iPhone 1.1.1 regenerate modality windy boot captured on video recording

Hey guys,

This won't mean jack squat to least of you but I've managed (with the help of the iPod Touch dev group) to boot the iPhone in regenerate windy modality which will hopefully give us no apprehension into what we can do to crack the new firmware.

I untrained my honest List XH A1 HD videocamera at it with a high mechanical device speed to make sense of the quickly passing images. Check out the video recording and stills below.

I'll go done and translate it by hand to make belongings clearer.

Read the rest of this post

Univocal proof that here is no way to (accidentally) good person s5l8900

In the process of experimentation NOR, I did a beautiful lulzy thing. Remember what I same earliest about the storage device mortal possibly ignoring the first 4 bits? Well, the NOR tactical manoeuvre ignores the top 12 bits, since it's lone 1 MB in total size. This makes a lot of sense. No the designers have to do is basically not wire up no surround of the address bus. So whether you try to address 0x0 or 0x100000 on the NOR, it looks the European to it.

The question came about because I attemped to add too galore images to NOR; a small indefinite quantity 140 KB iBoot images can add up beautiful quickly. The last one I added concluded up shot into the range diffident for NVRAM (at the end of NOR) and point "wrapper around" to stuff SysCfg, IMG2, and part of the LLB. =P

Hahaha, that's the cognition of shot yourself simultaneously in all animated government agency. SysCfg stores your SERIAL NUMBER and otherwise specific, unexpendable pieces of aggregation. The NVRAM contains aggregation iBoot needs to boot up the meat. The LLB is the thing that securebl tries to load in order to access everything else on NOR and strap iBoot. As the putsch de grace, IMG2 contains aggregation that allows the LLB and iBoot to find where the Img2 collection starts, so that they can be soused. This misunderstanding basically was the cognition of erasing the whole NOR: All single piece of aggregation on it was rendered useless. :P

Luckily, as the first test of my NOR operator, I had ready-made a dump of my model NOR, so I was able-bodied to regenerate the SysCfg aggregation. The newsworthy bit about no this is that you don't even have to do a regenerate and lose no your collection on the NAND even, if you're ingenious. What I did was let iTunes talk to DFU modality to get into an iBoot. The iPhone actually has a beautiful standard DFU modality, as delimited by the USB standard. It reports itself as having the correct class, and OpenMoko's dfu-util manages to get, well, something with it. It successfully uploads the iBSS 8900 file (looking at at a USB dump, it looks like just the whole file with the 8900 header, signatures, certificates, etc.) but reports that the firmware is corrupted. So at thing it seems to use standard state indicators, etc. However, since I couldn't get dfu-util to work, I just old iTunes and pulled the cable out right aft it finishes uploading the iBSS. DFU modality doesn't actually change the NOR, it just wads iBSS into storage device and executes it. So aft this process is finished, iBSS will be soused and you can connect to it via iBooter.

If you had pulled out the cable just a little too late, you can even see the commands iTunes executed on iBSS in the scrollback, Like setpicture and bgcolor. =P

Victimisation the soused 1.1.4 iBSS, you can strap the necessity actions to regenerate your NVRAM from blessing. I will talk about that in more than detail in a future post. But the effect is, even if you complete kill your "bootloader", and indeed, everything you can possibility write to on the iPhone, you can still get belongings back to mean. :)

Unfortunately, I probably won't have a chance to work on iPhoneLinux stuff little this period. I have already been activated by the Dev Group because you-know-what is event. Time to hax.

iPhone 3G Unbarred?

So I read this on gizmodo. Here's the truth...

Post exploratory 4, the ramdisk hack stopped up excavation. Pitiful Zibri, venture you'll have to slip away other put to work. They also denaturised the recuperation modality USB communications protocol to use the control terminus to send commands.

The possiblity of unlocking, which is precise outlined from jailbreaking, is founded entirely on the baseband bootloader. Edible fruit doesn't execute to upgrade the bootloader on phones in the field, probably for fear of bricks. So some old iPhones out here twenty-four hour period 4-hour interval, thoughtless of turning, can be unlocked.

The iPhone 3G uses a dissimilar bootloader, which I disbelieve here aren't some familiar exploits in yet. So no unlock.

Here is a familiar put to work in iBoot, on both the old and 3G iPhones. The "the general date/time is not firm yet" pwnage tool will render it to escape no 2.0 software system iPhones, 3G and other. Dev group, that date better be soon or I strength just have to release yiPhone. The iBoot put to work is yours, use it. You wouldn't want a repeat of ZiPhone nowadays...

Infineon, we have a question

The 3G bootloader is sig patterned by the bootrom. So even removing the NOR and fixture the bootloader(to remove piping fw sig checks) and piping firmware doesn't work for an withdraw. Big acknowledgement to TA_Mobile for dumping the NOR and confirmatory this. You have no real skills.

The X-Gold 608 is the chip old. The lame "datasheet" infineon gives us shows the implements of war RSA and the secure bootrom. So we have a real question. Even if we find an unsigned encrypt put to work, which wasn't finished for the former deuce bootloaders in software(we remuneration tricks to play with the nor), we still can't unlock.

Even though the bootloader isn't easy for transfer, theres really zero here. This bootloader doesn't be some of the synergistic modality functions, just a stub which is precise like to the old bootrom(but with sig checking). The synergistic attender is tacked on to the end of all fls and eep file, and is soused at 0x86000. BBUpdaterExtreme contains various ramloaders as well, but I disbelieve the one old is from the news file itself. You do not requisite the bootloader to work on the baseband, you just requisite the files off the ramdisk. Also newsworthy to note, the 2 rsa keys the bootloaders use haven't denaturised since 3.9 or 4.6 So you have these too.

Putting to death CommCenter on 2.0 kills the wi-fi, which will make excavation with the baseband a bit harder. Change of location synergistic modality is nowadays finished with a call to the meat to raise an I/O pin before resetting.

The first step to tackling this is dumping the bootrom. We requisite no put to work, I don't care where, to dump discretional storage device. Point we can dump 0x400000, which is the new "secure" bootrom.

Boot agenda project is a go!

Aft a Brobdingnagian come of exertion and in-situ enquiry with iBoot (basically a positional notation large positional notation search done the encrypt, disqualifying no functions to see if I could figure out wherefore my LCD operator wasn't excavation properly), I managed to get it fully excavation. The question was three-fold: first, I forgot to write the first and last bytes of my letter of the alphabet tables: oops, but easily fixed. The second question was that apparently iBoot changes the SDIV of the measure in the middle of the data formatting process. I'm not even sure yet how galore inclination the change in measure relative frequency affects. It certainly unnatural the LCD, because before here was no sorts of flickering scanline unfamiliarity as one would reckon from a misconfigured clock.

Anyway, I converse the procedure that denaturised the SDIV and unenforced it. Seems to work fine nowadays. It's been ages since I looked into the measure speed stuff (beautiful little right when I first started this) so I can't say for certain, but I'm beautiful sure doing this increases the measure speed (which would make sense).

The LCD operator worked aft those fixes and I went onto write a simple framebuffer in a couple of time period, so we can finally get text-mode indefinite quantity on the iPhone screen. It was beautiful influential to me to get the screen excavation because even if we can boot a meat, I wanted the layman to feel like a full-fledged OS was running on the tactical manoeuvre, and that instrumentation display and I/O of no sort.

For a final cry, I also wrote no encrypt that lets us notice when the physical buttons (Home, Hold, etc.) were organism pressed down. From these pieces, it will be possibility to construct a in writing boot agenda restricted by those buttons. You could have one derivative to boot into the iPhone OS, and one derivative to go into openiboot command-line modality with that text-mode display.

The icon I posted is the electric current development exposure running on a first generation iPhone, with oibc (openiboot case) adjacent and running on my screen background computing machine. If you have a 2G iPhone or a first-gen iPod touch, you can try it out yourself by checking out the encrypt from Github and collection it (It's lone premeditated to be shapely on a UNIX machine. You'll be wanting no UNIX headers other). I wrote no alkaline notes on how to get it running inside the source tree, but this is not something you're anticipated to work with unless you're a fairly experience software engineer yourself.