P0sixninja has posted some information explaining greenpois0n, spirit, and Geohot's latest exploit; as well as when they might be released.
-----
Let me start off by saying that these have been some of the wildest and craziest months I could possibly imagine. So many new things have happened; I'm really not sure where to begin. But I think I'll start by clearing up a couple of common questions and misunderstandings.
The one question I get asked the most (other than “when are you going to release?”) is “what is greenpois0n?” Put simply, greenpois0n is a toolkit designed to help discover and exploit new vulnerabilities. Let me repeat that, greenpois0n itself is NOT an exploit. Most exploits typically have much more boring and technical names, such as “iBoot Environment Variable Overflow” or “usb_control_msg(0x21, 2)”. Tools, on the other hand, are typically given more creative names, like redsn0w, blackra1n, or greenpois0n. Even though most of these tools use the same exploits, each one has its own unique strengths and weaknesses. Redsn0w was designed to be robust and low maintenance by using Apple's own NOR flashing routines, whereas blackra1n was designed to be small, fast, and have a low memory footprint. While both these tools are excellent pieces of software, neither had the flexibility nor advanced capabilities that we were really looking for. Thus greenpois0n was born.
While we do have a GUI designed to allow users to perform a simple jailbreaking, the true power is hidden away in our advanced exploit payload. Once injected into iBoot, greenpois0n inserts many new and powerful commands allowing you to do everything from accessing the AES engine to decrypt firmware keys, hook and call into existing iBoot functions, read and write to blockdevices, including the filesystem (although filesystem is read only right now), and even set breakpoints within iBoot to dump registers and stack information during runtime.
So what about the exploit I mentioned in the last post? It's still there, and turns out it's the exact same exploit Geohot demonstrated in his iPod Touch 3g video a few weeks ago, but since that time, there have been quite a few new developments. By now, I'm sure everyone has seen or heard about the userland “spirit” exploit demonstrated by Comex, and which was used to jailbreak the first iPad. This exploit is by far one of the most impressive pieces of work I think this community has seen in quite some time. The only problem with this method of jailbreaking is it can be easily patched by Apple in the next firmware update. Also, since the exploit being used resides in userland, you're denied access to many of the low level hardware features, including the ability to decrypt firmware keys. iBoot exploits, on the other hand, are much lower level and offer much more freedom to interact directly with the system unrestricted. With the exploit being so much more powerful, we've decided it would be wiser to release the “spirit” exploit first and hold onto the iBoot exploit until the next hardware revision.
Soon after this decision, I quickly set to work porting “spirit” to run on Linux and adding these capabilities into greenpois0n. At the same time, Comex, a number of members from iPhone Dev Team, and Chronic-Dev Team helped by fixing many possible snags and getting Cydia prepared to run on the iPad. It was truly an epic display of cooperation by everyone involved. Everything was progressing smoothly until yesterday. The boy-wonder Geohot threw a wrench in our gears once again after discovering a NEW exploit that pretty much blows everything we've got out of the water. So now we're forced to reconsider our release plans once again. As of today (I can't speak for tomorrow, for all I know everything could change again), both the original exploit I posted about earlier and the new “spirit” exploit are probably going to be held off for a little bit longer to avoid being patched by Apple. Also, today I mentioned on my twitter that I can almost guarantee an exploit for 3.1.3/3.2 (all devices, and all models!) before the end of the month. I would strongly advise everyone to keep a close eye on Geohot's blog for updates in the near future. And if you haven't already, PLEASE backup your SHSHs with either firmware umbrella or using Saurik method.
EDIT:
To all the people asking about an unlock, you're probably going to be waiting until the next iPhone is released. Since it hasn't even been announced yet, there's no telling how long the wait is going to be.
-----
Read More
-----
Let me start off by saying that these have been some of the wildest and craziest months I could possibly imagine. So many new things have happened; I'm really not sure where to begin. But I think I'll start by clearing up a couple of common questions and misunderstandings.
The one question I get asked the most (other than “when are you going to release?”) is “what is greenpois0n?” Put simply, greenpois0n is a toolkit designed to help discover and exploit new vulnerabilities. Let me repeat that, greenpois0n itself is NOT an exploit. Most exploits typically have much more boring and technical names, such as “iBoot Environment Variable Overflow” or “usb_control_msg(0x21, 2)”. Tools, on the other hand, are typically given more creative names, like redsn0w, blackra1n, or greenpois0n. Even though most of these tools use the same exploits, each one has its own unique strengths and weaknesses. Redsn0w was designed to be robust and low maintenance by using Apple's own NOR flashing routines, whereas blackra1n was designed to be small, fast, and have a low memory footprint. While both these tools are excellent pieces of software, neither had the flexibility nor advanced capabilities that we were really looking for. Thus greenpois0n was born.
While we do have a GUI designed to allow users to perform a simple jailbreaking, the true power is hidden away in our advanced exploit payload. Once injected into iBoot, greenpois0n inserts many new and powerful commands allowing you to do everything from accessing the AES engine to decrypt firmware keys, hook and call into existing iBoot functions, read and write to blockdevices, including the filesystem (although filesystem is read only right now), and even set breakpoints within iBoot to dump registers and stack information during runtime.
So what about the exploit I mentioned in the last post? It's still there, and turns out it's the exact same exploit Geohot demonstrated in his iPod Touch 3g video a few weeks ago, but since that time, there have been quite a few new developments. By now, I'm sure everyone has seen or heard about the userland “spirit” exploit demonstrated by Comex, and which was used to jailbreak the first iPad. This exploit is by far one of the most impressive pieces of work I think this community has seen in quite some time. The only problem with this method of jailbreaking is it can be easily patched by Apple in the next firmware update. Also, since the exploit being used resides in userland, you're denied access to many of the low level hardware features, including the ability to decrypt firmware keys. iBoot exploits, on the other hand, are much lower level and offer much more freedom to interact directly with the system unrestricted. With the exploit being so much more powerful, we've decided it would be wiser to release the “spirit” exploit first and hold onto the iBoot exploit until the next hardware revision.
Soon after this decision, I quickly set to work porting “spirit” to run on Linux and adding these capabilities into greenpois0n. At the same time, Comex, a number of members from iPhone Dev Team, and Chronic-Dev Team helped by fixing many possible snags and getting Cydia prepared to run on the iPad. It was truly an epic display of cooperation by everyone involved. Everything was progressing smoothly until yesterday. The boy-wonder Geohot threw a wrench in our gears once again after discovering a NEW exploit that pretty much blows everything we've got out of the water. So now we're forced to reconsider our release plans once again. As of today (I can't speak for tomorrow, for all I know everything could change again), both the original exploit I posted about earlier and the new “spirit” exploit are probably going to be held off for a little bit longer to avoid being patched by Apple. Also, today I mentioned on my twitter that I can almost guarantee an exploit for 3.1.3/3.2 (all devices, and all models!) before the end of the month. I would strongly advise everyone to keep a close eye on Geohot's blog for updates in the near future. And if you haven't already, PLEASE backup your SHSHs with either firmware umbrella or using Saurik method.
EDIT:
To all the people asking about an unlock, you're probably going to be waiting until the next iPhone is released. Since it hasn't even been announced yet, there's no telling how long the wait is going to be.
-----
Read More