25C3 presentation "Hacking the iPhone"

From The iPhone Wiki
Revision as of 10:09, 17 October 2010 by Liamchat (talk | contribs) (added more work)
Jump to: navigation, search




Conference Recordings

The presentation slides are currently not available. Maybe one of the presentators can upload them here or post a link.

Transcript of the presentation




Introduction (by pytey)

Good evening ladies and gentlemen. Here’s a little slide show here for you.




We formed in June 2007, just before the release of the original iPhone. We’re original hardware hackers and device enthusiasts, based around Apple products and we sort of rather say towards the iPhone as a platform. We exist on IRC. This is the first time most of us have met each other. Originally there was a couple of channels on the osx86.hu server.








We’ve got a tool called Pwnage tool and another tool called QuickPwn which is viewed here as the next good project.







So with that further I’ll hand you over to planetbeing who’s gonna talk a bit about the applications processor side of the iPhone. Thanks.

Part 1: Applications Processor (by planetbeing)











Here is how the iPhone OS is protected.



































Part 2: Baseband (by MuscleNerd)

right i am musclenerd i am part of the team is sorted in to baseband gyes and s5l gyes all thoe there is sort of a crotch i have spent most of the last few month's on the baseband side the gole on the baseband side is to remove the sim carea lock we want it completely gone for the first generation phone there where good resin's because there whereat any market's that other than the usa that you could use the iphone so there was a push to get unlock for the next generation it was open to more market's out there but there are some valid resin's other than just the challenge of it to get a software based or a non apple based unlock in to the phone mostly for travel perpus, moving between the market's

the baseband in both version's of the phone is run by a system on chip called the sgold there was the original sgold and the sgold 3 it's a full system on chip it's completely different from the s5l ( over on the application side ) it is connected to the s5l throughout some limited hardware mens serial lines, gios some i25script and some dam is used for audio there is some scattered radio peripharal's on that side three is some unique id that are permuntley etched in to the sgold to the nor that are firmware they uniquely identify your phone and come in to play a little bit later

the second generation also has gps that sort of a hardware over view software over view it's sort of got the same rhyme as the s5l side there is a sequence of loader's some of the are that first one the bottom is based in hardware we believe it is mask rom we hope it's not because if it's not and we do some thing to apple they well try to reprogram the bootrom's in the field and that would be glorious to see and we could reuse that our selves but we beleve it in mask rom so the bottom load's the bootloader witch load's the firmware witch is where that heumungus bit of code is and where all of the action takes place so that includes nucleus witch is a comet invented operating system's the gsm is in a stack and sim support and stk support and all the thing's you'd expect from the radio so there is a sequence and when i do the next few slides i will describe a little bit more detail about itch of those component's oh i forgot these what they are calling eprom and nvram witch are really just part's of the nor but there are in parameter blocks witch are smaller so you can program them faster these hold things that are well they hold two thing's tied to the baseband and thing's that are tied to your phone for example your wifi is calibrated at the factory and there is a useque set of calibration data that was determined at the factory that works with your particle rf chip to a specific profile so some of it changes depending on the baseband and some of it never changes unless you change phone

now the big thing about the baseband is and the most irritating thing is there is no recovery mode and i have alway's being jealous of planetbeing and wizdat and pumpkin and all these gyes because they alway's had a failsafe to give them a free pass to do any thing you think of to the phone some of us throughout point's have erased the nor and completely invalidated the llb like that and what happens if you have an invalid llb ( sort of a second stage ) is your phone rapidly flashes away in black with like these horrible looking sere marks going down the screen and it's very scary to watch and you think it's completely gone and we nicknamed it crismastree mode zf but as bad as it looked at the time al long as you where good with timing you can alway's enter dfu mode and recover from that there is nothing like that in the baseband there are thing;s you can do the the bseband or the images in the nor that can permontley brick your phone and on the first gen i mentioned this fakeblank thing but i will get in to it later

so now each of the bootloader's the boot rom is just the basic setup it maps the some of the tightly cupeled memory, it maps the external nor coming to the address space set's up the serial then it goose through a sequence of checks it checks to see if the nor is blank and does not check the whole nor is blank but it looks at certain key location's to see if blank if it is blank then it allows through the serial port you to upload your next stage loader if it's not blank it will go off and load it in he second generation but int in the first generation the serial payload that you send to the bottom has to be sighed with an apple certificate that was not true in the first generation phone and we actually made use of that not being true in the first generation phone quite a lot because it gives you low lever access to the baseband also in the second generation phone the bootloader it's sylph is normally signature checked to make sure it has not being tampered with and if it does not match the sinned hash then it just wont load it it will just stay there in the bootrom and spin that wasn't true in the first generation phone the bootloader which is this next step is the first few nor sectors it has a couple different entry point's normal, service mode but there is completely separate witch is only enabled by having that bit set in that chip i mentioned early it is set then considered trusted or a developer, engineer device of cross any of these thing;s i will talk about in the next few slides the bootloader in the first generation phone the nor sector's where locked down so they are not normally erasable but evan if you got the authority to remove them you would need to lift a signal to get the pin it's like an extra lockdown

the bootloader is alway's in the nor and it is invokeable and it is very easy to invoke and that bootloader it sylph i don't know if that is it's name or whether it is an official term or wether it was developed by the community but that bootloader that allows you to go off and program the next stage as long as you pass the check and one of those checks is a signature check on the firmware so the bootloader i don't think 3.9 but 4.6 bootloader on the first generation phone does signature check the firmware except for the bootloader it's sylph not being checked i guess the chain of trues begins at that point in the second generation phone unlike the first generation phone that interactive loader is not there in nor it is permanent you have to upload it you have to upload a payload that the rom acsept's with key's and along as you have the authority to do that it will go off and upload a second stage loader there is this devishon of trust in this loader of a loader that is hard to brake and it signature checks then next stage that next stage being firmware

so the firmware is where everything except for the booting happens so this is where your radio hardware get's setup and the stack's and sim start's and stk his is where all the action is once the firmware is up and running this is done by nucleus it's basically the whole program of the phone the only thing that can bring it out of this mode is a crash or a power off the firmware can be updated obviously and in the next few slides our brief description of an update

you basically reboot the baseband with a control signal you ping it and tell it to enter service mode that i talked about in the second generation phone this is where you do that multi stage loader of the loader it sylph so there is this security loader and this ram loader but in the first generation phone it was a lot eased you just reset it and ask it please go into service mode that is where they differ at that point they sort of join up again and you baysiculey give these loader's what called a secpack it's baysiculy it's a file that sinned by apple and verifiably sinned by the bootloaer and it defines what nor addresses you are allowed to touch what the signature of the firmware you are about to load so it's a sinned package describing what is about to happen if any of thoes field's are mutated in any way the signature fail's

if all of those thing's pass you send the firmware and the bootloader takes care of updating the upper nor so this is the chain of trust i am going to do it in reverse order so the sim carear lock which is our ultimate gole is enforced by the firmware defiantly do not want to go into detail because there is a lot of table's that describe the phone whether the lock exist's it's tied to two id i mentioned earlier the chip id of the sgold and the nor there is tea encryption there is rsa encryption there all the thing's that go on in the seczone  the only difference between a locked and an unlocked phone in the official sense is the tables that are encrypted in the seczone the firmware is identical the baseband is identical the bottom is identical everything is identical except the seczone that linked to a chipped and norid that is why you cant just take an officially unlocked phone somehow copy the firmware over to a locked phone and somehow make it unlocked because that seczone would not verify the bootloader and the firmware it's sylph would try to decrypt it with that phones chipid and nor id it would be bogus it would not recognise it 

so this is the check for the existing firmware the existing firmware will not be run of the integrity check fail's

(in work by http, will follow here)

End and Q&A

(in work by http, will follow here)