|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "IPSF"
ChronicDev (talk | contribs) |
ChronicDev (talk | contribs) |
||
| Line 1: | Line 1: | ||
| − | IPSF, or iPhone SIM Free, created by a few key [[Devteam]] members, was the first software [[unlock]] available for the iPhone. It relied on two exploits, which weren't understood until much later. Both of these were only in [[Bootloader 3.9]] |
+ | IPSF, or iPhone SIM Free, created by a few key [[Devteam]] members (according to a few people that were around at the time, but not confirmed by the devteam), was the first software [[unlock]] available for the iPhone. It relied on two exploits, which weren't understood until much later. Both of these were only in [[Bootloader 3.9]] |
==RSA cube root== |
==RSA cube root== |
||
Revision as of 00:16, 31 July 2008
IPSF, or iPhone SIM Free, created by a few key Devteam members (according to a few people that were around at the time, but not confirmed by the devteam), was the first software unlock available for the iPhone. It relied on two exploits, which weren't understood until much later. Both of these were only in Bootloader 3.9
RSA cube root
The first exploit discovered was an exploit in the parsing of decrypted RSA. The padding length just needed to be greater than 0xA. Since the decryption was done using exponent 3, you could create a plaintext message and take the cube root of it. The first 0x28 bytes would decrypt properly, enough to generate a valid token for 3.9.
SHA1 zero
If the last 4 bytes in the SHA1 hash of the uploaded data were zero, the endpack would validate and the first 0x400 bytes would be written. This is a brilliant exploit since it isn't findable by reversing the IPSF software.
