3 ms·
Unfortunately, the SecureROM vulnerability that gala exploits was patched in the ROMs shipped with the 4s. Therefore, gala won't work out-of-the-box with the 4s
by codyd51 3y ago
Unfortunately, the SecureROM vulnerability that gala exploits was patched in the ROMs shipped with the 4s. Therefore, gala won't work out-of-the-box with the 4s.
However, a newer boot ROM exploit, checkm8, has become well-known in the intervening years. The A5 (that the 4s ships) is vulnerable to checkm8, which means that it'd certainly be possible to add support for this exploit chain to a project like gala!
- Nezteb 3y agoI've been waiting for years for a project/tool to come along that allows me access to an old iPhone 4s (S5L8940) I have that is locked with an unknown PIN. I really just want the photos on it for nostalgia reasons. The closest I found at the time was ipwdnfu, but it doesn't support the 4s [1]. I had assumed that this meant that checkm8 (which ipwdnfu uses/includes) didn't support the 4s either. Is that not the case? [1] https://github.com/axi0mX/ipwndfu/issues/175 https://github.com/axi0mX/ipwndfu/issues/175
- bri3d 3y agoThe same exploit is present in the 8940, but the path to get there is slightly different and incompatible with normal PC host USB controllers due to the need to avoid ever sending a zero length packet. There are plenty of ports using low level host hardware, for example https://github.com/a1exdandy/checkm8-a5 https://github.com/a1exdandy/checkm8-a5 . I think Sliver does what you want (PIN bypass) end to end for this device.