|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Baseband Device"
m |
|||
| Line 4: | Line 4: | ||
The [[iPhone 3G]] and the [[iPhone 3GS]] make use of the [[X-Gold 608]] chip for this purpose. |
The [[iPhone 3G]] and the [[iPhone 3GS]] make use of the [[X-Gold 608]] chip for this purpose. |
||
| − | You can check some [[Baseband Commands]] too (by pH and EvilPenguin) |
+ | You can check some [[Baseband Commands]] too (by pH and EvilPenguin). |
==Seczone== |
==Seczone== |
||
| Line 23: | Line 23: | ||
* [[IPSF]] |
* [[IPSF]] |
||
* [[Minus 0x400]] |
* [[Minus 0x400]] |
||
| − | * [[Jerrysim]] |
||
* [[Minus 0x20000 with Back Extend Erase]] |
* [[Minus 0x20000 with Back Extend Erase]] |
||
| − | * [[ |
+ | * [[JerrySIM]] |
| + | * [[AT+stkprof]] |
||
* [[AT+XLOG Vulnerability]] |
* [[AT+XLOG Vulnerability]] |
||
| + | * [[AT+XEMN Heap Overflow]] |
||
==Theoretical Attacks== |
==Theoretical Attacks== |
||
Revision as of 15:59, 4 November 2009
This is the device in the iPhone that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the ARM core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in it's NVRAM.
The iPhone's baseband processor is the S-Gold 2. The iPhone 3G and the iPhone 3GS make use of the X-Gold 608 chip for this purpose.
You can check some Baseband Commands too (by pH and EvilPenguin).
Seczone
This is the area in the baseband where the lock state is stored.
Layout
0x400--NCK token 0xB00--IMEI 0xB10--IMEI signature 0xC00--Locks table
Encryption
Many of the sections are encrypted using TEA based off the CHIPID and NORID. See NCK Brute Force for more info.
Exploits
- SIM hacks
- Hardware Fakeblank
- IPSF
- Minus 0x400
- Minus 0x20000 with Back Extend Erase
- JerrySIM
- AT+stkprof
- AT+XLOG Vulnerability
- AT+XEMN Heap Overflow
