https://freemyipod.org/index.php?action=history&feed=atom&title=Ipod_sunIpod sun - Revision history2026-05-20T08:19:49ZRevision history for this page on the wikiMediaWiki 1.45.1https://freemyipod.org/index.php?title=Ipod_sun&diff=22084&oldid=prev760ceb3b9c0ba4872cadf3ce35a7a494: ipod_sun page2024-08-04T04:33:29Z<p>ipod_sun page</p>
<p><b>New page</b></p><div>{{DISPLAYTITLE:ipod_sun}}<br />
[https://github.com/CUB3D/ipod_sun ipod_sun] is a tool that builds a modified firmware image enabling code execution on the iPod nano 6th and 7th generation. It works by replacing a font file in the <code>rsrc</code> partition of the firmware image with a malformed OTF font exploiting CVE-2010-1797<ref>https://www.cve.org/CVERecord?id=CVE-2010-1797</ref>.<br />
<br />
== Usage ==<br />
Once the firmware is booted on the device, usually via the [[Osos/disk swapping bug|osos/disk swapping bug]], the following additional SCSI commands are added:<br />
<br />
* <code>C6 96 01 __ __ __ __</code> - write data to memory<br />
* <code>C6 96 02 __ __ __ __</code> - read data from memory<br />
* <code>C6 96 03 __ __ __ __</code> - call a certain address in memory<br />
<br />
The underscores represent the 4-byte memory address. <br />
<code>C6</code>, the operation code for these commands, is used for proprietary Apple SCSI commands and exists in unmodified firmware. Only these instructions are part of ipod_sun.</div>760ceb3b9c0ba4872cadf3ce35a7a494