Diags (iBoot command)

The diags command is an iBoot command that loads an image from an address in memory after disabling all the GPIO devices. This is meant for loading diags, so even unsigned images will be loaded. This command had no permission checks in 1.0-1.1.4 iBoots, so it was exploitable to load a patched iBoot, but in 2.0 iBoots, this command has a permission check to make sure it is not being run on a RELEASE fused CHIPID. In 3.1+, this command was removed entirely, but is still present in DEVELOPMENT iBoots. This command can also be set as the boot-command variable. In that case, as well as if you run diags without any args, it looks for the diags image in NOR/NAND, and also checks the diags-path value in NVRAM. If it doesn't find it, the command will fail.

Credit

iPhone Dev Team

Exploit

This is a very easy-to-use exploit on 1.x iBoots. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices. You can run unsigned code on the S5L8900 using this, but the GPIOs need to be restored if you intend to use any I/O again (such as the screen, serial, or USB).

In 2.0 iBoots, they have a flag check on this command (checks bit 4 of the iBoot flags), and that flag will not be present on a RELEASE fused CHIPID, just a whitelisted engineering CHIPID, so this exploit doesn't work on RELEASE fused devices after 2.0. However, the 1.1.4 iBSS can still be used on the iPhone, iPhone 3G, or iPod touch, and can be used to boot a modified 2.0+ iBoot. Therefore, it is still an open exploit for these devices.