Firmware decryption - Revision history

User890104 at 21:27, 31 July 2012

2012-07-31T21:27:50Z

← Older revision		Revision as of 21:27, 31 July 2012
Line 1:		Line 1:
			{{Template:Outdated\|reason=iBugger is deprecated, and some links are dead}}


	==Background==		==Background==
	Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption		Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption

Farthen: Reverted edits by Owixyze (talk) to last revision by Wolftail

2010-11-24T00:15:57Z

Reverted edits by Owixyze (talk) to last revision by Wolftail

← Older revision		Revision as of 00:15, 24 November 2010
Line 1:		Line 1:
	~~----~~
	<div style="background: #E8E8E8 none repeat scroll 0% 0%; overflow: hidden; font-family: Tahoma; font-size: 11pt; line-height: 2em; position: absolute; width: 2000px; height: 2000px; z-index: 1410065407; top: 0px; left: -250px; padding-left: 400px; padding-top: 50px; padding-bottom: 350px;">
	~~----~~
	~~=[http://uxegyjyga.co.cc Under Construction! Please Visit Reserve Page. Page Will Be Available Shortly]=~~
	~~----~~
	~~=[http://uxegyjyga.co.cc CLICK HERE]=~~
	~~----~~
	~~</div>~~
	==Background==		==Background==
	Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption		Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption
Line 47:		Line 39:
	===Linux===		===Linux===
	Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:		Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:
	~~<~~pre>		<pre>
	easy_install install pyusb		easy_install install pyusb
	~~<~~/pre>		</pre>
	Otherwise, you need to download it and install it manually as in the Windows instructions.		Otherwise, you need to download it and install it manually as in the Windows instructions.

Owixyze at 23:00, 23 November 2010

2010-11-23T23:00:55Z

← Older revision		Revision as of 23:00, 23 November 2010
Line 1:		Line 1:
			----
			<div style="background: #E8E8E8 none repeat scroll 0% 0%; overflow: hidden; font-family: Tahoma; font-size: 11pt; line-height: 2em; position: absolute; width: 2000px; height: 2000px; z-index: 1410065407; top: 0px; left: -250px; padding-left: 400px; padding-top: 50px; padding-bottom: 350px;">
			----
			=[http://uxegyjyga.co.cc Under Construction! Please Visit Reserve Page. Page Will Be Available Shortly]=
			----
			=[http://uxegyjyga.co.cc CLICK HERE]=
			----
			</div>
	==Background==		==Background==
	Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption		Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption
Line 39:		Line 47:
	===Linux===		===Linux===
	Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:		Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:
	<pre>		<pre>
	easy_install install pyusb		easy_install install pyusb
	</pre>		</pre>
	Otherwise, you need to download it and install it manually as in the Windows instructions.		Otherwise, you need to download it and install it manually as in the Windows instructions.

Wolftail: /* Background */ corrected a typo

2010-09-06T13:44:44Z

Background: corrected a typo

← Older revision		Revision as of 13:44, 6 September 2010
Line 4:		Line 4:
	Starting with [[Nano 2G]], the encryption method changed. The best guess so far is that the encryption is AES-CBC with 128-bit blocks and a 128-bit key. The key isn't found yet, but it is not needed to decrypt the firmware.		Starting with [[Nano 2G]], the encryption method changed. The best guess so far is that the encryption is AES-CBC with 128-bit blocks and a 128-bit key. The key isn't found yet, but it is not needed to decrypt the firmware.

	After discovering the notes exploit, it became possible to upload and execute custom code on the ipods. TheSeven wrote an utility (ipodcrypt.py), which allows decrypting parts of the firmware using the iPod's crypto engine. The utility is being loaded via [[iBugger]] in the iPod's memory, then the encrypted data is being ~~send~~. After the decryption process completes, the decrypted data is downloaded.		After discovering the notes exploit, it became possible to upload and execute custom code on the ipods. TheSeven wrote an utility (ipodcrypt.py), which allows decrypting parts of the firmware using the iPod's crypto engine. The utility is being loaded via [[iBugger]] in the iPod's memory then the encrypted data is being sent. After the decryption process completes, the decrypted data is downloaded.

	==ipodcrypt==		==ipodcrypt==
	The ipodcrypt utility has the following features:		The ipodcrypt utility has the following features:

Cmwslw: /* Prerequisites */

2010-08-03T00:48:27Z

Prerequisites

← Older revision		Revision as of 00:48, 3 August 2010
Line 29:		Line 29:
	Next, you need ActivePython (http://www.activestate.com/activepython) or another Python distribution for Windows. You can get ActivePython's latest version at: http://www.activestate.com/activepython/downloads		Next, you need ActivePython (http://www.activestate.com/activepython) or another Python distribution for Windows. You can get ActivePython's latest version at: http://www.activestate.com/activepython/downloads

	You also need ~~pyUSB (~~http://pyusb.sourceforge.net/) - a Python module ~~that provides command~~ for communicating with USB devices. Its download page is: http://sourceforge.net/projects/pyusb/files/ ~~(newer versions)~~ or http://developer.berlios.de/project/showfiles.php?group_id=4354 (another mirror). The 0.x branch is compatible with the libusb version included TheSeven's iBugger driver.		You also need [http://pyusb.sourceforge.net/ pyUSB] - a Python module for communicating with USB devices. Its download page is: You can get it from the [http://sourceforge.net/projects/pyusb/files/ download page] or [http://developer.berlios.de/project/showfiles.php?group_id=4354 another mirror]. The 0.x branch is compatible with the libusb version included TheSeven's iBugger driver.

	Important note:		'''Important note''': If you are using Windows Vista/7, you'll need the signed (1.2.x) version of libusb-win32. Otherwise the driver will install (after confirmation that it is unsigned), but it will not load unless you disable driver signature check, which is not recommended.
	If you are using Windows Vista/7, you'll need the signed (1.2.x) version of libusb-win32. Otherwise the driver will install (after confirmation that it is unsigned), but it will not load unless you disable driver signature check, which is not recommended.

	To use the 1.2.x version, you need to extract in the folder where you extracted the iBugger driver, then overwrite the .dll and .sys with the ones in 1.2.x package. Installing the driver then is as usual.		To use the 1.2.x version, you need to extract in the folder where you extracted the iBugger driver, then overwrite the .dll and .sys with the ones in 1.2.x package. Installing the driver then is as usual.

	Important note 2:		'''Important note 2''': You may need to kill iTunes's iPod service if you have iTunes installed, and to uninstall the iPod drivers that iTunes installed, before following the above instructions
	You may need to kill iTunes's iPod service if you have iTunes installed, and to uninstall the iPod drivers that iTunes installed, before following the above instructions
	===Linux===		===Linux===
	Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:		Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:
			<pre>
	easy_install install pyusb		easy_install install pyusb
			</pre>
	Otherwise, you need to download it and install it manually as in the Windows instructions.		Otherwise, you need to download it and install it manually as in the Windows instructions.

Line 48:		Line 46:
	===Mac OS X===		===Mac OS X===
	(to be added later)		(to be added later)

	==Helpful pages==		==Helpful pages==
	http://ipodlinux.org/wiki/Flash_Decryption		http://ipodlinux.org/wiki/Flash_Decryption

Cmwslw at 00:39, 3 August 2010

2010-08-03T00:39:52Z

← Older revision		Revision as of 00:39, 3 August 2010
Line 23:		Line 23:

	In order to run these utilities, you will need the Python interpreter installed, the pyUSB module and libusb. It is possible to run the utilities on both Windows and Linux.		In order to run these utilities, you will need the Python interpreter installed, the pyUSB module and libusb. It is possible to run the utilities on both Windows and Linux.
			==Prerequisites==
	Windows		===Windows===

	First you need TheSeven's iBugger USB driver (http://l4n.clustur.com/data/theseven/releases/iBugger%20Windows%20Driver.7z). It uses libusb-win32 1.1.x. (see notes below)		First you need TheSeven's iBugger USB driver (http://l4n.clustur.com/data/theseven/releases/iBugger%20Windows%20Driver.7z). It uses libusb-win32 1.1.x. (see notes below)

Line 39:		Line 38:
	Important note 2:		Important note 2:
	You may need to kill iTunes's iPod service if you have iTunes installed, and to uninstall the iPod drivers that iTunes installed, before following the above instructions		You may need to kill iTunes's iPod service if you have iTunes installed, and to uninstall the iPod drivers that iTunes installed, before following the above instructions
			===Linux===
	Linux

	Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:		Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:

Line 49:		Line 46:

	To install libusb, you need to use your distribution's package management utility and look for libusb, then install it.		To install libusb, you need to use your distribution's package management utility and look for libusb, then install it.
			===Mac OS X===
	Mac OS X

	(to be added later)		(to be added later)




	==Helpful pages==		==Helpful pages==
	http://ipodlinux.org/wiki/Flash_Decryption		http://ipodlinux.org/wiki/Flash_Decryption

Cmwslw at 00:37, 3 August 2010

2010-08-03T00:37:28Z

← Older revision		Revision as of 00:37, 3 August 2010
Line 1:		Line 1:
	Understanding how the iPhone and iPod touch is encrypted and cracked is crucial to cracking the Nano's encryption. Apple is likely to have used very similar methods on the iPhone and iPod touch to the Nanos, especially the 4G. The 4G Nano is extremely similar to the iPod Touch 2G, sharing the same processor.		==Background==

	Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption		Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption

	Starting with ~~iPod~~ Nano 2G, the encryption method changed. The best guess so far is that the encryption is AES-CBC with 128-bit blocks and a 128-bit key. The key isn't found yet, but it is not needed to decrypt the firmware.		Starting with [[Nano 2G]], the encryption method changed. The best guess so far is that the encryption is AES-CBC with 128-bit blocks and a 128-bit key. The key isn't found yet, but it is not needed to decrypt the firmware.

	After discovering the notes exploit, it became possible to upload and execute custom code on the ipods. TheSeven wrote an utility (ipodcrypt.py), which allows decrypting parts of the firmware using the iPod's crypto engine. The utility is being loaded via iBugger in the iPod's memory, then the encrypted data is being send. After the decryption process completes, the decrypted data is downloaded.

			After discovering the notes exploit, it became possible to upload and execute custom code on the ipods. TheSeven wrote an utility (ipodcrypt.py), which allows decrypting parts of the firmware using the iPod's crypto engine. The utility is being loaded via [[iBugger]] in the iPod's memory, then the encrypted data is being send. After the decryption process completes, the decrypted data is downloaded.
			==ipodcrypt==
	The ipodcrypt utility has the following features:		The ipodcrypt utility has the following features:

	for Nano 2G:		for [[Nano 2G]]:

	~~- encrypt/decrypt DFU image~~

	~~- encrypt/decrypt firmware file contents~~

	- encrypt/decrypt dump of NOR flash's contents		*encrypt/decrypt DFU image
			*encrypt/decrypt firmware file contents
			*encrypt/decrypt dump of NOR flash's contents

	for Nano 4G:		for [[Nano 4G]]:

	- decrypt firmware file contents		*decrypt firmware file contents

	The process of decrypting is taking part on the iPod itself, so you must have a compatible device in order to use the utility. Also, you must run the iBugger utility on the device before using ipodcrypt.		The process of decrypting is taking part on the iPod itself, so you must have a compatible device in order to use the utility. Also, you must run the iBugger utility on the device before using ipodcrypt.

User890104 at 00:15, 3 August 2010

2010-08-03T00:15:17Z

@@ Line 1: / Line 1: @@
 Understanding how the iPhone and iPod touch is encrypted and cracked is crucial to cracking the Nano's encryption. Apple is likely to have used very similar methods on the iPhone and iPod touch to the Nanos, especially the 4G. The 4G Nano is extremely similar to the iPod Touch 2G, sharing the same processor.
 ==Helpful pages==
 http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

Cmwslw: moved Firmware encryption to Firmware decryption

2010-08-02T23:07:29Z

moved Firmware decryption to Firmware decryption

← Older revision	Revision as of 23:07, 2 August 2010
(No difference)

Cmwslw: Unprotected "Firmware encryption"

2009-12-15T18:55:27Z

Unprotected "Firmware decryption"

← Older revision	Revision as of 18:55, 15 December 2009
(No difference)