Evasi0n

evasi0n's icon

evasi0n is a jailbreak tool that can perform an untethered jailbreak on iOS 6.0-6.1.2 for all supported devices, excluding both Apple TV 3G revisions. It was first released on 4 February 2013 by evad3rs, and is available for Windows, Mac OS X, and Linux (x86 and x86_64). There is also a Cydia package called "evasi0n iOS 6.0-6.1 untether" which can untether an existing tethered jailbreak without the need to restore and use the desktop tool. It is a userland jailbreak.

Supported Devices

As of evasi0n's release, the only unsupported devices are the Apple TV 3G revisions, since the kernels on these devices lack an injection vector to run unsigned code. All other devices running iOS 6.0-6.1.2 are supported (including iOS 5.2 for the Apple TV 2G).

Cydia Package

The Cydia package contains just these files:

/usr/libexec/dirhelper
/var/evasi0n/amfi.dylib
/var/evasi0n/evasi0n

It also includes three Debian maintenance scripts: prerm (a bash script that cancels uninstallation if the device is not vulnerable to limera1n), as well as postrm and extrainst_ binaries.

Version History

Version	Cydia Package Version	Release Date	#	SHA-1 of evasi0n binary	Changes
1.0	0.1-1	04 Feb 2013	1	f16f4592e5d65927faf98a25bce51b22ee9bc831	Initial Release
1.1	0.2-3	06 Feb 2013	2	301003d8aa58a0a2e1bf7030bb903ca42a89c851	Prevents Weather app from appearing on iPads Mitigated the long reboot issue Fixed freezing issue with after connecting multiple devices Fixed blinking of the jailbreak instructions on OS X. OS X app is now codesigned.
1.2	0.3-1	08 Feb 2013	3	75d140c53bdd615cc279932f843ab3af584086a5	Disables OTA updates. Correct timezone issue in evasi0n binary if client fails to correct it.
1.3	0.3-2	11 Feb 2013	4	ff5a5e767acb4c9acf9a25555ae172ad254e596a	Adds support for the iPhone 4S on iOS 6.1.1.
1.4	0.3-3	19 Feb 2013	5	3b2cc5e2d7be397c09d369e83ea52094250d86e9	Added support for iOS 6.1.2
1.5	0.4-1	23 Feb 2013	6	cd5a71b4d0b2767294049cc6b3b2ce3e09d68445	Improved boot time. Updated included Cydia package list.
1.5.1		05 Mar 2013	7	1a826416932e77f24c94da17884e48ccfe7cdbf6	Updated included Cydia package list.
1.5.2	0.4.1-1	11 Mar 2013	8	3e89337956189e6654cd359995ac550f0372ac8b	Added French translation. Added Chinese translation. Added German translation. Updated bundled Cydia with localization fixes.
1.5.3		12 Mar 2013	9	3e89337956189e6654cd359995ac550f0372ac8b	Fixes Windows bugs.

Download

Version	OS	SHA-1 Hash	Download
1.0	GNU/Linux	c9e4b15a161b89f0e412721f471c5f8559b6054f	Google Sites	Box	Mega	RapidShare
	Mac OS X	23f99a0d65e71fd79ff072b227f0ecb176f0ffa8	Google Sites	Box	Mega	RapidShare
	Windows	2ff288e1798b4711020e9dd7f26480e57704d8b2	Google Sites	Box	Mega	RapidShare
1.1	GNU/Linux	6c06a6be87e003eee470eb749b42ffbaafcc9e62	Google Sites	Box	Mega	RapidShare
	Mac OS X	ae9d20bc927976a1f55089cd80afca48de0f7a2e	Google Sites	Box	Mega	RapidShare
	Windows	4225b01afd4a4fd1277565954964bd3310ad8b5f	Google Sites	Box	Mega	RapidShare
1.2	GNU/Linux	2e1d1f6c7e6ca775860df03298dce3b0d798658a	Google Sites	Box	Mega	RapidShare
	Mac OS X	8f91aba478ad28bda800dc5c303be1699fcfb800	Google Sites	Box	Mega	RapidShare
	Windows	9942559caf779da6526b9fd0e207d21554a8a9cf	Google Sites	Box	Mega	RapidShare
1.3	GNU/Linux	d93bc45653345e62a315e0a0aaa1b709aacd26c4	Google Sites	Box	Mega	RapidShare
	Mac OS X	c239da3fd4e312c8468cdca967c86962b2cbd3f9	Google Sites	Box	Mega	RapidShare
	Windows	92bbe23f125f3b0155334f1925943624e24ce130	Google Sites	Box	Mega	RapidShare
1.4	GNU/Linux	95c34e7a7220d2dab2e93cf9bb62beb49aef8996	Google Sites	Box	Mega	N/A
	Mac OS X	96b62f303e335bb5c6b78034027606fee5fc93c3	Google Sites	Box	Mega
	Windows	36adf9ccf62aaf770163666e757c7a89e9ba3a55	Google Sites	Box	Mega
1.5	GNU/Linux	923db21a9045df6aaaff27670be92330f4855a21	Google Sites	Box	Mega
	Mac OS X	cccf7e5b4a83df8c05dcfed98b9627533c018541	Google Sites	Box	Mega
	Windows	25799bbeea3733c26fb010e6aca432d686fd8f9f	Google Sites	Box	Mega
1.5.1	GNU/Linux	cc0bd166a1480c2a838584b201981db1e45ca411	N/A	Box	Mega
	Mac OS X	4a0e9fb8b5f83fbee5e26d1d7db876cefd09832a		Box	Mega
	Windows	a220bb5fb1ccf5cf1cb666dc03e20ac54890835d		Box	Mega
1.5.2	GNU/Linux	97fbeb932dd3cb22ec339ec4c2f95a17d570d30c		Box	N/A	RapidShare
	Mac OS X	051079f808f5c31f32ba09c6a39f09a8c3479157		Box		RapidShare
	Windows	30d34e23f860eae28d4ae6513edc46ef8aa2042c		Box		RapidShare
1.5.3	GNU/Linux	620dcb7996b1f3497827b11876bf0c2fae069ecf		Box		RapidShare
	Mac OS X	54827d78cb45b7dae4e7566b9ed5c1b833d68850		Box		RapidShare
	Windows	2f8c2f111a6afefd099ecb0ce5aab63f160940b8		Box		RapidShare

Exploits and Vulnerabilities

evasi0n takes advantage of several vulnerabilities:

• Symbolic Link Vulnerability
• Malformed PairRequest
• Timezone Vulnerability (CVE-2013-0979)
• Shebang Trick
• AMFID code signing evasion
• launchd.conf untether
• IOUSBDeviceFamily Vulnerability (CVE-2013-0981)
• ARM Exception Vector Info Leak (CVE-2013-0978)
• dynamic memmove() locating
• vm_map_copy_t corruption for arbitrary memory disclosure
• kernel memory write via ROP gadget
• Overlapping Segment Attack (CVE-2013-0977)

Symbols in Untether code

Symbol	v1	v2	v3	v4	v5	v6	v7	v8/9
start	020B0	02EF8	02BFC	02BFC	02BFC	02E30	?	02A80
find_memmove_arm#search	?	?	?	?	?	0AFA0	?	?
find_memmove_thumb#search	?	?	?	?	?	0AFD0	?	?
find_memmove	?	?	?	?	?	0571C	?	?
find_memmove#exit	?	?	?	?	?	05762	?	?
_catch_exception_raise_state_identity	?	?	?	?	?	?	?	065B8

See Also

• evad3rs
• Patchfinder

External Links

• Official Website
• Accuvant Labs analysis
• Analysis by kernelpool
• kernelpool presentation at NISlab: slides
• kernelpool presentation at NISlab: video
• Explanation by planetbeing in Forbes
• Hopper Script to demangle evasi0n strings for Mac client of evasi0n, use in Hopper disassembler
• Apple Response: iOS 6.1.3 Security Fixes
• Apple Response: iOS 5.2.1 (Apple TV) Security Fixes
• Slides from HITB presentation in Amsterdam 2013
• Quarkslab blog post describing how evasi0n bypasses code signing