|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
PwnageTool
PwnageTool is a iOS jailbreak tool for Mac OS X that jailbreaks by creating a custom IPSW. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it to restore to in iTunes.
Contents
- 1 Exploits Used
- 2 Models Supported
- 3 Versions
- 4 Creating the Firmware
- 5 How to create Custom Firmware Bundles
- 6 Problems
- 7 Windows
- 8 License
Exploits Used
Version 4.0
- Bootrom exploit (used by limera1n and greenpois0n)
Version 2.0
Version 1.0
Models Supported
| Model | Since |
|---|---|
| iPhone 2G | April 3, 2008 |
| iPod touch 1G | April 3, 2008 |
| iPhone 3G | Jul 19, 2008 |
| iPod touch 2G | Oct 2, 2009 |
| iPhone 3GS | Oct 2, 2009 |
Note that the iPod touch 3G and subsequent devices are not supported. With the iPod touch 2G and iPhone 3GS you must be jailbroken prior to using PwnageTool. The S5L8900 devices you can go into DFU Mode and restore with iTunes without being jailbroken.
Versions
PwnageTool was released April 3, 2008 but largely unused until version 2.0 was released July 19, 2008. The following versions that are shown here are not beta, alpha, or in development.
1.x: First release of PwnageTool
| Version | Release date | Features | |
|---|---|---|---|
1.1.4 |
April 3, 2008 |
|
|
2.x: Second major release of Pwnagetool
| Version | Release date | Features |
|---|---|---|
2.0 |
Jul 19, 2008 |
|
2.0.1 |
Aug 4, 2008 |
|
2.0.2 |
Aug 21, 2008 |
|
2.0.3 |
Aug 25, 2008 |
|
2.1 |
Sep 13, 2008 |
|
2.2 |
Nov 21, 2008 |
|
2.2.5 |
Jan 30, 2009 |
|
3.x: Third Major Release of PwnageTool
| Version | Release date | Features | |
|---|---|---|---|
3.0 |
Jun 19, 2009 |
|
|
3.1 |
Sep 15, 2009 |
|
|
3.1.3 |
Oct 2, 2009 |
|
|
3.1.4 |
Oct 13, 2009 |
|
|
3.1.5 |
Feb 7, 2010 |
|
|
4.x: Fourth Major Release of PwnageTool
| Version | Release date | Features | ||
|---|---|---|---|---|
4.0 |
Jun 22, 2010 |
|
||
4.01 |
Jun 23, 2010 |
|
||
4.1 |
Oct 20, 2010 |
|
||
4.1.1 |
Oct 22, 2010 |
|
||
4.1.2 |
Oct 22, 2010 |
|
Creating the Firmware
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, BootNeuter (iPhone software unlock), custom packages and boot logos. This method is usually less secure than the quick exploits such (redsn0w, QuickPwn, purplera1n, blackra1n, etc.).
How to create Custom Firmware Bundles
Following steps are needed:
- Copy an existing bundle as a template
- Decrypt IMG3 KBAGs and put the keys into Info.plist - usually using an AES payload
- Use GenPass with decrypted ramdisk to get the rootfs vfdecrypt key, put the key and rootfs volume name into Info.plist
- Unpack NOR files, ramdisk and kernelcache using AES Keys, apply patches (for minor upgrades, you can apply byte pattern-based patches from previous version, so you don't have to use IDA for every file)
- Patch ASR from the Restore Ramdisk, use codesign or ldid to fix up its code page hashes.
- Use bsdiff to create diffs by diffing unpacked original versus patched files. iPod touch 2G and iPhone 3GS utilize a different bootrom exploit, so the encrypted LLB for these devices need patching, using the xpwntool option "-x24k" (for iPod touch 2G) or "-xn8824k" (for iPhone 3GS) to patch the file.
(from here: question and answer)
Problems
This method does have negative aspects. The most common errors are the 1600 errors, a group of errors saying that the either the firmware file is corrupt or you didn't put it in the right mode (recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common computer error is a 1604 error which means that the firmware file is corrupt.
Windows
PwnageTool is expected to remain exclusive to Mac OS X. As of October 2009, iH8sn0w, et. al. has announced that they made a project that will bring PwnageTool's functionality to Windows, called sn0wbreeze. [3]
License
PwnageTool is freeware.
