Obtaining IMG3 Keys

This is one way of getting the IMG3 keys using iBoot/iBEC patch based on the Dev Team's and Geohot's exploits.

This method is tested on both Linux and Windows OS.

Epic thanks to #xpwn crew on irc.osx86.hu !

What you need: 1. Pwned 1st gen iPhone on 1.1.4 OS 2. ibooter from here [1] 3. iBEC.m68ap.RELEASE.dfu from iPhone1,1_1.1.4_4A102_Restore.ipsw 4. xpwntool from [2] 5. iPhuc (for Windows users only) 6. Any Hex Editor

Summary:Patched a function in the iBEC file so that it will branch to the desired memory location when the associated iboot command is called in ibooter. The desired memory location is at 0x09000000 as indicated by an earlier Geohot post and the iboot command chosen is "clearenv" in this documentation. The desired memory location will be housing the codes that enable and call the hardware aes engine so that the KBAG data can be decrypted for Keys/IV.

1. Unpack iBEC.m68ap.RELEASE.dfu

Utilizing xpwntool, enter this command: xpwntool <original iBEC file> <unpacked iBEC file> i.e. xpwntool iBEC.m68ap.RELEASE.dfu unpacked_iBEC

2. Patching iBEC.m68ap.RELEASE.dfu

Before: ROM:180074A0 PUSH {R4,R5,R7,LR} ;"clearenv" routine starts here ROM:180074A2 ADD R7, SP, #8 ROM:180074A4 ADDS R4, R1, #0 ROM:180074A6 CMP R0, #1 ROM:180074A8 BGT loc_180074B4 ROM:180074AA LDR R0, =aNotEnoughArgum

After: ROM:180074A0 LDR R3, =0x9000000 ROM:180074A2 BX R3 ROM:180074A2 ; --------------------------------------------------------------------------- ROM:180074A4 dword_180074A4 DCD 0x9000000  ; DATA XREF: ROM:180074A0�r ROM:180074A8 ; --------------------------------------------------------------------------- ROM:180074A8 BGT loc_180074B4 ROM:180074AA LDR R0, =aNotEnoughArgum

You will notice that iBEC starts at 0x18000000 but in your Hex Editor, just do the following changes at 0x74A0: 0x000074A0: 00 4b 18 47 00 00 00 09

The idea is to tell clearenv routine to branch to 0x09000000 and BX is used because the codes to be used at 0x09000000 later will be in ARM. This "clearenv" routine is in THUMB mode. BX will enable them to switch. Save and name your modified iBEC, for example iBECmod.

3. Packing the modified iBEC Using xpwntool: xpwntool iBECmod iBEC.patch -t iBEC.m68ap.RELEASE.dfu

Note that the original iBEC file has to be used after -t as a template. IBEC.patch will be your modified, packed iBEC file.

4. Executing patched iBEC in ibooter

• • • • • • • • To Be Continued *********