|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Talk:IDA Pro Setup"
MuscleNerd (talk | contribs) (out of context) |
(Sign your talk page entries, folks! (Also removed the "update please" headers and duplicate entries.)) |
||
| (10 intermediate revisions by 5 users not shown) | |||
| Line 1: | Line 1: | ||
| + | ==More instructions== |
||
| − | prereqs.: IDA Pro Advanced, baseband files |
||
| + | It could be great if someone writes more instructions for the other basebands and models.. I tried with the instruction for 3G baseband in 3gs 5.12.01 baseband and I got an error in IDA Pro... |
||
| + | --[[User:L0g0|L0g0]] 18:54, 29 July 2010 (UTC) |
||
| + | Thank you all for contributing. -caique2001- |
||
| − | wanted: Howto load these files correctly into IDA |
||
| + | ==Please update!== |
||
| − | '''Anybody to give this information here?''' TIA -caique2001- |
||
| + | Hi! I'm a n00b trying to learn a way to discover vulnerabilities in baseband 05.12.01 ... but this article needs an update... please, someone update it , also it could help me to help you xD |
||
| + | Also, there is no tutorial on how to find a way to jailbreak, and there arent well documented all the actually available jailbreaks... |
||
| + | --[[User:L0g0|L0g0]] 06:21, 28 June 2010 (UTC) |
||
| − | Happy :-) ~geohot |
||
| + | http://www.theiphonewiki.com/wiki/index.php?title=Greenpois0n |
||
| − | == into ida == |
||
| − | I suggest you look more into IDA Pro, see how things work. you may not be ready for a baseband yet. |
||
| + | use the greenpois0n utilities. [[User:Leobruh|Leobruh]] 07:34, 28 June 2010 (UTC)! |
||
| − | the most important thing you need is the address. for example, i knew the iBoot was at 0x18000000 because at the beginning there is a routine to look if it is there and relocate it if not. also it has many references to 0x1800000 throughout the file. |
||
| + | This page is correct and doesnt need an update. You need to read up on exploits if you want to make jailbreaks. Lately buffer based overflows have been used the most. Google it, Wikipedia it and understand what exploits are. Use IDA next. As for a tutorial, let me write one for you: 1. Find a function which can be exploited to run usercode, 2. Insert code to edit/overwrite fstab to |
||
| − | Here are some key combinations to use: |
||
| + | mount (all) disks as read/write, instead of read-only. Optional 3. Transfer cydia.app. Done. |
||
| − | c = turn the 'gibberish' into code |
||
| − | d = turn the 'gibberish' into data |
||
| − | a = turn the 'gibberish' into a string |
||
| − | u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing |
||
| − | Alt+G = change the 0 to a 1 to switch to thumb mode when needed |
||
| + | - toomuchjames |
||
| − | really i feel that you should do some more research on ARM and IDA Pro because a wiki article would not be enough to fully explain it |
||
| + | Hi, could anyone explain, how to dump the bootrom (iPod Touch 2G MC). Thank you {{unsigned|Kubatek94|11:42, June 28, 2010}} |
||
| − | == offsets == |
||
| − | For example, if you look into ICE2_01.45 using a hex editor, you will see starting 0x634 there contains the memory maps. It started at 0x20000000 and ends at 0x21000000 with sections in between doing its own thing. The code/data in the .fls starts at 0xCF8 indicated by location 0xCF4. The length of the code is indicated by the location at 0xCEC which amounts to 0x5E9E18. |
||
| + | == help == |
||
| − | So, you may want to load the data in the .fls file from 0xCF8 to 0X5EAB0F at offset 0x20000000 in IDA pro. |
||
| + | where do I get the baseband fls file??? {{unsigned|L0g0|09:09, July 26, 2010}} |
||
| − | -- CPICH |
||
| + | Decrypt the root filesystem dmg, and look in /usr/local/standalone/firmware or similar. ~toomuchjames |
||
| − | Hey, you speak my language :-) Thanks -caique2001- |
||
Latest revision as of 15:26, 13 August 2010
More instructions
It could be great if someone writes more instructions for the other basebands and models.. I tried with the instruction for 3G baseband in 3gs 5.12.01 baseband and I got an error in IDA Pro... --L0g0 18:54, 29 July 2010 (UTC)
Thank you all for contributing. -caique2001-
Please update!
Hi! I'm a n00b trying to learn a way to discover vulnerabilities in baseband 05.12.01 ... but this article needs an update... please, someone update it , also it could help me to help you xD Also, there is no tutorial on how to find a way to jailbreak, and there arent well documented all the actually available jailbreaks...
--L0g0 06:21, 28 June 2010 (UTC)
http://www.theiphonewiki.com/wiki/index.php?title=Greenpois0n
use the greenpois0n utilities. Leobruh 07:34, 28 June 2010 (UTC)!
This page is correct and doesnt need an update. You need to read up on exploits if you want to make jailbreaks. Lately buffer based overflows have been used the most. Google it, Wikipedia it and understand what exploits are. Use IDA next. As for a tutorial, let me write one for you: 1. Find a function which can be exploited to run usercode, 2. Insert code to edit/overwrite fstab to mount (all) disks as read/write, instead of read-only. Optional 3. Transfer cydia.app. Done.
- toomuchjames
Hi, could anyone explain, how to dump the bootrom (iPod Touch 2G MC). Thank you --The preceding unsigned comment was added by Kubatek94 (talk) 11:42, June 28, 2010. Please consult this page for more info on how to sign pages, and how to fix this.
help
where do I get the baseband fls file??? --The preceding unsigned comment was added by L0g0 (talk) 09:09, July 26, 2010. Please consult this page for more info on how to sign pages, and how to fix this.
Decrypt the root filesystem dmg, and look in /usr/local/standalone/firmware or similar. ~toomuchjames
