January 27, 2023
GeoHot Explains How the PurpleRa1n Jailbreak Works

GeoHot Explains How the PurpleRa1n Jailbreak Works

Posted July 13, 2009 at 9:22pm by iClarified · 15535 views
GeoHot has added an entry to TheiPhoneWiki explaining how his purplera1n iPhone 3GS jailbreak works.

Below you can read the step by step description of what the exploit does...

* purplera1n sends the enter recovery commands using iTunesMobileDevice
* once in recovery(iBoot), it sends the IBoot Environment Variable Overflow exploit
* the exploit adds a "geohot" command to the phone which runs the payload
* the "geohot" command is run, control is now transferred from iboot to the payload
* the purplera1n client is done

Inside payload
* the payload restores the default environment variable ring buffer and saves the environment to nvram(sets auto-boot to true)
* it patches iBoot to load unsigned img3s and not care about the tags
* it loads the purplera1n picture(sent with payload)
* the nor patcher starts
* llb is decrypted, patched, and increased in size to 0x24200. this is the resident 0x24000 Segment Overflow exploit
* a little loader code is put @ 0x20000 in the LLB to load it and fix the stack
* iboot is decrypted, patched
* everything else is read as is
* nor is written back, nor patcher is done
* kernel is loaded, decrypted, and patched
* ramdisk is loaded(sent with payload) and moved to ramdisk region at 0x44000000, patched kernel is tacked on to the end
* patched kernel is booted
* control is now transferred from payload to ramdisk

Inside ramdisk
* launchd is run, all stuff happens here
* /dev/disk0s1 is mounted
* fstab and services are overwritten here to allow disk0s1 writes and afc2 respectively
* Freeze.app is transferred and Freeze.app loader has SUID bit set
* patched kernel is read from end of ramdisk block device and written to filesystem
* ramdisk is done, rebooting...

Reboots as jailbroken phone

Read More

GeoHot Explains How the PurpleRa1n Jailbreak Works
Add Comment
Would you like to be notified when someone replies or adds a new comment?
Yes (All Threads)
Yes (This Thread Only)
iClarified Icon
Would you like to be notified when we post a new Apple news article or tutorial?
You must login or register to add a comment...
RRR - August 4, 2009 at 6:25am
i got an iphone 3gs w/c wont turned on. it got stuck on purplera1n's entering recovery mode.. the iphone wont turn on now.. can you help? i tried to connect to itunes sa i can do a recovery but it doesnt seem to see the iphone
yasha - July 15, 2009 at 8:48am
Real hax0rs not afraid to show code cuz they know there's always another bug waiting... much respect to geohot!
zenrock - July 14, 2009 at 1:50pm
LOL geohot and the dev team need to calm down before they kill the jailbreaking community with all this nonsense wtf is it with you guys giving out the code in a public forum so the experts at apple can look at this and start slamming the door shut on you guys 3.0 just showed how good they are getting at making it harder for both of you and now you just up and hand them all the jailbreak code i have lost all respect for you guys that's like the usa just handing the nuke formula to the germans in world war 2 what are you guys smoking seriouslly. you guys are going the why of winpwn,ziphone extincted keep this up. morons
dt - August 4, 2009 at 10:57am
Hey stupid. What are you contributing. GeoHot, the DevTeam, Zibri, etc... can do whatever they want with their code. Contribute more than hot air then you can call the shots. Until then shut up.
ayyywa - July 14, 2009 at 11:26am
What is somewhat frustrating is that Apple is taking North America for a ride. many other countries banned the sale of locked iPhones ande I don't see a reason why we can't lobby for that in US and Canada. I know that JB is different but an unlocked phone is a right since we are entering in a contract for service. Price with no contract should include an officially unlocked phone too. Unless we all go for this, it won't happen. cheers
21 More Comments
Recent. Read the latest Apple News.
Tutorials. Help is here.
Where to Download macOS Ventura
AppleTV Firmware Download Locations
Where to Download iPod touch Firmware Files From
Where To Download iPad Firmware Files From
Where To Download iPhone Firmware Files From
Deals. Save on Apple devices and accessories.