synackuk

The Gateway of Last Resort, casual interest in computer security and maths.

[synackuk @synackuk]

Given Apple's removing of signing status for the iPhone 4S (hopefully not the iPod touch 4G..), I've published the De Rebus Antiquis ram disks I created for iOS 6. https://t.co/JpNKPJXCDF I was planning to also port this work to the iPad 2.. But I'm not sure there's much point.

[synackuk @synackuk]

@Pingzi610 @tuanem6996 You can use the stack dump handler and look for relevant values. My experience was that the first value will be a pointer to some printed string like NAND; and the second one will be some integer (I’ve had 0x3 and 0x83)

[synackuk @synackuk]

iPad 2 untethered with De Rebus Antiquis. Ramdisk is available now on my GH. https://t.co/JpNKPJXCDF

[synackuk @synackuk]

@tuanem6996 @Pingzi610 Yeah. Then set noot-partition=2

[synackuk @synackuk]

@tuanem6996 @Pingzi610 If you’re just trying to develop an exploit it’s easier to patch an LLB and then send your debug iBoot over usb.

[synackuk @synackuk]

@Pingzi610 It looked to me like an issue with some value not being set properly.. I didn't investigate it enough to get to the bottom of it, since it does work

[synackuk @synackuk]

@tuanem6996 Yeah. You need to install a second iBoot into the NOR which is patched and tagged as Bob, create a third partition and set boot-partition=2 and boot-ramdisk equal to the ramdisk in the comment of the target.h file.

[synackuk @synackuk]

@Pingzi610 Yep. It’s definitely not perfectly reliable, but it’s something.

[synackuk @synackuk]

@lefunny87104 It is possible, but I don’t have a device with those blobs, so I’m not really able to properly create + test a ramdisk.

[synackuk @synackuk]

@Pingzi610 @LukeZGD1 ETA s0n :)

[synackuk @synackuk]

Thanks to @LukeZGD1 for adding DRAv6 to Legacy iOS kit!

[synackuk @synackuk]

@Pingzi610 So use latest baseband or disable baseband restore?

[synackuk @synackuk]

@Pingzi610 Ah nice you updated the payload. Glad to see the utilities working for you :)

[synackuk @synackuk]

@Vyce_Merculous Also how I feel atm :).. I don't want to lose my currently working devices. If things are still good in a couple of days I'll finish off the tooling and release a utility to make using these Ramdisks easier.

[synackuk @synackuk]

Given Apple's removing of signing status for the iPhone 4S (hopefully not the iPod touch 4G..), I've published the De Rebus Antiquis ram disks I created for iOS 6. https://t.co/JpNKPJXCDF I was planning to also port this work to the iPad 2.. But I'm not sure there's much point.

[synackuk @synackuk]

@Vyce_Merculous Source for this?

[synackuk @synackuk]

@nyan_satan These tools. I advise anyone with iOS 6.1.3 blobs (OTA or otherwise) saved for the 4S to keep them, and anyone with an iPod touch 4G to save their blobs.

[synackuk @synackuk]

@nyan_satan I have a nearly-complete IPSW patcher and a custom version of idevicerestore which you can use to install the exploit. I'm not going to release these yet.. Currently they don't support using saved blobs, which given what Apple's doing currently is the only safe way to use...

[synackuk @synackuk]

@polin0mm The iPod touch 4 is afaik still signed. I’m inclined to publish what I’ve built so far, with the proviso that it’s very much not the finished article. It may be the case that it’s only baseband firmware that has been unsigned, in which case we can still restore using cfw.

[synackuk @synackuk]

RIP signing for the iPhone 5 and 4S…