3 ms·
> HELP WANTED: If you happen to know why -0x400 trick works, or can get in touch with Geohotz/MuscleNerd, please let me know. I have tried to ask around b
by dmitrygr 3y ago
> HELP WANTED: If you happen to know why -0x400 trick works, or can get in touch with Geohotz/MuscleNerd, please let me know. I have tried to ask around but have not found any explanation. I would be happy to update this article if someone knows.
This is commonly done with fw updaters. first 0x400 bytes is a header that the earlier stage loader needs to see before it'll allow this stage to boot. So you RX the data, write it freely, just not the header. This is safe and will not allow any code exec since the header is missing. then at the end you sig check the whole thing you wrote, and if it is good, you write the header, making the whole image valid.
the trick here is you write 0x400 bytes of garbage first, 0x400 bytes earlier than your desired write. this is buffered but not written (treated as the headers). The rest of what you sent IS written (writing what you wanted where you wanted). then sig is checked. you fail. the first 0x400 is not written (and you did not want it written).
win
- ixtli 3y agoiZsh ( https://x.com/izsh1911 https://x.com/izsh1911 ) might also know but i lost track of that guy more than 10 years ago :(
- ixtli 3y agoAlso the part where you talk about “recovery mode” I think we referred to this as DFU mode back in the day. “Device firmware update” I’m not entirely sure it was called “recovery” at the time though I could be wrong as it’s been more than 15 years
- sneak 3y agoI think DFU mode and recovery mode are different. In recovery mode the screen is initialized and displays the “connect to iTunes” image. In DFU mode the screen is blank; I think this is implemented by the bootrom and can be used to restore even iBoot. https://www.theiphonewiki.com/wiki/DFU_Mode https://www.theiphonewiki.com/wiki/DFU_Mode
- ixtli 3y agoooo good point it’s been so long I might be misremembering. the reason I commented was because I thought you had to put the device in DFU to upload the image to the Media dir that was mounted rw. But again it’s been 15 years lol
- 95014_refugee 3y agoDFU is implemented in the ROM; it is morally if not technically a subset of the open standard by the same name. Recovery mode is implemented in iBoot; it provides mediated access to the command interpreter and some file-ish transfer capabilities. Both are still in use; whilst the implementations have obviously evolved the fundamental interactions have not changed since the original Apple (not Samsung) ROMs.