|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "S5L8900"
(not really hacking more like editing a wiki page. bunch of losers.) |
(Reverted to the last revision I made.) |
||
| Line 1: | Line 1: | ||
| + | This is the Application Processor shared between the [[M68ap|iPhone]], [[N45ap|iPod touch]], and the [[N82ap|iPhone 3G]]. Not much is known about it through official sources. This processor is not used in any of the newest devices, being replaced by the [[S5L8720]] and [[S5L8920]]. |
||
| + | |||
| + | ==[[S5L File Formats|Firmware File Formats]]== |
||
== Exploits == |
== Exploits == |
||
=== [[iBoot]] === |
=== [[iBoot]] === |
||
| − | '''Note''': [[iBoot]] on the S5L8720 can be downgraded, allowing any of these exploits to be used on future firmwares |
||
* [[Restore Mode]] - Works up to [[iOS]] 1.0.2 |
* [[Restore Mode]] - Works up to [[iOS]] 1.0.2 |
||
* [[Ramdisk Hack]] - Works up to [[iOS]] 2.0 beta 3 |
* [[Ramdisk Hack]] - Works up to [[iOS]] 2.0 beta 3 |
||
| Line 10: | Line 12: | ||
* [[usb_control_msg(0x21, 2) Exploit]] - Works up to [[iOS]] 3.1.2 |
* [[usb_control_msg(0x21, 2) Exploit]] - Works up to [[iOS]] 3.1.2 |
||
| + | ===[[VROM (S5L8900)|Bootrom]]=== |
||
| + | * [[pwnage|Pwnage 1.0 (Ramdisk + AppleImage2NORAccess)]] |
||
| + | * [[Pwnage 2.0|Pwnage 2.0 (DFU + Malformed Certificate)]] |
||
=== [[Kernel]] === |
=== [[Kernel]] === |
||
| Line 23: | Line 28: | ||
* [[PDF CFF Font Stack Overflow]] - Works up to [[iOS]] 4.0.1 |
* [[PDF CFF Font Stack Overflow]] - Works up to [[iOS]] 4.0.1 |
||
| − | + | ==Boot Chain== |
|
| − | [[VROM]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[ |
+ | [[VROM (S5L8900)]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]] |
| + | |||
| + | One of the [[iPhoneLinux]] goals are to replace that Boot Chain after iBoot: |
||
| + | |||
| + | [[VROM (S5L8900)]]->OpeniBoot->Linux Kernel->X Server->Window Manager |
||
| + | |||
| + | ==Upgrade Process== |
||
| + | |||
| + | === [[Restore Mode]] === |
||
| + | The common upgrade process chain is [[VROM]]->[[DFU Mode]]->[[WTF]]->[[iBoot]]->[[Kernel]]->[[Ramdisk]]->[[Restore Mode]]. |
||
| + | |||
| + | === [[DFU Mode]] === |
||
| + | To flash an older version of the iPhone software you have to let your phone reside in [[DFU Mode]]. In iTunes you have to press the option key (Mac) or the shift key (Windows) when pressing 'Restore' to be able to manually chose an [[IPSW File Format|IPSW]]. |
||
==== Boot Chain ==== |
==== Boot Chain ==== |
||
| − | [[VROM]]->[[DFU]] |
+ | [[VROM]]->[[DFU Mode]] |
| + | |||
| + | ==External Links== |
||
| + | * [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf Technical Reference Manual: ARM1176JZF-S] |
||
Revision as of 03:04, 23 September 2010
This is the Application Processor shared between the iPhone, iPod touch, and the iPhone 3G. Not much is known about it through official sources. This processor is not used in any of the newest devices, being replaced by the S5L8720 and S5L8920.
Contents
Firmware File Formats
Exploits
iBoot
- Restore Mode - Works up to iOS 1.0.2
- Ramdisk Hack - Works up to iOS 2.0 beta 3
- diags - Works up to iOS 2.0 beta 5
- ARM7 Go - Works on iOS 2.1.1
- iBoot Environment Variable Overflow - Works up to iOS 3.1 beta 3
- usb_control_msg(0x21, 2) Exploit - Works up to iOS 3.1.2
Bootrom
Kernel
- BPF STX Kernel Write Exploit - Works up to iOS 3.1.3
- IOSurface Kernel Exploit - Works up to iOS 4.0.1
Userland
- Symlinks - Works up to iOS 1.1.1
- LibTiff - Works up to iOS 1.1.1
- Mknod - Works up to iOS 1.1.2
- Dual Boot Exploit - Works up to iOS 2.0 beta 3
- MobileBackup Copy Exploit - Works up to iOS 3.1.3
- PDF CFF Font Stack Overflow - Works up to iOS 4.0.1
Boot Chain
VROM (S5L8900)->LLB->iBoot->Kernel->System Software
One of the iPhoneLinux goals are to replace that Boot Chain after iBoot:
VROM (S5L8900)->OpeniBoot->Linux Kernel->X Server->Window Manager
Upgrade Process
Restore Mode
The common upgrade process chain is VROM->DFU Mode->WTF->iBoot->Kernel->Ramdisk->Restore Mode.
DFU Mode
To flash an older version of the iPhone software you have to let your phone reside in DFU Mode. In iTunes you have to press the option key (Mac) or the shift key (Windows) when pressing 'Restore' to be able to manually chose an IPSW.
