ipod_sun
ipod_sun copied to clipboard
New Signature Bypass + Fixed iTunes Restarting Device
Adds a new signature verification bypass for the resources file, allowing booting straight to 'osos'.
- This works by changing the Img1 format of the resources file from '4' (X509_SIGNED) to '3' (X509_SIGNED_ENCRYPTED). There is some issue when the Img1 verification is done, which allows the resource file to be considered 'verified' when changed. I'm assuming this is due to some return values being mistreated.
- I'm not sure if this works on iPods outside of n7g 2012, but I'm guessing this issue is in the bootloader so it may not matter.
Fixes the issue described in #4 for n7g.
- This is done by changing which SCSI command is overwritten by the exploit (from 0x96 to 0x98)
- I don't have a n6g to test updated offsets for that device
- Some of the tools have been updated to accomodate this change
- Ideally, we only modify a branch in the SCSI logic to add a new command, but I feel like the best way to do this is to malloc + memcopy the generated code, but I think that is outside the scope of this project
If you have offsets for n6g, i can test them.