|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Talk:TinyUmbrella"
(→5.00.5: new section) |
m (→Restore / downgrade iPad 2 GSM without baseband) |
||
| (20 intermediate revisions by 8 users not shown) | |||
| Line 1: | Line 1: | ||
| + | == Restore / downgrade iPad 2 GSM without baseband == |
||
| − | Didn't he used to support Linux? --[[User:JacobVengeance|JakeAnthraX]] 19:59, 7 May 2011 (UTC) |
||
| + | Does anybody know details on how semaphore does a TSS downgrade of an [[K94AP|iPad 2 (GSM)]] firmware, without modifying the baseband and without running into a recovery loop? (see [http://cl.ly/2i151c3x1C3z3W2i0l0q this screenshot]) The latest TinyUmbrella release supports such downgrades and there is no bootrom exploit that would allow a kick out of recovery. I thought such a downgrade is possible by getting the [[SHSH]] from the local backup and the baseband SHSH from Apple (because of the nonce problem). As long as Apple signs the same baseband, even a baseband downgrade from an iOS5 beta baseband would be possible. Or, in the more common case, a complete restore from iOS 4.3.4 to 4.3.3 (including baseband). But TinyUmbrella doesn't even try to change the baseband, so his method must be totally different. He also twitted me "it is WAY more complicated". Anybody knows more? --[[User:Http|http]] 06:13, 20 July 2011 (MDT) |
||
| − | == |
+ | == Source == |
| + | Where is the source of TinyUmbrella? --[[User:XiiiX|XiiiX]] 16:46, 14 August 2011 (MDT) |
||
| + | :Take the Mac (.PKG) file look at the contents. I am on Windows, so I extracted it to a SUB-dir and navigated to a file called <tt>Payload</tt> and extracted that to get <tt>Payload~</tt>. Extracted that to get the app and then the .class files are just Java files that can be decompiled with any free Java decompiler. PS, I used 7-Zip for extraction... --[[User:5urd|5urd]] 20:10, 14 August 2011 (MDT) |
||
| + | == Recovery == |
||
| − | If anyone can edit, these are the file sizes for 5.00.5: |
||
| + | Does anybody know how TU puts the device into recovery mode? And how to go from recovery to DFU? --[[User:Dylan Laws|Dylan Laws]] 01:18, 22 January 2012 (MST) |
||
| − | |||
| + | ::The iTunes MobileDevice Library has a function to put the device into Recovery Mode. --[[User:Rud0lf77|rud0lf77]] 08:36, 22 January 2012 (MST) |
||
| − | Windows: 1,951,232 bytes (1.86 MB)<br />Mac: 1,735,841 bytes (1.65 MB) |
||
| + | ::: Do you know the command? --[[User:Dylan Laws|Dylan Laws]] 12:32, 22 January 2012 (MST) |
||
| − | |||
| + | ::::Learn Java, decompile the Java scripts, examine. done :) --[[User:5urd|5urd]] 13:47, 22 January 2012 (MST) |
||
| − | --[[User:Balloonhead66|Balloonhead66]] 21:52, 15 July 2011 (UTC) |
||
| + | :::: In the Headers of [[MobileDevice Library]] you can find: AMDeviceEnterRecovery , have fun with it. --[[User:Rud0lf77|rud0lf77]] 14:12, 22 January 2012 (MST) |
||
| + | ::::: So, no execution with the DLL through CMD? --[[User:Dylan Laws|Dylan Laws]] 14:41, 22 January 2012 (MST) |
||
| + | :::::: You can't execute DLLs, you have to get the MobileDevice Header, include it in your Application and then link against the dll. --[[User:Rud0lf77|rud0lf77]] 15:55, 22 January 2012 (MST) |
||
Latest revision as of 09:46, 29 March 2017
Restore / downgrade iPad 2 GSM without baseband
Does anybody know details on how semaphore does a TSS downgrade of an iPad 2 (GSM) firmware, without modifying the baseband and without running into a recovery loop? (see this screenshot) The latest TinyUmbrella release supports such downgrades and there is no bootrom exploit that would allow a kick out of recovery. I thought such a downgrade is possible by getting the SHSH from the local backup and the baseband SHSH from Apple (because of the nonce problem). As long as Apple signs the same baseband, even a baseband downgrade from an iOS5 beta baseband would be possible. Or, in the more common case, a complete restore from iOS 4.3.4 to 4.3.3 (including baseband). But TinyUmbrella doesn't even try to change the baseband, so his method must be totally different. He also twitted me "it is WAY more complicated". Anybody knows more? --http 06:13, 20 July 2011 (MDT)
Source
Where is the source of TinyUmbrella? --XiiiX 16:46, 14 August 2011 (MDT)
- Take the Mac (.PKG) file look at the contents. I am on Windows, so I extracted it to a SUB-dir and navigated to a file called Payload and extracted that to get Payload~. Extracted that to get the app and then the .class files are just Java files that can be decompiled with any free Java decompiler. PS, I used 7-Zip for extraction... --5urd 20:10, 14 August 2011 (MDT)
Recovery
Does anybody know how TU puts the device into recovery mode? And how to go from recovery to DFU? --Dylan Laws 01:18, 22 January 2012 (MST)
- The iTunes MobileDevice Library has a function to put the device into Recovery Mode. --rud0lf77 08:36, 22 January 2012 (MST)
- Do you know the command? --Dylan Laws 12:32, 22 January 2012 (MST)
- Learn Java, decompile the Java scripts, examine. done :) --5urd 13:47, 22 January 2012 (MST)
- In the Headers of MobileDevice Library you can find: AMDeviceEnterRecovery , have fun with it. --rud0lf77 14:12, 22 January 2012 (MST)
- So, no execution with the DLL through CMD? --Dylan Laws 14:41, 22 January 2012 (MST)
- You can't execute DLLs, you have to get the MobileDevice Header, include it in your Application and then link against the dll. --rud0lf77 15:55, 22 January 2012 (MST)
- So, no execution with the DLL through CMD? --Dylan Laws 14:41, 22 January 2012 (MST)
- Do you know the command? --Dylan Laws 12:32, 22 January 2012 (MST)
- The iTunes MobileDevice Library has a function to put the device into Recovery Mode. --rud0lf77 08:36, 22 January 2012 (MST)
