Dream Team Explains How Corona Jailbreak Worked

Posted May 25, 2012 at 11:55am by iClarified | Please help us and submit a translation by clicking here | 21580 views

The 'dream team' of iOS hackers explains how the Corona jailbreak worked at HITBSecConf.

GreenPois0n Absinthe was built upon @pod2g's Corona untether jailbreak to create the first public jailbreak for the iPhone 4S and iPad 2 on for the 5.0.1 firmware. In this paper, we present a chain of multiple exploits to accomplish sandbox breakout, kernel unsigned code injection and execution that result in a fully-featured and untethered jailbreak.

Corona is an acronym for "racoon", which is the primary victim for this attack. A format string vulnerability was located in racoon's error handling routines, allowing the researchers to write arbitrary data to racoon's stack, one byte at a time, if they can control racoon's configuration file. Using this technique researchers were able to build a ROP payload on racoon's stack to mount a rogue HFS volume that injects code at the kernel level and patch its code-signing routines.

The original Corona untether exploit made use of the LimeRa1n bootrom exploit as an injection vector, to allow developers to disable ASLR and sandboxing, and call racoon with a custom configuration script. This however left it unusable for newer A5 devices like the iPad2 and iPhone 4S, which weren't exploitable to LimeRa1n, so another injection vector was needed.

You can get the full presentation notes from here.

Add Comment
Imaster - May 25, 2012 at 6:12pm
Corona is not an acronym nor an anagram. It's a f{#^}ing corona. Cheers b}tches LOL
wherewolf - May 25, 2012 at 2:11pm
why would they explain how this works for all of apple to see making it easier to close the exploits????
Akido - May 25, 2012 at 2:20pm
As soon as a jailbreak is released, Apple devs are able to decompile the jailbreak tool to see the vulnerability it exploits so that they an close it be releasing a patch or fixing it in the new firmware. It's not difficult for them.
AJ - May 25, 2012 at 12:28pm
Corona is -not- an acronym for "racoon." Acronym- A word formed from the initial letters of other words (e.g., radar, laser, scuba). You mean... Anagram- A word, phrase, or name formed by rearranging the letters of another (e.g. cinema, formed from iceman). I know. Stickler. But we learned something here. ;-) Otherwise, a well written and informative article.
datumax - May 25, 2012 at 12:22pm
"Corona is an acronym for "racoon"" "Corona" is an ANAGRAM of "racoon." Regardless, they're all still smart in my book.
FARPThor - May 25, 2012 at 1:59pm
I guess it feels good to know such smart people ain't that smart in ALL areas!
Follow iClarified
TaiG Updates iOS 8.4 Jailbreak, Removes Setreuid Kernel Patch
TaiG has updated their jailbreak of iOS 8.4 t...
Tweaks Can Now Modify Cydia
Saurik has released Cydia 1.1.19, an update t...
Star Walk 2 is Apple's Free App of the Week [Download]
Star Walk 2, a guide to the night sky, is App...
Tweetbot for iPhone Gets Quoted Tweet Notifications, Improved Video Upload Quality, More
Apple Posts 'Pride 2015' Video
Apple has posted a new 'Pride 2015' video doc...