ipwndfu

I've been waiting for years for a project/tool to come along that allows me access to an old iPhone 4s (S5L8940) I have that is locked with an unknown PIN. I really just want the photos on it for nostalgia reasons. The closest I found at the time was ipwdnfu, but it doesn't support the 4s [1]. I had assumed that this meant that checkm8 (which ipwdnfu uses/includes) didn't support the 4s either. Is that not the case? [1] https://github.com/axi0mX/ipwndfu/issues/175

Is this the same or different than the "New ‘unpatchable’ iOS exploit could lead to permanent jailbreak for iPhone 4s to iPhone X" from September 2019: * https://9to5mac.com/2019/09/27/ios-unpatchable-ios-exploit-j... * https://arstechnica.com/information-technology/2019/09/devel... * https://github.com/axi0mX/ipwndfu * https://news.ycombinator.com/item?id=21091219

You can do it if your iPad is one of the models vulnerable to the "checkm8" bootloader exploit. Sorry I'm not going to name any tools or link to any tutorials, though, RE https://github.com/axi0mX/ipwndfu/issues/100

Sandcastle is using the checkm8[0] unpatchable bootrom exploit to allow running unsigned secureROM arbitrary code with help from alloc8[1]. They then load a modified pongoOS[2] to get device tree and load their modified AOSP[3] from what I can tell. [0] https://github.com/axi0mX/ipwndfu [1] https://github.com/axi0mX/alloc8 [2] https://github.com/checkra1n/pongoOS [3] https://github.com/corellium/projectsandcastle

https://github.com/axi0mX/ipwndfu/issues/141 I've been poking at this already, and I'd venture a guess that the T2 will be breakable. The reason I think the XS and later are hard is pointer authentication codes, but that's more conjecture as I don't have a SecureROM dump from an XS. Plan to examine other parts of the boot-loader like iLLB, assuming they are not encrypted, for the ARM branch with authentication instructions...

Better link: https://github.com/axi0mX/ipwndfu/commit/2d0abd321dfc947899f...

Github has the code for checkm8: https://github.com/axi0mX/ipwndfu/blob/master/checkm8.py The readme hasn't been updated to reflect the exploit yet.