Pingzi

Still need to fix memalign handler to get where cannot put shellcode.

iloader for iBoot1537 is convenient while finding offsets. But for some reason it can’t test the shellcode. So we have to move to the real boot-chain to see whether shellcode is working or not. Also for iOS 6, kdumper isn’t available.

I failed to run iBoot 1537 for iPad2 in iloader, maybe because of an allocation problem. (However running iBoot1537 for iPad mini seems fine) Trying to use synackuk’s method instead.

@SteelMaskCH USI sucks. I also got some 4s, with Wi-Fi unavailable. All USI.

iPhone 4sのWi-FiグレーアウトはUSI製のチップ(339S0154)が搭載されてる個体で起こるっぽい 今まで買ってきた40台近くの4sのうちグレーアウト起こしてたのは4台くらいあるけど全部USI製だった チップ内部の問題ならメーカー違いで起きないのも納得

@MasterMike88 I haven’t tested the overly-late versions. It’s just because their exploit ramdisk is corrupt(

@Pingzi610 It's probably related to incompatibility with some overly-late revision of the 4S. Do those devices that don't work also not work when trying to normally downgrade to 6.1.3?

Why some iPhone 4s failed to boot using my payload? I just used the same method as dora2ios did. Weird. I have 10 iPhone 4s, and I tested 4 of them(since others are not iOS 9.3.5/6), all works fine. Seems that devices manufactured in 2013 is failing.

@SashaKirichenko @synackuk Absolutely. This payload just works like the devices downgraded using iOS 7 blob. It’s compatible with powdersn0w.

@Pingzi610 @synackuk Can we go for 5.1.1 using this method?

Successfully exploited De Rebus Antiquis on iOS 6 and used 6.1.3 OTA blob to upgrade my iPhone 4s to 7.1.2！ Thanks for @synackuk , but currently I will not release it.

@synackuk You can see this method working on iPhone 4s according to my video.

@synackuk Actually I have an older method that copies the full iBoot image to 0x44000000(For A4 device) or 0x84000000, and patch the image, run nettoyeur … Finally let iBoot re-run. I used this payload to adapt the payload to powdersn0w(which use “ibob” as the tag).

Given Apple's removing of signing status for the iPhone 4S (hopefully not the iPod touch 4G..), I've published the De Rebus Antiquis ram disks I created for iOS 6. github.com/synackuk/De-Re… I was planning to also port this work to the iPad 2.. But I'm not sure there's much point.

@synackuk However, this failed on iPod touch 4. It won’t re-run. My nettoyeur take 0x44000000 as target.

iPod touch 4的payload好难 我想先睡会

@XiaoWZ_Tech @synackuk 那是必须的😋

@Pingzi610 @synackuk Good job

@synackuk I maybe update iPod4,1 payload later, the writeup is far harder since my English is bad（

@Pingzi610 Ah nice you updated the payload. Glad to see the utilities working for you :)

@synackuk @nyan_satan I tried to make the “ibob” payload but somehow it’s not working currently. I have no idea whether anywhere is incorrect.

The payload requires you to add a second iBoot into your NOR (tagged ibox). The technique to achieve this was described by @nyan_satan at the end of his dual booting guide: nyansatan.github.io/dualboot/alter…

About preserving baseband, this is a 100% fine workaround. gist.github.com/Pingzi610/650d… This is a must-done work.

tsschecker can fetch iOS 6.1.3、8.4.1 OTA blobs, but baseband for 4s、5、5c、iPad 2,3、iPad 3 and iPad mini is not signed and cannot be restored correctly. Remember to preserve the baseband files before restoring.

github.com/Pingzi610/iloa… I added iPad mini 7.1.x exploit. Working well.

通过二进制编辑器修改Windows端redsn0w也可以做到相同的功能，比如我可以将05.13.04改为04.26.08，然后同步将FirmwareURL、Ramdisk与Baseband的相关内容修改后保存，即可实现降级3G/3GS基带到04.26.08，这个基带版本是3GS的最低版本，如果想刷iOS版本对应原基带，用idevicerestore刷官方固件即可。

关于iPhone 3G/3GS降级基带的知识 目前只有redsn0w能做到降级3G/3GS的基带，但是redsn0w本身只能降到05.13.04；此时我们找到macOS端redsn0w.app显示包内容，转到/Contents/MacOS，有个Keys.plist，将有关05.13.04的基带相内容替换为你想要降级的基带版本，就可以了。