5 ms·

I'm sure there's something I'm missing, but why not just wrap an old-school ROM in a controller that emulates the storage interface? Similarly, if the phone ta

I'm sure there's something I'm missing, but why not just wrap an old-school ROM in a controller that emulates the storage interface? Similarly, if the phone takes too long to boot, why not take a snapshot of its RAM after it has booted but before you've attempted to login? I'm sure there's some way to automate the described process with an FPGA or similar.

acqq 11y ago
Yes, the nicest trick, once you make the custom hardware is that the CPU doesn't have to "tick" at the full speed all the time which gives you the chance to process longer the conditions that need some special processing. You can "single step" the hardware.
pessimizer 11y ago
I must be missing the same thing. I would assume that after you copied the flash, you would put the old chip somewhere safe, wire an emulator into the phone, and trap/ignore any instructions that want to wipe it.
05 11y ago
You can't 'take a snapshot of its RAM' - if you could, there would be no need for NAND write block, you'd just patch the PIN delay/limit functions directly in RAM. CPU and RAM are stacked into the same IC package https://en.wikipedia.org/wiki/Package_on_package https://en.wikipedia.org/wiki/Package_on_package Secondly, there is a separate issue of the SoC hardware state that's contained in registers separate from DRAM (including CPU state). Rewriting DRAM contents does nothing to change that state.
- mistaken 11y ago
  Wouldn't it be possible to take a copy of the NAND and run the whole thing in an emulator? If they can reverse-engineer the decryption algorithm, they wouldn't even need that. Edit: It seems that there is a device specific encryption key that may be hard to extract. Bring on the electron microscopes! http://searchmobilecomputing.techtarget.com/tip/How-iOS-encryption-and-data-protection-work http://searchmobilecomputing.techtarget.com/tip/How-iOS-encr...
  - 05 11y ago
    Anti-fuses seem to be difficult to read even with electron microscopes. http://chipdesignmag.com/display.php?articleId=5045 http://chipdesignmag.com/display.php?articleId=5045

acqq 11y ago

Yes, the nicest trick, once you make the custom hardware is that the CPU doesn't have to "tick" at the full speed all the time which gives you the chance to process longer the conditions that need some special processing. You can "single step" the hardware.

pessimizer 11y ago

I must be missing the same thing. I would assume that after you copied the flash, you would put the old chip somewhere safe, wire an emulator into the phone, and trap/ignore any instructions that want to wipe it.

05 11y ago

You can't 'take a snapshot of its RAM' - if you could, there would be no need for NAND write block, you'd just patch the PIN delay/limit functions directly in RAM. CPU and RAM are stacked into the same IC package https://en.wikipedia.org/wiki/Package_on_package https://en.wikipedia.org/wiki/Package_on_package Secondly, there is a separate issue of the SoC hardware state that's contained in registers separate from DRAM (including CPU state). Rewriting DRAM contents does nothing to change that state.

mistaken 11y ago
Wouldn't it be possible to take a copy of the NAND and run the whole thing in an emulator? If they can reverse-engineer the decryption algorithm, they wouldn't even need that. Edit: It seems that there is a device specific encryption key that may be hard to extract. Bring on the electron microscopes! http://searchmobilecomputing.techtarget.com/tip/How-iOS-encryption-and-data-protection-work http://searchmobilecomputing.techtarget.com/tip/How-iOS-encr...
- 05 11y ago
  Anti-fuses seem to be difficult to read even with electron microscopes. http://chipdesignmag.com/display.php?articleId=5045 http://chipdesignmag.com/display.php?articleId=5045