5.8 Exploit
Ο Geohot βρήκε ένα bug στον bootloader 5.8 του iPhone 3G που μας επιτρέπει να κάνουμε downgrade το baseband.
Δυστυχώς, οι περισσότεροι που χρειάζονται το downgrade έχουν iPhone με 5.9 Bootloader: σε αυτή την περίπτωση το exploit δεν μπορεί να εκτελεστεί πλήρως, αλλά ο Geohot νομίζει ότι είναι δυνατόν να τρέξει ο ramloader του 5.8 σε αυτές τις συσκευές.
Ο Geohot και η DevTeam είναι πίσω και σύντομα όσοι χρήστες κάνανε κατά λάθος update στα iPhone τους σε 2.2.1 θα μπορούνε να τα κάνουν downgrade και να χρησιμοποιήσουν το Yellowsn0w.
I’ve been off the iPhone scene for a while. A couple days ago, I got an e-mail from Chronic asking for help with the new asr. I helped out with genpass, and started reading through theiphonewiki again. Thanks so much for all the information contributed so far; it prompted me to find this.
In bootloader 5.8 on the 3G, the loader signature validator is broken. Someone botched an if statement checking the location and length of the loader in the cert. Because of this, you can pass the run cert for the firmware you currently have on the phone instead of the loader cert, and send whatever you want as a loader.
Here is a bspatch file to be applied to ICE2_02.28.00.fls allowing downgrades from 2.30.03 using BBUpdaterExtreme. By replacing the patched cert with your current run cert, you can downgrade from any other version.
Unfortunately, most 3G’s out there are bootloader 5.9 I was hoping, since RSA was added to the bootrom, that it would run the vulnerable ramstrapper, but I had no luck, although I didn’t try that hard. I see no reason why it shouldn’t work theoretically; the bootrom RSA is complicated, maybe when I finish EDA…