iPhone News

Having difficulties installing Dropbear SSH on your iPhone? Never fear! Nate True has written a collection of scripts to automate the process. In 4 easy steps --

1. Jailbreak the iPhone -- "jailbreak.exe" included.
2. Download Nate True's iPhone SSH kit (below) and extract it somewhere.
3. Run "sshify-windows.bat" and follow the instructions carefully.
4. Connect with SSH!

By default the root password is "dottie." Username: root Password: dottie Capture the iPhone's IP address under Settings -> Wi-Fi. Tap the blue icon next to the connected network. These scripts are written for Windows; a Mac equivalent shouldn't be difficult to create. Basically "sshify-windows.bat" needs modification, and a Mac-compiled version of iPhoneInterface has to be used. Download: Nate True's iPhone SSH Kit Thanks Alin - source: cre.ations.net

Update: v0.08 is now available...

• stepwhite Initial release
• 0.02 nervegas Implemented frame skip
• 0.03 nervegas Rewrote rendering routines using CoreSurface
• 0.04 nervegas Added multi-touch support to controller
• 0.05 nervegas Further optimizations
• 0.06 nervegas Corrected color palette
• 0.07 nervegas Further controller improvements (dragging, etc)
• 0.08 nervegas Further controller improvements (fixed disconnect, etc)

---

All I gotta say is, awesome! The first iPhone Nintendo emulator! Project owner, stepwhite, has managed to conquer NES emulation on the iPhone using InfoNES core -- "A fast and portable NES emulator." While in the early stages of development, the emulator port currently lacks sound (but who cares, listen to your own mp3s while playing 1942) and is a tad slow... Controls are somewhat iffy also... Nonetheless, the future looks quite promising. I soon sense smoothness... Smooth, smooth, smoothness... Copy your ROMs to /var/root/Media/ROMs/NES. I've received a few emails concerning installation; this is how I got it working:

1. First and foremost, get SSH operational -- read here
2. Download this iPhone binary kit
3. Copy usr/lib/libarmfp.dylib to /usr/lib on your iPhone's file system
4. Also copy libexec/sftp-server and usr/bin/scp to their respective folders on the iPhone. This should be enough to get SCP working.
5. I recommend copying the whole she-bang; /bin, /usr, /usr/bin, /var, etc... This way you have all the iPhone compiled binaries for future purposes
6. Once the above is all working; scp NES.app to /Applications; from a terminal
   $ scp -r NES.app root@<iphone_ip>:/Applications
7. Enter the pass "dottie" (if you haven't changed it yet)
8. Reboot, "NES" should appear on the home screen

That's the gist of things... Problems? Consult our forums. By the way, you only need to setup SSH/SCP once -- use it whenever afterwards. Download: iphonenes v0.08 - source: google code

bitSplit has given iFuntastic a new version number, 2.5.0. For good reason too! The Mac app which provides the simplest ways to customize your iPhone now features a full file browser, allowing easy navigation through the iPhone's internal file system. Unfortunately Intel-based Mac's are only supported for now. Within the coming days a PPC-supported version should be available. Stay tuned! Download: iFuntastic 2.5.0 - source: iphonealley

Astonishing! Although it's not a total unlock quite yet, its been reported working for the most part -- all in/out calls and sms messages! Perhaps this method can be mimicked entirely via software, who knows... Till that day, you'll require a few things... Requirements:

1. an iPhone
2. SIM Reader / Writer -- Infinity USB Unlimited, Dynamite Programmer, etc...
3. SilverCard
4. V1 SIM card (must be able to get Ki number)
5. Download: this, and this.

Props to Vladimir, OZ, and all the others who got this working... If anyone knows any shops in Toronto selling the necessities or performing the unlock itself, please contact me. - discussion thread - How to, over in the hackint0sh forum, Sassha writes --

1. ::Getting IMSI,ICCID & Ki number from your SIMs:: Step 1 - Your(V1)SIM 1. Put your carrier SIM card in programer 2. Run Woronscan 3. Click on "Tasks" tab then on "IMSI select" u will get a IMSI number, write it down. 4. Click on "Task" tab then on "ICC select" u will get a ICCID number, write it down. 5. Click on "Tasks" tab then on "Ki search", in pop-up window just click "Search", and wait,Ki extraction has began.(I was waiting for mine 40 min ) When u get it, write it down. Step 2 - Getting IMSI from AT&T SIM card which came with an iPhone 1. Put your AT&T SIM card in programer 2. Click on "Tasks" then on "IMSI select" u will get a IMSI number, write it down. 3. Close Woronscan 4. Remove SIM from programer Now U have all "data" to make SuperSim. ::Making SuperSim:: 1. Download & extract this 1.a Put your Silvercard in programer 2. Run Sim-Emu 6.01 Configurator v2.1 3. Click on Configure tab 4. Click "Read from disk" button 5. Browse to your downloaded Flash&EEPROM files, first double click on SIM_EMU_6.01_iphone.HEX and then double click on SIM_EMU_6.01_iphone_EP.HEX, now they are loaded,positions 0 and 9 are red colored,thats fine. 6. In position 0 , type in data which u got from your carrier SIM with Woronscan - IMSI,Ki & ICCID! For ADN/SMS/FDN# type 161, 15, 4, for SMS Centre type in your carrier SMS center number. 7. Now select position 9, here type only IMSI from AT&T SIM card, NOTHING ELSE! 8. In "Config mode" check "Card" circle button 9. Click on "Write to card" button,when its done close Sim-Emu 6.01 Configurator v2.1 10. Run Woronscan again, click on "Tasks" tab then click on "IMSI select" 5 times in a row,U should get first two times AT&T IMSI rest three times your SIM IMSI,if u do u're ready to go! 11. Click on "Security" tab then on "Disable PIN1", it will ask U PIN1 ,its 1111, click OK. 12. Close Woronscan, and remove card from programer 13. http://www.mobileshop.org/usertech/simcutting.htm 2. ::Making your iPhone SuperSim compatible:: Step 1 MAC WINDOWS Step 2 For already "fake activated" iPhones ,put the AT&T SIM that it came with iPhone in it or deactivation in step 12. will not work! In "Step 15" when U are filling in fileds ,for ICCID use your carrier SIM ICCID not AT&Ts! When u download a "custom activator v0.2" DO NOT PROCCED to Step 16! At this point remove AT&T SIM card from iPhone(still connected to computer),put in your SuperSim AND THEN procced to Step 16.! MAC WINDOWS

I was anxiously awaiting this, and of course a full unlock, but today is today which brings my dream to a partial reality, MobileTerminal -- a terminal emulator app for the iPhone. Don't be mistaken, MobileTerminal is not a SSH or Telnet client; however, it can be used to execute iPhone-compiled binaries. So, you may use whatever client, providing the binary has been compiled using the toolchain. Ya dig? I got this working on my iPhone a few hours ago; must say, awesome job guys. Thanks! What I did (jailbreak first):

• get SSH working -- so you can SSH to your iPhone (find the IP address under Settings -> Wi-Fi)
• download iPhone Binaries Kit 0.04
• whichever method you prefer, respectfully copy the binaries to /bin and /usr/bin from the above package -- using iPhoneInterface, iPHUC, SCP (if you have that working, etc...)
• copy Terminal.app (downloaded below) to /Applications; you may need to chmod it
  $ chmod +x /Applications/Terminal.app/Terminal
• reboot the iPhone; the app should appear

That pretty much sums it up... Should you run into difficulties, our forums may enlighten you. Otherwise, there is a better installation guide on the project's home page. Download: MobileTerminal v85 - source: google code

A few days ago another tremendous breakthrough was achieved by the iPhone Dev Team. The skilled individuals behind the iPhone unlocking movement have successfully developed a program responsible for dumping the baseband chip's NOR memory. NOR memory is dumped while in the bootloader's interactive mode; the resulting file will contain the bootloader, the main code, and the eeprom. Somewhere in that mess of binary data is what we're looking for! ;)

Just a couple of days ago we managed to extract the full content of the NOR memory (from the S-Gold2), which is the main key to achieving a true unlock. Releasing this dump would be of course illegal and risky, as it contains personal information and copyrighted code. That said, we're going to release the NOR Dumper binary to enable everyone else to continue working on the iPhone's unlocking. We'll release the source code at a later date when we feel it is mature enough to do so.

To use iPhone NOR Dumper:

• copy NORDumper to /usr/bin
• set the executable flag with chmod (chmod +x /usr/bin/NORDumper)
• add <key>Disabled</key><true/> to /System/Library/LaunchDaemons/com.apple.CommCenter.plist and reboot
• type: NORDumper dump.bin

Download: NOR Dumper Share your gratitude on #iphone @ irc.osx86.hu

Introducing the iPhone Dev Team's iPHUC; pronounced, "i fuck." It is the next iteration of iPhoneInterface providing improved usability and more features. iPHUC (iPHoneUtilityClient) actually behaves like a real shell. I've taken the liberty in compiling the latest from SVN; its been compiled on my Intel Mac. For those with PPC Macs, follow these instructions:

• Download and install Macports
• Open Terminal and issue the following commands $ sudo port install readline $ cd /directory/where/you/want/iphuc $ svn co http://iphonesvn.halifrag.com/svn/iPhone $ cd ./iPhone/trunk/iPHUC/
• Get the most recent version of MobileDevice.h and save a copy to 'MobileDevice.h' in the iPHUC directory
• Issue the following commands $ ./autogen.sh && ./configure --with-readline=/opt/local && make $ ./iPHUC

iPHUC features:

• Remote Tab Completion
• Can be used to jailbreak on both PPC and Intel without messing up iTunes
• Code is now maintainable and easily extendable for others to add features and fixes

Future features:

• Script executions to allow one command to jailbreak, one command to set up SSH and SCP
• Verbosity control
• Nice interface to get/put notes from the phones notes application

iPHUC works fine with iPhone Software v1.0.1. Kudos team! Download: iPHUC 0.5.0 (Intel) - source: #iphone.iphuc

Apple has officially released software version 1.0.1 for the iPhone... After successfully decrypting the update using vfdecrypt...

Edit vfdecrypt.c putting in the key you found where it says INSERT KEY HERE. Use the same amount of characters as the hyphens in there, replacing them with parts of the key. Now compile vfdecrypt. You can use Cygwin - use the command gcc vfdecrypt.c -lcrypto -o vfdecrypt.exe Run vfdecrypt, passing it the name of the encrypted DMG ("694-5281-6.dmg") and the name of an output file (say, "694-5281-6-decrypted.dmg"). Now if you're on Windows you need Transmac to open the DMG. If you're on Mac you can just open it.

...Its been reported that manually copying the new/changed files to a jailbroken iPhone will result in hacked components continuing to work -- SSH, jailbreak, 3rd-party compiled binaries, custom ringtones, etc... I'm sure this process will be streamlined in the future. Upgrading your iPhone via iTunes probably isn't the best idea; that is, if you're looking to hack it. :) - source: cre.ations.net iPhone v1.0.1 changelog... Safari -- CVE-ID: CVE-2007-2400

• Impact: Visiting a malicious website may allow cross-site scripting
• Description: Safari's security model prevents JavaScript in remote web pages from modifying pages outside of their domain. A race condition in page updating combined with HTTP redirection may allow JavaScript from one page to modify a redirected page. This could allow cookies and pages to be read or arbitrarily modified. This update addresses the issue by correcting access control to window properties. Credit to Lawrence Lai, Stan Switzer, and Ed Rowe of Adobe Systems, Inc. for reporting this issue.

Safari --CVE-ID: CVE-2007-3944

• Impact: Viewing a maliciously crafted web page may lead to arbitrary code execution
• Description: Heap buffer overflows exist in the Perl Compatible Regular Expressions (PCRE) library used by the JavaScript engine in Safari. By enticing a user to visit a maliciously crafted web page, an attacker may trigger the issue, which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript regular expressions. Credit to Charlie Miller and Jake Honoroff of Independent Security Evaluators for reporting these issues.

WebCore -- CVE-ID: CVE-2007-2401

• Impact: Visiting a malicious website may allow cross-site requests
• Description: An HTTP injection issue exists in XMLHttpRequest when serializing headers into an HTTP request. By enticing a user to visit a maliciously crafted web page, an attacker could trigger a cross-site scripting issue. This update addresses the issue by performing additional validation of header parameters. Credit to Richard Moore of Westpoint Ltd. for reporting this issue.

WebKit -- CVE-ID: CVE-2007-3742

• Impact: Look-alike characters in a URL could be used to masquerade a website
• Description: The International Domain Name (IDN) support and Unicode fonts embedded in Safari could be used to create a URL which contains look-alike characters. These could be used in a malicious web site to direct the user to a spoofed site that visually appears to be a legitimate domain. This update addresses the issue by through an improved domain name validity check.

WebKit -- CVE-ID: CVE-2007-2399

• Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
• Description: An invalid type conversion when rendering frame sets could lead to memory corruption. Visiting a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution. Credit to Rhys Kidd of Westnet for reporting this issue.

The Operator has released a simple Toolchain Helper responsible for copying the iPhone's file system to your Mac. You're granted two options:

1. Copy Core Filesystem
2. Copy Full Filesystem.

"Copy Core Filesystem" copies everything but your media files & preferences (MP3s, pictures, etc...). So obviously it's faster if your iPhone is packed full of goodies. While, you guessed it, "Copy Full Filesystem" does the whole shebang. Great tool for developers or simply poking around. Kudos Op. Note: This app only works when the iPhone is in "jailbreak" mode. Download: Toolchain Helper 1.0.2

Presenting bitSplit's most recent iFuntastic release, version 2.1.0 b001. iFuntastic for Mac OS X allows anyone to easily customize their iPhone, and I mean easily. Truly -- it's user-friendly to the max! Custom ringtones, set a new carrier logo, rearrange the home screen, you name it -- all customizable!

Very nicely done bitSplit! Download: iFuntastic 2.1.0 b001 - source: iphonealley

Told you to check back for a release, "Hello World" -- the first 3rd party app for the iPhone. Released is a binary from the iPhone dev community. As well, for those with the toolchain installed and/or have a curious mind, the source code is available. These are the steps I took...

• Perform jailbreak
• Get Dropbear-SSH working on the iPhone -- follow this guide.
• Copy the 'hello' binary to /bin using iPhoneInterface -- putfile /bin/hello
• SSH to your iPhone
• Type: /bin/chmod +x /bin/hello
• Type: /bin/hello

Voila!

Now that we have a functioning toolchain, what's left? Unlocking the iPhone! Download: Hello World (bin) | Hello World (src) - source: #iphone @ irc.osx86.hu