Kirkwood 7A341 (iPhone1,2)

From The iPhone Wiki
Revision as of 22:45, 30 December 2010 by 5urd (talk | contribs) (Patches: indenting is better)
Jump to: navigation, search

Decryption Keys

Pseudo-GID

  • 5f650295e1fffc97ce77abd49dd955b3

Root Filesystem

  • VFDecrypt: 8d5d1fea02d627c9e9b0d994c3cfdeaab9780c86ac908db15461efe44eddd19f8924b6b2

Update Ramdisk - 018-5303-002.dmg

  • IV: 0dc67d4f50ac62ee142b99baa569d0f4
  • Key: 5a0f82979f336baa58ed37926bd89dfe

Restore Ramdisk - 018-5305-002.dmg

  • IV: caca33f1aca029320d60873a4deed68d
  • Key: 9962589aabb4d5ec56b7a867ab5b11b0

DeviceTree

  • IV: 5e6bca89f06c8dc4f3868fa4caba9d40
  • Key: 1852158326954e1379ee3aebe1d5c50c

iBoot

  • IV: 674a95015a8d33cd2f1f259ebe01aca7
  • Key: 4a8d6657297ca45cf6bec0854ee0a2e8

  • IV: 30c0cb05ae49d0484392261b2c8b21a8
  • Key: f9841fa3197f0bd9fd162ce170c5f6f9

  • IV: 848d4cef8e4d8182c3f10062cf5347fe
  • Key: 5a56972f4750335c448f3219269ed202

Kernel

  • IV : a4db9183cd79722b4146c9de09ab29c5
  • Key: 02418105dfb3be2af2a76248e026f702

Patches

Putting this here for developers that would like to to utilize "extras" like /dev/kmem access, tfp0, etc.

Kernel

// thumb patches
0x08DE72: 8D 43 => 00 00               // w^x patch #1
0x090B6E: A2 43 => 00 00               // w^x patch #2
0x19B8BC: 0C D1 => 0C E0               // allow tfp0
0x381E22: FA 23 DB 00 => 01 23 5B 42   // allow aes uid key usage
0x381E34: FA 23 9B 00 => 01 23 5B 42   // allow aes gid key usage
0x3DEF8E: 40 42 => 00 20               // img3 signature check

// flag patches
0x213638: 00 00 00 00 => 01 00 00 00   // setup_kmem flag

// arm patches
0x3F908C: 00 40 A0 E3 => 01 40 A0 E3   // codesign check actual code patch
0x3FCB40: FF 40 A0 E3 => 00 40 A0 E3