An Explanation of the Current Jailbreak Situation

Posted April 11, 2010 at 2:28am by iClarified | Please help us and submit a translation by clicking here | 44419 views
Chinese (Simplified)  

P0sixninja has posted some information explaining greenpois0n, spirit, and Geohot's latest exploit; as well as when they might be released.

-----
Let me start off by saying that these have been some of the wildest and craziest months I could possibly imagine. So many new things have happened; I'm really not sure where to begin. But I think I'll start by clearing up a couple of common questions and misunderstandings.

The one question I get asked the most (other than “when are you going to release?”) is “what is greenpois0n?” Put simply, greenpois0n is a toolkit designed to help discover and exploit new vulnerabilities. Let me repeat that, greenpois0n itself is NOT an exploit. Most exploits typically have much more boring and technical names, such as “iBoot Environment Variable Overflow” or “usb_control_msg(0x21, 2)”. Tools, on the other hand, are typically given more creative names, like redsn0w, blackra1n, or greenpois0n. Even though most of these tools use the same exploits, each one has its own unique strengths and weaknesses. Redsn0w was designed to be robust and low maintenance by using Apple's own NOR flashing routines, whereas blackra1n was designed to be small, fast, and have a low memory footprint. While both these tools are excellent pieces of software, neither had the flexibility nor advanced capabilities that we were really looking for. Thus greenpois0n was born.

While we do have a GUI designed to allow users to perform a simple jailbreaking, the true power is hidden away in our advanced exploit payload. Once injected into iBoot, greenpois0n inserts many new and powerful commands allowing you to do everything from accessing the AES engine to decrypt firmware keys, hook and call into existing iBoot functions, read and write to blockdevices, including the filesystem (although filesystem is read only right now), and even set breakpoints within iBoot to dump registers and stack information during runtime.

So what about the exploit I mentioned in the last post? It's still there, and turns out it's the exact same exploit Geohot demonstrated in his iPod Touch 3g video a few weeks ago, but since that time, there have been quite a few new developments. By now, I'm sure everyone has seen or heard about the userland “spirit” exploit demonstrated by Comex, and which was used to jailbreak the first iPad. This exploit is by far one of the most impressive pieces of work I think this community has seen in quite some time. The only problem with this method of jailbreaking is it can be easily patched by Apple in the next firmware update. Also, since the exploit being used resides in userland, you're denied access to many of the low level hardware features, including the ability to decrypt firmware keys. iBoot exploits, on the other hand, are much lower level and offer much more freedom to interact directly with the system unrestricted. With the exploit being so much more powerful, we've decided it would be wiser to release the “spirit” exploit first and hold onto the iBoot exploit until the next hardware revision.

Soon after this decision, I quickly set to work porting “spirit” to run on Linux and adding these capabilities into greenpois0n. At the same time, Comex, a number of members from iPhone Dev Team, and Chronic-Dev Team helped by fixing many possible snags and getting Cydia prepared to run on the iPad. It was truly an epic display of cooperation by everyone involved. Everything was progressing smoothly until yesterday. The boy-wonder Geohot threw a wrench in our gears once again after discovering a NEW exploit that pretty much blows everything we've got out of the water. So now we're forced to reconsider our release plans once again. As of today (I can't speak for tomorrow, for all I know everything could change again), both the original exploit I posted about earlier and the new “spirit” exploit are probably going to be held off for a little bit longer to avoid being patched by Apple. Also, today I mentioned on my twitter that I can almost guarantee an exploit for 3.1.3/3.2 (all devices, and all models!) before the end of the month. I would strongly advise everyone to keep a close eye on Geohot's blog for updates in the near future. And if you haven't already, PLEASE backup your SHSHs with either firmware umbrella or using Saurik method.

EDIT:
To all the people asking about an unlock, you're probably going to be waiting until the next iPhone is released. Since it hasn't even been announced yet, there's no telling how long the wait is going to be.
-----

Read More


Share
Add Comment
Jonathan - April 13, 2010 at 8:01pm
I have seen promises before about Greenpoison being released by Xmas. BlackRa1n came through instead. Dont donate for Greenpoison VaporWare, wait until you get a working tool, then donate.
Lugoco - April 13, 2010 at 10:35am
Excuse my ignorance but what is the... \"backup your SHSHs with either firmware umbrella or using Saurik method\". What is this for, and how do you do it. (Is there a Tutorial?)
ngk - April 12, 2010 at 8:57am
I\'m wondering what will gone happen with all the \"hack industry\" if Apple will release iPhone 4G free from any contractual obligation with any gsm/3g/etc. providers...
mp3 - April 12, 2010 at 10:58am
Some low end internet dudes will try to sell you the jailbreak.
brandon - April 22, 2010 at 1:08pm
the hacking will continue bcuz apple will continue to have the system locked down regardless of if the phone is unlocked for any carrier Jailbreaking will continue until apple burns or realizes to unjail the system natively
steve - April 11, 2010 at 4:43am
jailbreak out tomorrow
ithoo - April 11, 2010 at 3:41pm
how did u know???
GUS - April 11, 2010 at 10:07pm
I don\'t think so !
ithoo - April 11, 2010 at 11:03pm
I know one thing. Tomorrow will never comes........
c - April 11, 2010 at 3:31am
why does iclarified have a bunch of birds sweeping around my screen
0 More Comments
Follow iClarified
Hands-On With an Alleged Case for the 4.7-inch iPhone 6 [Video]
A new video goes hands-on with an alleged cas...
Notes From Apple's Second Quarter Earnings Call
Here's some notes taken from Apple's second q...
Apple Expands Capital Return Program to Over $130 Billion
Apple today announced that its Board of Direc...
Apple Announces Second Quarter Results of $45.6 Billion in Revenue, $10.2 Billion in Net Profit
Google Maps Now Lets You Go Back in Time With Street View
Google has announced that starting today you ...