Automatic SSH ramdisk creation and loading

A runnable JAR archive - works on OS X or Windows; needs 32-bit JRE on Windows.
Supported devices - hopefully everything Syringe supports (devices with A4 chips and lower) plus iPhone 2G, iPhone 3G and iPod Touch 1G.
The tool automatically downloads required files from Apple using @planetbeing's Partial Zip, patches them and sends to the device.
If everything works as it should, the only thing you need is an SSH client.
Credits:

Made possible thanks to Camilo Rodrigues (@Allpluscomputer)

Including xpwn source code by the iPhone Dev Team and @planetbeing
Including syringe source code by Chronic-Dev and @posixninja
syringe exploits by @pod2g, geohot & @posixninja
pwnage2 exploit by iPhone Dev Team
Special thanks to @iH8sn0w
code.google.com/p/iphone-dataprotection - EMF tools and kernel patches

To see more verbose stuff, run from command line: java -jar ssh_rd_rev04b.jar
Source on github.

Lion, Time Machine and AFP feature bits.

Update2: SMB should be supported in _r2 version. Probably not a very good idea unless your network connection is solid. Also remember that you can't restore the whole system from a TM image on an SMB share.. at least not from OS X boot disk.
Update1: Please try updating your NAS firmware first; most manufacturers will be releasing updates that make their devices Lion-compatible in the near future.
These new flags made mandatory in Lion help with AFP session recovery after network connection loss, so you will be at a higher risk of data corruption when using this workaround over spotty WiFi.

'The network backup disk does not support the required AFP features' message means that
Lion's backupd now requires 'TM Lock Stealing' and 'Server Reply Cache' AFP features on all TM destinations.

TMShowUnsupportedNetworkVolumes workaround affects the UI but has no effect on actual daemon behaviour.
So, seeing as how I'm not going to buy a Time Capsule any time soon, an idea was born:
What if we could make backupd work with those unsupported volumes and unleash any potentially data-munching-monster-ish bugs this unsupportedness shall surely entail? Sounds like a plan!

tldr: Download, unzip and run the script.

^^ A dylib that fakes those new shiny AFP feature bits for your old musty half-dead early 20th century NAS-o-saurus.

Disclaimer: Use at your own risk; data-corru¾*{5Ë# may occur!

Boring tech details: just read the source.

Ultrasn0w (with preserved baseband) on 4.3..

NO NEW UNLOCKS HERE! FOR USERS WITH BB VERSIONS CURRENTLY SUPPORTED BY ultrasn0w ONLY! PLEASE RTFM!

4.3 seems to have enabled slidable image address randomization (ASLR). This broke ultrasn0w code naively using 0x1000 as the main executable base address. In addition to that, its FindReference function was using hardcoded offset/xref pairs for slidable images, which means every fw update will break it.
So, I've written a small dylib that works around those issues.
https://github.com/msftguy/ultrasn0w-fixer

Only tested on 3GS; will require changes for next betas.

Booting SSH ramdisk on new devices

This information is deprecated; please use the new automatic tool here.

Booting 4.2 bundle - instructions

Instructions

• Download the appropriate tetheredboot binary for Windows or OS X from https://github.com/msftguy/syringe/downloads
• Update: OS X version does NOT need libUSB from MacPorts any more.
• Put the device in DFU mode
• Use the command line tetheredboot -i iBSS.CPUap.RELEASE.dfu -k kernelcache.release.CPU to boot, where CPU is k48 for iPad, n90 for iPhone4
• These files (iBSS and kernelcache) need to be extracted from custom ipsw you made using the bundle!

Bundles 

• Look here for bundles: https://sites.google.com/site/msftguy/file/

Data recovery: not just for iBoot-pwned devices

Deprecated: Now you can use greenpois0n to load an SSH ramdisk on any new device.

Update: wrote a tool to generate upgrade IPSWs automatically
iPad data recovery!

If your user data partition is not corrupted, it's possible to get your data back (say, after some Cydia app made your oversized iTouch hang on boot!)

Should also work for iOS 4.0 new bootrom 3GS iPhones and 3G iTouches.


Will it work if you were jailbroken with:
PwnageTool: Not recommended/might work

SnowBreeze: Not recommended/might work

Spirit: YES

redsn0w: YES

blackra1n: YES

Not jailbroken: YES


Other necessary conditions:

Mountable user data volume - not always the case!

Other warnings:
You'll obviously lose your jailbroken state and will have to re-Spirit if using iPad or just back up and restore if using a PwnageTool/SnowBreeze iOS4 jailbreak!

When should you use this method?

• You have an iDevice that does not boot (stuck in DFU/on Apple logo) with important data on it (kids pix, financial reports, names of Russian spies)
• You are not jailbroken with PwnageTool/redsn0w/blackra1n/Sn0wbreeze
• If you are jailbroken using one of those jailbreak methods, check out SSH ramdisk method first as it guarantees non-destructive recovery.
• You don't need the device to remain jailbroken/unlocked or can jailbreak/unlock a device that has been restored to latest firmware version.

Download:
Windows version, Python source

Usage:
Use current firmware version that is still being signed by Apple (4.1 ATM)!
Drag and drop original unmodified IPSW file over the tool icon, wait for it to generate a UPG_...ipsw file, restore to that using iTunes.
Make sure you've read the necessary conditions and warnings sections!

Look at the source code if you want an insight into what exactly happens here.

iRecovery functionality on Windows without libUSB

itunnel_mux_rev6.exe <- this unfortunately named tool now supports loading stuff into iBoot, including USB exploit payloads.
Usage example: 

itunnel_mux_rev6.exe --ibss iBSS.n88ap.RELEASE.dfu --exploit exploit --ibec
 iBEC.n88ap.RELEASE.dfu --ramdisk  018-6461-399.dmg.ssh --devicetree 
DeviceTree.n88ap.img3 --kernelcache kernelcache.release.n88

Due to some hardcoded structure offsets still left, will probably only work with iTunes 9.2.

OLD BOOTROM + Spirit => 4.0 JB

Updated for FW 4.0/4.0.1 + 'Star' jailbreak. You'll need NOR files from a custom 4.0 ipsw made with PwnageTool 4.0.1.
You still obviously need to have an old bootrom 3GS, however you don't currently need any SHSH while Apple still signs 4.0.1
The fact that Star jailbreak uses Safari, however, means it will be patched in weeks, so back up those hashes while you can..
Now that 4.0 is jailbroken, potential uses of this method include installing 4.1 betas, rolling back to 3.x and similar fun activities.

STOP if you have a new bootrom (week 40+, tethered only 3.1.2 JB etc). Here's how to check bootrom ver
- your hardware is iPhone 3GS with OLD BOOTROM
- you HAVE 3.1.3 SHSH (**)
- you DON'T have 3.1.2 SHSH (otherwise, just use blackra1n/redsn0w).
- you WANT iOS4/JB

Update: thanks to movie for those awesome step by step instructions!
Update2: someone made a Cydia package. Looking at type of questions people ask in the comments, that might be the only option for 80% of them. Apple's license terms, of course, don't allow to redistribute their binaries, so I just link to it. Their description also says it works with 3.1.2/Spirit - I very much doubt that.

This tool can be used to flash pwned nor files (containing LLB  exploit) on the phone  running Spirit JB  (script has hardcoded offsets for 3.1.3 3GS).

Educational..

http://www.youtube.com/v/B6J2OQvaHjw&hl=en_US&fs=1&hd=1

On bluetooth in 4.0

• Bluetooth in 4.0 has a couple of new profiles: HID (meh) and.. Braille. Wait, what's exciting about Braille? Two things:
• It is one of the three services that call OpenSerialPort()
• It is the only one of them that isn't handled by OS isn't generally handled by the OS, unless you enable some obscure accessibility feature, unlike WiAP and Nike sensor profiles, meaning there are no side effects to connecting the service to arbitrary BT devices with serial profile.
  
  
  

Working iPhone recovery ramdisk with SSH ;-)

This information is deprecated; please use the new automatic tool here.

Fixing Blacksn0w on 3.1.3

Update: Ultrasn0w now supports 05.11 thru 05.13 with a new exploit that should fix all possible WiFi issues and any OS 4.0 problems. http://ultrasn0w.com/

Asking for it..

Pseudo-code:

VerifyLicense()
{
    char
         readbuf[16],
         plaintext[16],
         uuid[32]; 
    int hLic = open(LICENSE_FILE);
    get_uuid(uuid);
    read(hLic, readbuf, 16);
    raw_decrypt(readbuf, plaintext);
    memcmp(plaintext, uuid, 16);
}

Where raw_decrypt is an AES symmetric cypher function -)

Even more amazingly, raw_encrypt function is ALSO present in the code!

Windows 7 registry keys

Enable the new taskbar*: 1. run this command: strings explorer.exe | findstr /C:"ShellFolder" 2. under the path HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ CurrentVersion\Explorer, create subkeys: CLSID\{SOME_GUID}\ShellFolder (for every guid returned by findstr e.g.: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Explorer\CLSID\{A5181F28-5A04-4DBE-A8F6-EEBD7FE228F2}\ShellFolder 3. Under each subkey path, in ShellFolder key, create new value: Attributes REG_DWORD 0xA0100004 *) Seems to work in 6801+. The new taskbar should be enabled by default in newer builds. Disable 'Send Feedback' link: HKEY_CURRENT_USER\Control Panel\Desktop FeedbackToolEnabled REG_DWORD 0

Troubleshooting 802.1x on the iPhone

• Create /private/var/preferences/SystemConfiguration/com.apple.eapolclient.plist with following contents:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>LogFlags</key> <integer>255</integer> </dict> </plist>

• Log is in /var/log/eapolclient.en0.log

Tools: IDA 5.2 (talk about overkill..), iPhoneList

Snipping Tool on Server 2008 - no love?

Short:

Problem: Snipping Tool from Vista SKUs does not start on Server 2008 Solution:

1. Create a new directory, SnipTool
2. Copy System32\SnippingTool.exe to SnipTool
3. Copy System32\en-US\SnippingTool.exe.mui to SnipTool\en-US
4. Create a file called SnippingTool.exe.local in SnipTool directory.
5. Download this Zip file
6. Extract the contents of the Zip file, copy slc/x86/slc.dll to SnipTool directory (replace x86 with x64 on a 64-bit OS).

Befriending Live Mesh and Server 2008

Update: recent versions of Live Mesh do not perform this check any more

Tip of the day: Sony Rolly Motion Editor installation on English OS

Well, It looks like Rolly isn't popular enough here in States, so the only kind of forum posts I found recommended using a Japanese XP in VMware. Which is fine, except I've got no Japanese XP. After changing system locale failed to affect installer's behavior, next idea was to install a MUI. (Un?)fortunately for me and my remaining diskspace, Japanese MUI for x64 Vista SP1 failed to install, and I had to resort to other ideas. Such as: Tried to decrypt the setup.inx and decompile it with SID And figured that installer wants GetSystemDefaultUILanguage to return 0x411 (Japanese LCID) Step-by step instructions: 1. Run installer under debugger ntsd setup.exe in ntsd console, type:

sxi av a GetSystemDefaultUILanguage mov eax,411 ret g

2. Click next-next-..finish. Update: Batch file for lazy ones. Copy Motion Editor directory to the local disk, place this file inside and run it. Additional software: Rolly needs SonicStage in addition for Motion Editor. Fortunately for all non-Japanese speakers out there, there is an English version of that here. PS. You may also want to install 'support for East Asian languages' in Control Panel/Regional & Language Settings to prevent Japanese characters looking like boxes.