freemyipod - User contributions [en]

User talk:TheSeven

2011-01-27T04:47:48Z

ArthuruhtrA: /* spoke of spam */ new section

== Asked about IPL on the Nano 2G ==

When will I be able to use ipl on my Nano 2g? I assume it needs to be ported, but I don't know how to do so. Is there someone working on that? --[[User:ArthuruhtrA|ArthuruhtrA]]
:AFAIK no --[[User:TheSeven|TheSeven]] 00:00, 4 January 2011 (UTC)

Can you point me to any sort of information that would help me do it? The IPL site is down currently, no idea when it will be up. I do have the files found on SourceForge, but they are not very recent. I also have no experience with this, and don't want to brick my iPod. However, I may be able to get a spare Nano 2G to try it on. Thanks. --[[User:ArthuruhtrA|ArthuruhtrA]]

I found [http://ipl.derpapst.eu/ this] mirror of the ipl site last updated in '09. That is more recent. --[[User:ArthuruhtrA|ArthuruhtrA]]
:I don't have much more either, and I don't think there are newer files. iPodLinux hasn't really been developed any more for quite some time now. As this is a completely different architecture, I would suggest throwing the iPL kernel away and starting from a recent vanilla kernel, but I haven't really dealt with Linux kernels myself yet, so I probably can't help you much with this. --[[User:TheSeven|TheSeven]] 07:23, 5 January 2011 (UTC)

If I can port it, will you create the installer/incorporate it into what you have? And can you help me with porting to an extent? I bet you know more about it then I do. I got the latest kernel from linux.org (released yesterday) and the old kernel from ipl, and will look in them, and hopefully find something that I can do, but I don't quite know what I'm doing, as I don't quite understand the ipod as well as you. Should I be using the uCLinux kernel instead? --[[User:ArthuruhtrA|ArthuruhtrA]]
:I really don't know anything about embedded Linux. IIUC uCLinux is a fork of Linux 2.4 for MMU-less systems, but someone told me that the Linux 2.6 branch supports those natively. That's about everything I can tell you regarding Linux. I will of course be able to help you on the hardware side of things, i.e. answer questions about the hardware and the drivers emBIOS uses. What I certainly won't to is incorporating any kind of non-FAT filesystem support into my tools, as this would be a huge amount of work. But if the user handles creating an e.g. ext2 partition himself and the installer only needs to copy some files and add Linux to the iLoader menu, that's rather trivial. --[[User:TheSeven|TheSeven]] 13:13, 7 January 2011 (UTC)

== spoke of spam ==

We are having a lot of orphaned spam pages being generated. As I do not have the right to delete the pages, I have emptied their contents. The easiest way to find them is to go to the orphaned pages page, and look at the obvious spam. I would like the right to delete them, however your knowing of them is sufficient.

User talk:TheSeven

2011-01-06T03:12:02Z

ArthuruhtrA:

is there any scope of finding vulnerabilities, being able to execute code through the nike+ ipod kits? as in control the alter the sensor to send modified data to the ipod through the kit? i guess we havent already tried that. -- [[User:Psgarcha92]], 19:29, 21 November 2010
:I don't the sensor will ever send data that's complex enough for the parser to have an exploitable bug. --[[User:TheSeven|TheSeven]] 18:22, 22 November 2010 (UTC)

Hello.my classic 3g's HDD just broke,as no one provide classic 3g's PCB scan yet,if l4n need this,i will snap some photos of it..
Then where should i upload it? -- [[User:sinless]]
:I think you should upload them here [http://www.freemyipod.org/wiki/Special:Upload] and then add them to the Classic 3G page. --[[User:Benedikt93|Benedikt93]] 15:00, 17 December 2010 (UTC)

OK.I will take apart it soon,and does anybody know can classic work with a ssd? -- [[User:sinless]] 23:00, 17 December 2010 (GMT+8)
:It should be able to handle pretty much everything that's PATA or CE-ATA, and the OF also supports LBA48. --[[User:TheSeven|TheSeven]] 13:49, 20 December 2010 (UTC)
I just took apart my classic 3g,but the only camera I can use is Nokia 5310..the pictures are not clear enough
Notice that my classic(MC293,160GB,firmware 2.o.4)'s motherboard is the same to the 2g classic board in hardware page,Apple's mark is the same 820-2437-- [[User:sinless]] 21:00, 21 December 2010 (GMT+8)

== Asked about IPL on the Nano 2G ==

When will I be able to use ipl on my Nano 2g? I assume it needs to be ported, but I don't know how to do so. Is there someone working on that? --[[User:ArthuruhtrA|ArthuruhtrA]]

:AFAIK no --[[User:TheSeven|TheSeven]] 00:00, 4 January 2011 (UTC)

Can you point me to any sort of information that would help me do it? The IPL site is down currently, no idea when it will be up. I do have the files found on SourceForge, but they are not very recent. I also have no experience with this, and don't want to brick my iPod. However, I may be able to get a spare Nano 2G to try it on. Thanks. --[[User:ArthuruhtrA|ArthuruhtrA]]

I found [http://ipl.derpapst.eu/ this] mirror of the ipl site last updated in '09. That is more recent. --[[User:ArthuruhtrA|ArthuruhtrA]]
:I don't have much more either, and I don't think there are newer files. iPodLinux hasn't really been developed any more for quite some time now. As this is a completely different architecture, I would suggest throwing the iPL kernel away and starting from a recent vanilla kernel, but I haven't really dealt with Linux kernels myself yet, so I probably can't help you much with this. --[[User:TheSeven|TheSeven]] 07:23, 5 January 2011 (UTC)

If I can port it, will you create the installer/incorporate it into what you have? And can you help me with porting to an extent? I bet you know more about it then I do. I got the latest kernel from linux.org (released yesterday) and the old kernel from ipl, and will look in them, and hopefully find something that I can do, but I don't quite know what I'm doing, as I don't quite understand the ipod as well as you. Should I be using the uCLinux kernel instead? --[[User:ArthuruhtrA|ArthuruhtrA]]

User talk:TheSeven

2011-01-04T23:31:14Z

ArthuruhtrA: /* Asked about IPL on the Nano 2G */

User talk:TheSeven

2011-01-04T01:32:40Z

ArthuruhtrA: /* Asked about IPL on the Nano 2G */

Address bruteforcing

2011-01-02T23:35:22Z

ArthuruhtrA: Noted that the links are broken.

{{Outdated|reason=This process is no longer needed. Anybody left trying this is wasting their time, but we are preserving it for reference.}}

The best way people can help us out right now is by helping find the correct address we need to jump to in order to execute code. This has already been done on the 2G Nano and the 1G Classic. But now we really need help with the other iPods. Regardless of technical experience, anyone can help us out and get Rockbox and iPodLinux ported to the Nano's quicker. If you find the correct return address, you can rightfully brag about being the first person to run non-Apple code on that iPod :-). I'd also like to point out that your iPod cannot be bricked by this process and the freemyipod team will gladly help you out on IRC if you encounter any problems.

== Setup ==
OK, so here's how to help out: first of all download a copy of [http://l4n.clustur.com/data/sweep/sweepfreeze.7z sweepfreeze.7z](broken link). You will also need [http://l4n.clustur.com/data/sweep/sweepcrash.7z sweepcrash.7z](also broken). Don't be fooled by the small sizes, because uncompressed these archives are ~250MB. Each one contains every return address that can possibly be jumped to. The best way to get the files is to just extract the files you need one by one, rather than the whole thing. Also update your iPod to the latest firmware (except for the 4G Nano - update or [[Firmware_downgrading|downgrade]] to 1.0.3) because we want everyone to have the same version. Once you have these things set up, you are ready to go.

This process involves trying out various sweep files in the .7z archives. The files in sweepfreeze.7z will freeze if code has executed and the files in sweepcrash.7z will crash if code is executed. The files are .htm format. They are prefixed with either an 'a' or a 'b' and then the address they jump to. You should try only the A files for right now. As you can see, there are many sweep files, and only some of them will do anything interesting. If nobody has started on your iPod yet, start trying files starting at a080a2004.htm, otherwise continue where the others have left off.

Be sure to reserve a range for yourself to test in the table below. (we don't wont anyone doing the same files at the same time) Reserve small amounts at a time.

== Known problems ==
Note: if you are using your iPod with a Mac, your note files will not do anything. You will need to reformat the iPod to FAT32, and restore using iTunes on a Windows machine.

As stated above, this will not work with the 4G Nano with the 1.0.4 firmware or the 5G Nano. If you have 1.0.4, see [[Firmware_downgrading|firmware downgrading]].

== Steps ==
# Connect your iPod to the computer if it isn't already and browse to it's Notes directory. Clear out any previous notes files and put a new one from the sweepfreeze.7z archive in there. Unmount your iPod and disconnect it.
# Reboot your iPod by holding the menu and center buttons for a few seconds. The apple logo will show while it is booting, and when the iPod is done booting you will see 1 of 4 scenarios:
## The iPod reboots automatically the instant the main menu is shown. This will lead to an endless reboot cycle until the note is taken off
## The iPod works completely normally. You can navigate menus, play music, etc. without any problems.
## The iPod seems to work normally ie. you can still navigate menus, but when you try to play a song it freezes or crashes
## The iPod freezes up entirely.
# The next step is to get into disk mode in order to remove the notes file. First, you need to reboot by holding menu+center. If your note causes a type #1 behavior, the iPod is always rebooting and you do not need to reboot manually. When the apple logo shows up, hold the play and center buttons until the disk mode screen comes up. Repeat these steps for the next file, but read the paragraph below first!

Most sweep files will usually either crash(#1) or freeze(#4). If you have one/s that is not either of these, record it in the table. If you have one that crashes, you will need to test the same address again with the sweepcrash.7z archive. If the iPod crashes or does anything different this time, it is a good sign that we have execution. Definitely record any of these incidents in the table!

== Table of reserved or tested files ==
{| class="wikitable"
|-
! Username
! iPod generation
! Firmware version
! Windows/Mac
! Starting filename
! Ending filename
! Status
|-
| Farthen
| 4G Nano
| 1.0.3
| Windows
| a080a2004.htm
| a080a4e04.htm
| Tested
|-
| watto
| 4G Nano
| 1.0.3
| Windows
| a080a4f04.htm
| a080b3f04.htm
| Tested
|-
| watto
| 4G Nano
| 1.0.3
| Windows
| a080b4004.htm
| a080b7f04.htm
| Reserved
|-
| kylemsguy
| 4G Nano
| 1.0.3
| Windows
| a080c0104.htm
| a080c1004.htm
| Tested
|-
| clueX
| 4G Nano
| 1.0.3
| Windows
| a080d0a04.htm
| a080d0f04.htm
| Tested (All #1)
|-
| clueX
| 4G Nano
| 1.0.3
| Windows
| a080d0104.htm
| a080d1004.htm
| Tested (All #1, except a080d0304 #4)
|-
| kylemsguy
| 4G Nano
| 1.0.3
| Windows
| a080d1104.htm
| a080d2f04.htm
| Reserved
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a08010b04.htm
| a08027f04.htm
| Tested
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a08050104.htm
| a08057f04.htm
| Tested
|-
| Eosphere46
| 3G Nano
| 1.1.3
| Windows
| a080a0a04
| a080a1904
| Tested Results Below
|-
| Eosphere46
| 3G Nano
| 1.1.3
| Windows
| a080a2004.htm
| a080a5904.htm
| Tested!
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a080a6104.htm
| a080c7f04.htm
| Tested
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a080d0104.htm
| a080d7f04.htm
| Tested
|-
| BlackLotus
| 3G Nano
| 1.1.3
| Windows
| a080e0104.htm
| a080e7f04.htm
| Reserved
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a080f0104.htm
| a080f7f04.htm
| Tested
|-
| JoeWheeler
| 3G Nano
| 1.1.3
| Windows
| a08100104.htm
| a08100904.htm
| Reserved
|}

== Table of non-#1 (or non-#4) behaviors ==
If you leave an entry in here and don't normally hang out on IRC, send your email address to me at (cwalker32 AT gmail DOT com). This will give us a way to contact you if necessary.
{| class="wikitable"
|-
! Username
! iPod generation
! Firmware version
! Windows/Mac
! Sweep filename
! Behavior type
! Notes
|-
| Sto
| 2G Nano
| 1.1.3
| Windows
| a08640568.htm
| #4
| Direct jump to buffer
|-
| 3mpty
| 1G Classic
| 1.0.3
| Windows
| a080a2004.htm
| #4
| Indirect - an ldmia instruction in firmware portion of ram jumps to the correct buffer location
|-
| PharaohsVizier
| 2G Classic
| 2.0.1
| Windows
| a09352f04.htm a09352a04.htm a09352b04.htm
| #2
| Unknown, definitely check this out
|-
| farthen, cmwslw, kylemsguy
| 4G Nano
| 1.0.4
| Windows/Mac
| All
| #2
| Not exploitable, as the bug is fixed in 1.0.4
|-
| farthen
| 4G Nano
| 1.0.3
| Mac
| All
| #2
| Not exploitable because it's a macpod
|-
| Superandy
| 3G Nano
| 1.1.3
| Windows
| a08010c04
| Freezes when I play a song - Please try a08010c04 from http://tinyurl.com/sweepdelay and post behavior :)
Ok, done that. It does the same thing, freezes. The 1st boot it froze stright away as soon as it loaded the album artwork for the menu. The second time it took about 10 seconds to freeze.
| Pretty cool
|-
| Jwnordquist
| 2G Nano
| latest
| Windows
| a08010404.htm a08010504.htm a08010d04.htm a08010e04.htm a08010f04.htm a08011204.htm a08011304.htm a08011404.htm a08011904.htm
| #4
|
|-
| Farthen
| 4G Nano
| 1.0.3
| Windows
| a080a2104.htm, a080a3b04.htm, a080a3e04.htm, a080a4604.htm, a080a4d04.htm
| #4
| I don't know why I record this, *maybe* it can help. Should be of no interest but who knows... Crasher files have same result as freezer.
|-
| Farthen
| 4G Nano
| 1.0.3
| Windows
| a080a2f04.htm, a080a3a04.htm,
| #2
| I don't know why I record this, *maybe* it can help. Should be of no interest but who knows... Crasher files have same result as freezer.
|-
| watto
| 4G Nano
| 1.0.3
| Windows
| a080a4f04.htm, a080a6c04 to a080a7504 inc.
| #4
| Same result with crash and freeze files.
|-
| watto
| 4G Nano
| 1.0.3
| Windows
| a080a5c04.htm
| #2
| Same result with crash and freeze files.
|-
| kylemsguy
| 4G Nano
| 1.0.3
| Windows
| a080c0304.htm
| #4
| The results for the sweep files were the same
|-
| Eosphere46
| 3G Nano
| 1.1.3
| Windows
| a080a3504.htm a080a0104.htm a080a0204.htm a080a0304.htm a080a0404.htm a080a0504.htm a080a0604.htm a080a0704.htm a080a0804.htm a080a0904.htm
| #4
| Same result with crash and freeze files, they both froze.
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a08012f04.htm a08013a04.htm a08015c04.htm a08022f04.htm a08023a04.htm a08025c04.htm
| #2
| Same result for both freeze & crash files
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a08012b04.htm a08026104.htm
| #4 for sweepfreeze #1 for sweepcrash!
| Seems interesting to me but these are low addresses (below a080a2004)
|-
|Eosphere46
|3G Nano
|1.1.3
|Windows
|a080a2f04.htm a080a3a04.htm a080a5c04.htm
|#2 for sweepfreeze #2 for sweepcrash
|Probably nothing much, but check it out.
|-
|Eosphere46
|3G Nano
|1.1.3
|Windows
|a080a4b04.htm
|VERY Strange..hard to describe <sup>1</sup>
|Check this out.. Same for the sweepcrash..
|-
|Eosphere46
|3G Nano
|1.1.3
|Windows
|a080a1004.htm
|#3
|Freezes when I play a song. Sweepcrash is #3 too. Sweepdelay is #3...
|-
|KAB123
|2G Classic
|2.0.1
|Windows
|09196804.htm 08334d04.htm
|#4 for sweepfreeze, #4 for sweepcrash.
|
|}

<sup>1</sup> - I have added video demonstration, d00p3k: [http://www.youtube.com/watch?v=qPNLKXXpmMM]

User talk:TheSeven

2011-01-02T23:23:59Z

ArthuruhtrA: /* Asked about IPL on the Nano 2G */ new section