|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Jailbreak Exploits"
(→8.1.1) |
(new design) |
||
| Line 1: | Line 1: | ||
This page lists the exploits used in [[Jailbreak]]s. |
This page lists the exploits used in [[Jailbreak]]s. |
||
| − | == |
+ | == Common exploits which are used in order to jailbreak different versions of iOS == |
| + | * [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]]) |
||
| − | === 1.0.2 === |
||
| + | * [[ARM7 Go]] (from iOS 2.1.1) (for [[tethered jailbreak]] on [[n72ap|iPod touch 2G]]) |
||
| − | * [[Restore Mode]] ([[iBoot (Bootloader)|iBoot]] had a command named <code>cp</code>, which had access to the whole filesystem) |
||
| + | * [[0x24000 Segment Overflow]] (for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]] and [[n72ap|iPod touch 2G]] with [[Bootrom 240.4|old bootrom]]; another exploit as the [[limera1n Exploit]] is required) |
||
| − | === 1.1.1 === |
||
| + | * [[limera1n Exploit]] (for [[tethered jailbreak]] on [[n88ap|iPhone 3GS]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], [[n81ap|iPod touch 4G]] and [[k66ap|Apple TV 2G]]) |
||
| − | * [[Symlinks]] (an upgrade jailbreak) |
||
| + | * [[usb_control_msg(0xA1, 1) Exploit]] (also known as "steaks4uce") (for [[tethered jailbreak]] on [[n72ap|iPod touch 2G]]) |
||
| + | |||
| + | == Programs which are used in order to jailbreak different versions of iOS == |
||
| + | === [[PwnageTool]] (2.0 - 5.1.1) === |
||
| + | * uses different common exploits |
||
| + | * uses the exploits listed below to untether up to iOS 5.1.1 |
||
| + | |||
| + | === [[redsn0w]] (3.0 - 6.0) === |
||
| + | * uses different common exploits |
||
| + | * uses the same exploits as [[Absinthe|Absinthe]] and [[Absinthe|Absinthe 2.0]] to jailbreak iOS 5.0/5.0.1 and 5.1.1 |
||
| + | * uses the exploits listed below to untether up to iOS 5.1.1 |
||
| + | |||
| + | === [[sn0wbreeze]] (3.1.3 - 6.1.3) === |
||
| + | * uses different common exploits |
||
| + | * uses the exploits listed below to untether up to iOS 6.1.2 |
||
| + | |||
| + | == Programs which are used in order to jailbreak 1.x == |
||
| + | |||
| + | === [[AppTapp Installer]] (1.0 / 1.0.1 / 1.0.2) === |
||
| + | * iBoot <code>cp</code>-command exploit |
||
| + | |||
| + | === [[iBrickr]] (1.0 / 1.0.1 / 1.0.2) === |
||
| + | * iBoot <code>cp</code>-command exploit |
||
| + | |||
| + | === [[AppSnapp]]/[[JailbreakMe|JailbreakMe 1.0]] (1.0 / 1.0.1 / 1.0.2 / 1.1.1) === |
||
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459 CVE-2006-3459]) |
* [[LibTiff|libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]]) ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459 CVE-2006-3459]) |
||
| − | === 1.1.2 === |
+ | === [[mknod|OktoPrep]] (1.1.2) === |
| + | "Upgrade" to 1.1.2 from a jailborken 1.1.1 |
||
| − | * [[Mknod]] (an upgrade jailbreak) |
||
| + | * [[mknod]] |
||
| − | === 1.1.3 / 1.1.4 / 1.1.5 === |
||
| + | |||
| − | * [[Soft Upgrade]] (an upgrade jailbreak) |
||
| + | === [[Soft Upgrade]] (1.1.3) === |
||
| + | "Upgrade" to 1.1.3 from a running jailbroken 1.1.2 |
||
| + | |||
| + | === [[ZiPhone]] (1.1.3 / 1.1.4 /1.1.5) === |
||
* [[Ramdisk Hack]] |
* [[Ramdisk Hack]] |
||
| − | * [[Dual Boot Exploit]] - Works up to [[iOS]] 2.0 beta 3 |
||
| − | * [[diags]] - Works up to [[iOS]] 2.0 beta 5 |
||
| + | === [[iLiberty+|iLiberty / iLiberty+]] (1.1.3 / 1.1.4 /1.1.5) === |
||
| − | == Exploits which are used in order to jailbreak 2.x == |
||
| − | === 2.0 / 2.0.1 / 2.0.2 / 2.1 === |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] |
||
| − | === 2.1.1 === |
||
| − | * [[ARM7 Go]] ([[tethered jailbreak]]) |
||
| − | === 2.2 === |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]]) |
||
| − | === 2.2.1 === |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]]) |
||
| − | * [[0x24000 Segment Overflow]] + [[ARM7 Go]] (from iOS 2.1.1) ([[n72ap|iPod touch 2G]]) |
||
| − | == |
+ | == Programs which are used in order to jailbreak 2.x == |
| − | === |
+ | === [[QuickPwn]] (2.0 - 2.2.1) === |
| − | * [[Pwnage]] |
+ | * uses [[Pwnage]] and [[Pwnage 2.0]] |
| − | * [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] ( [[n72ap|iPod touch 2G]]) |
||
| − | * [[Pwnage]] + [[iBoot Environment Variable Overflow]] ([[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]]) |
||
| − | * [[0x24000 Segment Overflow]] + [[iBoot Environment Variable Overflow]] ([[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]]) |
||
| − | === 3.1 / 3.1.1 === |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]]) |
||
| − | * [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]]) |
||
| − | * [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) |
||
| − | === 3.1.2 === |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]]) |
||
| − | * [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], and [[n18ap|iPod touch 3G]]) |
||
| − | * [[0x24000 Segment Overflow]] + [[usb_control_msg(0x21, 2) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) |
||
| − | * [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]]) |
||
| − | * [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]]) |
||
| − | === 3.1.3 === |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] (together for [[untethered jailbreak]] on [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]]) |
||
| − | * [[0x24000 Segment Overflow]] (for [[n72ap|iPod touch 2G]] and [[n88ap|iPhone 3GS]] devices with older bootroms) |
||
| − | ** + [[Limera1n Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]], used in [[sn0wbreeze]]) |
||
| − | ** + [[usb_control_msg(0xA1, 1) Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]], used in [[sn0wbreeze]]) |
||
| − | * [[usb_control_msg(0xA1, 1) Exploit]]+ [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[n72ap|iPod touch 2G]] [[Bootrom 240.5.1|new bootrom]], used in [[sn0wbreeze]]) |
||
| − | * [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[N18ap|iPod touch 3G]] and [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], used in [[sn0wbreeze]]) |
||
| − | * [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]]) |
||
| − | * [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]]) |
||
| − | === |
+ | === [[Redsn0w Lite]] (2.1.1) === |
| + | * [[ARM7 Go]] (for [[n72ap|iPod touch 2G]] only) |
||
| − | * [[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (all devices, used in [[Spirit]]) |
||
| − | * [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]]) |
||
| − | * [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] ([[K48ap|iPad]] used in [[sn0wbreeze]] 2.9.x) |
||
| − | === 3.2.1 === |
||
| − | * [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[Star]]) |
||
| − | * [[Limera1n Exploit]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] ([[k48ap|iPad]], used in [[sn0wbreeze]] 2.9.x) |
||
| − | === 3.2.2 === |
||
| − | * [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[k48ap|iPad]]) |
||
| − | == |
+ | == Programs which are used in order to jailbreak 3.x == |
| − | === |
+ | === [[purplera1n]] (3.0) === |
| + | * [[iBoot Environment Variable Overflow]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2795 CVE-2009-2795]) |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]]) |
||
| − | * [[0x24000 Segment Overflow]] |
+ | * uses [[0x24000 Segment Overflow]] |
| − | * [[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (all devices, used in [[Star]]) |
||
| − | * [[Limera1n Exploit]] + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] New bootrom, [[N18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]]) |
||
| − | === |
+ | === [[blackra1n]] (3.1.2) === |
| + | * [[usb_control_msg(0x21, 2) Exploit]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0038 CVE-2010-0038]) |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] ([[n82ap|iPhone 3G]]) |
||
| − | * |
+ | * uses [[0x24000 Segment Overflow]] |
| − | * [[0x24000 Segment Overflow]] ([[n88ap|iPhone 3GS]]) |
||
| − | * [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] ([[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]]) |
||
| − | === |
+ | === [[Spirit]] (3.1.2 / 3.1.3 / 3.2) === |
| + | * [[MobileBackup Copy Exploit]] |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]]) |
||
| + | * [[Incomplete Codesign Exploit]] |
||
| − | * [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]]) |
||
| + | * [[BPF_STX Kernel Write Exploit]] |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) |
||
| − | * [[limera1n]]'s bootrom exploit + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]])) |
||
| − | * [[usb_control_msg(0xA1, 1) Exploit]] + [[Packet Filter Kernel Exploit]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]]) |
||
| + | === [[Star|JailbreakMe 2.0 / Star]] (3.1.2 / 3.1.3 / 3.2 / 3.2.1) === |
||
| − | === 4.2.1 === |
||
| + | * [[Malformed CFF Vulnerability]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1797 CVE-2010-1797]) |
||
| − | * [[Pwnage]] + [[Pwnage 2.0]] (together to jailbreak the [[n82ap|iPhone 3G]]) |
||
| + | * [[Incomplete Codesign Exploit]] |
||
| − | * [[ARM7 Go]] (from iOS 2.1.1) + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]] [[Bootrom 240.4|old bootrom]]) |
||
| + | * [[IOSurface Kernel Exploit]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2973 CVE-2010-2973]) |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) |
||
| − | * [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]]) |
||
| − | * [[usb_control_msg(0xA1, 1) Exploit]] + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n72ap|iPod touch 2G]]) |
||
| − | === |
+ | === [[limera1n]] / [[greenpois0n (jailbreak)|greenpois0n]] (3.2.2) === |
| + | * uses different common exploits |
||
| − | * [[limera1n]]'s bootrom exploit + [[HFS Legacy Volume Name Stack Buffer Overflow]] (together for [[untethered jailbreak]] on [[n92ap|iPhone 4 (iPhone3,3)]]) |
||
| + | * [[Packet Filter Kernel Exploit]] |
||
| − | * [[T1 Font Integer Overflow]] (used for [[Saffron]]) ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0226 CVE-2011-0226]) |
||
| + | == Programs which are used in order to jailbreak 4.x == |
||
| − | === 4.2.9 / 4.2.10 === |
||
| + | === [[Star|JailbreakMe 2.0 / Star]] (4.0 / 4.0.1) === |
||
| − | * [[limera1n]]'s bootrom exploit (Tethered jailbreak on [[n92ap|iPhone 4 (iPhone3,3)]]) |
||
| + | * [[Malformed CFF Vulnerability]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1797 CVE-2010-1797]) |
||
| + | * [[Incomplete Codesign Exploit]] |
||
| + | * [[IOSurface Kernel Exploit]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2973 CVE-2010-2973]) |
||
| + | === [[limera1n]] / (4.0 / 4.0.1 / 4.0.2 / 4.1) === |
||
| − | === 4.3 === |
||
| + | * uses different common exploits |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) |
||
| + | * [[Packet Filter Kernel Exploit]] |
||
| − | * [[limera1n]]'s bootrom exploit ([[tethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], [[n81ap|iPod touch 4G]], and [[k66ap|Apple TV 2G]]) |
||
| − | * [[T1 Font Integer Overflow]] (used for [[Saffron]]) ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0226 CVE-2011-0226]) |
||
| + | === [[greenpois0n (jailbreak)|greenpois0n]] (4.1) === |
||
| − | === 4.3.1 / 4.3.2 / 4.3.3 === |
||
| + | * uses different common exploits |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) |
||
| + | * [[Packet Filter Kernel Exploit]] |
||
| − | * [[limera1n]]'s bootrom exploit + [[ndrv_setspec() Integer Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]]) |
||
| − | * [[T1 Font Integer Overflow]] (used for [[Saffron]]) |
||
| − | === |
+ | === [[greenpois0n (jailbreak)|greenpois0n]] (4.2.1) === |
| + | * uses different common exploits |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]]) |
||
| + | * [[HFS Legacy Volume Name Stack Buffer Overflow]] |
||
| − | * [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[n90ap|iPhone 4 (iPhone3,1)]], and [[n81ap|iPod touch 4G]]) |
||
| + | === [[Saffron|JailbreakMe 3.0 / Saffron]] (4.2.6 / 4.2.7 / 4.2.8) === |
||
| − | == Exploits which are used in order to jailbreak 5.x == |
||
| + | * [[T1 Font Integer Overflow]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0226 CVE-2011-0226]) |
||
| − | === 5.0 === |
||
| + | * [[HFS Legacy Volume Name Stack Buffer Overflow]] |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]]) |
||
| − | * [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]]) |
||
| − | * [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]]- [[n94ap|iPhone 4S]] only |
||
| + | === [[Saffron|JailbreakMe 3.0 / Saffron]] (4.3 / 4.3.1 / 4.3.2 / 4.3.3) === |
||
| − | ===5.0.1=== |
||
| + | Except for the [[n18ap|iPod touch 3G]] on iOS 4.3.1. |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]]) |
||
| + | * [[T1 Font Integer Overflow]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0226 CVE-2011-0226]) |
||
| − | * [[limera1n]]'s bootrom exploit + [[Racoon String Format Overflow Exploit]]+[[HFS Heap Overflow]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]]) |
||
| + | * [[IOMobileFrameBuffer Privilege Escalation Exploit]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0227 CVE-2011-0227]) |
||
| − | * [[Racoon String Format Overflow Exploit]] (used both for payload injection and untether)+[[HFS Heap Overflow]] - [[iPad 2]] and [[iPhone 4S]] with [[Absinthe]] |
||
| + | === i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3) === |
||
| − | ===5.1=== |
||
| + | * [[ndrv_setspec() Integer Overflow]] |
||
| − | * [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[n18ap|iPod touch 3G]], [[k48ap|iPad]], [[iPhone 4]], and [[n81ap|iPod touch 4G]]) |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]]) |
||
| + | == Programs which are used in order to jailbreak 5.x == |
||
| − | ===5.1.1=== |
||
| + | === [[unthredera1n]] (5.0 / 5.0.1 / 5.1 / 5.1.1) === |
||
| − | * [[limera1n Exploit]] + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]]) |
||
| + | Except for the [[iPad 3]] |
||
| − | * [[limera1n Exploit]] + [[Rocky Racoon]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], [[n18ap|iPod touch 3G]], and [[n81ap|iPod touch 4G]]) |
||
| + | * MobileBackup2 Copy Exploit |
||
| + | * a new Packet Filter Kernel Exploit ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3728 CVE-2012-3728]) |
||
| + | * [[AMFID code signing evasion]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0977 CVE-2013-0977]) |
||
| + | * [[launchd.conf untether]] |
||
| + | * [[Timezone Vulnerability]] |
||
| + | === [[Absinthe]] (5.0 on [[n94ap|iPhone 4S]] only / 5.0.1 on [[iPad 2]] and [[iPhone 4S]]) === |
||
| − | == Exploits which are used in order to jailbreak 6.x == |
||
| + | * [[Racoon String Format Overflow Exploit]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0646 CVE-2012-0646]) (used both for payload injection and untether) |
||
| − | === 6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2 === |
||
| + | * [[HFS Heap Overflow]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0642 CVE-2012-0642]) |
||
| − | * [[limera1n]]'s bootrom exploit (Tethered jailbreak) on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3.2|new bootrom]], [[iPhone 4]], and [[n81ap|iPod touch 4G]]) |
||
| + | * [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0643 CVE-2012-0643] |
||
| − | * [[limera1n]]'s bootrom exploit + [[0x24000 Segment Overflow]] (together for [[untethered jailbreak]] on [[n88ap|iPhone 3GS]] with [[Bootrom 359.3|old bootrom]]) |
||
| + | |||
| − | * [[Symbolic Link Vulnerability]] |
||
| + | === [[Corona|Corona Untether]] (5.0.1) === |
||
| − | * [[Timezone Vulnerability]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0979 CVE-2013-0979]) |
||
| + | * [[Racoon String Format Overflow Exploit]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0646 CVE-2012-0646]) |
||
| − | * [[Shebang Trick]] |
||
| + | * [[HFS Heap Overflow]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0642 CVE-2012-0642]) |
||
| + | * [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0643 CVE-2012-0643] |
||
| + | |||
| + | === [[Absinthe|Absinthe 2.0]] and [[Rocky Racoon|Rocky Racoon Untether]] (5.1.1) === |
||
| + | {{Section Stub}} |
||
| + | * a new Packet Filter Kernel Exploit ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3728 CVE-2012-3728]) |
||
| + | * Racoon DNS4/WINS4 table buffer overflow ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3727 CVE-2012-3727]) |
||
| + | * MobileBackup2 Copy Exploit |
||
| + | |||
| + | == Programs which are used in order to jailbreak 6.x == |
||
| + | === [[evasi0n]] (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2) === |
||
| + | * [[Symbolic Link Vulnerability]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0979 CVE-2013-0979]) |
||
| + | * [[Timezone Vulnerability]] |
||
| + | * [[Shebang Trick]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5154 CVE-2013-5154]) |
||
* [[AMFID code signing evasion]] |
* [[AMFID code signing evasion]] |
||
* [[launchd.conf untether]] |
* [[launchd.conf untether]] |
||
| Line 145: | Line 143: | ||
* [[Overlapping Segment Attack]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0977 CVE-2013-0977]) |
* [[Overlapping Segment Attack]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0977 CVE-2013-0977]) |
||
| − | === 6.1.3 / 6.1.4 / 6.1.5 / 6.1.6 === |
+ | === [[p0sixspwn]] (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6) === |
| − | * [[posix_spawn kernel information leak]] (by [[i0n1c]]) |
+ | * [[posix_spawn kernel information leak]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3954 CVE-2013-3954]) (by [[i0n1c]]) |
* [[posix_spawn kernel exploit]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3954 CVE-2013-3954]) (by [[i0n1c]]) |
* [[posix_spawn kernel exploit]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3954 CVE-2013-3954]) (by [[i0n1c]]) |
||
| − | * [[mach_msg_ool_descriptor_ts for heap shaping]] |
+ | * [[mach_msg_ool_descriptor_ts for heap shaping]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3953 CVE-2013-3953]) |
| − | * [[AMFID_code_signing_evasi0n7]] |
+ | * [[AMFID_code_signing_evasi0n7]] |
* [[DeveloperDiskImage race condition]] (by [[comex]]) |
* [[DeveloperDiskImage race condition]] (by [[comex]]) |
||
* [[launchd.conf untether]] |
* [[launchd.conf untether]] |
||
| − | == |
+ | == Programs which are used in order to jailbreak 7.x == |
{{Section Stub}} |
{{Section Stub}} |
||
| − | === 7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6 === |
+ | === [[evasi0n7]] (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6) === |
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5133 CVE-2013-5133] |
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5133 CVE-2013-5133] |
||
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1272 CVE-2014-1272] |
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1272 CVE-2014-1272] |
||
| − | * |
+ | * [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1273 CVE-2014-1273] |
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1278 CVE-2014-1278] |
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1278 CVE-2014-1278] |
||
* [[Symbolic Link Vulnerability]] |
* [[Symbolic Link Vulnerability]] |
||
| − | === 7.1 / 7.1.1 / 7.1.2 === |
+ | === [[Geeksn0w]] (7.1 / 7.1.1 / 7.1.2) === |
| − | [[Geeksn0w]] |
||
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]] |
* [[limera1n]]'s bootrom exploit ([[Tethered jailbreak]]) on [[iPhone 4]] |
||
| + | |||
| − | [[Pangu]] |
||
| + | === [[Pangu]] (7.1 / 7.1.1 / 7.1.2) === |
||
* [[i0n1c]]'s Infoleak vulnerability (Pangu v1.0.0) |
* [[i0n1c]]'s Infoleak vulnerability (Pangu v1.0.0) |
||
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) (Pangu v1.1.0) |
* break_early_random (by [[i0n1c]] and Tarjei Mandt of Azimuth) (Pangu v1.1.0) |
||
| − | * LightSensor / ProxALSSensor kernel exploit (Pangu 1.0.0) |
+ | * LightSensor / ProxALSSensor kernel exploit (Pangu 1.0.0) ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4388 CVE-2014-4388]) |
| − | * TempSensor kernel exploit (Pangu 1.1.0) |
+ | * TempSensor kernel exploit (Pangu 1.1.0) ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4388 CVE-2014-4388]) |
* "syslogd chown" vulnerability |
* "syslogd chown" vulnerability |
||
* enterprise certificate (no real exploit, used for initial "unsigned" code execution) |
* enterprise certificate (no real exploit, used for initial "unsigned" code execution) |
||
| − | * "foo_extracted" symlink vulnerability (used to write to /var) |
+ | * "foo_extracted" symlink vulnerability (used to write to /var) ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4386 CVE-2014-4386]) |
* /tmp/bigfile (a big file for improvement of the reliability of a race condition) |
* /tmp/bigfile (a big file for improvement of the reliability of a race condition) |
||
* VoIP backgrounding trick (used to auto restart the app) |
* VoIP backgrounding trick (used to auto restart the app) |
||
* hidden segment attack |
* hidden segment attack |
||
| + | * [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4407 CVE-2014-4407] |
||
| − | == |
+ | == Programs which are used in order to jailbreak 8.x == |
{{Section Stub}} |
{{Section Stub}} |
||
| − | === 8.0/8.0.1/8.0.2/8.1 === |
+ | === [[Pangu8]] (8.0 / 8.0.1 / 8.0.2 / 8.1) === |
| − | [[Pangu8]] |
||
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w) |
* an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w) |
||
* enterprise certificate (inside the IPA) |
* enterprise certificate (inside the IPA) |
||
* a kind of dylib injection into a system process (see IPA) |
* a kind of dylib injection into a system process (see IPA) |
||
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking) |
* a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking) |
||
| − | * a sandboxing problem in debugserver ([http:// |
+ | * a sandboxing problem in debugserver ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4457 CVE-2014-4457]) |
| − | * the same/a similar kernel exploit as used in [[Pangu]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4461 CVE-2014-4461]) (source @iH8sn0w) |
+ | * the same/a similar kernel exploit as used in [[Pangu|the first Pangu]] ([http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4461 CVE-2014-4461]) (source @iH8sn0w) |
* enable-dylibs-to-override-cache |
* enable-dylibs-to-override-cache |
||
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4455 CVE-2014-4455] |
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4455 CVE-2014-4455] |
||
| + | === [[TaiG]] (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2) === |
||
| − | [[TaiG]] |
||
| − | * LightSensor / ProxALSSensor kernel exploit (Also used in Pangu 1.0.0) |
||
| − | * [[DeveloperDiskImage race condition]] (by [[comex]]) (source: https://twitter.com/iH8sn0w/status/538602532088860672; also used in p0sixspwn) |
||
| − | * enable-dylibs-to-override-cache (Also used in Pangu8) |
||
| − | * a kind of dylib injection into a system process (see IPA) (Also used in Pangu8 but tweaked slightly) |
||
| − | |||
| − | === 8.1.1 / 8.1.2 === |
||
* LightSensor / ProxALSSensor kernel exploit (Also used in Pangu 1.0.0) |
* LightSensor / ProxALSSensor kernel exploit (Also used in Pangu 1.0.0) |
||
* [[DeveloperDiskImage race condition]] (by [[comex]]) (source: https://twitter.com/iH8sn0w/status/538602532088860672; also used in p0sixspwn) |
* [[DeveloperDiskImage race condition]] (by [[comex]]) (source: https://twitter.com/iH8sn0w/status/538602532088860672; also used in p0sixspwn) |
||
Revision as of 09:50, 17 January 2015
This page lists the exploits used in Jailbreaks.
Contents
- 1 Common exploits which are used in order to jailbreak different versions of iOS
- 2 Programs which are used in order to jailbreak different versions of iOS
- 3 Programs which are used in order to jailbreak 1.x
- 4 Programs which are used in order to jailbreak 2.x
- 5 Programs which are used in order to jailbreak 3.x
- 6 Programs which are used in order to jailbreak 4.x
- 7 Programs which are used in order to jailbreak 5.x
- 8 Programs which are used in order to jailbreak 6.x
- 9 Programs which are used in order to jailbreak 7.x
- 10 Programs which are used in order to jailbreak 8.x
Common exploits which are used in order to jailbreak different versions of iOS
- Pwnage + Pwnage 2.0 (together to jailbreak the iPhone 3G)
- ARM7 Go (from iOS 2.1.1) (for tethered jailbreak on iPod touch 2G)
- 0x24000 Segment Overflow (for untethered jailbreak on iPhone 3GS with old bootrom and iPod touch 2G with old bootrom; another exploit as the limera1n Exploit is required)
- limera1n Exploit (for tethered jailbreak on iPhone 3GS, iPod touch 3G, iPad, iPhone 4, iPod touch 4G and Apple TV 2G)
- usb_control_msg(0xA1, 1) Exploit (also known as "steaks4uce") (for tethered jailbreak on iPod touch 2G)
Programs which are used in order to jailbreak different versions of iOS
PwnageTool (2.0 - 5.1.1)
- uses different common exploits
- uses the exploits listed below to untether up to iOS 5.1.1
redsn0w (3.0 - 6.0)
- uses different common exploits
- uses the same exploits as Absinthe and Absinthe 2.0 to jailbreak iOS 5.0/5.0.1 and 5.1.1
- uses the exploits listed below to untether up to iOS 5.1.1
sn0wbreeze (3.1.3 - 6.1.3)
- uses different common exploits
- uses the exploits listed below to untether up to iOS 6.1.2
Programs which are used in order to jailbreak 1.x
AppTapp Installer (1.0 / 1.0.1 / 1.0.2)
- iBoot
cp-command exploit
iBrickr (1.0 / 1.0.1 / 1.0.2)
- iBoot
cp-command exploit
AppSnapp/JailbreakMe 1.0 (1.0 / 1.0.1 / 1.0.2 / 1.1.1)
- libtiff exploit (Adapted from the PSP scene, used by JailbreakMe) (CVE-2006-3459)
OktoPrep (1.1.2)
"Upgrade" to 1.1.2 from a jailborken 1.1.1
Soft Upgrade (1.1.3)
"Upgrade" to 1.1.3 from a running jailbroken 1.1.2
ZiPhone (1.1.3 / 1.1.4 /1.1.5)
iLiberty / iLiberty+ (1.1.3 / 1.1.4 /1.1.5)
Programs which are used in order to jailbreak 2.x
QuickPwn (2.0 - 2.2.1)
- uses Pwnage and Pwnage 2.0
Redsn0w Lite (2.1.1)
- ARM7 Go (for iPod touch 2G only)
Programs which are used in order to jailbreak 3.x
purplera1n (3.0)
blackra1n (3.1.2)
Spirit (3.1.2 / 3.1.3 / 3.2)
JailbreakMe 2.0 / Star (3.1.2 / 3.1.3 / 3.2 / 3.2.1)
- Malformed CFF Vulnerability (CVE-2010-1797)
- Incomplete Codesign Exploit
- IOSurface Kernel Exploit (CVE-2010-2973)
limera1n / greenpois0n (3.2.2)
- uses different common exploits
- Packet Filter Kernel Exploit
Programs which are used in order to jailbreak 4.x
JailbreakMe 2.0 / Star (4.0 / 4.0.1)
- Malformed CFF Vulnerability (CVE-2010-1797)
- Incomplete Codesign Exploit
- IOSurface Kernel Exploit (CVE-2010-2973)
limera1n / (4.0 / 4.0.1 / 4.0.2 / 4.1)
- uses different common exploits
- Packet Filter Kernel Exploit
greenpois0n (4.1)
- uses different common exploits
- Packet Filter Kernel Exploit
greenpois0n (4.2.1)
- uses different common exploits
- HFS Legacy Volume Name Stack Buffer Overflow
JailbreakMe 3.0 / Saffron (4.2.6 / 4.2.7 / 4.2.8)
JailbreakMe 3.0 / Saffron (4.3 / 4.3.1 / 4.3.2 / 4.3.3)
Except for the iPod touch 3G on iOS 4.3.1.
- T1 Font Integer Overflow (CVE-2011-0226)
- IOMobileFrameBuffer Privilege Escalation Exploit (CVE-2011-0227)
i0nic's Untether (4.3.1 / 4.3.2 / 4.3.3)
Programs which are used in order to jailbreak 5.x
unthredera1n (5.0 / 5.0.1 / 5.1 / 5.1.1)
Except for the iPad 3
- MobileBackup2 Copy Exploit
- a new Packet Filter Kernel Exploit (CVE-2012-3728)
- AMFID code signing evasion (CVE-2013-0977)
- launchd.conf untether
- Timezone Vulnerability
Absinthe (5.0 on iPhone 4S only / 5.0.1 on iPad 2 and iPhone 4S)
- Racoon String Format Overflow Exploit (CVE-2012-0646) (used both for payload injection and untether)
- HFS Heap Overflow (CVE-2012-0642)
- CVE-2012-0643
Corona Untether (5.0.1)
- Racoon String Format Overflow Exploit (CVE-2012-0646)
- HFS Heap Overflow (CVE-2012-0642)
- CVE-2012-0643
Absinthe 2.0 and Rocky Racoon Untether (5.1.1)
This section is a stub; it is incomplete. Please add more content to this section and remove this tag.
- a new Packet Filter Kernel Exploit (CVE-2012-3728)
- Racoon DNS4/WINS4 table buffer overflow (CVE-2012-3727)
- MobileBackup2 Copy Exploit
Programs which are used in order to jailbreak 6.x
evasi0n (6.0 / 6.0.1 / 6.0.2 / 6.1 / 6.1.1 / 6.1.2)
- Symbolic Link Vulnerability (CVE-2013-0979)
- Timezone Vulnerability
- Shebang Trick (CVE-2013-5154)
- AMFID code signing evasion
- launchd.conf untether
- IOUSBDeviceFamily Vulnerability (CVE-2013-0981)
- ARM Exception Vector Info Leak (CVE-2013-0978)
- dynamic memmove() locating
- vm_map_copy_t corruption for arbitrary memory disclosure
- kernel memory write via ROP gadget
- Overlapping Segment Attack (CVE-2013-0977)
p0sixspwn (6.1.3 / 6.1.4 / 6.1.5 / 6.1.6)
- posix_spawn kernel information leak (CVE-2013-3954) (by i0n1c)
- posix_spawn kernel exploit (CVE-2013-3954) (by i0n1c)
- mach_msg_ool_descriptor_ts for heap shaping (CVE-2013-3953)
- AMFID_code_signing_evasi0n7
- DeveloperDiskImage race condition (by comex)
- launchd.conf untether
Programs which are used in order to jailbreak 7.x
This section is a stub; it is incomplete. Please add more content to this section and remove this tag.
evasi0n7 (7.0 / 7.0.1 / 7.0.2 / 7.0.3 / 7.0.4 / 7.0.5 / 7.0.6)
Geeksn0w (7.1 / 7.1.1 / 7.1.2)
- limera1n's bootrom exploit (Tethered jailbreak) on iPhone 4
Pangu (7.1 / 7.1.1 / 7.1.2)
- i0n1c's Infoleak vulnerability (Pangu v1.0.0)
- break_early_random (by i0n1c and Tarjei Mandt of Azimuth) (Pangu v1.1.0)
- LightSensor / ProxALSSensor kernel exploit (Pangu 1.0.0) (CVE-2014-4388)
- TempSensor kernel exploit (Pangu 1.1.0) (CVE-2014-4388)
- "syslogd chown" vulnerability
- enterprise certificate (no real exploit, used for initial "unsigned" code execution)
- "foo_extracted" symlink vulnerability (used to write to /var) (CVE-2014-4386)
- /tmp/bigfile (a big file for improvement of the reliability of a race condition)
- VoIP backgrounding trick (used to auto restart the app)
- hidden segment attack
- CVE-2014-4407
Programs which are used in order to jailbreak 8.x
This section is a stub; it is incomplete. Please add more content to this section and remove this tag.
Pangu8 (8.0 / 8.0.1 / 8.0.2 / 8.1)
- an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
- enterprise certificate (inside the IPA)
- a kind of dylib injection into a system process (see IPA)
- a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
- a sandboxing problem in debugserver (CVE-2014-4457)
- the same/a similar kernel exploit as used in the first Pangu (CVE-2014-4461) (source @iH8sn0w)
- enable-dylibs-to-override-cache
- CVE-2014-4455
TaiG (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2)
- LightSensor / ProxALSSensor kernel exploit (Also used in Pangu 1.0.0)
- DeveloperDiskImage race condition (by comex) (source: https://twitter.com/iH8sn0w/status/538602532088860672; also used in p0sixspwn)
- enable-dylibs-to-override-cache (Also used in Pangu8)
- a kind of dylib injection into a system process (see IPA) (Also used in Pangu8 but tweaked slightly)
