October 4, 2022
Hackers Begin to Detail the SHAtter Exploit

Hackers Begin to Detail the SHAtter Exploit

Posted September 29, 2010 at 3:30pm by iClarified · 13295 views
Hackers have begun to tell the story of the SHAtter exploit, how it was discovered, and how it is being used to bring the next iPhone jailbreak.

SHAtter is an unsigned code execution vulnerability that resides in DFU mode of the S5L8930 bootrom. Uses of this exploit have already involved uploading a pwned iBSS/iBEC to provide access to the AES engine and to run custom ramdisks.

In April 2010 pod2g wrote a USB fuzzer and tested every single USB control message possible on his iPod2,1. The fuzzer found 2 vulnerabilities: - a heap overflow caused by the A1,1 control message - a way to dump the bootrom using USB descriptors request

The team tested both PoC on new generation devices (iPhone2,1, iPod3,1, iPad) and both were already fixed by Apple.

posixninja continued the fuzzing on new gens and found that with a particular sequence of USB messages it was possible to dump the BSS+Heap+Stack (on new gens only). Having a memory dump is really helpful to make exploits and it was also the first time we had this kind of dump, previous bootrom exploits (ex: 24kpwn) were done blind!

Also, his first attempts to dump the memory resulted in rebooting the device. Interesting! We'll see after that this reboot is the base of the SHAtter exploit.


Continue Reading


Hackers Begin to Detail the SHAtter Exploit
Add Comment
Would you like to be notified when someone replies or adds a new comment?
Yes (All Threads)
Yes (This Thread Only)
No
iClarified Icon
Notifications
Would you like to be notified when we post a new Apple news article or tutorial?
Yes
No
You must login or register to add a comment...
Lizamay
Lizamay - September 30, 2010 at 1:04pm
So - my iPhone 4, 4.0.1, is already jailbroken. But I believe mine is a software exploit, isn't that right? So when the new jailbreak comes out, what should I do? Unjailbreak and then update to 4.2 and re-jailbreak?
zexx0r
zexx0r - September 30, 2010 at 6:06pm
If you need an unlock, it means you will build a custom ipsw via PwnageTool (new version, that supports SHAtter exploit) and get 4.1 with old baseband version. If you do not need an unlock, you just update to 4.1 and then jailbreak it with SHAtter. :)
Alan
Alan - September 29, 2010 at 5:41pm
Gosh, I'm really anxious for this one. My brand new iPhone 4 thanks you. Great work guys!
Name
Name - September 29, 2010 at 4:21pm
So nice of the hackers to give Apple the exact items to fix.
Josh
Josh - September 29, 2010 at 5:26pm
It's a hardware exploit, so until they change the hardware, the exploit will remain
4 More Comments
Recent. Read the latest Apple News.
RECENT
Tutorials. Help is here.
TUTORIALS
How to Turn Off Always On Display on iPhone 14 Pro [Video]
How to Turn On the iPhone Startup Sound [Video]
How to Take 48MP Photos on iPhone 14 Pro [Video]
AppleTV Firmware Download Locations
Where To Download iPhone Firmware Files From
Deals. Save on Apple devices and accessories.
DEALS