|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Talk:IDA Pro Setup"
(Sign your talk page entries, folks! (Also removed the "update please" headers and duplicate entries.)) |
|||
| (22 intermediate revisions by 9 users not shown) | |||
| Line 1: | Line 1: | ||
| + | ==More instructions== |
||
| − | prereqs.: IDA Pro Advanced, baseband files |
||
| + | It could be great if someone writes more instructions for the other basebands and models.. I tried with the instruction for 3G baseband in 3gs 5.12.01 baseband and I got an error in IDA Pro... |
||
| + | --[[User:L0g0|L0g0]] 18:54, 29 July 2010 (UTC) |
||
| + | Thank you all for contributing. -caique2001- |
||
| − | wanted: Howto load these files correctly into IDA |
||
| + | ==Please update!== |
||
| − | '''Anybody to give this information here?''' TIA -caique2001- |
||
| + | Hi! I'm a n00b trying to learn a way to discover vulnerabilities in baseband 05.12.01 ... but this article needs an update... please, someone update it , also it could help me to help you xD |
||
| + | Also, there is no tutorial on how to find a way to jailbreak, and there arent well documented all the actually available jailbreaks... |
||
| + | --[[User:L0g0|L0g0]] 06:21, 28 June 2010 (UTC) |
||
| − | == into ida == |
||
| − | I suggest you look more into IDA Pro, see how things work. you may not be ready for a baseband yet. |
||
| + | http://www.theiphonewiki.com/wiki/index.php?title=Greenpois0n |
||
| − | the most important thing you need is the address. for example, i knew the iBoot was at 0x18000000 because at the beginning there is a routine to look if it is there and relocate it if not. also it has many references to 0x1800000 throughout the file. |
||
| + | use the greenpois0n utilities. [[User:Leobruh|Leobruh]] 07:34, 28 June 2010 (UTC)! |
||
| − | Here are some key combinations to use: |
||
| − | c = turn the 'gibberish' into code |
||
| − | d = turn the 'gibberish' into data |
||
| − | a = turn the 'gibberish' into a string |
||
| − | u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing |
||
| − | Alt+G = change the 0 to a 1 to switch to thumb mode when needed |
||
| + | This page is correct and doesnt need an update. You need to read up on exploits if you want to make jailbreaks. Lately buffer based overflows have been used the most. Google it, Wikipedia it and understand what exploits are. Use IDA next. As for a tutorial, let me write one for you: 1. Find a function which can be exploited to run usercode, 2. Insert code to edit/overwrite fstab to |
||
| − | really i feel that you should do some more research on ARM and IDA Pro because a wiki article would not be enough to fully explain it |
||
| + | mount (all) disks as read/write, instead of read-only. Optional 3. Transfer cydia.app. Done. |
||
| + | - toomuchjames |
||
| − | == re: into ida == |
||
| − | I roughly know how ida works and what the keys are. I think there are some people that have already setup the right values for reversing the baseband. So what I want to see here is just a quick intro to set up the project (segments, fileoffsets, changed options, entry points and so on), not how to use ida. This should almost fit into your article above, just counting words ;-) |
||
| + | Hi, could anyone explain, how to dump the bootrom (iPod Touch 2G MC). Thank you {{unsigned|Kubatek94|11:42, June 28, 2010}} |
||
| − | Yea, but if you don't understand how to get those numbers, you'll be pretty useless as a reverser. Not to discourage, but the numbers really aren't that hard to get. Look at the memory map I posted. All the information you need is here. ~geohot |
||
| + | |||
| + | == help == |
||
| + | |||
| + | where do I get the baseband fls file??? {{unsigned|L0g0|09:09, July 26, 2010}} |
||
| + | |||
| + | Decrypt the root filesystem dmg, and look in /usr/local/standalone/firmware or similar. ~toomuchjames |
||
Latest revision as of 15:26, 13 August 2010
More instructions
It could be great if someone writes more instructions for the other basebands and models.. I tried with the instruction for 3G baseband in 3gs 5.12.01 baseband and I got an error in IDA Pro... --L0g0 18:54, 29 July 2010 (UTC)
Thank you all for contributing. -caique2001-
Please update!
Hi! I'm a n00b trying to learn a way to discover vulnerabilities in baseband 05.12.01 ... but this article needs an update... please, someone update it , also it could help me to help you xD Also, there is no tutorial on how to find a way to jailbreak, and there arent well documented all the actually available jailbreaks...
--L0g0 06:21, 28 June 2010 (UTC)
http://www.theiphonewiki.com/wiki/index.php?title=Greenpois0n
use the greenpois0n utilities. Leobruh 07:34, 28 June 2010 (UTC)!
This page is correct and doesnt need an update. You need to read up on exploits if you want to make jailbreaks. Lately buffer based overflows have been used the most. Google it, Wikipedia it and understand what exploits are. Use IDA next. As for a tutorial, let me write one for you: 1. Find a function which can be exploited to run usercode, 2. Insert code to edit/overwrite fstab to mount (all) disks as read/write, instead of read-only. Optional 3. Transfer cydia.app. Done.
- toomuchjames
Hi, could anyone explain, how to dump the bootrom (iPod Touch 2G MC). Thank you --The preceding unsigned comment was added by Kubatek94 (talk) 11:42, June 28, 2010. Please consult this page for more info on how to sign pages, and how to fix this.
help
where do I get the baseband fls file??? --The preceding unsigned comment was added by L0g0 (talk) 09:09, July 26, 2010. Please consult this page for more info on how to sign pages, and how to fix this.
Decrypt the root filesystem dmg, and look in /usr/local/standalone/firmware or similar. ~toomuchjames
