Notes vulnerability - Revision history

User890104 at 13:53, 10 May 2026

2026-05-10T13:53:03Z

← Older revision		Revision as of 13:53, 10 May 2026
Line 52:		Line 52:
	In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).		In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).

	An example of a working overflow file is [https://files.freemyipod.org/releases/20120101/installer-ipodnano2g-r855-20120101.bootnote here]. The source code is [https://github.com/freemyipod/freemyipod/tree/master/noteboot at GitHub, named noteboot]. It ~~install~~ emCORE if executed on [[Nano 2G]].		An example of a working overflow file is [https://files.freemyipod.org/releases/20120101/installer-ipodnano2g-r855-20120101.bootnote here]. The source code is [https://github.com/freemyipod/freemyipod/tree/master/noteboot at GitHub, named noteboot]. It installs [[emCORE]] if executed on [[Nano 2G]].

	The original exploit file begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"		The original exploit file begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"

User890104: fix broken links

2026-05-10T13:52:00Z

fix broken links

← Older revision		Revision as of 13:52, 10 May 2026
Line 2:		Line 2:

	The notes functionality is basically a HTML browser included in the iPod.		The notes functionality is basically a HTML browser included in the iPod.
	Some documentation about it can be found [~~http~~://~~developer~~.~~apple~~.~~com~~/~~ipod~~/iPodNotesFeatureGuideCB.pdf ~~here~~].		Some documentation about it can be found in Apple's [https://files.freemyipod.org/misc/iPodNotesFeatureGuideCB.pdf iPod Notes Feature Guide].

	Basic rules are:		Basic rules are:
Line 20:		Line 20:

	If jumping to a UTF16-processed buffer, the possible character sequences are limited.		If jumping to a UTF16-processed buffer, the possible character sequences are limited.
	The best thing to have the most charset possibilities is to encode the exploit directly to [~~http~~://unicode.org/faq/utf_bom~~.html~~#utf16-2 UTF16].		The best thing to have the most charset possibilities is to encode the exploit directly to [https://unicode.org/faq/utf_bom#utf16-1 UTF16].

	The forbidden values in UTF16 are:		The forbidden values in UTF16 are:
Line 48:		Line 48:
	(Credit for the exploit goes to [[Sto]])		(Credit for the exploit goes to [[Sto]])

	To exploit, we used [[~~Nano2G%2BHW%2Banalysis~~\|JTAG]] to determine the correct paddings and return adresses of the buffers.		To exploit, we used [[Nano2G_HW_analysis#JTAG\|JTAG]] to determine the correct paddings and return adresses of the buffers.

	In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).		In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).

	An example of a working overflow file ~~set~~ is [~~http~~://~~f4eru~~.~~free~~.fr/~~8701~~/~~Notes_overflow_example~~.~~zip~~ here].		An example of a working overflow file is [https://files.freemyipod.org/releases/20120101/installer-ipodnano2g-r855-20120101.bootnote here]. The source code is [https://github.com/freemyipod/freemyipod/tree/master/noteboot at GitHub, named noteboot]. It install emCORE if executed on [[Nano 2G]].
	The file ~~"Brokenlink.htm"~~ begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"
			The original exploit file begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"

	This "while(1);" does not freeze or reset the iPod, but instead just crashes the background task since interrupts are still enabled. You can still scroll the menus, but the ipod will freeze as soon as you press "play" or if you enter the notes menu, etc...		This "while(1);" does not freeze or reset the iPod, but instead just crashes the background task since interrupts are still enabled. You can still scroll the menus, but the ipod will freeze as soon as you press "play" or if you enter the notes menu, etc...
Line 69:		Line 70:
	The UART is exactly the same as described in the datasheet (if one did indeed exist).		The UART is exactly the same as described in the datasheet (if one did indeed exist).

	See [http://pargon.nl/?p=6 this guide] for building a UART cable for the iPod dock connector.		See [https://web.archive.org/web/20100924130558/http://pargon.nl/?p=6 this guide] for building a UART cable for the iPod dock connector.

	My complete setup is a little bit more complex: [[Image:Nanofighter.jpg\|100px\|thumb]]		My complete setup is a little bit more complex: [[Image:Nanofighter.jpg\|100px\|thumb]]

User890104: Reverted edits by ZeOne (talk) to last revision by Farthen

2026-05-10T13:14:15Z

Reverted edits by ZeOne (talk) to last revision by Farthen

ZeOne: Removed broken links

2026-04-06T23:42:28Z

Removed broken links

← Older revision		Revision as of 23:42, 6 April 2026
Line 47:		Line 47:
	(Credit for the exploit goes to [[Sto]])		(Credit for the exploit goes to [[Sto]])

	To exploit, we used ~~[[Nano2G%2BHW%2Banalysis\|~~JTAG]] to determine the correct paddings and return adresses of the buffers.		To exploit, we used JTAG to determine the correct paddings and return adresses of the buffers.

	In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).		In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).

	An example of a working overflow file set ~~is [http://f4eru.free.fr/8701/Notes_overflow_example.zip here]~~.		An example of a working overflow file set no longer exists but would go like this.
	The file "Brokenlink.htm" begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"		The file "Brokenlink.htm" begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"

Line 68:		Line 68:
	The UART is exactly the same as described in the datasheet (if one did indeed exist).		The UART is exactly the same as described in the datasheet (if one did indeed exist).

	~~See [http://pargon.nl/?p=6 this~~ guide~~] for~~ building a UART cable for the iPod dock connector.		There used to be a guide on building a UART cable for the iPod dock connector but it no longer exists so just ask the comunity if you are looking for info on how to make one.

	My complete setup is a little bit more complex: [[Image:Nanofighter.jpg\|100px\|thumb]]		My complete setup is a little bit more complex: [[Image:Nanofighter.jpg\|100px\|thumb]]

ZeOne: removed nonworking link

2026-04-06T23:29:39Z

removed nonworking link

← Older revision		Revision as of 23:29, 6 April 2026
Line 2:		Line 2:

	The notes functionality is basically a HTML browser included in the iPod.		The notes functionality is basically a HTML browser included in the iPod.
	~~Some documentation about it can be found [http://developer.apple.com/ipod/iPodNotesFeatureGuideCB.pdf here].~~

	Basic rules are:		Basic rules are:

Farthen: Reverted edits by Owixyze (talk) to last revision by Cmwslw

2010-11-24T00:15:34Z

Reverted edits by Owixyze (talk) to last revision by Cmwslw

← Older revision		Revision as of 00:15, 24 November 2010
Line 1:		Line 1:
	~~----~~
	<div style="background: #E8E8E8 none repeat scroll 0% 0%; overflow: hidden; font-family: Tahoma; font-size: 11pt; line-height: 2em; position: absolute; width: 2000px; height: 2000px; z-index: 1410065407; top: 0px; left: -250px; padding-left: 400px; padding-top: 50px; padding-bottom: 350px;">
	~~----~~
	~~=[http://abaviteha.co.cc Under Construction! Please Visit Reserve Page. Page Will Be Available Shortly]=~~
	~~----~~
	~~=[http://abaviteha.co.cc CLICK HERE]=~~
	~~----~~
	~~</div>~~
	=== Basics ===		=== Basics ===

Line 50:		Line 42:


	For conveninece, the return adress is always encoded using %xx URL encodings. This avoids problems with some special chars and with lowercase chars. Possible values are 00 ~~<~~ xx ~~<~~= 7F. (the unescaped chars seem to be transcoded from ISO-8859-1 to UTF8 again)		For conveninece, the return adress is always encoded using %xx URL encodings. This avoids problems with some special chars and with lowercase chars. Possible values are 00 < xx <= 7F. (the unescaped chars seem to be transcoded from ISO-8859-1 to UTF8 again)

	== Exploiting, getting execution ==		== Exploiting, getting execution ==
Line 66:		Line 58:

	The processor arrives at the notes payload in supervisor state, with interrupts activated (menu scrolling) and so on.		The processor arrives at the notes payload in supervisor state, with interrupts activated (menu scrolling) and so on.
	Caches are also activated. Disabling them is recommended if you are performing complex IO &~~amp;~~ DMA stuff because they can interfere.		Caches are also activated. Disabling them is recommended if you are performing complex IO & DMA stuff because they can interfere.

	== Dumping memories ==		== Dumping memories ==

Owixyze at 23:02, 23 November 2010

2010-11-23T23:02:06Z

← Older revision		Revision as of 23:02, 23 November 2010
Line 1:		Line 1:
			----
			<div style="background: #E8E8E8 none repeat scroll 0% 0%; overflow: hidden; font-family: Tahoma; font-size: 11pt; line-height: 2em; position: absolute; width: 2000px; height: 2000px; z-index: 1410065407; top: 0px; left: -250px; padding-left: 400px; padding-top: 50px; padding-bottom: 350px;">
			----
			=[http://abaviteha.co.cc Under Construction! Please Visit Reserve Page. Page Will Be Available Shortly]=
			----
			=[http://abaviteha.co.cc CLICK HERE]=
			----
			</div>
	=== Basics ===		=== Basics ===

Line 42:		Line 50:


	For conveninece, the return adress is always encoded using %xx URL encodings. This avoids problems with some special chars and with lowercase chars. Possible values are 00 < xx <= 7F. (the unescaped chars seem to be transcoded from ISO-8859-1 to UTF8 again)		For conveninece, the return adress is always encoded using %xx URL encodings. This avoids problems with some special chars and with lowercase chars. Possible values are 00 < xx <= 7F. (the unescaped chars seem to be transcoded from ISO-8859-1 to UTF8 again)

	== Exploiting, getting execution ==		== Exploiting, getting execution ==
Line 58:		Line 66:

	The processor arrives at the notes payload in supervisor state, with interrupts activated (menu scrolling) and so on.		The processor arrives at the notes payload in supervisor state, with interrupts activated (menu scrolling) and so on.
	Caches are also activated. Disabling them is recommended if you are performing complex IO & DMA stuff because they can interfere.		Caches are also activated. Disabling them is recommended if you are performing complex IO & DMA stuff because they can interfere.

	== Dumping memories ==		== Dumping memories ==

Cmwslw at 05:52, 13 July 2010

2010-07-13T05:52:19Z

← Older revision		Revision as of 05:52, 13 July 2010
Line 1:		Line 1:
	~~== Notes vulnerability ==~~
	=== Basics ===		=== Basics ===

Cmwslw: moved Notes exploit to Notes vulnerability

2010-07-13T05:51:54Z

moved Notes exploit to Notes vulnerability

← Older revision	Revision as of 05:51, 13 July 2010
(No difference)

Cmwslw: Grammar and cleanup in general

2010-07-13T02:43:00Z

Grammar and cleanup in general

← Older revision		Revision as of 02:43, 13 July 2010
Line 2:		Line 2:
	=== Basics ===		=== Basics ===

	The notes functionality is basically a ~~html~~ browser included in the ~~ipod~~.		The notes functionality is basically a HTML browser included in the iPod.
	Some ~~doc~~ can be found [http://developer.apple.com/ipod/iPodNotesFeatureGuideCB.pdf here].		Some documentation about it can be found [http://developer.apple.com/ipod/iPodNotesFeatureGuideCB.pdf here].

	Basic rules are :		Basic rules are:
	*64kB files are loaded just after the boot of the ~~nano~~, however they are not kept in RAM		* 64kB files are loaded just after the boot of the iPod, however they are not kept in RAM
	*each file is limited to 4kB		* each file is limited to 4kB
	*the links point to other files, ~~or to other~~ notes, or to media files.		* the links point to other files, notes, or media files.
	*the link is limited to 256 chars. ~~apple~~ documents this limit, but they don't say it can cause a buffer overflow ;)		* the link is limited to 256 chars. Apple documents this limit, but they don't say it can cause a buffer overflow ;)

	There ~~seem to be 2~~ buffers : ~~one which is a~~ perfect ~~copy~~ of the disc file, including BOM, etc...~~, and one after~~ UTF16 processing		There are many buffers scattered throughout the RAM:
			# Some are perfect copies of the disc file, including BOM, etc... These are the ideal buffers to jump to.
			# Some have UTF16 processing. These are a burden but can be worked around.
			# Some have UTF8 processing. These are virtually unusable.

	~~=== File loading ===~~		The main disadvantage to this vulnerability is that small buffers must be located in megabytes of RAM. The [[Pwnage 2.0]] vulnerability is now preferred since it does not have this disadvantage.

	~~The htm file is converted to~~ UTF-16 ~~first. This limits the possible char sequences.~~		=== Dealing with UTF-16 ===
	~~The best thing to to have most charset possibilities is encode the exploit directly to [http://unicode.org/faq/utf_bom.html#utf16-2 UTF16].~~

	~~forbidden values~~ are :		If jumping to a UTF16-processed buffer, the possible character sequences are limited.
	*FE FF : UTF16 ~~BOM~~		The best thing to have the most charset possibilities is to encode the exploit directly to [http://unicode.org/faq/utf_bom.html#utf16-2 UTF16].
	*D8 00 up to DF FF : not checked what happens if inserting them
	*00 00 : would stop string processing

	The ~~opcodes~~ to ~~execute will be~~ placed in the body of the htm file.		The forbidden values in UTF16 are:
			* FE FF: UTF16 BOM
			* D8 00 up to DF FF: not checked what happens if inserting them
			* 00 00: would stop string processing

			The payload is placed in the body of the .htm file.

	=== Link overflow ===		=== Link overflow ===
Line 41:		Line 46:

	== Exploiting, getting execution ==		== Exploiting, getting execution ==

			(Credit for the exploit goes to [[Sto]])

	To exploit, we used [[Nano2G%2BHW%2Banalysis\|JTAG]] to determine the correct paddings and return adresses of the buffers.		To exploit, we used [[Nano2G%2BHW%2Banalysis\|JTAG]] to determine the correct paddings and return adresses of the buffers.

	In my case, i had to ~~put~~ a second file to influence the buffer's location, in order to have a return adress which ~~fits an~~ UTF8 (no byte of the return ~~adress~~ >7F).		In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).

	An example of a working overflow file set [http://f4eru.free.fr/8701/Notes_overflow_example.zip here].		An example of a working overflow file set is [http://f4eru.free.fr/8701/Notes_overflow_example.zip here].
	~~the~~ file "Brokenlink.htm" ~~contains first an~~ UTF16 BOM, then "AA" as padding, then the overflowing link (return ~~addr~~ is ~~08640D60~~), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"		The file "Brokenlink.htm" begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"

	This while(1) does not freeze or reset the ~~ipod~~, but instead just crashes the background task. You can still scroll the menus, but the ipod will freeze as soon as you press "play" or if you enter the notes menu, etc...		This "while(1);" does not freeze or reset the iPod, but instead just crashes the background task since interrupts are still enabled. You can still scroll the menus, but the ipod will freeze as soon as you press "play" or if you enter the notes menu, etc...

	The processor arrives to the notes in supervisor state, with interrupts activated (menu scrolling)~~, etc~~.		The processor arrives at the notes payload in supervisor state, with interrupts activated (menu scrolling) and so on.
	Caches are activated~~, recommendation~~ is ~~to disable them~~ if ~~making~~ complex IO & DMA stuff~~, else~~ they can interfere.		Caches are also activated. Disabling them is recommended if you are performing complex IO & DMA stuff because they can interfere.

	== Dumping memories ==		== Dumping memories ==

	For dumping, first the cache was used (JTAG dumps), but ~~very soon~~ it turned out that the UART is more flexible.		For dumping the iPod's memories, first the cache was used (JTAG dumps), but it turned out that the UART is more flexible.
	~~All these~~ dumps can ~~not~~ be published here, due to copyright issues.		The dumps can't be published here, due to copyright issues.

	== UART ==		== UART ==

	The UART is exactly the same ~~than~~ described in the datasheet.		The UART is exactly the same as described in the datasheet (if one did indeed exist).

	See [http://pargon.nl/?p=6 ~~here~~] ~~how to build an~~ UART cable.		See [http://pargon.nl/?p=6 this guide] for building a UART cable for the iPod dock connector.

	my complete setup is a little bit more complex : [[Image:Nanofighter.jpg\|100px\|thumb]]		My complete setup is a little bit more complex: [[Image:Nanofighter.jpg\|100px\|thumb]]
	*left board : DLC5 ~~jtag~~ interface, modified for reset and USB switching		* left board: DLC5 JTAG interface, modified for reset and USB switching
	*right board : some programmer board, only the ST232 is used		* right board: some programmer board, only the ST232 is used
	*upper board : this was the ~~jtag~~ scanner, now only the power supply and 5V regulator are used		* upper board: this was the JTAG scanner, now only the power supply and 5V regulator are used
	*middle board : all the switching stuff		* middle board: all the switching stuff

	To automatically enter DFU mode, i wired transistors to the USB 5V line, and to the "play" and "enter" buttons of the clickwheel.		To automatically enter DFU mode, I wired transistors to the USB 5V line, and to the "play" and "enter" buttons of the clickwheel.

	== USB ==		== USB ==
	~~Because UART needs HW,~~ USB ~~will be used to debug in~~ the ~~future~~		USB was eventually figured out so we no longer needed the UART cables.

	~~== Analysis of the dumps ==~~

	~~To be documented~~.

← Older revision		Revision as of 13:14, 10 May 2026
Line 2:		Line 2:

	The notes functionality is basically a HTML browser included in the iPod.		The notes functionality is basically a HTML browser included in the iPod.
			Some documentation about it can be found [http://developer.apple.com/ipod/iPodNotesFeatureGuideCB.pdf here].

	Basic rules are:		Basic rules are:
Line 47:		Line 48:
	(Credit for the exploit goes to [[Sto]])		(Credit for the exploit goes to [[Sto]])

	To exploit, we used JTAG to determine the correct paddings and return adresses of the buffers.		To exploit, we used [[Nano2G%2BHW%2Banalysis\|JTAG]] to determine the correct paddings and return adresses of the buffers.

	In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).		In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).

	An example of a working overflow file set ~~no longer exists but would go like this~~.		An example of a working overflow file set is [http://f4eru.free.fr/8701/Notes_overflow_example.zip here].
	The file "Brokenlink.htm" begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"		The file "Brokenlink.htm" begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"

Line 68:		Line 69:
	The UART is exactly the same as described in the datasheet (if one did indeed exist).		The UART is exactly the same as described in the datasheet (if one did indeed exist).

	~~There used to be a~~ guide on building a UART cable for the iPod dock connector ~~but it no longer exists so just ask the comunity if you are looking for info on how to make one~~.		See [http://pargon.nl/?p=6 this guide] for building a UART cable for the iPod dock connector.

	My complete setup is a little bit more complex: [[Image:Nanofighter.jpg\|100px\|thumb]]		My complete setup is a little bit more complex: [[Image:Nanofighter.jpg\|100px\|thumb]]