iPhone hacks

Имам си GCC toolchain!

iPhone:~ root# gcc -v
Using built-in specs.
Target: arm-apple-darwin9
Configured with: ../llvm-gcc-4.2/configure --build=x86_64-unknown-linux-gnu --host=arm-apple-darwin9 --enable-static=no --enable-shared=yes --prefix=/usr --localstatedir=/var/cache/iphone-gcc --enable-languages=c,c++,objc,obj-c++ --enable-wchar_t=no --with-gxx-include-dir=/usr/include/c++/4.0.0
Thread model: posix
gcc version 4.2.1 (Based on Apple Inc. build 5555)

I can has debugger. На iPhone разработчиците английския им е като втори майчин език!

iPhone:~ root# cat hello.c 
#include <stdio.h>
int main() {
	printf("hello\n");
	return 0;
}
iPhone:~ root# gcc hello.c
iPhone:~ root# ./a.out 
Killed
iPhone:~ root# dmesg | tail -1
seatbelt: hook..execve() killing pid 242: outside of container && !i_can_has_debugger
iPhone:~ root# ldid -S a.out
iPhone:~ root# ./a.out 
hello

Добре познатото xnu ядро върху ARM S5L8900X

iPhone:~ root# uname -a
Darwin iPhone 9.4.1 Darwin Kernel Version 9.4.1: Sat Nov  1 19:09:48 PDT 2008; root:xnu-1228.7.36~2/RELEASE_ARM_S5L8900X iPhone1,2 arm N82AP Darwin

Процесор 412Mhz , little endian, 32 Kb cache, памет 128 Mb

iPhone:~ root# sysctl hw
hw.ncpu: 1
hw.byteorder: 1234
hw.memsize: 121634816
hw.activecpu: 1
hw.optional.floatingpoint: 1
hw.packages: 1
hw.tbfrequency: 6000000
hw.fixfrequency: 24000000
hw.prffrequency_max: 51500000
hw.prffrequency_min: 51500000
hw.prffrequency: 51500000
hw.memfrequency_max: 137333333
hw.memfrequency_min: 137333333
hw.memfrequency: 137333333
hw.l1dcachesize: 16384
hw.l1icachesize: 16384
hw.cachelinesize: 32
hw.cpufrequency_max: 412000000
hw.cpufrequency_min: 412000000
hw.cpufrequency: 412000000
hw.busfrequency_max: 103000000
hw.busfrequency_min: 103000000
hw.busfrequency: 103000000
hw.pagesize: 4096
hw.cachesize: 0 0 0 0 0 0 0 0 0 0
hw.cacheconfig: 0 16384 16384 1 32 4 0 0 0 0
hw.cpufamily: -1879695144
hw.cpu64bit_capable: 0
hw.cpusubtype: 6
hw.cputype: 12
hw.logicalcpu_max: 1
hw.logicalcpu: 1
hw.physicalcpu_max: 1
hw.physicalcpu: 1
hw.machine = iPhone1,2
hw.model = N82AP
hw.ncpu = 1
hw.byteorder = 1234
hw.physmem = 121634816
hw.usermem = 91435008
hw.pagesize = 4096
hw.epoch = 1
hw.vectorunit = 0
hw.busfrequency = 103000000
hw.cpufrequency = 412000000
hw.cachelinesize = 32
hw.l1icachesize = 16384
hw.l1dcachesize = 16384
hw.tbfrequency = 6000000
hw.memsize = 121634816
hw.availcpu = 1

feedface и асемблер за ARM

iPhone:~ root# objdump -D a.out | head

a.out:     file format mach-o-le

Disassembly of section LC_SEGMENT.__TEXT:

0000000000001000 <LC_SEGMENT.__TEXT>:
    1000:	feedface 	cdp2	10, 14, cr15, cr13, cr14, {6}
    1004:	0000000c 	andeq	r0, r0, ip
    1008:	00000000 	andeq	r0, r0, r0
    100c:	00000002 	andeq	r0, r0, r2

8 Gb флаш

iPhone:~ root# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/disk0s1          523M  489M   29M  95% /
devfs                  25K   25K     0 100% /dev
/dev/disk0s2          7.1G  1.2G  6.0G  16% /private/var

Процеси и yellowsn0w

iPhone:~ root# ps ax    
  PID   TT  STAT      TIME COMMAND
 ??  Ss     0:02.60 /sbin/launchd
 ??  Ss     0:01.55 /usr/sbin/mDNSResponder -launchd
 ??  Ss     0:02.38 /usr/sbin/notifyd
 ??  Ss     0:03.03 /usr/sbin/syslogd
 ??  Ss     0:13.70 /usr/sbin/configd
 ??  Ss     2:07.40 /System/Library/CoreServices/SpringBoard.app/SpringBoard
 ??  Ss     0:00.70 /usr/bin/yellowsn0w
 ??  Ss     0:00.44 /Applications/MxTube.app/MxT2d
 ??  Ss     0:00.72 /usr/sbin/update
 ??  Ss     0:28.78 /usr/libexec/lockdownd
 ??  Ss     0:32.73 /usr/sbin/mediaserverd
 ??  Ss     0:02.83 /System/Library/PrivateFrameworks/IAP.framework/Support/iapd
 ??  Ss     0:00.29 /usr/sbin/fairplayd
 ??  Ss     0:07.88 /System/Library/PrivateFrameworks/CoreTelephony.framework/Support/CommCenter
 ??  Ss     0:01.11 /usr/sbin/BTServer
 ??  Ss     0:03.12 /Applications/MobilePhone.app/MobilePhone
 ??  Ss     0:10.22 /Applications/MobileMail.app/MobileMail
 ??  Ss     0:58.92 /Applications/MobileSafari.app/MobileSafari
 ??  Ss     0:00.59 /System/Library/Frameworks/SystemConfiguration.framework/SCHelper
 ??  Ss     0:00.27 /usr/libexec/ptpd -t usb
 ??  S      0:00.38 /usr/libexec/afcd --lockdown -d /var/mobile/Media -u mobile
 ??  S      0:00.11 /usr/libexec/notification_proxy
 ??  S      0:01.48 /usr/sbin/sshd -i
 ??  Ss     0:00.11 /usr/libexec/securityd
s000  Ss     0:00.42 -sh
s000  R+     0:00.02 ps ax

Nmap

iPhone:/ root# nmap 192.168.1.1

Starting Nmap 4.76 ( http://nmap.org ) at 2009-04-02 22:26 EEST
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Interesting ports on 192.168.1.1:
Not shown: 997 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
1900/tcp closed upnp
8080/tcp open   http-proxy
MAC Address: xx:xx:xx:xx:xx:xx (Tp-link Technologies Co.)

Nmap done: 1 IP address (1 host up) scanned in 16.17 seconds

TinyScheme след преправяне на makefile и компилиране

iPhone:~/tinyscheme1.39 root# make
gcc -I. -c -Os  scheme.c 
gcc -I. -c -Os  dynload.c 
gcc  -shared   scheme.o dynload.o  -ldl 
gcc -o scheme -Os scheme.o dynload.o  -ldl 
iPhone:~/tinyscheme1.39 root# ldid -S scheme
iPhone:~/tinyscheme1.39 root# ls -al scheme
-rwxr-xr-x 1 root staff 46224 Apr  2 22:37 scheme*
iPhone:~/tinyscheme1.39 root# ./scheme 
TinyScheme 1.39
> (eval (car (list (quote (display "scheme baby!")))))
scheme baby!#t

Debian rulez

1 root# apt-get update

My Shiny Weblog!

programming, photography and lifestyle