iPhone 3.1.3 Jailbreak Progress Update

News | Thursday April 8 2010 11:51 AM | Comments (0) Tags: , , ,

Put simply, greenpois0n is a toolkit designed to help discover and exploit new vulnerabilities. Let me repeat that, greenpois0n itself is NOT an exploit. Most exploits typically have much more boring and technical names, such as “iBoot Environment Variable Overflow” or “usb_control_msg(0x21, 2)”.
Tools, on the other hand, are typically given more creative names, like redsn0w, blackra1n, or greenpois0n. Even though most of these tools use the same exploits, each one has its own unique strengths and weaknesses. Redsn0w was designed to be robust and low maintenance by using Apple 's own NOR flashing routines, whereas blackra1n was designed to be small, fast, and have a low memory footprint. While both these tools are excellent pieces of software, neither had the flexibility nor advanced capabilities that we were really looking for. Thus greenpois0n was born.
While we do have a GUI designed to allow users to perform a simple jailbreaking, the true power is hidden away in our advanced exploit payload. Once injected into iBoot, greenpois0n inserts many new and powerful commands allowing you to do everything from accessing the AES engine to decrypt firmware keys, hook and call into existing iBoot functions, read and write to blockdevices, including the filesystem (although filesystem is read only right now), and even set breakpoints within iBoot to dump registers and stack information during runtime.
It's still there, and turns out it's the exact same exploit Geohot demonstrated in his iPod Touch 3g video a few weeks ago, but since that time, there have been quite a few new developments. By now, I'm sure everyone has seen or heard about the userland “spirit” exploit demonstrated by Comex, and which was used to jailbreak the first iPad. This exploit is by far one of the most impressive pieces of work I think this community has seen in quite some time. The only problem with this method of jailbreaking is it can be easily patched by Apple in the next firmware update. Also, since the exploit being used resides in userland, you're denied access to many of the low level hardware features, including the ability to decrypt firmware keys. iBoot exploits, on the other hand, are much lower level and offer much more freedom to interact directly with the system unrestricted. With the exploit being so much more powerful, we've decided it would be wiser to release the “spirit” exploit first and hold onto the iBoot exploit until the next hardware revision.
Soon after this decision, I quickly set to work porting “spirit” to run on Linux and adding these capabilities into greenpois0n. At the same time, Comex, a number of members from iPhone Dev Team, and Chronic-Dev Team helped by fixing many possible snags and getting Cydia prepared to run on the iPad. It was truly an epic display of cooperation by everyone involved. Everything was progressing smoothly until yesterday. The boy-wonder Geohot threw a wrench in our gears once again after discovering a NEW exploit that pretty much blows everything we've got out of the water. So now we're forced to reconsider our release plans once again. As of today (I can't speak for tomorrow, for all I know everything could change again), both the original exploit I posted about earlier and the new “spirit” exploit are probably going to be held off for a little bit longer to avoid being patched by Apple . Also, today I mentioned on my twitter that I can almost guarantee an exploit for 3.1.3/3.2 (all devices, and all models!) before the end of the month. I would strongly advise everyone to keep a close eye on Geohot's blog for updates in the near future.
And if you haven't already, PLEASE backup your SHSHs with either
This should give a better perspective to users who have been upset that the iPhone jailbreaking community have not released tools to jailbreak iPhone OS 3.1.3.
iPhone OS 3.1.3 will most likely be released by Geohot before the end of the month.
. Otherwise tools will be released only after the
is available.
As always, we’ll keep you posted if there are any further updates so stay tuned here at
for the tip.

No Comments »

No comments yet.

RSS feed. TrackBack URI

Leave a comment

You must be logged in to post a comment.