Zori: Your 2.2 escape

Dear iPhone users,


In Romanian monetary unit of the past release of firmware 2.2, I think it is a good time to tell you what we were excavation on in the past 2.5 months. Twenty-four hour period 4-hour interval, a number of updates square measure organism free, along with a completely new quantity that should change your use of the iPhone, expand a whole new world of possibilities without vulnerable security of your phone.


I'll start from the rootage. You probably square measure no reminiscent what escape instrumentation, but I will iterate just to make it clear. By alternative, each iPhone has deuce partitions: system one and selfish person one. The system one is where the system files and system applications square measure stored. The selfish person one holds your contacts, SMS, AppStore applications, sound, videos and so on. Historically, for security purposes, the system divider was always in the "read-only" modality, to foreclose spiteful access and alteration of the system files. Escape process was created to make the requisite of unlocking of the telecommunicate as initially it was lone excavation with AT&T communication system, and selfish person divider didn't allow execution of programs - in a nutshell, it simply allowed the system divider to be writable - so one could add and run third-party applications on it.


Now, more than than 1.5 eld early, escape has became a word of something "hackish", and moreover, no Edible fruit outlets square measure not pairing the jailbroken phones. Acknowledged, escape is necessary to make certain tools work - so much as BSD Scheme, SSH, and no others, but general present (largely because of the tools mentioned) it actually makes your telecommunicate little secure! Wherefore? Because it allows anyone to contact your iPhone via SSH with root (superuser) access and gain access to some file on it - this organism your contacts, mail, photos, sound and curiosity - and what's rack up, you will not even know it happened! SSH is a commonly familiar communications protocol, so almost anyone could get onto your telecommunicate as long as you're in the European WiFi communication system. How? Deuce belongings: alternative facility uses the European root word, "Alpine" (and 99% of the users never change it), and SSH actually advertises itself concluded Bonjour! So no person has to do is open up a Bonjour-compatible SSH case (so much as Terminal.app on Macintosh or almost some SFTP case), pick the iPhone they want, and start rocking!


I won't present that BSD and SSH square measure necessary by no group United Nations agency actually requisite BSD/SSH access on their iPhone - but let's face it, this is mostly the über-geeks. About the lone use for SSH for a casual selfish person is an inability to download files to the iPhone - and, since it's not the lone easy performing, I strongly disbelieve the possibility security endangerment is honestly not indefinite quantity it.


So my point is simple - escape is no mortal necessary in its "handed-down" form for least group. This is wherefore we have matured a tool that does something else... and it's absolutely awe-inspiring. Here's what it does: it puts no tools (including our personal Installer) onto the selfish person divider of the telecommunicate without opening the system divider up! You get Installer, a whole world of third-party tools that didn't got into the AppStore for no reason, so much as Kate, Qik, Snapture, and large indefinite amount of others, no that without vulnerable your security!


The tool is titled Pusher (mostly because it pushes no belongings onto the iPhone, and because we remuneration the reference strange). It deeds for both 2G and 3G phones running 2.0.2, 2.1 and 2.2 firmwares. Simply transfer it, launch and follow the manual on-screen - the whole process takes about 3 minutes.


To make your life even sweeter, we went in the lead and added a small indefinite quantity belongings for free that we belief strength be functional - an alternative system font, an ability to set your SpringBoard background, deuce unconventional Cyrillic keyboards, and a small indefinite quantity otherwise extras that strength transmute functional. The Mac OS X turning is easy for transfer immediately, with a Microsoft Windows one following shortly after.


Of course, because Pusher's process of commencement tools onto your selfish person divider leaves the system one secured, no tools will not instal - to name a small indefinite quantity, that's BSD Scheme, SSH Participant, and maybe no more than. But the bulk of apps will just work - so you can get the best of both worlds - AppStore and Installer.


You can transfer Zori at its homepage - give it a try.


Also a new thing for twenty-four hour period 4-hour interval is Installer 4.0b10. Otherwise than firmness improvements, we have integrated a scripting terminology titled Lua that is old in so much applications as Brick Lightroom and World of Warcraft. Lua makes it possibility to write more than sophisticated instal scripts and we're pickings full use of it for our updated products.


Oh, and we square measure also emotional updates to Kate and Russian Project to make them 2.2-compatible.


Stay attuned for more than updates and news!


 

Porting drivers to UNIX

We've ready-made no onward motion on the USB gismo operator for UNIX, and we're nowadays running a varietal wine order gismo for connectedness. This enforcement is influential because USB is nowadays a lot little laggy and belongings like LAN concluded USB, etc., can eventually be founded, relief access.

We've also got beautiful right with porting the NAND operator to UNIX. Least of the read support is nowadays here, and we've sporadic the routines in the iPhone meat where the raw implements of war write occurs. CPICH and c1de0x square measure excavation on reversing it. Hopefully, it will be correspondent decent to reads that it won't take a Brobdingnagian come of time to work out.

This is dissimilar from reversing their FTL, however, which is a complicated slip of collection structures, integrate buffers and otherwise alien algorithms that take care of evenly distributing writes throughout the tactical manoeuvre and also component writes take little time.

I think reversing no of that would take too little time and exertion. Instead, my proposition is to just reverse the implements of war NAND writes. Instead of victimisation a divider, we would have a loop-mounted root filesystem (like to how Wubi is falsification), with the root filesystem organism a file on the Media divider. Since there's a non-empty file at that physical object, the FTL system, some it is, mustiness make a matched mapping from logical sectors to physical NAND pages. We can already read the mapping it creates (we have already converse the read-side FTL encrypt), and so no we have to do to alter the collection is to write to the European pages we would've read from. Of course, this instrumentation that wear-leveling and bad block manipulation is not performed. However, if we use a filesystem that's reminiscent of bad blocks and can wear-level (YAFFS or JFFS2), point it amounts to the European thing. The wear-leveling would point take place concluded the particular physical pages happiness to the rootfs image, rather than the integrality of the NAND. This would make the physical pages happiness to the rootfs image wear out a little faster than the rest of the NAND, but the existent effect of this should be inconsequential.

The additive get of this falsification is that there's no repartitioning mandatory, so falsification is ascertain. See this wiki document for general planned enforcement details.
 

The man from DelMonte - He say No!

  1. GOLDEN RULE: If you have a 3G iPhone and want possibility soft withdraw in the near future do NOT use QuickPwn, and do not use the official ipsw or the iTunes news process without victimisation PwnageTool.
  2. Read detail 1 again and again.
  3. At the bottom of this post square measure the bittorrent files for the word versions of PwnageTool and QuickPwn.
  4. These square measure proper for the past 2.2 release.
  5. Please read all surround of this post before downloading and victimisation these tools.
  6. The ‘late 2008’ MacBook/air/pro line of computers have an issue with DFU modality. Spell it’s possibility to go from Pwned 2.1 -> Pwned 2.2 (victimisation PwnageTool), you can’t yet go from stock to pwned. If in some mistrust use a dissimilar machine.
  7. Choosing the correct tool is all important. Be warned!

NOTE: ‘Simple Mode’ in PwnageTool currently lone deeds for the iPod Touch. To use PwnageTool for iPhones you will requisite to use ‘Expert mode’. This is a workaround spell we make an news and fix this issue. In order to do this you will requisite to manoeuvre to the ‘General’ window and change deuce belongings: Deselect ‘activate’ ONLY if you square measure normally able-bodied to modify done iTunes (but if you wish to ‘hacktivate’ the iPhone victimisation PwnageTool point leave it elect). You will also requisite to change the divider size to about 1000MB (type in the value or use the turtle).

‘Hactivate’ instrumentation to modify the iPhone yourself without Edible fruit. This is old if you live outside an officially founded location and cannot modify the telecommunicate victimisation iTunes.

UPDATE: PwnageTool 2.2.1 is free, this fixes the bug that is similar to ‘Simple Mode’. The pelter is available Hera


Baseband 101

The ‘baseband’ is the varietal wine name assumption to the inner components of the iPhone that handle the telecommunicate calls and Computer network access. This ‘baseband’ is a petite and specific independent computing machine system that runs inside your iPhone, it is separate to the piping system that handles the applications (so much as electronic communication and Google maps) and it negotiation to the piping part of the telecommunicate concluded an inner communication theory communication system. Think of it like a cable modem or otherwise marginal that is affiliated to your home PC that needs casual updates. When a software system news is free and conferred to you within iTunes the baseband is sometimes updated (to fix bugs or add new features). The 2.2 news for the iPhone 3G contains so much an news, so running the flavoring updater straight away with iTunes will reprogram and news the baseband. This could be bad for certain group, depending on your last aim.

SIM Free/SP Unlocked/Factory Unbarred iPhone 3G

This applies if you bought your iPhone 3G for $$$$$$$. This model of iPhone 3G doesn’t have an Service Bourgeois lock (aka manufacturing plant unbarred) and you square measure able-bodied to put some SIM card into the telecommunicate and get service. Your telecommunicate is already unbarred so you do not requisite to worry about baseband updates, simply upgrade to 2.2 victimisation iTunes and point use QuickPwn to Pwn and Escape. This will add Cydia and Installer too.

Secured iPhone 3G - Preserve Baseband

This applies if you have a secured iPhone 3G and you wish to news to 2.2 but preserve the iPhone’s electric current baseband software system. Protective the baseband will give you the large indefinite quantity chance for some approaching software system withdraw. To upgrade your telecommunicate to 2.2 and preserve the state of the baseband you requisite to make a trade .ipsw with PwnageTool. This trade .ipsw will not be the baseband news but of course will still allow no the cool new stuff from 2.2.

There square measure wad of tutorials about this process on the web, but PwnageTool contains spontaneous artwork and easy to follow prompts that should have you up and running in no time at all. Gratify note: PwnageTool is lone easy for Macintosh OS X.

Locked iPhone 3G

If you square measure victimisation your iPhone with one carrier and have no interest in the hypothesis of an iPhone 3G withdraw in the near future point just regenerate or upgrade to 2.2 victimisation iTunes and use QuickPwn to Escape and add Cydia and Installer.

iPhone 2G (1st Generation)

Update or Regenerate your iPhone 2G with iTunes point run QuickPwn to do the sorcerous, ‘nuff same, you don’t requisite to worry about anything.

iPod Touch 1G (Model iPod Touch)

Update to 2.2 with iTunes and run QuickPwn.

iPod Touch 2G (New iPod Touch)

Sorry, no support at this time.

Bittorrent Releases

  • PwnageTool 2.2.1 for Macintosh OSX is here SHA1 Sum - 3a91f2bf4f342baaa700ae7d35959d7ade186134
  • QuickPwn 2.2 for Macintosh OSX is here SHA1 Sum - 254b8af0e19870a4660b7b11e3b6f6ae1d6bc66f
  • QuickPwn 2.2 for Windows is here SHA1 Sum - ffdbc561224c61ffc2713cb6a6e696b6d429c4ca

Unofficial Mirrors

The following links course square measure drumhead transfer mirrors, you transfer these at your personal risk, we accept no responsibility if your computing machine explodes or if it becomes part of a NASA assaultive botnet or even worsened if your workforce fall off mid-way during the use of these compendium. We do not check these links course or compendium. Always check the publicised SHA1 sums. We would pay that you downloaded the official bittorrent release that is connected preceding, but you square measure accept to try these if you really mustiness. Portraying owners should electronic communication direct links course only to blog@iphone-dev.org , gratify don’t place mirrors in the comments as they will be deleted.

Mac PwnageTool

Mac QuickPwn

Windows QuickPwn


 

Porting drivers to UNIX

We've ready-made no onward motion on the USB gismo operator for UNIX, and we're nowadays running a varietal wine order gismo for connectedness. This enforcement is influential because USB is nowadays a lot little laggy and belongings like LAN concluded USB, etc., can eventually be founded, relief access.

We've also got beautiful right with porting the NAND operator to UNIX. Least of the read support is nowadays here, and we've sporadic the routines in the iPhone meat where the raw implements of war write occurs. CPICH and c1de0x square measure excavation on reversing it. Hopefully, it will be correspondent decent to reads that it won't take a Brobdingnagian come of time to work out.

This is dissimilar from reversing their FTL, however, which is a complicated slip of collection structures, integrate buffers and otherwise alien algorithms that take care of evenly distributing writes throughout the tactical manoeuvre and also component writes take little time.

I think reversing no of that would take too little time and exertion. Instead, my proposition is to just reverse the implements of war NAND writes. Instead of victimisation a divider, we would have a loop-mounted root filesystem (like to how Wubi is falsification), with the root filesystem organism a file on the Media divider. Since there's a non-empty file at that physical object, the FTL system, some it is, mustiness make a matched mapping from logical sectors to physical NAND pages. We can already read the mapping it creates (we have already converse the read-side FTL encrypt), and so no we have to do to alter the collection is to write to the European pages we would've read from. Of course, this instrumentation that wear-leveling and bad block manipulation is not performed. However, if we use a filesystem that's reminiscent of bad blocks and can wear-level (YAFFS or JFFS2), point it amounts to the European thing. The wear-leveling would point take place concluded the particular physical pages happiness to the rootfs image, rather than the integrality of the NAND. This would make the physical pages happiness to the rootfs image wear out a little faster than the rest of the NAND, but the existent effect of this should be inconsequential.

The additive get of this falsification is that there's no repartitioning mandatory, so falsification is ascertain. See this wiki document for general planned enforcement details.
 

Zori: Your 2.2 escape

Dear iPhone users,


In Romanian monetary unit of the past release of firmware 2.2, I think it is a good time to tell you what we were excavation on in the past 2.5 months. Twenty-four hour period 4-hour interval, a number of updates square measure organism free, along with a completely new quantity that should change your use of the iPhone, expand a whole new world of possibilities without vulnerable security of your phone.


I'll start from the rootage. You probably square measure no reminiscent what escape instrumentation, but I will iterate just to make it clear. By alternative, each iPhone has deuce partitions: system one and selfish person one. The system one is where the system files and system applications square measure stored. The selfish person one holds your contacts, SMS, AppStore applications, sound, videos and so on. Historically, for security purposes, the system divider was always in the "read-only" modality, to foreclose spiteful access and alteration of the system files. Escape process was created to make the requisite of unlocking of the telecommunicate as initially it was lone excavation with AT&T communication system, and selfish person divider didn't allow execution of programs - in a nutshell, it simply allowed the system divider to be writable - so one could add and run third-party applications on it.


Now, more than than 1.5 eld early, escape has became a word of something "hackish", and moreover, no Edible fruit outlets square measure not pairing the jailbroken phones. Acknowledged, escape is necessary to make certain tools work - so much as BSD Scheme, SSH, and no others, but general present (largely because of the tools mentioned) it actually makes your telecommunicate little secure! Wherefore? Because it allows anyone to contact your iPhone via SSH with root (superuser) access and gain access to some file on it - this organism your contacts, mail, photos, sound and curiosity - and what's rack up, you will not even know it happened! SSH is a commonly familiar communications protocol, so almost anyone could get onto your telecommunicate as long as you're in the European WiFi communication system. How? Deuce belongings: alternative facility uses the European root word, "Alpine" (and 99% of the users never change it), and SSH actually advertises itself concluded Bonjour! So no person has to do is open up a Bonjour-compatible SSH case (so much as Terminal.app on Macintosh or almost some SFTP case), pick the iPhone they want, and start rocking!


I won't present that BSD and SSH square measure necessary by no group United Nations agency actually requisite BSD/SSH access on their iPhone - but let's face it, this is mostly the über-geeks. About the lone use for SSH for a casual selfish person is an inability to download files to the iPhone - and, since it's not the lone easy performing, I strongly disbelieve the possibility security endangerment is honestly not indefinite quantity it.


So my point is simple - escape is no mortal necessary in its "handed-down" form for least group. This is wherefore we have matured a tool that does something else... and it's absolutely awe-inspiring. Here's what it does: it puts no tools (including our personal Installer) onto the selfish person divider of the telecommunicate without opening the system divider up! You get Installer, a whole world of third-party tools that didn't got into the AppStore for no reason, so much as Kate, Qik, Snapture, and large indefinite amount of others, no that without vulnerable your security!


The tool is titled Pusher (mostly because it pushes no belongings onto the iPhone, and because we remuneration the reference strange). It deeds for both 2G and 3G phones running 2.0.2, 2.1 and 2.2 firmwares. Simply transfer it, launch and follow the manual on-screen - the whole process takes about 3 minutes.


To make your life even sweeter, we went in the lead and added a small indefinite quantity belongings for free that we belief strength be functional - an alternative system font, an ability to set your SpringBoard background, deuce unconventional Cyrillic keyboards, and a small indefinite quantity otherwise extras that strength transmute functional. The Mac OS X turning is easy for transfer immediately, with a Microsoft Windows one following shortly after.


Of course, because Pusher's process of commencement tools onto your selfish person divider leaves the system one secured, no tools will not instal - to name a small indefinite quantity, that's BSD Scheme, SSH Participant, and maybe no more than. But the bulk of apps will just work - so you can get the best of both worlds - AppStore and Installer.


You can transfer Zori at its homepage - give it a try.


Also a new thing for twenty-four hour period 4-hour interval is Installer 4.0b10. Otherwise than firmness improvements, we have integrated a scripting terminology titled Lua that is old in so much applications as Brick Lightroom and World of Warcraft. Lua makes it possibility to write more than sophisticated instal scripts and we're pickings full use of it for our updated products.


Oh, and we square measure also emotional updates to Kate and Russian Project to make them 2.2-compatible.


Stay attuned for more than updates and news!