Slashdot Log In
iPhone Researchers Gain a Shell
Posted by
Zonk
on Fri Jul 06, 2007 10:19 PM
from the just-don't-play-three-card dept.
from the just-don't-play-three-card dept.
SkiifGeek writes "A team of researchers dedicated to finding means to fully control and interact with the new Apple iPhone claim to have successfully gained an interactive shell on the device. In order to achieve this feat physical access to the phone is required, as it relies on some minor electronics to be created and connected to the phone's serial port. It is believed that general control over the iPhone will be available to the enterprising researchers within a week (after all, it has only just been a week since the iPhone was released), with the promise of enough control to allow for self-propagating code not very far away."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Turtle Power! (Score:5, Funny)
And calling them 'researchers?' Oh, come on. 'Hacker' is an appropriate term, just ask Paul Graham [paulgraham.com].
Re:Turtle Power! (Score:5, Interesting)
Seriously, if blogs mean anybody can become a journalist, if open source means anybody can write code used in mission critical systems, I think it's only fair that any random curious person can be a "researcher".
Parent
Re: (Score:3, Funny)
That would make him a Graham cracker then.
Mmmm, smores.
Re:Turtle Power! (Score:4, Insightful)
Parent
Re:Turtle Power! (Score:4, Insightful)
Parent
command list (mirror) (Score:3, Informative)
help this list
script run script at specific address
go jump directly to address
bootx boot a kernel cache at specified address
diags boot into diagnostics (if present)
tsys boot into tsys (if present)
bdev block device commands
image flash image inspection
fs file system commands
fsboot try to boot kernel at
devicetree create a device tree from the specified address
ramdisk create a ramdisk from the specified address
tftp tftp via ethernet to/from device
eload tftp via ethernet from hardcoded install server
halt halt the system (good for JTAG)
reboot reboot the device
poweroff power off the device
md memory display - 32bit
mdh memory display - 16bit
mdb memory display - 8bit
mw memory write - 32bit
mwh memory write - 16bit
mwb memory write - 8bit
mws memory write - string
crc POSIX 1003.2 checksum of memory
task examine system tasks
printenv print one or all environment variables
setenv set an environment variable
clearenv clear all environment variables
saveenv save current environment to flash
run use contents of environment var as script
bgcolor set the display background color
setpicture set the image on the display
iic iic read/write
radio Manipulate the radio board.
setbusclock Set bus clock to the given frequency in Hz.
setcorevoltage Set core voltage to the given voltage in mV.
syscfg flash SysCfg inspection
charge Manage the charger chip.
powernvram Access Power NVRAM.
usb run a USB command
nand nand flash routines
chunk chunk a file7/6/2007
Re:command list (mirror) (Score:5, Informative)
It looks a lot like an old forth/open firmware prompt, kind of like on PowerMacs. On PowerMacs you could get a list like this when you booted while holding down some magic keys. You could even open a remote session on your open firmware if you set a server running on the target machine (this required physical access to the target machine at boot time).
If this is really what it looks like, then it's really low-level access to the hardware. OTOH, it requires physical access to the iPhone, and once you got the thing up the bootloader is likely to blow away most of the low-level environment. The real crown jewels would be decryption of the binaries on the phone, plus breaking the various validations and checksums the iphone's doing before it runs, so yous could patch them to do your evil, but that's a bigger hack.
Parent
Re:command list (mirror) (Score:5, Interesting)
There's a restore image, and they have managed to decrypt, extract, and modify said image before sending it to the phone. The executables aren't encrypted or signed on the device; however, the restore image has a password. They have the password.
Parent
Re:command list (mirror) (Score:5, Interesting)
It's interesting to see how Apple has so far managed security. Unlike other companies, at least so far, they don't seem set on complete lock down. For example, so far they seem only to use the Trusted Computing to make their OS run on Apple hardware only. They could be a lot more evil with it. Even the DRM on their music. While the change it up occasionally, they at least haven't made a lot of sound about PlayFair.
As for the iPhone, it might be a matter that they're fine with people hacking it, as long as they don't have to be held responsible for it. That is, if your iPhone starts crashing, it's because you put programs on it that you weren't supposed to. Doing so also allows them to watch what other people are doing with the HW (free R&D). It's somewhat similar to what the did with Bootcamp. They didn't actively stop people from getting Windows booting on the Intel computers, but they also didn't help.
I guess the two telling signs of this will be if: (a) Apple patches this with their next update (an update coming real soon?), and (b) if they force signed binaries to run on the iPhone.
Parent
Re:command list (mirror) (Score:4, Interesting)
From the Singh [osxbook.com] linked in the Boing Boing segment:
Parent
Re:command list (mirror) (Score:5, Insightful)
I believe Gruber was misinformed on the issue (first time that ever happened, surely.) My Intel Macbook and Intel Mac Pro do not have a TPM:
$ ioreg | grep tpm
$ ioreg | grep TPM
$ ioreg | grep infineon
I'm not just taking ioreg's word for it, at least in the case of the Mac Pro. I've opened it and can't find an infineon or any other unaccounted-for LPC IC.
Just because it's hard for J. Random Cracker to get an OS running on a hardware platform it's not supported on, without the source code. doesn't mean someone's lying. Further, the teardowns of the iPhone available on the internet include no mention of a trusted platform module, which is a physical artifact, not an "implementation."
(Let us not forget of course, the presence of the Dont_Steal_Mac_OS_X device, whose manifestation and theory of operation remain shrouded in mystery ;P)
Parent
Re: (Score:3, Insightful)
http://wiki.osx86project.org/wiki/index.php/FAQ#Do _I_need_Apple_hardware_to_run_Mac_OS_X.3F [osx86project.org]
they had to work around the TPM, stating:
"The "Trusted Platform Module," or TPM, is a computer chip embedded inside Intel-based Macs to prevent the Intel-based version of Mac OS X from running on non-Apple hardware. (during installation of Mac OS X, Mac OS X interfaces with the TPM. If Mac OS X finds that the TPM doesn't exist, Mac OS X refuses to
Re: (Score:3, Informative)
http://osxbook.com/book/bonus/chapter10/tpm/#EXEC
Re:command list (mirror) (Score:5, Funny)
IDSPISPOPD - no clipping (walk through walls with iPhone)
IDBEHOLDS - Berserker! With iPhone!
IDDQD - God/Steve Jobs mode (not just a seafood restaurant, but a reservation at that restaurant)
Parent
Looks more like a boot loader to me (Score:4, Insightful)
But that's what you WANT. (Score:5, Interesting)
Yep. Sounds like a bootstrapping and image management firmware. (A pretty capable one, though. Not some minimalist system launcher.)
But isn't that what you WANT if you're trying to establish control of your machine? Why live within the old image's limitations if you can replace it?
Meanwhile this has lots of debugging and control tools suitable for tweaking and reverse-engineering the running image And that command list sure looks like it will let you load and launch a debugging tool that's more capable and give that tool even more control of the running system than is built into this firmware.
This machine is about to be opened, whether Apple likes it or not.
(I wouldn't be surprised if - at some level within the company - they really wanted it to be opened and only launched it in closed form so they could write contracts with networking companies and obtain FCC type approval. Plausible deniability at work.)
Parent
Re: (Score:3, Informative)
Said by someone who thinks a PC BIOS is a boot loader. New World (iMac forward?) and newer Mac roms can do it, darned near every "workstation" can do it.
Even a lot of $30 routers have boot loaders that can do tftp... once you solder on the headers to get at the serial console port like was done to the iPhone Heck, even a PC's PXE net booting involves DHCP to get an address/etc and then followed by a tftp.
Re: (Score:3)
Re:Looks more like a boot loader to me (Score:5, Informative)
* A serial console is now working to the device. It requires a 6.8k resistor from pin 21 to ground, and tie pin 11 (sergnd) to the real ground. You can use iPhoneInterface to send some commands in recovery mode (setenv debug-uarts 1, saveenv, and reboot), and then you'll be in the boot loader.
* Some of us believe that the boot loader is the key to really unlocking the radio but we have several other approaches a serial console has enabled us to test. A few of us have been hard at work on some proof of concept code for these pieces, and we will release them as available.
* We know exactly how to unlock the radio right now. The problem is, getting the commands to the radio has proved more difficult than we anticipated. We have a couple of different potential vectors:
o The boot loader's memory display and writing commands, or the ability to send commands to the radio directly using 'radio send'. Many of these commands report permission denied. We are interested in getting around this.
o bbupdater and imeisv can do interesting things with the radio. We are trying to get to the point where we can run these commands and get output back.
* We have made some really good progress getting third party apps to run on the phone. More information on this will be available soon.
Parent
I don't get it (Score:5, Funny)
Oh, ok, the other phones have API and aren't locked to AT&T.
I get it now.
Re: (Score:3, Interesting)
I advise you to look at hard numbers when talking about success, since "recent hype" metrics are wildly inaccurate.
For example, let's see, I have a Sony Ericsson. How many were sold from this one model? 22 million in Q1 2007 (3 months).
How many has iPhone sold? 0.5 million. Of course, iPhone is just hot out of the oven, but I only trust numbers, so I'll wait and see how it does for, say, 3 months.
If it tops other phone ma
Re:I don't get it (Score:5, Informative)
http://www.nokiaphoneblog.com/2007/04/news_sony_e
That says 21.8 million units in that time period. After some more quick googling, it seems that they have a line consisting of 57 models. Thus, an average of 382k phones per model over that three month period. So, from your statement that the iPhone has sold 500k phones since it was released a week ago, I would say that Apple is having a pretty successful launch.
Parent
Re: (Score:3, Insightful)
Re:I don't get it (Score:5, Insightful)
There may be signing requirements that (at least in the case of Windows Mobile) can be bypassed by disabling signature checks on executables or (a much better solution IMO) adding your own certificate to the list of trusted certificates and signing.
And standard "dumb" phones in the GSM world along with Blackberries have Java 2 ME, which has SDKs you can download to write applications that are downloaded to and run on the device... they can often interface things like sound, Bluetooth, etc., making GPS applications possible.
No hacking required! No funky way to get a serial connection required! Just at least one way to get applications on the phone (which includes over-the-air via the Internet and USB -- sometimes even Bluetooth).
Parent
Re:I don't get it (Score:4, Interesting)
Parent
Re:I don't get it (Score:4, Insightful)
> along with thriving third-party software support.
You should check again, specifically for the "thriving" part. Phone apps look like 1992's ass.
> No cracking required!
Usually the phones are crippled in some way, so that is not true. In fact it takes master hacking skills just to work some of those phones.
> You can run real applications [on non-iPhone phones]
Can I run a real Web browser? No. Pathetic. The Web is almost 20 years old. When are they going to get around to it?
The phones you're talking about are pocket calculators with phones in them, they make some nerds happy and everyone else miserable. The iPhone is an iPod with a phone AND a Web 2.0 browser in it. People really like it.
The apps that regular people run are MySpace, YouTube, Flickr, Facebook, eBay, and they want to run the whole app, not just see some snippets of text out of each page with no formatting. So for most users the iPhone is a better application platform than other phones.
Parent
Re: (Score:3, Informative)
Re:I don't get it (Score:4, Informative)
commercial software: Handago [handago.com] Smartphone.net [smartphone.net]
free software: FreewarePPC [freewareppc.com] Freeware Palm [freewarepalm.com]
There are thousands of third-party downloadable applications for PPCs, Smartphones, Palm OS devices, Series 60 devices, etc., etc. Anyone can download an SDK and make their own apps with access to a suite of communication, sound, storage, and animation APIs.
Number of third-party downloadable applications for the iPhone that aren't web applications: zero.
Most phone application developers do not consider "look pretty" a huge priority.
What the fuck are you talking about? My Samsung Blackjack runs any application I throw at it. The default WM Smartphone configuration only runs signed programs: to fix this problem you can either add your own certificate (a matter of going to a URL with the certificate and answering Yes to a few promprts) or plugging in the device and running a program that disables all application locks.
Pocket PC and Palm OS devices do not have signature requirements that I'm aware of.
The iPhone does not have the ability to run arbitrary programs natively at all. Just web apps.
Series 60 phones often ship with Opera. Opera & a port of Mozilla called Minimo is available for Windows Mobile.
Every smartphone I have ever used has used some sort of ARM CPU, recent ones often around 400MHz. Compare this to the 620MHz iPhone ARM CPU (WebKit needs all that power to render HTML...)
I'm sure people really like it if they want to use Web 2.0 applications and listen to music. But what if they want to do something that isn't possible with the included software and isn't implementable in the iPhone's JavaScript environment?
Last I checked, there were no APIs acessible from JavaScript on the iPhone that allowed access to just about anything. No Bluetooth (so no GPS), no sound, no fancy graphics, no file access -- nothing interesting.
There are other phones that play music and do a better job of surfing the internet for cheaper: often cheap enough that you could still buy an iPod nano if you wanted.
Those applications run just as well on other mobile browsers such as Opera Mobile, for those who like to use the full version. Have you not used mobile applications recently? WEP is dead and pages are now written with XHTML. In fact, with stylesheets, the same HTML can be designed for mobile and normal-sized devices.... and even after the iPhone's widely touted support for full-sized webpages, there are lots of people talking about how they can adapt their app to use the iPhone. Hmm....
For those who don't have the luxury of being in an iPhone-friendly wifi environment, not loading advertisements and (relatively) high-res GUI elements and logos can shave a noticeable amount of time off the loading time: on my 3G device, PayPal's mobile site takes 2 seconds to load. The full site takes almost 10 and uses 122k.
Without downloadable app support, you can't download games for your phone -- you're stuck with web apps. A
Parent
Re: (Score:3, Insightful)
I think you might have just hit the nail on the head as to why people are flocking to the iPhone. Seriously, what was the last good OS Sony, Nokia, or Motorola came out with?
It's the iShell (Score:5, Funny)
Re:It's the iShell (Score:4, Funny)
I think you mean, "am iNuts?"
Parent
apple sues in 5,4,3,2.... (Score:3, Funny)
Smells like Open Firmware (Score:3, Informative)
That's not a shell. That's the boot loader. (Score:4, Interesting)
From the command list, they're talking to the boot loader, not the operating system. That's nice, but rather low level. You can load another operating system image, so there's the potential of booting a different OS, if someone writes the appropriate drivers. Somebody will probably boot Linux eventually, but mostly as a curiosity.
These guys are total wusses! (Score:5, Funny)
Re:That's quite a jump (Score:5, Informative)
Parent
Not surprising, really. (Score:5, Informative)
It can be usefu on its ownl, but to be really useful, you use it to call down a modified image which has a more versatile shell (ash comes to mind, and I know that has a BSD and prolly a Darwin port...)
Parent
Re:That's quite a jump (Score:5, Informative)
Parent
Re: (Score:3, Interesting)
Re:HAHA (Score:5, Insightful)
You mean like how IBM's opening of the PC just as Apple closed theirs (with Lisa and the initial Mac)? And laughed all the way to the bank as the PC took over the world - with IBM selling "true blue" desktop hardware into the business market for years while the clones became the standard for home users.
Yeah, what Idiots. B-)
Parent
Re:HAHA (Score:5, Insightful)
The IBM PC came out in 1982 and competed with the Apple II throughout the 80's. That was Apple's business machine. The Apple II had more slots than IBM PC and years of hardware hacking documentation behind it, as well as color display, and Woz' encouragement. If the battle was openness then Apple II would win. Instead what happened was the 98% of businesses that had IBM Selectric typewriters bought IBM PC's.
As for the Mac, it sold really well to an entirely different market because it was the only computer with graphics, typography, laser printer. In 1984 you did typesetting the same way it was done in 1884, but by 1988 you were using a Mac. The IBM PC and the Mac simply did not compete with each other.
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
The Compaq name comes from "compact", not "compatible". Their first product was a portable PC. I was just a kid when it came out, but I recall that the meaning of the company name was "common knowledge" at the time
http://en.wikipedia.org/wiki/Compaq_Portable [wikipedia.org]
http://www.bizwaremagic.com/notebook-computer-hist ory.htm [bizwaremagic.com]
Re:"self-propagating code" (Score:5, Funny)
Parent
Re:"self-propagating code" (Score:5, Funny)
Parent
Re: (Score:3, Funny)
So to speak...
Re:Developing for the mobile market... (Score:5, Insightful)
Apple has learned many lessons, and many of them are much more relevant to the success of the iPhone than the decision in the early days of the Mac to not license the operating system. They have learned that you don't necessarily need the most apps, you need great apps. The iPhone, one way or another, will have great apps. From the iPod, they have learned that keeping full control over the device enables them to move more nimbly, unlike the cumbersome PlaysFor{not}Sure system developed by Microsoft.
Windows Mobile is already out there and has been out there for years. Yet, the iPhone can come along and make an immediate, serious impact on the market. Apple knows what it is doing, and they will do with the iPhone what they need to do to keep it competitive.
Parent
Re:Developing for the mobile market... (Score:5, Insightful)
> is to allow 3rd parties to develop under your platform and support you.
You are making the mistake of thinking "3rd party development == C coders."
The iPod has millions of third-party developers. They make music and movies. For example, Disney/Pixar, Dixie Chicks, Eminem, 20th Century Fox.
The iPhone has millions of third-party developers. They make Web apps. For example, YouTube, Flickr, eBay, MySpace, Facebook, Twitter.
An hour into your iPhone ownership you probably have the work of hundreds if not thousands of third-parties on your iPhone. Throughout an iPhone's two year life span (both the hardware and service contract are $X/month for 24 months) a typical user will probably have 1000x the third-party data in their iPhone than if they were using another phone. The iPhone has so much more storage, syncs so much more easily with your music and movies, and has a real Web browser and Wi-Fi so you can chew up a lot of Web over two years.
So if your standard for greatness is third-parties then you have predicted iPhone's impending world domination.
Parent
So how do I write an input method as a web applet? (Score:5, Insightful)
No, I'm making the mistake of thinking "applications" == "things that run on the phone".
Web applets? I've used them on my Palm and Pocket PC, years before the iPhone was a twinkle in Steve's eye. Every device has these... they *also* run software on the device itself, so you can use them with the battery-eating radio shut down.
One of the most popular classes of applications on the Palm, for example, are input methods. You want something faster than their predictive keyboard? Sorry, you're out of luck. You want an eBook reader that doesn't require you to be online the whole time you're reading? Uh-uh, you don't get that. An aplication I use all the time is a shopping list app... that I couldn't use on the iPhone even if it was available as a web applet because there's a big fat dead area near the back of my neighborhood supermarket.
This doesn't mean that it won't be a popular device. A lot of people seem happy with fancy dumb phones, but claiming that this is in any way comparable to the ability to run real native applications, or that being able to run web applets is some kind of unique feature of the iPhone, is just daft. That's something the competition has been doing for almost a decade now, and unless the people writing the applets are particularly stupid they're almost all going to work on any handheld. Certainly the only ones I've found that are iPhone-only are ones that explicitly check to see if they're running on one.
Parent
Re:Open Suggestion to the Editors (Score:4, Funny)
Parent