|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Diags (iBoot command)"
(Not compatible with iPt2 and newer.) |
m |
||
| Line 1: | Line 1: | ||
| − | This was an exploit that allowed the running of unsigned code at iBoot level, present in pre-2.0 versions of iBoot. |
+ | This was an exploit that allowed the running of unsigned code at iBoot level, present in pre-2.0 versions of [[iBoot (Bootloader)|iBoot]]. |
==Credit== |
==Credit== |
||
| Line 7: | Line 7: | ||
This is a very easy-to-use exploit. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices. You can run unsigned code on the [[S5L8900]] using this, but the GPIOs need to be restored if you intend to use any I/O again (such as the screen, serial, or USB). |
This is a very easy-to-use exploit. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices. You can run unsigned code on the [[S5L8900]] using this, but the GPIOs need to be restored if you intend to use any I/O again (such as the screen, serial, or USB). |
||
| − | In 2.0 iBoots, they have a flag check on this command (checks bit 4 of the iBoot flags), and that flag will not be present on a retail device, just an engineering one with a 'whitelisted' CHIPID, so this exploit doesn't work. However, the 1.1.4 iBSS can still be used on the [[m68ap|iPhone]], [[n82ap|iPhone 3G]], or [[n45ap|iPod touch 1G]], and can be used to boot a modified 2.0+ [[iBoot]]. Therefore, it is still an open exploit for these devices. |
+ | In 2.0 iBoots, they have a flag check on this command (checks bit 4 of the iBoot flags), and that flag will not be present on a retail device, just an engineering one with a 'whitelisted' CHIPID, so this exploit doesn't work. However, the 1.1.4 [[iBSS]] can still be used on the [[m68ap|iPhone]], [[n82ap|iPhone 3G]], or [[n45ap|iPod touch 1G]], and can be used to boot a modified 2.0+ [[iBoot (Bootloader)|iBoot]]. Therefore, it is still an open exploit for these devices. |
[[Category:Exploits]] |
[[Category:Exploits]] |
||
Revision as of 04:37, 8 November 2010
This was an exploit that allowed the running of unsigned code at iBoot level, present in pre-2.0 versions of iBoot.
Credit
Exploit
This is a very easy-to-use exploit. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices. You can run unsigned code on the S5L8900 using this, but the GPIOs need to be restored if you intend to use any I/O again (such as the screen, serial, or USB).
In 2.0 iBoots, they have a flag check on this command (checks bit 4 of the iBoot flags), and that flag will not be present on a retail device, just an engineering one with a 'whitelisted' CHIPID, so this exploit doesn't work. However, the 1.1.4 iBSS can still be used on the iPhone, iPhone 3G, or iPod touch 1G, and can be used to boot a modified 2.0+ iBoot. Therefore, it is still an open exploit for these devices.
