How the Devteam Conquered the iPhone

Just for history’s sake: I wrote iPHUC (and yes I was 19 and came up with that name lmao) and a guy with the nic “nightwatch” who I loved working with was responsible for the initial jailbreak and coining the term itself. I believe he was also responsible for pdf or tiff exploits that unlocked the PSP, too. He worked and lived in South America possibly at a university … but that’s all I know.

It was a really fun time and I learned a lot.

Also, George Hotz endangered the welfare of a few people who had kindly gotten us access to some documentation in Japanese despite repeated pleas not to do so. Very frustrating and why the dev team all eventually stopped working on the project.

Well written and highly detailed description, as always with Fabien's work.

I remember seeing the investigation on this iPhone protection back at the time, what a journey it has been since this work.

Also, I hope someone can provide more information about that minus 0x400 shift before data write so it would be completely explained.

Anyone know what tool they used to make the flow diagrams? They seem to be text based and might be superior to mermaid.

HELP WANTED: If you happen to know why -0x400 trick works, or can get in touch with Geohotz/MuscleNerd, please let me know. I have tried to ask around but have not found any explanation. I would be happy to update this article if someone knows.

This is commonly done with fw updaters. first 0x400 bytes is a header that the earlier stage loader needs to see before it'll allow this stage to boot. So you RX the data, write it freely, just not the header. This is safe and will not allow any code exec since the header is missing. then at the end you sig check the whole thing you wrote, and if it is good, you write the header, making the whole image valid.

the trick here is you write 0x400 bytes of garbage first, 0x400 bytes earlier than your desired write. this is buffered but not written (treated as the headers). The rest of what you sent IS written (writing what you wanted where you wanted). then sig is checked. you fail. the first 0x400 is not written (and you did not want it written).

win

The “S” in original iPhone is for security. All in the name of shipping out that first product.

Just like car manufacturers. Never buy the first few model years of a new product or platform.

Those were the days. :)

These three fields would be concatenated into a token. The token would be sent to Apple server (albert.apple.com) where it would be signed with Apple's private key. The signed token would then be sent back to the device. A daemon lockdownd, listening over USB verified the token using Apple's public key. With the proof that the token came from Apple, and matching DeviceID, IMEI, and ICCID, lockdownd updated the device state to "Activated". The user then had access to the iPhone homescreen and the apps.

Sounds like the pre-cursor to oAuth now days.

Ah, the good old days. Back when iPhone hacking was easy…well not easy, but far easier.

fuck this was a beautiful trip down memory lane thanks for the work putting and narrating this story so well. I remember following the progress half way across the globe and doing the hardware soldering hack on my 1st-gen, then good ol'd Cydia days. Can't process how young these people were and how they knew how to do such low-level investigative coding. I remember back then I was doing .NET c# and thought i'm the boss, humbling.