Tag Archives: Firmware 2.0

[iPhone] Geohot’s new holistic iPhone Project: EDA

Leave a reply

GeoHot just granted the world an insight into his current work project. It is called EDA and it almost looks like IDA (that btw also includes an iPhone debugger), but EDA seems to go a little further in case of simulator/dissassembler terms.

Geohot says the EDA simulator to:

  • include version control
  • allow graphical comparision between different versions of code
  • handle memory location as files
  • handle instructions as changelists

This concept he explains should make tracing of memory mapped IO processes “super easy”. But as GeoHot says: “Sadly, it’s still a work in progress. Maybe when its done, I’ll look for the 3G unlock.” Means: this tool is not available to the public, sadly.

eda4iphone.png

Picture is courtesy of GeoHot.

[iPhone] QuickPwn 1.0 for MacOS X released

Leave a reply

Our fellow iPhone Dev Team yesterday finally released QuickPwn for MacOS X. Sadly the Dev Team in the first place only provided a .torrent link (get torrent here) for distribution. We will come up with further details soon. For now: there are no reports about bugs about this version for Mac ,yet. Use “Archive Utility” to unpack, otherwise permission may be screwed up. Thumbs up for the Dev Team.

SHA1 sum: QuickPwn_1.0.0.tbz (via torrent) = 22ee0d6814a6bac9b1b9a8c7715dd714bd6bb449

[Update] Download QuickPwn 1.0 for Mac from these mirror locations now: RapidShare and iPhone-Hacks.com.

[iPhone] Experienced Issues with Firmware 2.0

1 Reply

After some days of using a pwned iPhone 2G with firmware 2.0, we found some issues. As of now, we don’t know where they come from. But we definitly know: we don’t like them.

  • WiFi doesn’t stay connected, it falls “asleep” and takes time to reconnect
  • the more apps have been used, the longer it takes to see reactions
    means: if you click on contacts and have used Safari, SMS and Youtube before, opening of contacts takes a lot longer than after an fresh reboot!
  • loading the contacts take 5-10 seconds
  • scrolling through contacts is jerky and freezes the view from time to time
  • scrolling through photos is jerky and freezes the view from time to time
  • launching the camera takes up to 10 seconds
  • the unlock slider may not react in time and you may miss a call
  • keyboard reacts slower than on 1.1.4
  • reaction time is heavily delayed (or seems not to react at all for more than 17 seconds – see video below)

We won’t blame anyone for this, because on the one hand this could be an effect of Pwning the iPhone and on the other hand these issues might be “features” of the original unmodified firmware 2.0 aswell. See update below, this is a firmware 2.0 issue.

Anyway we feel there are heavy problems with the memory management in firmware 2.0, that need to be addressed soon. Workflow was a lot faster with firmware 1.1.4.

As of now we just reboot the iPhone once a day, but this really is no working solution for such a device. We feel this reminiscent to Windows 95 times is not necessary.

Update: it has been reported this may come from Cydia. As we’re investigating this issue, we get back to you once we found a solution.

Update: Pumpkin of the iPhone Dev Team reports this most likely is an issue of the original firmware 2.0. Native iPhone users have also experienced this behaviour (see reports here in Apple’s forums). The internet is full of reports. Do a Google search you will find plenty of people reporting these issues.

[iPhone] Pwnage for Windows 2.0 (WinPwn) waits in its wings

3 Replies

CMW – the developer of the Microsoft Windows version of Pwnage tool announced that WinPwn is about to be released. On http://www.winpwn.com he writes: “Expect a release within the next few days!”.

That sounds like a release on the weekend. Windows users help is on its way. In the meantime scroll the Apple pages and consider buying a Mac :-)

[iPhone] HowTo Activate and Unlock your iPhone using Pwnage 2.0

17 Replies

Article is outdated. Find newest Jailbreak and Unlock HowTo for iPhone Firmware 3.0 here.

Note

We need to stress: respect the laws of the country you live in. For instance as german citizen with a T-Mobile Germany plan and iPhone you are not allowed to jailbreak or unlock your iPhone. T-Mobile is not kidding in this topic, as we’ve all seen with the sipgate sue (we reported here). This tutorial is in no way meant as an invitation to do things that are in violation of your contracts. We cannot be held responsible for bricking your devices. You do everything at your own risk and responsibility. Thanks.

I. Abstract

Pwnage Tool 2.0 is the newest tool to unlock and jailbreak “old” iPhones (iPhone 2G) and jailbreak “new” iPhones (iPhone 3G). It is developed, maintained and provided for free by the iPhone Dev Team. The Dev Team already provided Pwnage Tool 1.0 (see recent tutorial here).

This tutorial is for Mac users only who previously activated and unlocked their iPhones using Pwnage Tool 1.0. The release of Pwnage Tool 2.0 has been delayed in the last few days because of several bugfixes and issues that occurred during latest test. As we’ve used Pwnage Tool 2.0 in the last hours on some old iPhones, we can say: in contrast to Pwnage Tool 1.0, we encountered some problems with Pwnage Tool 2.0. Keeping that in mind it is your own risk to prolly brick your iPhone. We cannot be held responsible for your actions.

II. Preparations

A Microsoft Windows version of Pwnage 2.0 has not yet been released. Get yourself a Mac, it really is time to switch :-)

You need to download and install a couple of programs

  • download and install Pwnage Tool 2.0.1 (here or here) / Updated links to new Pwnage 2.0.1
  • download bootloaders.rar (for legal reasons, we can’t provide a direct download link as we are in Germany. Do a simple Google search for bootloaders.rar)
  • update to iTunes 7.7 (using Apple Software Update)
  • download iPhone Restore Firmware 2.0 (here)

III. Fasten your seatbelts

Before taking off, we highly recommend to do the following preparations on your iPhone:

  • backup/synchronize current calendar and address book using iTunes
  • backup current SMS using Syphone (download here)

In case you didnot, we highly recommend you read our tutorial about activating and unlocking iPhones with firmware 1.1.4 (see here).

IV. Take off

…into the wide open world of unlocked and jailbroken iPhones.

  1. Start Pwnage Tool 2.0, and click OK.

  2. Choose Expert Mode

  3. Select iPhone 2G, and click the blue arrow

  4. After clicking the blue arrow you will see a window like this:

    Note: we encountered errors when browsing for the IPSW firmware that we manually downloaded several times:

    We circumvented this error by letting iTunes download the firmware. But be careful let iTunes only download the firmware. Don’t choose download and install!!!

  5. When Pwnage feels like the Firmware is the right one, it will show this picture, where we can manually change some settings. We highly recommend to change nothing but the Cydia packages. We even leave the pictures the same.

  6. Inside the Cydia packages menu we recommend to choose these files for download:
    OpenSSH, Cydia Installer, and Cydia's Source Set. These files will automatically become downloaded in the background.



  7. Make sure you select the above downloaded Cydia packages. Under Select packages you can check them, in case the packages are not pre-chosen for including into your custom IPSW. Then click the blue arrow again.

  8. After having clicked the blue arrow again, we may choose new logos. We recommend to leave these as they are and click the blue arrow again.

  9. Pwnage Tool 2.0 feels we are ready and shows “Build” with a checkmark. We click the blue arrow again and can already smell the pwrn.

  10. You may provide the bootloaders now, by clicking No to search the web for them (we only show the 4.6 bootloader question, in fact there will be same question for the 3.9 bootloader).


  11. After having chosen the bootloader Pwnage needs to know where to save the custom IPSW file. It will show a picture similar to this:

    After having chosen the target filename and folder, Pwnage will submissively begin its work.

    At a specific point of work, Pwnage will require your admin password. This is due to a limitation of access to the filesystem.

  12. After working some minutes you will be shown this menu. Since we are all obedient Pwnage users (aren’t we?) we already had used Pwnage 1.0 before. And therefore we choose Yes.
  13. Pwrnage Tool will wish us the best for our recovery and wants to be quitted:

V. Approach for Landing

  1. As our odysee thru iPhonitis is not over, we need to start iTunes (we have our iPhones connected!). And we choose the iPhone menu in iTunes (looks like this picture:)

  2. We need to restore our 0wn firmware, therefore we need to hold the ALT key and press Restore Button. We will get a dialog, where we can choose our custom firmware:

  3. iTunes will begin its work of extracting and restoring our custom firmware. This process will take some minutes. Don’t disconnect during this period. You would have an expensive brick then.

  4. After restoring successfully the custom firmware to your iPhone your iPhone will reboot and eventually show a screen that indicates that the baseband is currently in process of getting unlocked:

  5. After the baseband flashing has been finished, your iPhone will reboot again and will show up with firmware 2.0. We hope you enjoyed your flight with incomplete-news airways. We wish you a good stay on Eff-Doubleyou-Two-Dot-Oh. We recommend to pick up your baggage in the claim area.

VI. Baggage Claim Area

  1. You may now decide to set up your system clean and configure everything anew or simply choose to restore your old settings (like eMail-accounts, calendar, photos, muzaq, and videos):

  2. After having clicked Continue you will see this picture. It depends on how many things you had saved on your iPhone and how much space it’s got. Our 4GB testmodel only took about 5 minutes to get all settings restored:

  3. After restoring the settings your iPhone will reboot…
  4. To get back your EDGE settings, simply follow our tutorial here (see part II.)_T_H_E__Z_E_N__W_A_Y_ . In firmware 2.0 the EDGE menu is now called “Cellular Data Network”).

VII. Final words

Congratulations. You’re finished now. In case any of you got questions, don’t hesitate to ask below in our comments section. We hope you enjoyed this tutorial. Thanks for your attention. Big shouts fly out to the iPhone Dev Team. You guys simply rock our hearts…

[iPhone] Pwnage Tool 2.0 released

Leave a reply

Eventually the iPhone Dev Team released their long awaited Pwnage Tool 2.0 for Mac. You can download here and here. As expected it supports jailbreaking and unlocking of “old” iPhones and jailbreaking of 3G iPhones and iPod Touch. It’s been reported there are issues with installing the installer.app. Note that this is only the Apple Mac version of Pwnage, there is currently no information when Pwnage for Windows (WinPwn) will be released.

Please allow some hours for testing the new Pwnage. We’ll publish a tutorial during the next hours. We need to check Pwnage carefully. Update: Tutorial has been released. See here.

Congrats to the iPhone Dev Team.

[iPhone] iPhone 3G allegedly unlocked using SIM Adapter

1 Reply

[Update] Aug/25th/2008: read here, everything you gotta know about Proxy SIM solutions.

The Brazilian based company DesbloqueioBr.com.br claims to have unlocked the 3G iPhone. The whole procedure is like a deja-vu. It is said it works almost the same like with TurboSIM for the “old” iPhone. The difference is they say they make use of a faked IMSI test card, while Bladox’ TurboSIM solution emulated an AT&T card.

The Theory behind

The guys at DesbloqueioBr claim that the iPhone 3G only checks on first card detection (means after hot-swapping or after reboot) for the type of SIM. It is said it checks the IMSI code. During card-detection, the IMSI test card emulation now returns that it is a test card. The next requests to the card will then be answered by the normal SIM card. Same working like with the TurboSIM, except that the TurboSIM was coded to emulate an AT&T card during card detection stage.

Empiricism

Since this has not been confirmed on forums and the video provided (see below) doesn’t show the unlock procedure, this is likely to be a rip-off. Anyway for proving the theory the iPhone Dev Team already provided a sample application for the TurboSIM, that does exactly what the theory requires: emulating a test IMSI at card detection stage. As of now there is no feedback. For legal reasons we cannot link the application, as we are located in Germany. During the next 24 hours google will index the page that contains the link, search for lamesaft-0.1.zip then.

Limitations

The video provided does not clarify how the unlock is performed. It simply shows a call being made from one iPhone to the other. It does not show the SIM adapter to be taken out. Moreover you still need to have the iPhone 3G activated. Currently there is no application available to do this. People on forums report that the DesbloqueioBr guys seem not to be willing to answer concrete questions.

Since there is no prove: we currently classify the DesbloqueioBr SIM adapter as SCAM. Update: at 00:29 the video shows the model as MB046LL, which could be identified as a U.S. american AT&T locked iPhone 3G (see model list here). This model obviously works with a different carrier (not AT&T, but TIM) in a different country (not the US, but Brazil).

Here’s the video that shows calls being made from one iPhone to another. The guy is talking portuguese, a translation is not available.

empty line for distance to the text.

[iPhone] Geohot confirms 3G uses new Bootloader

3 Replies

Although we didn’t get our hands on a new iPhone 3G yet, things are as expected: the iPhone 3G uses a new bootloader for its baseband modem as confirmed by Geohot.

Bootloader versions from the “old” iPhones

As far as we are aware the there are those 3 different bootloader versions known on old iPhones:

  • 3.8 (very rare)
  • 3.9 (iPhones before november 2007) and
  • 4.6 (iPhones after november 2007).

It is widely known, that exploits for these old bootloaders have been found, that allow to SIM unlock any of these old iPhones. No matter which software revision is running.

No Unlock for iPhone 3G, but for old iPhones

For the new iPhone 3G bootloader, there is no (public) exploit known yet. Although the iPhone Dev Team states they can unlock firmware 2.0 – the unlock is most likely meant to work on “old” iPhones only. The only exploit yet known (in both old and new iPhones) is an iBoot bug. The iPhone Dev Team provided a video showing Pwnage Tool neutering the baseband for firmware 2.0:

Video: Pwnage Tool Bootneuter on firmware 2.0 (on an old iPhone)

Bootneuter 2.0 from iphonedev on Vimeo.

A new jailbreak for iPhone 3G and old iPhones

The Pwnage Tool 2.0 (and Geohot’s yiPhone) will most likely feature an iBoot bug to jailbreak old and new iPhones. iBoot is needed by iTunes to talk to when restoring firmware. About a year ago, Geohot found out that iBoot provides a full interactive shell. The only problem was, iBoot only allowed signed code to run. The iPhone Dev Team now managed to break the chain of trust from the earliest boot stage. Thus allowing to run unsigned code and in the end jailbreaking old and new iPhones (see video):

Video: Talking to iBoot unsigned

Talking to iBoot? from iphonedev on Vimeo.

Both videos are provided by iPhone Dev Team. Kudos to you guys.

[iPhone] Pwnage Tool for Firmware 2.0

1 Reply

Update 15.07.2008: iPhone 3G allegedly unlocked using SIM Adapter (read here)
Update 15.07.2008: XPwn command line utility released by iPhone Dev Team (read here)
Update 14.07.2008: Geohot confirms that iPhone 3G got a new bootloader (read here)

It is rumored, the Pwnage Tool for firmware 2.0 (= firmware 1.2) will not be released this weekend. Enjoy youself and don’t play around until we tell you.

Anyway the iPhone Dev Team has released a video of Pwnage Tool 2.0. See here:

empty line

[iPhone] Activation and iTunes Download Servers collapsed

Leave a reply

The iPocalypse has begun. Many iPhone 3G customers all over the world report activation issues after having bought their new gadget. The same also applies to customers of the “old” iPhone who tried to update to firmware 2.0 and needed to re-activate.

We recommend weather to upgrade nor to buy a new iPhone 3G now. Stay tuned.