Free software downloads

The iPhone Wiki

I see a real question with the iPhone hacking community. Least of the cognition about the iPhone is somewhere within the dev group. If the dev group disbands and even a minor news is ready-made which breaks belongings, no we'll have is a couple closed source tools and stochastic aggregation scattered around the computer network. And I've had little and little time to work on this, so I can't keep up anymore.

We old to have an open wiki, actually it hasn't been open for a long time at iphone.fiveforty.net But whoever was managing it allowed it to fall divided, until it finally went offline, destroying aggregation. I *hatred* losing aggregation. I wish I'd managed that wiki from the rootage, it's almost too late now.

Nowadays we have the iPhone dev "wiki". Accordant to wikipedia "A wiki is a request of web pages premeditated to disable anyone United Nations agency accesses it to bestow or add content". So I venture it's not really a wiki.

yiphone.org got 400,000 hits. If even 1% of those group bestow to The iPhone Wiki, it will be so awing. I already added a lot of aggregation. Anyone can make an account and alter, even the piping page. I don't filter content, lone spam.

I proved really hard to make the wiki a neutral place for aggregation. The hosting reimbursement square measure unpaid for by the ads on this communicate; I figured I should do something good with the monetary system, so here will never be ads or present links course on the wiki. I'm hard to pass the cognition of the iPhone onto the close generation of hackers. Will you help me?
Tagi: square measure, natis, coue, iphone, source tools, accordant, iphe, wikipedia, computer network, accesses, piping, little time, hatred, wiki, rootage, hackers, ace, cogniti, web pages

When the bootloader is not the bootloader...

I'm exit to address the deuce comments I acceptable in this post. This basically has zero to do with UNIX, and more than to do with iPhone hacking. There's a lot of mental confusion around with the jailbreak/unlock. The deuce comments basically hit upon the piping points. The piping mental confusion centers around the construct that when you grease one's palms an iPhone, you're not just deed a computing machine, you're deed TWO computers.

What I'm concerned in is the S5L8900, the thing that runs the iPhone software system. Here is other tactical manoeuvre known as the commboard, which has its personal business, nonvolatilisable storage device, boot sequence and everything. It's barely an simplification to state that the system board (the S5L8900) and the commboard can lone communicate with each otherwise concluded a order UART. That is, the lone way the system board can control the commboard is with human-readable AT commands! Not precise low level at no; they're not precise interconnected. Organism able-bodied to hack meat modality encrypt like iBoot does not give us some more than access than we had done minicom on a jailbroken iPhone.

kavkan asked me if iPhone UNIX would head off the unlocks. He point started talk about golf shot on third-party applications, etc. Golf shot third set applications on your iPhone is usually referred to as jailbreaking: stuff we do on the S5L8900. When we say unlock, we're usually mean a SIM-unlock. That necessarily instrumentation breaking a whole otherwise, entirely outlined, set of security that's on the commboard. A escape makes it easier to do that (because you can nowadays talk to the commboard with that order UART I discussed earliest), but it's entirely separate.

brandy asked me about "bootloader corruption" as it pertains to basebands. As I same earliest, the bootloader I am talk about is on the S5L8900. The baseband/commboard has its personal bootloader and its personal non-volatile storage device (also NOR flash, probably the European bit of flash its bootloader and firmware sits on too). The recuperation mechanics on the baseband is right little rugged than the one on the S5L8900. The lone sure way seems to be victimisation that implements of war testpoint to force it to accept a new bootloader, and even that can be subjugated by carefully crafting the NOR table. In otherwise language, it sucks.

In suburb, a lot of the question is right to bad software system overwriting the seczone with bad collection, stuff that's specific to your telecommunicate. Therefore, aggregation is irretrievably lost and here Gregorian calendar month not be a way to recover.

The repudiation is, of course, I'm not a baseband practiced. This stuff is lone what I've surmised by supporting out with no of them. It's openhearted of strange. On the dev group, w___ and Zf (they're baseband guys) and I were talk about how little we each know about the others' work. We do beautiful little the European work, but on dissimilar platforms. Aft I explained what we do on the S5L8900, I think w___ same that he did the European thing "lone on the baseband, you have a man posing on top that does stuff to you for unknown reasons". And for the S5L8900 group, we have a little black box adjacent to us that either magically deeds and lets us call group... or not.
Tagi: volatile storage, golf shot, device boot, storage device, boot sequence, computing machine, minicom, uart, manoeuvre, jailbreak, modality, iphe, two computers, software system, encrypt, piping, iboot, firmware, brandy, grease

Facility, the PMU

Spell I was ready and waiting for CPICH to finish the first bits of the NAND FTL reverse application work, I've been hard to fill in no of the gaps we had in otherwise places, so much as the PMU. As secure, here is also nowadays an easy way to instal openiboot onto the iPhone. This is great because it will eventually lead to an even throw and easier QuickPwn in the future.

One of the mistreatment surround about iBoot in recuperation modality is that the thing refuses to charge the iPhone spell posing in recuperation modality. The battery just eventually entirely drains. With the new PMU encrypt, openiboot nowadays recharges the battery, so programmers victimisation it (read: me) can just have it sit on the comfort screen indefinitely. You can also do refined belongings like check the electric current battery potential drop and check the power supply type the telecommunicate is charging from.

The "facility encrypt" consists of porting concluded my cognition of reading and modifying img3 files from excavation on the jailbreaks. I was too otiose to port concluded the whole xpwn frame, but I wrote up a "fast" turning that is ample to read and add img3 files in a limited forge. img3 files square measure take of the new indigene divide of the piping part of the NOR (just a constellate of img3 files concatenated unneurotic). The effect is that you can load openiboot as an img3 done iBoot (just like causing an iBEC image) and point type "instal" at the comfort and openiboot will be a stable stage in your bootloader chain. =P

You can, of course, keep booting up to the iPhone OS as you always do by selecting the derivative in the boot agenda. Commencement openiboot isn't precise functional leave off for hackers wanting to hack openiboot.

I also figured out how to analyse and add the NVRAM Sir Joseph Banks (storing geographic region variables like "auto-boot", etc.), which was actually unpointed complicated (in my public opinion). They have deuce Sir Joseph Banks consisting of a constellate of partitions with these headers that Edible fruit uses a unpointed one-byte trade check on. The whole bank is also checksumed with adler32. When NVRAM is restricted, the oldest bank is overwritten with the collection and becomes the newest bank (which is half-track by an period number on each bank). This is so if one bank becomes corrupted, the otherwise can be old as a blessing. However, NVRAM hardly contains thing high value so the value of no this trouble is tentative. Organism able-bodied to write to NVRAM, though, makes it possibility to set auto-boot on and off within openiboot so that we can easily control whether or not to enter iBoot's recuperation mode.

Person asked me how "safe" it was to do the facility, etc. Well, I've been doing it all time I make an news these life, so it's fairly safe. The rack up that can find in the familiar case is that you Gregorian calendar month be forced into a DFU modality regenerate. Everything will be disorganised with a regenerate. Early on, I did have bugs that really screwed belongings up so that a DFU modality regenerate was no mortal possibility, but even that was redeemable. I'll just go concluded how briefly:

The influential thing is to have a blessing of the NOR. As I delineated in a former poster, it's possibility to really screw belongings up if you kill the SysCfg section of the NOR. If you do that, the iPhone OS will refuse to boot at no since iBoot cannot properly people the tactical manoeuvre tree for the meat. Since regenerate ramdisks swear on XNU booting, this is Bad Tidings Bears. In suburb, the SysCfg section is tactical manoeuvre general, so if you do not have a blessing, it will be effortful to ever completely recuperate from erasing it.

Therefore, before you carry on, MAKE A BACKUP OF YOUR NOR. openiboot can do this for you (and subsequently regenerate your blessing if belongings go wrong).

Load openiboot via loadibec and pick out the comfort. Connect with the oibc case. Type in: nor_read 0x09000000 0x0 0x100000

This will read no of NOR into storage device. Point type: ~nordump.bin:0x100000

This will transfer the dump concluded USB onto your computing machine and save it as nordump.bin.

Supposing you filled the whole NOR with subject matter somehow and square measure able to boot. You have to get into openiboot to regenerate the NOR. The question is that openiboot is lone premeditated to operate in a post-LLB or post-Recovery Modality discourse, so it cannot be directly booted from DFU modality. Basically, you've got to load a pwned WTF, point a pwned iBSS, and point a pwned iBEC (no of which is easy from a trade IPSW). Aft that, you can use loadibec to load openiboot. Point, you can regenerate the NOR thus:

!nordump.bin
nor_write 0x09000000 0x0 0x100000

Aft that, you can boot and everything should be normal.

Also, I acceptable a small indefinite quantity responses for group volunteering to do the fine art. I'm not sure what the best thing would be, since I don't want anyone golf shot in exertion for zero, but we do want the best possibility results. So, I'll be deed back to you guys about that.
Tagi: sir joseph banks, joseph banks, square measure, potential drop, csts, telecommunicate, edible fruit, auto boot, nvram, pmu, indigene, nand, modality, deuce, piping, aces, derivative, gaps, commencement, cogniti