|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Untethered jailbreak"
(→Untethered exploits) |
m |
||
| (One intermediate revision by one other user not shown) | |||
| Line 1: | Line 1: | ||
| − | An '''untethered jailbreak''' |
+ | An '''untethered jailbreak''' is a jailbreak wherein a user can reboot their device at will, and have their device start up with the jailbreak automatically applied without the assistance of a computer or a utility on the device. |
| + | These jailbreaks can be applied via multiple different methods, the most common of which being kernel exploits. |
||
| − | == Untethered exploits == |
||
| − | Any [[M68AP|iPhone]], [[N45AP|iPod touch]], [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] (running the [[Bootrom 359.3|old bootrom]]) or [[N72AP|iPod touch (2nd generation)]] (running the [[Bootrom 240.4|old bootrom]]) can be jail broken untethered no matter what version it is running. These devices have bootrom exploits that are able to jailbreak untethered - namely [[Pwnage 2.0]], [[0x24000 Segment Overflow]], and [[alloc8 Exploit|alloc8]]. |
||
| + | == Kernel exploits == |
||
| − | ==Different Types== |
||
| − | There are 2 types of untethered jailbreaks: Patched [[LLB]]-based and kernel hacks. For a patched [[LLB]]-based jailbreak, an untethered bootrom dump (such as [[24kpwn]] or [[Pwnage 2.0]]) is required. This type of jailbreak patches the LLB so that it does not check the firmware at bootup, allowing for a pwned kernel or a custom bootlogo to be uploaded to the system. |
||
| + | Most untethered jailbreaks rely on vulnerabilities in the kernel and early boot process, typically using a combination of codesigning bypasses and manipulating the system into executing a binary early in the boot process (or obtaining unsigned code execution via a vulnerability in an existing startup process). Once code execution has been obtained, a kernel exploit is used in order to patch the currently loaded kernel to allow for the rootfs to be remounted as read/write, and to allow for unsigned code execution. |
||
| − | The second type, which hacks the kernel, uploads the unpwned kernel, which the system then checks for a signature, then a kernel exploit is uploaded and the kernel is being patched and changed to run unsigned code. After the exploit, the bootlogo can be changed. A userland exploit was used before the kernel exploit in order to bypass the iBoot signature checks before the kernel exploit. |
||
| + | Tools that use kernel exploits to achieve untethered jailbreaks: |
||
| − | ==See Also== |
||
| + | |||
| + | *[[Spirit]] |
||
| + | *[[Star|JailbreakMe 2.0 (star)]]/[[Saffron|JailbreakMe 3.0 (saffron)]] |
||
| + | *[[limera1n]] |
||
| + | *[[greenpois0n]] |
||
| + | *[[Absinthe]] |
||
| + | *[[unthredera1n]] |
||
| + | *[[evasi0n]] |
||
| + | *[[p0sixspwn]] |
||
| + | *[[evasi0n7]] |
||
| + | *[[Pangu]] |
||
| + | *[[Pangu8]] |
||
| + | *[[TaiG]] |
||
| + | *[[etasonJB]] |
||
| + | *[[UntetherHomeDepot]] |
||
| + | *[[Pangu9]] |
||
| + | *[[Fugu14]] |
||
| + | |||
| + | == BootROM exploits == |
||
| + | |||
| + | Older devices, such as the iPhone 3GS, iPod touch 2 (old bootrom) and earlier, have had vulnerabilities discovered in the [[BootROM]] that are able to be executed without the assistance of DFU mode (such as via a malformed image in the NOR) allowing for stages of the boot chain to be overwritten with custom code, such as a patched LLB/iBoot to allow for an unsigned kernel, and a custom boot logo. Examples of bootrom exploits that allow for untethered code execution are [[Pwnage]], [[0x24000 Segment Overflow|24kpwn]] and [[alloc8 Exploit|alloc8]]. |
||
| + | |||
| + | Tools that use bootROM exploits to achieve untethered jailbreaks: |
||
| + | |||
| + | *[[redsn0w]] |
||
| + | *[[sn0wbreeze]] |
||
| + | *[[PwnageTool]] |
||
| + | *[[ipwndfu]] |
||
| + | |||
| + | == iBoot exploits == |
||
| + | |||
| + | Some jailbreaks abuse vulnerabilities in the currently installed [[iBoot]] in order to patch out signature checks or load an alternative iBoot, therefore being able to load a patched and jailbroken kernel. Very few jailbreak utilities opt to use this method, as iBoot exploits are rare to come across and are able to be patched by Apple with software updates, thereby only being able to be used if blobs have been saved, or if the device was discontinued before Apple released a patch. |
||
| + | |||
| + | ==See also== |
||
*[[Jailbreak]] |
*[[Jailbreak]] |
||
*[[Jailbreak Exploits]] |
*[[Jailbreak Exploits]] |
||
Latest revision as of 20:07, 24 October 2021
An untethered jailbreak is a jailbreak wherein a user can reboot their device at will, and have their device start up with the jailbreak automatically applied without the assistance of a computer or a utility on the device.
These jailbreaks can be applied via multiple different methods, the most common of which being kernel exploits.
Kernel exploits
Most untethered jailbreaks rely on vulnerabilities in the kernel and early boot process, typically using a combination of codesigning bypasses and manipulating the system into executing a binary early in the boot process (or obtaining unsigned code execution via a vulnerability in an existing startup process). Once code execution has been obtained, a kernel exploit is used in order to patch the currently loaded kernel to allow for the rootfs to be remounted as read/write, and to allow for unsigned code execution.
Tools that use kernel exploits to achieve untethered jailbreaks:
- Spirit
- JailbreakMe 2.0 (star)/JailbreakMe 3.0 (saffron)
- limera1n
- greenpois0n
- Absinthe
- unthredera1n
- evasi0n
- p0sixspwn
- evasi0n7
- Pangu
- Pangu8
- TaiG
- etasonJB
- UntetherHomeDepot
- Pangu9
- Fugu14
BootROM exploits
Older devices, such as the iPhone 3GS, iPod touch 2 (old bootrom) and earlier, have had vulnerabilities discovered in the BootROM that are able to be executed without the assistance of DFU mode (such as via a malformed image in the NOR) allowing for stages of the boot chain to be overwritten with custom code, such as a patched LLB/iBoot to allow for an unsigned kernel, and a custom boot logo. Examples of bootrom exploits that allow for untethered code execution are Pwnage, 24kpwn and alloc8.
Tools that use bootROM exploits to achieve untethered jailbreaks:
iBoot exploits
Some jailbreaks abuse vulnerabilities in the currently installed iBoot in order to patch out signature checks or load an alternative iBoot, therefore being able to load a patched and jailbroken kernel. Very few jailbreak utilities opt to use this method, as iBoot exploits are rare to come across and are able to be patched by Apple with software updates, thereby only being able to be used if blobs have been saved, or if the device was discontinued before Apple released a patch.
