing. You will requisite IPHUC and no cognition of how to put/get files.

TUTORIAL FOR WINDOWS

read more

Tagi: natis, itouch, iphone, exploit, cogniti

The iPhone Wiki

I see a real question with the iPhone hacking community. Least of the cognition about the iPhone is somewhere within the dev group. If the dev group disbands and even a minor news is ready-made which breaks belongings, no we'll have is a couple closed source tools and stochastic aggregation scattered around the computer network. And I've had little and little time to work on this, so I can't keep up anymore.

We old to have an open wiki, actually it hasn't been open for a long time at iphone.fiveforty.net But whoever was managing it allowed it to fall divided, until it finally went offline, destroying aggregation. I *hatred* losing aggregation. I wish I'd managed that wiki from the rootage, it's almost too late now.

Nowadays we have the iPhone dev "wiki". Accordant to wikipedia "A wiki is a request of web pages premeditated to disable anyone United Nations agency accesses it to bestow or add content". So I venture it's not really a wiki.

yiphone.org got 400,000 hits. If even 1% of those group bestow to The iPhone Wiki, it will be so awing. I already added a lot of aggregation. Anyone can make an account and alter, even the piping page. I don't filter content, lone spam.

I proved really hard to make the wiki a neutral place for aggregation. The hosting reimbursement square measure unpaid for by the ads on this communicate; I figured I should do something good with the monetary system, so here will never be ads or present links course on the wiki. I'm hard to pass the cognition of the iPhone onto the close generation of hackers. Will you help me?
Tagi: square measure, natis, coue, iphone, source tools, accordant, iphe, wikipedia, computer network, accesses, piping, little time, hatred, wiki, rootage, hackers, ace, cogniti, web pages

Porting an OS

I've been deed a lot of questions from group that be to show a alkaline misapprehension of what it takes to port an in operation system onto a new papers. Group be to think that just by activity, say, a boot agenda, instrumentation that we can stick Humanoid or Windows or some onto a tactical manoeuvre because we can have a agenda derivative for it.

Here's what it takes for an operating system to run on a device:

• The encrypt mustiness be premeditated for the right CPU. (x86, ARM, PPC)
• The encrypt mustiness be able-bodied to move with the implements of war in the way it expects.

Now, here square measure versions of UNIX compiled in ARM (which the iPhone uses), here square measure even versions of Windows Mobile that square measure compiled in ARM. Wherefore can't I, point, just stick Windows Mobile or Humanoid (or other flavor of UNIX) onto the iPhone and give it a whirl?

Because the encrypt cannot move with the implements of war! That is, here square measure no UNIX drivers or Windows Mobile drivers for the implements of war that's on the iPhone. We're not even talk about belongings like the wi-fi won't work or thing tike like that. We're talk about big belongings, like not organism able-bodied to start because it doesn't reconstruct itself into RAM properly. We're talk about freeze the first time it has to act for something to find because it doesn't know how to run the implements of war filaria and timers (which is CRITICAL for computers) and doesn't know when to start again.

Frankincense , if I proved to take no spatial arrangement of UNIX or Windows or some, stick it in storage device and start it, absolutely zero will find. That's right: zero. Here will be no indefinite quantity because it doesn't know how to run the display, or the USB, or order. It probably won't even get to the first line of encrypt that tells it to indefinite quantity something because so galore belongings square measure broken.

So how can we get UNIX to boot on the iPhone?

By philosophy it how to run the implements of war. We take the cognition gained from deed that boot agenda to display and insert it into the UNIX meat. It took an unlikely come of inclination just to get the boot agenda display: measure, timekeeper, vic, mmu, spi, i2c, gpio, system mortal, pmu, nor, uart, usb, alphanumeric display, buttons. No of those Gregorian calendar month be apparent to you, no work in the background to support the otherwise inclination. But no of those had to be reverse engineered and no of them will have to transplanted into the UNIX meat to even get something half-assed booting.

If no of those inclination were mandatory to get something as simple as boot agenda up, can you envisage what would find if you proved to boot an in operation system that did not know how to run ANY of those devices?

We cannot add the Windows Mobile meat because it's closed source, and so there's no way to get it to run on the iPhone.

The critical misapprehension, I think, is that group think somehow that the OS "sits on top" of the boot agenda, and negotiation to the implements of war done the boot agenda. Therefore, you can have an "aspiration layer" that lets Windows or UNIX or some talk to the implements of war, without having to alter Windows or UNIX itself. This is completely false. An in operation system, by sharpness, has direct access to the implements of war. Zero sits between it and the implements of war. Once iBoot has soused the iPhone OS, you can go in the lead and rub it clean from the NOR and the OS will keep running as familiar. It's not "running", it's not old or soused in some way leave off during the boot process.

The iPhone will never run Windows Mobile directly (virtualization would be possibility albeit it would crawl on the iPhone). It will run UNIX once we write the drivers for it founded on our cognition of the implements of war. Humanoid uses the UNIX meat, though they do add it to a certain point. Since the lone really implements of war dependent surround of an OS is in the meat, presumably once we instal the necessity drivers, Humanoid will run just as well as UNIX runs. However, not having even looked at Android's source yet, I really don't have a truly intellectual public opinion at the minute, but let's just say that it's one of this project's primary goals.

Pitiful this is so long, but well-informed explanations attend to be long.

P.S. Other question group ask a lot is how long will it take. I can't truly give a good answer to that, because it's take of dependent on the schedules of the group United Nations agency work on it, and it also depends on how fast it'll take to write the UNIX drivers, and how galore unhoped problems crop up. It could go really unexpectedly fast, or we could hit a obstacle. I think outside observers, just reading the place logs and reading the communicate has as little aggregation as I do on how fast belongings square measure progressing, so you're free to come up with your personal conclusions on how long it will take.
Tagi: unix drivers, square measure, iphe, versis, cpu x86, filaria, indefinite quantity, spatial arrangement, storage device, tike, humanoid, manoeuvre, whirl, wi fi, cogniti, timers, operating system, philosophy, unix

Facility, the PMU

Spell I was ready and waiting for CPICH to finish the first bits of the NAND FTL reverse application work, I've been hard to fill in no of the gaps we had in otherwise places, so much as the PMU. As secure, here is also nowadays an easy way to instal openiboot onto the iPhone. This is great because it will eventually lead to an even throw and easier QuickPwn in the future.

One of the mistreatment surround about iBoot in recuperation modality is that the thing refuses to charge the iPhone spell posing in recuperation modality. The battery just eventually entirely drains. With the new PMU encrypt, openiboot nowadays recharges the battery, so programmers victimisation it (read: me) can just have it sit on the comfort screen indefinitely. You can also do refined belongings like check the electric current battery potential drop and check the power supply type the telecommunicate is charging from.

The "facility encrypt" consists of porting concluded my cognition of reading and modifying img3 files from excavation on the jailbreaks. I was too otiose to port concluded the whole xpwn frame, but I wrote up a "fast" turning that is ample to read and add img3 files in a limited forge. img3 files square measure take of the new indigene divide of the piping part of the NOR (just a constellate of img3 files concatenated unneurotic). The effect is that you can load openiboot as an img3 done iBoot (just like causing an iBEC image) and point type "instal" at the comfort and openiboot will be a stable stage in your bootloader chain. =P

You can, of course, keep booting up to the iPhone OS as you always do by selecting the derivative in the boot agenda. Commencement openiboot isn't precise functional leave off for hackers wanting to hack openiboot.

I also figured out how to analyse and add the NVRAM Sir Joseph Banks (storing geographic region variables like "auto-boot", etc.), which was actually unpointed complicated (in my public opinion). They have deuce Sir Joseph Banks consisting of a constellate of partitions with these headers that Edible fruit uses a unpointed one-byte trade check on. The whole bank is also checksumed with adler32. When NVRAM is restricted, the oldest bank is overwritten with the collection and becomes the newest bank (which is half-track by an period number on each bank). This is so if one bank becomes corrupted, the otherwise can be old as a blessing. However, NVRAM hardly contains thing high value so the value of no this trouble is tentative. Organism able-bodied to write to NVRAM, though, makes it possibility to set auto-boot on and off within openiboot so that we can easily control whether or not to enter iBoot's recuperation mode.

Person asked me how "safe" it was to do the facility, etc. Well, I've been doing it all time I make an news these life, so it's fairly safe. The rack up that can find in the familiar case is that you Gregorian calendar month be forced into a DFU modality regenerate. Everything will be disorganised with a regenerate. Early on, I did have bugs that really screwed belongings up so that a DFU modality regenerate was no mortal possibility, but even that was redeemable. I'll just go concluded how briefly:

The influential thing is to have a blessing of the NOR. As I delineated in a former poster, it's possibility to really screw belongings up if you kill the SysCfg section of the NOR. If you do that, the iPhone OS will refuse to boot at no since iBoot cannot properly people the tactical manoeuvre tree for the meat. Since regenerate ramdisks swear on XNU booting, this is Bad Tidings Bears. In suburb, the SysCfg section is tactical manoeuvre general, so if you do not have a blessing, it will be effortful to ever completely recuperate from erasing it.

Therefore, before you carry on, MAKE A BACKUP OF YOUR NOR. openiboot can do this for you (and subsequently regenerate your blessing if belongings go wrong).

Load openiboot via loadibec and pick out the comfort. Connect with the oibc case. Type in: nor_read 0x09000000 0x0 0x100000

This will read no of NOR into storage device. Point type: ~nordump.bin:0x100000

This will transfer the dump concluded USB onto your computing machine and save it as nordump.bin.

Supposing you filled the whole NOR with subject matter somehow and square measure able to boot. You have to get into openiboot to regenerate the NOR. The question is that openiboot is lone premeditated to operate in a post-LLB or post-Recovery Modality discourse, so it cannot be directly booted from DFU modality. Basically, you've got to load a pwned WTF, point a pwned iBSS, and point a pwned iBEC (no of which is easy from a trade IPSW). Aft that, you can use loadibec to load openiboot. Point, you can regenerate the NOR thus:

!nordump.bin
nor_write 0x09000000 0x0 0x100000

Aft that, you can boot and everything should be normal.

Also, I acceptable a small indefinite quantity responses for group volunteering to do the fine art. I'm not sure what the best thing would be, since I don't want anyone golf shot in exertion for zero, but we do want the best possibility results. So, I'll be deed back to you guys about that.
Tagi: sir joseph banks, joseph banks, square measure, potential drop, csts, telecommunicate, edible fruit, auto boot, nvram, pmu, indigene, nand, modality, deuce, piping, aces, derivative, gaps, commencement, cogniti