|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "IBoot (Bootloader)"
| Line 12: | Line 12: | ||
* Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at written to 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor. |
* Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at written to 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor. |
||
* In the iPod Touch 2G firmware 2.1.1 iBoot (iBoot version 385.22), the [[ARM7 Go]] command could be used to run a payload on the ARM7 in the iPod Touch 2G. |
* In the iPod Touch 2G firmware 2.1.1 iBoot (iBoot version 385.22), the [[ARM7 Go]] command could be used to run a payload on the ARM7 in the iPod Touch 2G. |
||
| − | * The [[iBoot Environment Variable Overflow]] exists in 3.0 iBoot, and is being used by [[purplera1n]] and [[redsn0w]] (as of version 0.8) in order to flash the oversized LLB which utilizes the [[24kPwn]] exploit to the iPhone 3GS. While this exploit is present on iPod Touch 2nd Gen, it is not used in favour of the [[ARM7 Go]] exploit. |
+ | * The [[iBoot Environment Variable Overflow]] exists in 3.0 iBoot, and is being used by [[purplera1n]] and [[redsn0w]] (as of version 0.8) in order to flash the oversized [[LLB]] which utilizes the [[24kPwn]] exploit to the iPhone 3GS. While this exploit is present on iPod Touch 2nd Gen, it is not used in favour of the [[ARM7 Go]] exploit. |
==OpeniBoot== |
==OpeniBoot== |
||
Revision as of 14:34, 31 August 2009
This is Apple's stage 2 bootloader for all of the iDevices. It runs what is known as Recovery Mode. It has an interactive interface which can be used over USB or serial.
Revisions
- iBoot-204.3.14 (1.1.4)
- iBoot-320.20 (2.0.x)
- iBoot-385.22 (2.1 and 2.1.1)
- iBoot-385.49 (2.2 and 2.2.1)
- iBoot-596.24 (3.0 and 3.0.1)
Commands used as an exploit vector
- Until 2.0 beta 6, the diags command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at written to 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
- In the iPod Touch 2G firmware 2.1.1 iBoot (iBoot version 385.22), the ARM7 Go command could be used to run a payload on the ARM7 in the iPod Touch 2G.
- The iBoot Environment Variable Overflow exists in 3.0 iBoot, and is being used by purplera1n and redsn0w (as of version 0.8) in order to flash the oversized LLB which utilizes the 24kPwn exploit to the iPhone 3GS. While this exploit is present on iPod Touch 2nd Gen, it is not used in favour of the ARM7 Go exploit.
OpeniBoot
There is an open source version of iBoot being made so that Linux on the iPhone will work. You can check out the source here. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
Remappings
// n88 0x4FF00000 => 0x0 0x40000000 => 0xC0000000
