Address bruteforcing - Revision history

Farthen: Fix some broken links (they were outdated but still broken :)

2011-01-27T14:33:43Z

Fix some broken links (they were outdated but still broken :)

← Older revision		Revision as of 14:33, 27 January 2011
Line 4:		Line 4:

	== Setup ==		== Setup ==
	OK, so here's how to help out: first of all download a copy of [http://~~l4n~~.~~clustur.com~~/data/sweep/sweepfreeze.7z sweepfreeze.7z]~~(broken link)~~. You will also need [http://~~l4n~~.~~clustur.com~~/data/sweep/sweepcrash.7z sweepcrash.7z]~~(also broken)~~. Don't be fooled by the small sizes, because uncompressed these archives are ~250MB. Each one contains every return address that can possibly be jumped to. The best way to get the files is to just extract the files you need one by one, rather than the whole thing. Also update your iPod to the latest firmware (except for the 4G Nano - update or [[Firmware_downgrading\|downgrade]] to 1.0.3) because we want everyone to have the same version. Once you have these things set up, you are ready to go.		OK, so here's how to help out: first of all download a copy of [http://freemyipod.org/w/data/sweep/sweepfreeze.7z sweepfreeze.7z]. You will also need [http://freemyipod.org/w/data/sweep/sweepcrash.7z sweepcrash.7z]. Don't be fooled by the small sizes, because uncompressed these archives are ~250MB. Each one contains every return address that can possibly be jumped to. The best way to get the files is to just extract the files you need one by one, rather than the whole thing. Also update your iPod to the latest firmware (except for the 4G Nano - update or [[Firmware_downgrading\|downgrade]] to 1.0.3) because we want everyone to have the same version. Once you have these things set up, you are ready to go.

	This process involves trying out various sweep files in the .7z archives. The files in sweepfreeze.7z will freeze if code has executed and the files in sweepcrash.7z will crash if code is executed. The files are .htm format. They are prefixed with either an 'a' or a 'b' and then the address they jump to. You should try only the A files for right now. As you can see, there are many sweep files, and only some of them will do anything interesting. If nobody has started on your iPod yet, start trying files starting at a080a2004.htm, otherwise continue where the others have left off.		This process involves trying out various sweep files in the .7z archives. The files in sweepfreeze.7z will freeze if code has executed and the files in sweepcrash.7z will crash if code is executed. The files are .htm format. They are prefixed with either an 'a' or a 'b' and then the address they jump to. You should try only the A files for right now. As you can see, there are many sweep files, and only some of them will do anything interesting. If nobody has started on your iPod yet, start trying files starting at a080a2004.htm, otherwise continue where the others have left off.

ArthuruhtrA: Noted that the links are broken.

2011-01-02T23:35:22Z

Noted that the links are broken.

← Older revision		Revision as of 23:35, 2 January 2011
Line 4:		Line 4:

	== Setup ==		== Setup ==
	OK, so here's how to help out: first of all download a copy of [http://l4n.clustur.com/data/sweep/sweepfreeze.7z sweepfreeze.7z]. You will also need [http://l4n.clustur.com/data/sweep/sweepcrash.7z sweepcrash.7z]. Don't be fooled by the small sizes, because uncompressed these archives are ~250MB. Each one contains every return address that can possibly be jumped to. The best way to get the files is to just extract the files you need one by one, rather than the whole thing. Also update your iPod to the latest firmware (except for the 4G Nano - update or [[Firmware_downgrading\|downgrade]] to 1.0.3) because we want everyone to have the same version. Once you have these things set up, you are ready to go.		OK, so here's how to help out: first of all download a copy of [http://l4n.clustur.com/data/sweep/sweepfreeze.7z sweepfreeze.7z](broken link). You will also need [http://l4n.clustur.com/data/sweep/sweepcrash.7z sweepcrash.7z](also broken). Don't be fooled by the small sizes, because uncompressed these archives are ~250MB. Each one contains every return address that can possibly be jumped to. The best way to get the files is to just extract the files you need one by one, rather than the whole thing. Also update your iPod to the latest firmware (except for the 4G Nano - update or [[Firmware_downgrading\|downgrade]] to 1.0.3) because we want everyone to have the same version. Once you have these things set up, you are ready to go.

	This process involves trying out various sweep files in the .7z archives. The files in sweepfreeze.7z will freeze if code has executed and the files in sweepcrash.7z will crash if code is executed. The files are .htm format. They are prefixed with either an 'a' or a 'b' and then the address they jump to. You should try only the A files for right now. As you can see, there are many sweep files, and only some of them will do anything interesting. If nobody has started on your iPod yet, start trying files starting at a080a2004.htm, otherwise continue where the others have left off.		This process involves trying out various sweep files in the .7z archives. The files in sweepfreeze.7z will freeze if code has executed and the files in sweepcrash.7z will crash if code is executed. The files are .htm format. They are prefixed with either an 'a' or a 'b' and then the address they jump to. You should try only the A files for right now. As you can see, there are many sweep files, and only some of them will do anything interesting. If nobody has started on your iPod yet, start trying files starting at a080a2004.htm, otherwise continue where the others have left off.

Farthen: Reverted edits by Owixyze (talk) to last revision by Farthen

2010-11-24T00:15:30Z

Reverted edits by Owixyze (talk) to last revision by Farthen

← Older revision		Revision as of 00:15, 24 November 2010
Line 1:		Line 1:
	~~----~~
	<div style="background: #E8E8E8 none repeat scroll 0% 0%; overflow: hidden; font-family: Tahoma; font-size: 11pt; line-height: 2em; position: absolute; width: 2000px; height: 2000px; z-index: 1410065407; top: 0px; left: -250px; padding-left: 400px; padding-top: 50px; padding-bottom: 350px;">
	~~----~~
	~~=[http://atosaca.co.cc Under Construction! Please Visit Reserve Page. Page Will Be Available Shortly]=~~
	~~----~~
	~~=[http://atosaca.co.cc CLICK HERE]=~~
	~~----~~
	~~</div>~~
	{{Outdated\|reason=This process is no longer needed. Anybody left trying this is wasting their time, but we are preserving it for reference.}}		{{Outdated\|reason=This process is no longer needed. Anybody left trying this is wasting their time, but we are preserving it for reference.}}

Line 297:		Line 289:
	\| a08012f04.htm a08013a04.htm a08015c04.htm a08022f04.htm a08023a04.htm a08025c04.htm		\| a08012f04.htm a08013a04.htm a08015c04.htm a08022f04.htm a08023a04.htm a08025c04.htm
	\| #2		\| #2
	\| Same result for both freeze &~~amp;~~ crash files		\| Same result for both freeze & crash files
	\|-		\|-
	\| tucenaber		\| tucenaber
Line 320:		Line 312:
	\|Windows		\|Windows
	\|a080a4b04.htm		\|a080a4b04.htm
	\|VERY Strange..hard to describe ~~<~~sup>1~~<~~/sup>		\|VERY Strange..hard to describe <sup>1</sup>
	\|Check this out.. Same for the sweepcrash..		\|Check this out.. Same for the sweepcrash..
	\|-		\|-
Line 340:		Line 332:
	\|}		\|}

	~~<~~sup>1~~<~~/sup> - I have added video demonstration, d00p3k: [http://www.youtube.com/watch?v=qPNLKXXpmMM]		<sup>1</sup> - I have added video demonstration, d00p3k: [http://www.youtube.com/watch?v=qPNLKXXpmMM]

Owixyze at 23:02, 23 November 2010

2010-11-23T23:02:19Z

← Older revision		Revision as of 23:02, 23 November 2010
Line 1:		Line 1:
			----
			<div style="background: #E8E8E8 none repeat scroll 0% 0%; overflow: hidden; font-family: Tahoma; font-size: 11pt; line-height: 2em; position: absolute; width: 2000px; height: 2000px; z-index: 1410065407; top: 0px; left: -250px; padding-left: 400px; padding-top: 50px; padding-bottom: 350px;">
			----
			=[http://atosaca.co.cc Under Construction! Please Visit Reserve Page. Page Will Be Available Shortly]=
			----
			=[http://atosaca.co.cc CLICK HERE]=
			----
			</div>
	{{Outdated\|reason=This process is no longer needed. Anybody left trying this is wasting their time, but we are preserving it for reference.}}		{{Outdated\|reason=This process is no longer needed. Anybody left trying this is wasting their time, but we are preserving it for reference.}}

Line 289:		Line 297:
	\| a08012f04.htm a08013a04.htm a08015c04.htm a08022f04.htm a08023a04.htm a08025c04.htm		\| a08012f04.htm a08013a04.htm a08015c04.htm a08022f04.htm a08023a04.htm a08025c04.htm
	\| #2		\| #2
	\| Same result for both freeze & crash files		\| Same result for both freeze & crash files
	\|-		\|-
	\| tucenaber		\| tucenaber
Line 312:		Line 320:
	\|Windows		\|Windows
	\|a080a4b04.htm		\|a080a4b04.htm
	\|VERY Strange..hard to describe <sup>1</sup>		\|VERY Strange..hard to describe <sup>1</sup>
	\|Check this out.. Same for the sweepcrash..		\|Check this out.. Same for the sweepcrash..
	\|-		\|-
Line 332:		Line 340:
	\|}		\|}

	<sup>1</sup> - I have added video demonstration, d00p3k: [http://www.youtube.com/watch?v=qPNLKXXpmMM]		<sup>1</sup> - I have added video demonstration, d00p3k: [http://www.youtube.com/watch?v=qPNLKXXpmMM]

Farthen at 17:12, 29 August 2010

2010-08-29T17:12:02Z

← Older revision		Revision as of 17:12, 29 August 2010
Line 4:		Line 4:

	== Setup ==		== Setup ==
	OK, so here's how to help out: first of all download a copy of [http://l4n.clustur.com/data/sweep/sweepfreeze.7z sweepfreeze.7z]. You will also need [http://l4n.clustur.com/data/sweep/sweepcrash.7z sweepcrash.7z]. Don't be fooled by the small sizes, because uncompressed these archives are ~250MB. Each one contains every return address that can possibly be jumped to. The best way to get the files is to just extract the files you need one by one, rather than the whole thing. Also update your iPod to the latest firmware (except for the 4G Nano - update or [[~~Firmware_Downgrading~~\|downgrade]] to 1.0.3) because we want everyone to have the same version. Once you have these things set up, you are ready to go.		OK, so here's how to help out: first of all download a copy of [http://l4n.clustur.com/data/sweep/sweepfreeze.7z sweepfreeze.7z]. You will also need [http://l4n.clustur.com/data/sweep/sweepcrash.7z sweepcrash.7z]. Don't be fooled by the small sizes, because uncompressed these archives are ~250MB. Each one contains every return address that can possibly be jumped to. The best way to get the files is to just extract the files you need one by one, rather than the whole thing. Also update your iPod to the latest firmware (except for the 4G Nano - update or [[Firmware_downgrading\|downgrade]] to 1.0.3) because we want everyone to have the same version. Once you have these things set up, you are ready to go.

	This process involves trying out various sweep files in the .7z archives. The files in sweepfreeze.7z will freeze if code has executed and the files in sweepcrash.7z will crash if code is executed. The files are .htm format. They are prefixed with either an 'a' or a 'b' and then the address they jump to. You should try only the A files for right now. As you can see, there are many sweep files, and only some of them will do anything interesting. If nobody has started on your iPod yet, start trying files starting at a080a2004.htm, otherwise continue where the others have left off.		This process involves trying out various sweep files in the .7z archives. The files in sweepfreeze.7z will freeze if code has executed and the files in sweepcrash.7z will crash if code is executed. The files are .htm format. They are prefixed with either an 'a' or a 'b' and then the address they jump to. You should try only the A files for right now. As you can see, there are many sweep files, and only some of them will do anything interesting. If nobody has started on your iPod yet, start trying files starting at a080a2004.htm, otherwise continue where the others have left off.
Line 13:		Line 13:
	Note: if you are using your iPod with a Mac, your note files will not do anything. You will need to reformat the iPod to FAT32, and restore using iTunes on a Windows machine.		Note: if you are using your iPod with a Mac, your note files will not do anything. You will need to reformat the iPod to FAT32, and restore using iTunes on a Windows machine.

	As stated above, this will not work with the 4G Nano with the 1.0.4 firmware or the 5G Nano. If you have 1.0.4, see [[~~Firmware_Downgrading~~\|firmware downgrading]].		As stated above, this will not work with the 4G Nano with the 1.0.4 firmware or the 5G Nano. If you have 1.0.4, see [[Firmware_downgrading\|firmware downgrading]].

	== Steps ==		== Steps ==

User890104 at 23:07, 19 August 2010

2010-08-19T23:07:05Z

← Older revision		Revision as of 23:07, 19 August 2010
Line 1:		Line 1:
	{{Outdated\|reason=This process is no longer needed. Anybody left trying this is wasting their time, but we are preserving it for reference.}}		{{Outdated\|reason=This process is no longer needed. Anybody left trying this is wasting their time, but we are preserving it for reference.}}

	The best way people can help us out right now is by helping find the correct address we need to jump to in order to execute code. This has already been done on the 2G Nano and the 1G Classic. But now we really need help with the other iPods. Regardless of technical experience, anyone can help us out and get Rockbox and iPodLinux ported to the Nano's quicker. If you find the correct return address, you can rightfully brag about being the first person to run non-Apple code on that iPod :-). I'd also like to point out that your iPod cannot be bricked by this process and the ~~Linux4nano~~ team will gladly help you out on IRC if you encounter any problems.		The best way people can help us out right now is by helping find the correct address we need to jump to in order to execute code. This has already been done on the 2G Nano and the 1G Classic. But now we really need help with the other iPods. Regardless of technical experience, anyone can help us out and get Rockbox and iPodLinux ported to the Nano's quicker. If you find the correct return address, you can rightfully brag about being the first person to run non-Apple code on that iPod :-). I'd also like to point out that your iPod cannot be bricked by this process and the freemyipod team will gladly help you out on IRC if you encounter any problems.

	== Setup ==		== Setup ==

Farthen at 00:41, 7 August 2010

2010-08-07T00:41:33Z

← Older revision		Revision as of 00:41, 7 August 2010
Line 1:		Line 1:
	~~'''NOTICE:~~ This process is no longer needed.~~'''~~ Anybody left trying this is wasting their time, but we are preserving it for reference.		{{Outdated\|reason=This process is no longer needed. Anybody left trying this is wasting their time, but we are preserving it for reference.}}

	The best way people can help us out right now is by helping find the correct address we need to jump to in order to execute code. This has already been done on the 2G Nano and the 1G Classic. But now we really need help with the other iPods. Regardless of technical experience, anyone can help us out and get Rockbox and iPodLinux ported to the Nano's quicker. If you find the correct return address, you can rightfully brag about being the first person to run non-Apple code on that iPod :-). I'd also like to point out that your iPod cannot be bricked by this process and the Linux4nano team will gladly help you out on IRC if you encounter any problems.		The best way people can help us out right now is by helping find the correct address we need to jump to in order to execute code. This has already been done on the 2G Nano and the 1G Classic. But now we really need help with the other iPods. Regardless of technical experience, anyone can help us out and get Rockbox and iPodLinux ported to the Nano's quicker. If you find the correct return address, you can rightfully brag about being the first person to run non-Apple code on that iPod :-). I'd also like to point out that your iPod cannot be bricked by this process and the Linux4nano team will gladly help you out on IRC if you encounter any problems.

Cmwslw at 15:10, 5 August 2010

2010-08-05T15:10:16Z

← Older revision		Revision as of 15:10, 5 August 2010
Line 27:		Line 27:

	== Table of reserved or tested files ==		== Table of reserved or tested files ==
	{\| ~~border~~="1"		{\| class="wikitable"
	\|-		\|-
	! Username		! Username
Line 168:		Line 168:
	== Table of non-#1 (or non-#4) behaviors ==		== Table of non-#1 (or non-#4) behaviors ==
	If you leave an entry in here and don't normally hang out on IRC, send your email address to me at (cwalker32 AT gmail DOT com). This will give us a way to contact you if necessary.		If you leave an entry in here and don't normally hang out on IRC, send your email address to me at (cwalker32 AT gmail DOT com). This will give us a way to contact you if necessary.
	{\| ~~border~~="1"		{\| class="wikitable"
	\|-		\|-
	! Username		! Username

Cmwslw at 02:52, 13 July 2010

2010-07-13T02:52:34Z

← Older revision		Revision as of 02:52, 13 July 2010
Line 1:		Line 1:
	'''NOTICE: ~~Do not do this if you have a 2G or 4G Nano or the 1G Classic (80GB and 160GB models): we already have execution on them~~.''' ~~We might not even need~~ this ~~done on the 2G Classic (120GB) either~~, but ~~feel free to try. The main iPod~~ we ~~still need execution on is the 3G Nano, but someone has already built an automated bruteforcer~~ for ~~this one~~.		'''NOTICE: This process is no longer needed.''' Anybody left trying this is wasting their time, but we are preserving it for reference.

	~~Done for 3G as well through an old iphone exploit on a bootrom vulnerbility~~

	The best way people can help us out right now is by helping find the correct address we need to jump to in order to execute code. This has already been done on the 2G Nano and the 1G Classic. But now we really need help with the other iPods. Regardless of technical experience, anyone can help us out and get Rockbox and iPodLinux ported to the Nano's quicker. If you find the correct return address, you can rightfully brag about being the first person to run non-Apple code on that iPod :-). I'd also like to point out that your iPod cannot be bricked by this process and the Linux4nano team will gladly help you out on IRC if you encounter any problems.		The best way people can help us out right now is by helping find the correct address we need to jump to in order to execute code. This has already been done on the 2G Nano and the 1G Classic. But now we really need help with the other iPods. Regardless of technical experience, anyone can help us out and get Rockbox and iPodLinux ported to the Nano's quicker. If you find the correct return address, you can rightfully brag about being the first person to run non-Apple code on that iPod :-). I'd also like to point out that your iPod cannot be bricked by this process and the Linux4nano team will gladly help you out on IRC if you encounter any problems.

TheSeven: Reverted edits by 95.208.87.219 (Talk) to last version by 92.116.10.174

2010-07-05T11:59:46Z

Reverted edits by 95.208.87.219 (Talk) to last version by 92.116.10.174

← Older revision		Revision as of 11:59, 5 July 2010
Line 1:		Line 1:
	~~<nowiki>��EE��A�� 3��# �� #��3��# ��EEEEEEEEE</nowiki>~~'''NOTICE: Do not do this if you have a 2G or 4G Nano or the 1G Classic (80GB and 160GB models): we already have execution on them.''' We might not even need this done on the 2G Classic (120GB) either, but feel free to try. The main iPod we still need execution on is the 3G Nano, but someone has already built an automated bruteforcer for this one.		'''NOTICE: Do not do this if you have a 2G or 4G Nano or the 1G Classic (80GB and 160GB models): we already have execution on them.''' We might not even need this done on the 2G Classic (120GB) either, but feel free to try. The main iPod we still need execution on is the 3G Nano, but someone has already built an automated bruteforcer for this one.

	Done for 3G as well through an old iphone exploit on a bootrom vulnerbility		Done for 3G as well through an old iphone exploit on a bootrom vulnerbility