Wednesday, June 23, 2010

OLD BOOTROM + Spirit => 4.0 JB

Updated for FW 4.0/4.0.1 + 'Star' jailbreak. You'll need NOR files from a custom 4.0 ipsw made with PwnageTool 4.0.1.
You still obviously need to have an old bootrom 3GS, however you don't currently need any SHSH while Apple still signs 4.0.1
The fact that Star jailbreak uses Safari, however, means it will be patched in weeks, so back up those hashes while you can..
Now that 4.0 is jailbroken, potential uses of this method include installing 4.1 betas, rolling back to 3.x and similar fun activities.

STOP if you have a new bootrom (week 40+, tethered only 3.1.2 JB etc). Here's how to check bootrom ver
- your hardware is iPhone 3GS with OLD BOOTROM
- you HAVE 3.1.3 SHSH (**)
- you DON'T have 3.1.2 SHSH (otherwise, just use blackra1n/redsn0w).
- you WANT iOS4/JB

Update: thanks to movie for those awesome step by step instructions!
Update2: someone made a Cydia package. Looking at type of questions people ask in the comments, that might be the only option for 80% of them. Apple's license terms, of course, don't allow to redistribute their binaries, so I just link to it. Their description also says it works with 3.1.2/Spirit - I very much doubt that.

This tool can be used to flash pwned nor files (containing LLB  exploit) on the phone  running Spirit JB  (script has hardcoded offsets for 3.1.3 3GS).

Thursday, May 27, 2010

Educational..

http://www.youtube.com/v/B6J2OQvaHjw&hl=en_US&fs=1&hd=1

On bluetooth in 4.0

  • Bluetooth in 4.0 has a couple of new profiles: HID (meh) and.. Braille. Wait, what's exciting about Braille? Two things:
    • It is one of the three services that call OpenSerialPort()
    • It is the only one of them that isn't handled by OS isn't generally handled by the OS, unless you enable some obscure accessibility feature, unlike WiAP and Nike sensor profiles, meaning there are no side effects to connecting the service to arbitrary BT devices with serial profile.


Sunday, May 16, 2010

Tuesday, March 23, 2010

Fixing Blacksn0w on 3.1.3




Update: Ultrasn0w now supports 05.11 thru 05.13 with a new exploit that should fix all possible WiFi issues and any OS 4.0 problems. http://ultrasn0w.com/


Sunday, October 4, 2009

Asking for it..

Pseudo-code:
VerifyLicense()
{
    char
         readbuf[16],
         plaintext[16],
         uuid[32]; 
    int hLic = open(LICENSE_FILE);
    get_uuid(uuid);
    read(hLic, readbuf, 16);
    raw_decrypt(readbuf, plaintext);
    memcmp(plaintext, uuid, 16);
}
Where raw_decrypt is an AES symmetric cypher function -)
Even more amazingly, raw_encrypt function is ALSO present in the code!

Sunday, November 2, 2008

Windows 7 registry keys

Enable the new taskbar*: 1. run this command: strings explorer.exe | findstr /C:"ShellFolder" 2. under the path HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ CurrentVersion\Explorer, create subkeys: CLSID\{SOME_GUID}\ShellFolder (for every guid returned by findstr e.g.: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Explorer\CLSID\{A5181F28-5A04-4DBE-A8F6-EEBD7FE228F2}\ShellFolder 3. Under each subkey path, in ShellFolder key, create new value: Attributes REG_DWORD 0xA0100004 *) Seems to work in 6801+. The new taskbar should be enabled by default in newer builds. Disable 'Send Feedback' link: HKEY_CURRENT_USER\Control Panel\Desktop FeedbackToolEnabled REG_DWORD 0