http://www.gizzomo.com/jailbreak/ipad/ipad-1g-jailbreak-3.2.0.php
網站首頁| 免費註冊| 登入網站| 搜索| 關於我們| 教學支援討論區| 主機破解及優化計劃| 加入支援團隊| 技術支援| 聯繫我們| 常見問題
歡迎你回來, 你尚未登入.
按此立即註冊, 或立即登入
友情提示:
擁有最齊全的教學資訊網站.
iOS 3.2.2/ iOS 4.1 的破解 (越獄) 教學經已全線推出 詳情請按此處查閱.Gizzomo 香港 » iOS 教學資訊網站 » 主機破解教學資訊 » iPad » JailBreak 3.2.0
以下教學將不會影響您的行貨保養, 只須重新使用 DFU Mode 回復至官方韌體後, 主機將回復至原來模樣.
執行以下教學前, 必須先備份你手上的主機的 SHSH Blob. 按此查看 SHSH Blobs 相關使用教學.
注意! 若果你的主機韌體版本已經是 3.2.0, 請由本教學的第六步開始.
下載本教學所需程式檔案
iPad 韌體 3.2.0 官方韌體檔案名為 iPad1,1_3.2_7B367_Restore.ipsw.
若下載回來的韌體不是以 .ipsw 為檔案副檔名, 按此查看更改檔案副檔名 (.ipa/ .ipsw) 教學.
1.) 備份手上 iPad 的資料
1.1.) 開啟 iTunes 並將手上的 iPad 連接至電腦.
1.2.) iTunes 認出主機後, 使用滑鼠右按 Back Up.
1.3.) 備份資料需時, 請等侍 iTunes 回應.
注意事項
建議完成備份才繼續本篇教學; 備份資料可於破解完成後回復至您的主機內 (請參閲本篇教學的第五步).
2.) 將 iPad 進入 DFU Mode
2.1.) 完成備份後, 繼續保持 iPad 開機.
2.2.) 首先同時按着主目錄制及電源開關制
2.3.) 至 iPad 被強制關機後, 放開電源開關制.
2.4.) 繼續維持按着主目錄制約 10 秒鐘;
2.5.) iTunes 認出在 DFU Mode 的主機, 按確定後即完成.
注意事項
進入 DFU Mode 後及按回復之前, 主機將維持黑屏及不會顯示任何東西.
以上方法若果不能進入 DFU Mode, 請按此嘗試其他方法.
3.) 使用 iTunes 回復 DFU Mode 的 iPad
3.1.) Windows 電腦: 按下鍵盤 Shift 鍵, 並同時按下 iTunes 裏的回復按鈕.
3.1.) Mac 電腦: 按下鍵盤 Option 鍵, 並同時按下 iTunes 裏的回復按鈕.
3.2.) 彈出提示框後, 選取剛剛下載的 iPad 3.2.0 官方韌體.
3.3.) 請等侍 iTunes 回應.
注意事項
韌體 3.2.0 檔案名為 iPad1,1_3.2_7B367_Restore.ipsw.
4.) 等待 iTunes 回復
4.1.) 回復過程需時, 請等侍 iTunes 回應.
4.2.) 以下為回復過程中將出現的訊息.
→ Extracting software...
→ Verifying iPad restore with Apple...
→ Preparing iPad for restore...
→ Restoring iPad software...
→ Verifying iPad software...
→ Verifying iPad restore...
→ Restoring iPad firmware...
5.) iPad 回復完成及回復備份資料
5.1.) 回復完成, 等待 iPad 重新開機.
5.2.) 重新開機後, iTunes 將出現 Set Up your iPad 的訊息.
5.3.) 選取剛剛備份的資料, 再按 Continue.
5.4.) 請等侍 iTunes 回應.
注意事項
請在此步同步 (Sync) 主機一次; 進入下一步前, 請確保主機不是顯示連接 iTunes 畫面.
6.) 設置 Spirit 使用權限
6.1.) 尋找剛下載的 Spirit.exe.
6.2.) 右按滑鼠, 點選 Properties (內容).
6.3.) 繼續把 iPad 連接至電腦.
7.) 設置 Spirit 使用權限
7.1.) 視窗開啟後, 選擇 Compatibility (相容性).
7.2.) 剔選 Run this program....
7.3.) 在下拉選單中選取 Windows 98/ Windows Me.
7.4.) 完成後, 按 OK.
8.) 使用 Spirit 開始破解主機
8.1.) 開啟 的 Spirit.exe.
8.2.) 按下 Jailbreak, 請等待 Spirit 回應.
8.3.) 繼續把 iPad 連接至電腦.
9.) 執行相關資料
9.1.) 系統將會開始執行相關資料.
9.2.) 繼續把 iPad 連接至電腦, 並等侍 Spirit 回應.
10.) 基本程序完成
10.1.) 基本破解程序完成, 可按下 Quit 關閉軟件.
注意事項
請繼續把 iPad 連接至電腦, 直至畫面已變成鎖定模式.
11.) 破解程序畫面
11.1.) 這時, 破解工作已轉至 iPad.
11.2.) 你會看到如左圖的畫面 (附有進度條).
11.3.) 這個程序需約數分鐘 (不多於 5 分鐘).
注意事項
請繼續把 iPad 連接至電腦, 直至畫面已變成鎖定模式, 主機破解才大功告成. 若果進度條長時間停在某位罝, 重新開啟主機後, 請由第八步重新開始.
主機破解後的 Cydia 相關基本設定 (重要!)
此篇教學至此完結, 還有問題?
歡迎討論, 提問或提出意見
Update Log for Knowledge Base
• 09072010: new structure for the knowledge base have been released (code: 0807201010003311)
• 12082010: added warnings on iOS update (code: 1208201016482011)
如果你覺得以上教學資訊有錯誤, 請按此通知我們.
如果你覺得以上教學資訊需要更新, 請按此通知我們.
Gizzomo 首頁Gizzomo 香港Tutorial System from worldZh Group. © 2010 worldZh Group.我要發問管理團隊技術支援
Powered by worldZh Group. Copyright © 2010 Gizzomo.Com. All rights reserved.網站首頁關於我們網站地圖使用條款隱私政策聯繫我們
Showing posts with label ipad. Show all posts
Showing posts with label ipad. Show all posts
Saturday, October 23, 2010
Tuesday, August 24, 2010
ipad restore
02-26-2010, 04:44 PM
Raeki
iPhone Intermediate
Join Date: Feb 2010
Posts: 105
Error Message 3194 Please Help
I have backed up all my contacts, etc. but now when trying to restore I get an error
I am trying to restore to 3.12 (I am currently on 3.0.1) but I get an error message after "Verify with Apple" number 3194. I do not see it anywhere else and the error message says "The iPhone "iPhone" was unable to restore. This device is eligible for the requested build."
#2 (permalink)
02-26-2010, 04:54 PM
big9erfan
iPhone Guru
Join Date: Jun 2009
Location: Sunny So Cal
Posts: 1,881
Apple signs the firmwares now. You cannot upgrade ( or downgrade ) and 3GS to a firmware that Apple doesn't sign anymore unless you tapped on "Make my life easier" within Cydia and you follow these instructions:
Caching Apple's Signature Server - Jay Freeman (saurik)
__________________
-I tweet ..therefore I am?
http://www.codemonkeycodes.com
iPhone4 BLACK - 16GB R.I.P Dad. Forever in our hearts 5/10/10
#3 (permalink)
02-26-2010, 05:06 PM
Raeki
iPhone Intermediate
Join Date: Feb 2010
Posts: 105
I have one problem: I edited the host file using notepad, but after adding the line my wifi stops working. How do I fix this?
#4 (permalink)
02-26-2010, 05:18 PM
Raeki
iPhone Intermediate
Join Date: Feb 2010
Posts: 105
Hmm, I rebooted my iPhone however now I get an error message 3014... after a bit of research I think Cydia restore only works with 3.0.
So my question is then, Is it still possible to upgrade to 3.12? If so, how?
#5 (permalink)
07-26-2010, 04:51 PM
gothicjim
iPhone Nanite
Join Date: Jul 2010
Posts: 1
i have a ipad with spirit jailbreak...3.2
for some reason it managed to delete my ipod.app and others, now im stuck it wont let me restore because i constantly get this 3194 error...what should i do!? please help
Caching Apple's Signature Server
Click here to skip directly to the instructions. Personally, I find it much less powerful to say "do this" than "do this, here is how it works, and this is why", because the former just causes more confusion and more problems down the road. However, some disagree. Those people can click this link. ;P
Please, for the love of all that is holy, do not e-mail me if you have problems. ;P Instead, go to ModMyi.com, where there is a special forum called 3G[S] Downgrading, created for the purposes of this article.
Seriously: there is no way I could possibly hope to answer even the number of e-mails I'm currently receiving regarding this, and the article isn't even out yet. There is this wonderful scene from Bruce Almighty where Bruce sees his e-mail inbox: that happens to me every day. :(
I have very little respect for Apple at this point: I make no secret of this fact. Apple, as a company, has turned into a corporate hypocrisy, embodying the very ideals that it claims to be rebelling against. "Think Different", as a slogan, has become a cold criticism of their own actions with regards to their product lines.
The Next Hope
Apple is not just a computer company: Apple is a movement. This concept was finally and truly cemented in the public mindset when Apple carved itself a lasting place in the history of marketing with its 1984 superbowl commercial for Macintosh.
Styled after the classic Orwellian distopia, 1984, this commercial was set in a future where all aspects of individuality had been stamped out by the overlords, constantly vigilant, watching from their television monitors.
This world, as well as everyone in it, was rendered in a blue and gray: some believe we are to see the overlords as IBM, well renowned for their corporate beaurocracy, and soon to be hated for trying to control our very thoughts with their bland machinery.
Others, including the creative director of the commercial, Lee Clow, state that the commercial represents the abstract struggle of "the few against the many": Apple's Macintosh standing as a symbol of "empowerment". [Wikipedia]
The True Enemy
However, as time grew on, Apple's real stance on individual expression and "empowerment" in particular, became clear: they are staunchly against it. Apple's insistence on controlling the experience of their products sounds very similar to the "garden of pure ideology" expoused by the Big Brother in their own commercial.
Today we celebrate the first glorious anniversary of the Information Purification Directives. We have created, for the first time in all history, a garden of pure ideology: where each worker may bloom, secure from the pests of any contradictory... thoughts.
Our Unification of Thoughts is more powerful a weapon than any fleet or army on Earth. We are one people: with one will, one resolve, one cause. Our enemies shall talk themselves to death and we will bury them with their own confusion. We shall prevail!
The Point of Jailbreaking
This is why many of us (upwards of 10% of all iPhone users, in fact) "jailbreak" our devices: we want choice. We believe that Apple has maintained its lead as the best mobile hardware platform provider, and we encourage that innovation by purchasing not only their devices but also numerous applications from their App Store; but, and this is important: we want more.
Sometimes, it is "only" marketing restrictions: there is no fundamental reason why only the 3G[S] can record video (although the quality of the camera on the iPhone 2G and 3G is not very high), or why the iPhone 2G is somehow unable to do MMS.
Applications like Google Latitude or Voice are likewise "rejected" (Apple likes to claim that they didn't reject these applications, they simply "didn't accept" them...) from the App Store because they might "confuse" the user by replacing functionality that exists with better equivalents.
Our need for "more", however, goes deeper: jailbreaking isn't just about applications that Apple "rejected", but is also about taking provided tools and going in a new direction. The most popular packages available in Cydia aren't even "applications", but are "extensions": seamless and pervasive modifications to existing software.
An Exploit a Day...
On desktop computers such markets are implicit: the computer is yours, and you can do whatever you want with it. You can purchase any kind of hardware, download any kind of software, and make any modifications you feel to be fit. However, Apple doesn't want us treating our iPhones like computers, no matter how similar they seem.
This means that those of us who demand to have the freedom to use the device we rightfully own the way we want to use it are in a constant battle with Apple. Each time they release a new product, or even just a software upgrade for an old one, we have to go to work defeating any new protections.
This arms race is what defines the "homebrew" community on most devices: each upgrade to the PlayStation Portable, for example, brings not only new features but also new restrictions, requiring users to find a new "exploit" to defeat the new defense.
What makes the iPhone platform special, however, is PwnageTool from the iPhone Dev Team: the trust chain on these devices has been completely defeated, and only with new hardware can Apple fix the issues to keep us out.
The Signature Server
Of course, new hardware comes every year, and Apple decided to strike hard with the new iPhone 3G[S]. Rather than just throw in new local protections, Apple decided that every restore of the device would be verified as being valid and safe by Apple itself.
To do this, during the restore process, users see "Verifying restore with Apple...", during which time a challenge/response protocol is used between the iPhone and Apple: a "partial digest" of the firmware files being used is sent to a server, which can then decide to sign off on the result... or not.
Not only does this allow Apple to keep custom firmwares from getting loaded onto the device, but it also allows them to recall existing firmwares by keeping people from restoring to them in the future. To do this they simply would refuse to ever sign, for example, iPhoneOS 3.0 again.
However, to make this model secure, one must verify that their system is not subject to a simple "replay attack": where one just stores a copy of Apple's sign off and then returns it at a later point. This is a "beginner's attack", and one that is easily mitigated by any of a number of strategies.
For a Purple Ra1ny Day
Apple's 3G[S] security mechanism, however, fails this test. Rather than even using a simple random number, they use a hardcoded challenge per device. The specific number they have chosen is the device's ECID, or "unique-chip-id", a number that all devices have so far had, although we haven't seen any previous use for it.
This means that, given an ECID, one can ask Apple's signature server to sign any firmware that they currently consider "OK" (which returns a blob that includes the critical SHSH, which is the signature hash) and then store the result forever.
In practice, there is only one critical file that we need signed: the one with the bug. ;P This is the iBSS, which is one of the modes of iBoot. Given that ECID/iBSS signature, one can load the buggy code and then continue with the jailbreak.
This is, in fact, what purplera1n.com was doing: it returned to you a file that contained just the signature hash for the iBSS file, as that is "sufficient". Eventually someone may write a tool to use this file.
Personalized Firmware
What iTunes does with these blobs is to "personalize" the firmware file, integrating the ECID, SHSH, and CERT blocks into it, so that the iPhone can verify the result. It does this in a temporary directory where users can actually just watch and grab the files.
So, many users have gone in and carefully gotten both the iBSS and iBEC files from this personalization mechanism. The iBSS file from this process actually contains no more information than the tiny purplera1nyday file.
However, and this is unfortunate: just because this information is "sufficient to jailbreak", doesn't mean it is convenient. Without someone writing a special jailbreak tool that uses these files as input you are pretty much stuck.
Your iPhone 3G[S] has an ECID SHSH on file.
Instead, what you really want, is to store the entire personalized firmware set required by iTunes to do a restore (or, more realistically: a full set of SHSH blobs). At this point you should be able to use iTunes to do a "normal" restore of the device.
This functionality was offered, very near to the end of the window, by Cydia: one needed only to agree to have the process done, and your ECID was used on Cydia's server to generate and store a full set of SHSH blobs using Apple's signature process.
In doing this, over 50,000 3G[S] devices got their ECID SHSHs "on file", and are now prepared to continue to restore to iPhoneOS 3.0 indefinitely.
A Narrow Window
Unfortunately, due to the timing of the release (it took a while for me to figure out how to do this effectively), many users failed to get their ECID's in by Apple's cutoff. However, while this means these users will not be able to downgrade to (or even stay at) 3.0, an exploit has (supposedly) been found in 3.1.
This means that, at some point in the tangible but unknown future, users will be able to use iPhoneOS 3.1 on their 3G[S] to jailbreak their devices.
To faciliate this, the Cydia "on file" system is going to come back online tonight and start signing ECIDs using the 3.1 firmware, to prepare for the coming release from Apple when users will once again be locked out.
Hopefully, by then, we'll have hundreds of thousands of users fully protected against Apple's "Information Purification Directives".
Bypassing the Overlord
To this end, I have constructed a server that duplicates the functionality exposed by Apple's signature server, except using "on file" results rather than live requests.
All we need, then, is to make iTunes use it. Luckily, most operating systems also have the ability to locally define bypasses on specific hostnames through a file called hosts. Using this, we can redirect requests to Apple's signature server to Cydia.
So, open the file C:\Windows\System32\drivers\etc\hosts (Windows) or /etc/hosts (Mac OS X) and add the following entry to the bottom of the file.
74.208.10.249 gs.apple.com
Now, when iTunes thinks it is talking to Apple, it is talking to Cydia instead. Doing this will allow iTunes to access signatures already stored by Cydia's "on file" feature.
This server will also act as a cache for any SHSH blobs it hasn't seen, acting as an intermediary to Apple's server. This effectively registers your device with the "on file" mechanism, which means you can now enjoy the protections of being able to downgrade your firmware in the future even if you aren't jailbroken.
This point should be stressed: even if you don't jailbreak, and even if you never intend to jailbreak, you should consider using the new "on file" service.
Let's say that Apple releases an OS upgrade in the future, you take it, and they break something important. Maybe they break your e-mail account, or your todo list. Your business is now crippled.
If only you could downgrade, right? Alas, Apple won't let you anymore. That's where the new signature cache server comes in: by doing your restores through this server you secure your ability to not accept upgrades from Apple if the need is dire.
Performing the Restore
Now, one would have hoped that the process would be as easy as "restore using the 3.0 IPSW". If only we were that lucky. The first problem is that a downgrade from 3.1 to 3.0 must be initiated in DFU mode.
So, we begin: hold down the lock and menu buttons (some call these the power and home buttons) for 10 seconds, letting go of the lock button but continuing to hold menu until iTunes recognizes the device with the message: "iTunes has detected an iPhone in recovery mode. You must restore this iPhone before it can be used with iTunes.".
Note that, at this point, your iPhone's screen should be entirely black. Many people confuse "DFU" with "recovery" (and in fact, iTunes itself glosses over this), but they are quite different. If you see anything on your screen, such as the iTunes logo and a sync cable, or a cartoon of Steve Jobs swearing in Cyrillic, you are in recovery mode and need to try again. One can find videos online that may help.
At this point, you should do a "normal" restore to the 3.0 software. When doing this, remember to hold down the option key (on Mac OS X) or the shift key (Windows) while clicking the Restore button in iTunes. Select the firmware (which is probably named iPhone2,1_3.0_7A341_Restore.ipsw), and things should be on their way.
Please note that I do not have signatures for 3.0.1, only for 3.0. For some very small number of users I also have a signature for 3.0.1, but I ran out of time hitting the Wednesday deadline getting the code for this working and generalized.
If you would like to try restoring to 3.0.1 with my server, therefore, to see if you have 3.0.1 keys on file you can try, but it may fail late in the process with a very weird error. All users "on file", however, have 3.0 ready to go.
Upcoming 3.1 Exploit
If you encouter "unknown error (3002)", you probably do not have your ECID SHSH's for 3.0 "on file" with Cydia. Unfortunately, as Apple is no longer allowing users to sign the 3.0 firmware, it is no longer possible to register your device with Cydia.
Luckily, it has been reported that iPhoneOS 3.1 is vulnerable to another exploit. This means that, once a jailbreak is released for 3.1, users will be able to prepare themselves for future jailbreaks even if they missed the first round of signature storage (which I unfortunately was only able to start very late in the 3.0 game).
Once you even attempt to use this service (or if you tell Cydia to "make your life easier") you will be signed up for the signature tracker, and Cydia HQ will do its best to manage your ability to restore.
And again, if you have any issues with this process, please please please do not e-mail me. Instead, go to ModMyi.com, where there is a special forum called 3G[S] Downgrading, created for the purposes of this article.
NAND Format Invalid
OK, if you were already using 3.0 then this process should "just work". However, if you had already upgraded to 3.1 you will encounted a nasty error: "The iPhone "iPhone" could not be restored. An unknown error occured (1015).". This is expected behavior.
For people who are curious, what has happened is that a section of the NAND storage has been slightly reorganized in 3.1, and the 3.0 iBoot can no longer parse it. If we pulled out iRecovery and checked the iBoot logs over USB we'd see the following messages (the typos are Apple's).
[WMR:ERR] NAND format invalid (mismatch, corrupt, read error or blank NAND device)
[WMR:ERR] boolSignatureFound false boolProductionFormatVerified true nSig 0x0
******************************************************************************
******************************************************************************
AND: NAND initialisaton failed due to format mismatch or uninitialised NAND.
AND: Please reboot with reformatting enabled.
******************************************************************************
******************************************************************************
NAND FTL failed initialisation
The first time this happened to me I actually spent a while with MuscleNerd working out how to do what it asked: "reboot with reformatting enabled". That was a severe waste of time: after you fix this, it still won't boot, and you will need to go through a second restore to finish the process.
However, it turns out a second restore also formats the NAND correctly by itself. So, without bothering to do anything else to the device (leaving it in the recovery mode it is now in: DFU is no longer required), just start the restore over again in the same manner as before, once again selecting the 3.0 firmware.
Stuck in Restore
Unfortuntaely, this second restore is also going to fail (*sigh*), and irritatingly enough it is going to cause the exact same error message: "The iPhone "iPhone" could not be restored. An unknown error occured (1015).". This is still expected behavior.
For those who are again curious, what has happened is that when the device turns on it has to decide what it is going to do: wait for instructions over USB, or continue into the boot process. This is determined by an NVRAM variable named auto-boot, which is currently set to "false".
Normally this is set at the end of the restore process, but technically we were unable to finish the restore: it is my understanding that this is because upgrading to 3.1 installed the 3.1 baseband (which is currently not unlockable, btw), and the baseband upgrade in the 3.0 release then fails, stopping the restore.
However, that seems to be the last and least important part of the restore, so we technically won: we are never, though, going to be able to restore back to 3.0 without hitting this 1015 again, though.
Jailbreak with redsn0w or purplera1n
You have two. The first is to use iRecovery to manually set auto-boot to "true", and the second is to just go ahead and jailbreak your device.
We will go ahead and do option #2 (jailbreak), as even just getting iRecovery working on your computer is something that I don't look forward to trying to describe. ;P (In fact, it still isn't working on my Windows computer.)
At this point, you can just run your jailbreak tool of choice, which should jailbreak the device and boot it into the normal operating system. Congratualations, you just overthrew your orwellian overlord, and have taken back control of your device.
At least today, we will prevail!
Raeki
iPhone Intermediate
Join Date: Feb 2010
Posts: 105
Error Message 3194 Please Help
I have backed up all my contacts, etc. but now when trying to restore I get an error
I am trying to restore to 3.12 (I am currently on 3.0.1) but I get an error message after "Verify with Apple" number 3194. I do not see it anywhere else and the error message says "The iPhone "iPhone" was unable to restore. This device is eligible for the requested build."
#2 (permalink)
02-26-2010, 04:54 PM
big9erfan
iPhone Guru
Join Date: Jun 2009
Location: Sunny So Cal
Posts: 1,881
Apple signs the firmwares now. You cannot upgrade ( or downgrade ) and 3GS to a firmware that Apple doesn't sign anymore unless you tapped on "Make my life easier" within Cydia and you follow these instructions:
Caching Apple's Signature Server - Jay Freeman (saurik)
__________________
-I tweet ..therefore I am?
http://www.codemonkeycodes.com
iPhone4 BLACK - 16GB R.I.P Dad. Forever in our hearts 5/10/10
#3 (permalink)
02-26-2010, 05:06 PM
Raeki
iPhone Intermediate
Join Date: Feb 2010
Posts: 105
I have one problem: I edited the host file using notepad, but after adding the line my wifi stops working. How do I fix this?
#4 (permalink)
02-26-2010, 05:18 PM
Raeki
iPhone Intermediate
Join Date: Feb 2010
Posts: 105
Hmm, I rebooted my iPhone however now I get an error message 3014... after a bit of research I think Cydia restore only works with 3.0.
So my question is then, Is it still possible to upgrade to 3.12? If so, how?
#5 (permalink)
07-26-2010, 04:51 PM
gothicjim
iPhone Nanite
Join Date: Jul 2010
Posts: 1
i have a ipad with spirit jailbreak...3.2
for some reason it managed to delete my ipod.app and others, now im stuck it wont let me restore because i constantly get this 3194 error...what should i do!? please help
Caching Apple's Signature Server
Click here to skip directly to the instructions. Personally, I find it much less powerful to say "do this" than "do this, here is how it works, and this is why", because the former just causes more confusion and more problems down the road. However, some disagree. Those people can click this link. ;P
Please, for the love of all that is holy, do not e-mail me if you have problems. ;P Instead, go to ModMyi.com, where there is a special forum called 3G[S] Downgrading, created for the purposes of this article.
Seriously: there is no way I could possibly hope to answer even the number of e-mails I'm currently receiving regarding this, and the article isn't even out yet. There is this wonderful scene from Bruce Almighty where Bruce sees his e-mail inbox: that happens to me every day. :(
I have very little respect for Apple at this point: I make no secret of this fact. Apple, as a company, has turned into a corporate hypocrisy, embodying the very ideals that it claims to be rebelling against. "Think Different", as a slogan, has become a cold criticism of their own actions with regards to their product lines.
The Next Hope
Apple is not just a computer company: Apple is a movement. This concept was finally and truly cemented in the public mindset when Apple carved itself a lasting place in the history of marketing with its 1984 superbowl commercial for Macintosh.
Styled after the classic Orwellian distopia, 1984, this commercial was set in a future where all aspects of individuality had been stamped out by the overlords, constantly vigilant, watching from their television monitors.
This world, as well as everyone in it, was rendered in a blue and gray: some believe we are to see the overlords as IBM, well renowned for their corporate beaurocracy, and soon to be hated for trying to control our very thoughts with their bland machinery.
Others, including the creative director of the commercial, Lee Clow, state that the commercial represents the abstract struggle of "the few against the many": Apple's Macintosh standing as a symbol of "empowerment". [Wikipedia]
The True Enemy
However, as time grew on, Apple's real stance on individual expression and "empowerment" in particular, became clear: they are staunchly against it. Apple's insistence on controlling the experience of their products sounds very similar to the "garden of pure ideology" expoused by the Big Brother in their own commercial.
Today we celebrate the first glorious anniversary of the Information Purification Directives. We have created, for the first time in all history, a garden of pure ideology: where each worker may bloom, secure from the pests of any contradictory... thoughts.
Our Unification of Thoughts is more powerful a weapon than any fleet or army on Earth. We are one people: with one will, one resolve, one cause. Our enemies shall talk themselves to death and we will bury them with their own confusion. We shall prevail!
The Point of Jailbreaking
This is why many of us (upwards of 10% of all iPhone users, in fact) "jailbreak" our devices: we want choice. We believe that Apple has maintained its lead as the best mobile hardware platform provider, and we encourage that innovation by purchasing not only their devices but also numerous applications from their App Store; but, and this is important: we want more.
Sometimes, it is "only" marketing restrictions: there is no fundamental reason why only the 3G[S] can record video (although the quality of the camera on the iPhone 2G and 3G is not very high), or why the iPhone 2G is somehow unable to do MMS.
Applications like Google Latitude or Voice are likewise "rejected" (Apple likes to claim that they didn't reject these applications, they simply "didn't accept" them...) from the App Store because they might "confuse" the user by replacing functionality that exists with better equivalents.
Our need for "more", however, goes deeper: jailbreaking isn't just about applications that Apple "rejected", but is also about taking provided tools and going in a new direction. The most popular packages available in Cydia aren't even "applications", but are "extensions": seamless and pervasive modifications to existing software.
An Exploit a Day...
On desktop computers such markets are implicit: the computer is yours, and you can do whatever you want with it. You can purchase any kind of hardware, download any kind of software, and make any modifications you feel to be fit. However, Apple doesn't want us treating our iPhones like computers, no matter how similar they seem.
This means that those of us who demand to have the freedom to use the device we rightfully own the way we want to use it are in a constant battle with Apple. Each time they release a new product, or even just a software upgrade for an old one, we have to go to work defeating any new protections.
This arms race is what defines the "homebrew" community on most devices: each upgrade to the PlayStation Portable, for example, brings not only new features but also new restrictions, requiring users to find a new "exploit" to defeat the new defense.
What makes the iPhone platform special, however, is PwnageTool from the iPhone Dev Team: the trust chain on these devices has been completely defeated, and only with new hardware can Apple fix the issues to keep us out.
The Signature Server
Of course, new hardware comes every year, and Apple decided to strike hard with the new iPhone 3G[S]. Rather than just throw in new local protections, Apple decided that every restore of the device would be verified as being valid and safe by Apple itself.
To do this, during the restore process, users see "Verifying restore with Apple...", during which time a challenge/response protocol is used between the iPhone and Apple: a "partial digest" of the firmware files being used is sent to a server, which can then decide to sign off on the result... or not.
Not only does this allow Apple to keep custom firmwares from getting loaded onto the device, but it also allows them to recall existing firmwares by keeping people from restoring to them in the future. To do this they simply would refuse to ever sign, for example, iPhoneOS 3.0 again.
However, to make this model secure, one must verify that their system is not subject to a simple "replay attack": where one just stores a copy of Apple's sign off and then returns it at a later point. This is a "beginner's attack", and one that is easily mitigated by any of a number of strategies.
For a Purple Ra1ny Day
Apple's 3G[S] security mechanism, however, fails this test. Rather than even using a simple random number, they use a hardcoded challenge per device. The specific number they have chosen is the device's ECID, or "unique-chip-id", a number that all devices have so far had, although we haven't seen any previous use for it.
This means that, given an ECID, one can ask Apple's signature server to sign any firmware that they currently consider "OK" (which returns a blob that includes the critical SHSH, which is the signature hash) and then store the result forever.
In practice, there is only one critical file that we need signed: the one with the bug. ;P This is the iBSS, which is one of the modes of iBoot. Given that ECID/iBSS signature, one can load the buggy code and then continue with the jailbreak.
This is, in fact, what purplera1n.com was doing: it returned to you a file that contained just the signature hash for the iBSS file, as that is "sufficient". Eventually someone may write a tool to use this file.
Personalized Firmware
What iTunes does with these blobs is to "personalize" the firmware file, integrating the ECID, SHSH, and CERT blocks into it, so that the iPhone can verify the result. It does this in a temporary directory where users can actually just watch and grab the files.
So, many users have gone in and carefully gotten both the iBSS and iBEC files from this personalization mechanism. The iBSS file from this process actually contains no more information than the tiny purplera1nyday file.
However, and this is unfortunate: just because this information is "sufficient to jailbreak", doesn't mean it is convenient. Without someone writing a special jailbreak tool that uses these files as input you are pretty much stuck.
Your iPhone 3G[S] has an ECID SHSH on file.
Instead, what you really want, is to store the entire personalized firmware set required by iTunes to do a restore (or, more realistically: a full set of SHSH blobs). At this point you should be able to use iTunes to do a "normal" restore of the device.
This functionality was offered, very near to the end of the window, by Cydia: one needed only to agree to have the process done, and your ECID was used on Cydia's server to generate and store a full set of SHSH blobs using Apple's signature process.
In doing this, over 50,000 3G[S] devices got their ECID SHSHs "on file", and are now prepared to continue to restore to iPhoneOS 3.0 indefinitely.
A Narrow Window
Unfortunately, due to the timing of the release (it took a while for me to figure out how to do this effectively), many users failed to get their ECID's in by Apple's cutoff. However, while this means these users will not be able to downgrade to (or even stay at) 3.0, an exploit has (supposedly) been found in 3.1.
This means that, at some point in the tangible but unknown future, users will be able to use iPhoneOS 3.1 on their 3G[S] to jailbreak their devices.
To faciliate this, the Cydia "on file" system is going to come back online tonight and start signing ECIDs using the 3.1 firmware, to prepare for the coming release from Apple when users will once again be locked out.
Hopefully, by then, we'll have hundreds of thousands of users fully protected against Apple's "Information Purification Directives".
Bypassing the Overlord
To this end, I have constructed a server that duplicates the functionality exposed by Apple's signature server, except using "on file" results rather than live requests.
All we need, then, is to make iTunes use it. Luckily, most operating systems also have the ability to locally define bypasses on specific hostnames through a file called hosts. Using this, we can redirect requests to Apple's signature server to Cydia.
So, open the file C:\Windows\System32\drivers\etc\hosts (Windows) or /etc/hosts (Mac OS X) and add the following entry to the bottom of the file.
74.208.10.249 gs.apple.com
Now, when iTunes thinks it is talking to Apple, it is talking to Cydia instead. Doing this will allow iTunes to access signatures already stored by Cydia's "on file" feature.
This server will also act as a cache for any SHSH blobs it hasn't seen, acting as an intermediary to Apple's server. This effectively registers your device with the "on file" mechanism, which means you can now enjoy the protections of being able to downgrade your firmware in the future even if you aren't jailbroken.
This point should be stressed: even if you don't jailbreak, and even if you never intend to jailbreak, you should consider using the new "on file" service.
Let's say that Apple releases an OS upgrade in the future, you take it, and they break something important. Maybe they break your e-mail account, or your todo list. Your business is now crippled.
If only you could downgrade, right? Alas, Apple won't let you anymore. That's where the new signature cache server comes in: by doing your restores through this server you secure your ability to not accept upgrades from Apple if the need is dire.
Performing the Restore
Now, one would have hoped that the process would be as easy as "restore using the 3.0 IPSW". If only we were that lucky. The first problem is that a downgrade from 3.1 to 3.0 must be initiated in DFU mode.
So, we begin: hold down the lock and menu buttons (some call these the power and home buttons) for 10 seconds, letting go of the lock button but continuing to hold menu until iTunes recognizes the device with the message: "iTunes has detected an iPhone in recovery mode. You must restore this iPhone before it can be used with iTunes.".
Note that, at this point, your iPhone's screen should be entirely black. Many people confuse "DFU" with "recovery" (and in fact, iTunes itself glosses over this), but they are quite different. If you see anything on your screen, such as the iTunes logo and a sync cable, or a cartoon of Steve Jobs swearing in Cyrillic, you are in recovery mode and need to try again. One can find videos online that may help.
At this point, you should do a "normal" restore to the 3.0 software. When doing this, remember to hold down the option key (on Mac OS X) or the shift key (Windows) while clicking the Restore button in iTunes. Select the firmware (which is probably named iPhone2,1_3.0_7A341_Restore.ipsw), and things should be on their way.
Please note that I do not have signatures for 3.0.1, only for 3.0. For some very small number of users I also have a signature for 3.0.1, but I ran out of time hitting the Wednesday deadline getting the code for this working and generalized.
If you would like to try restoring to 3.0.1 with my server, therefore, to see if you have 3.0.1 keys on file you can try, but it may fail late in the process with a very weird error. All users "on file", however, have 3.0 ready to go.
Upcoming 3.1 Exploit
If you encouter "unknown error (3002)", you probably do not have your ECID SHSH's for 3.0 "on file" with Cydia. Unfortunately, as Apple is no longer allowing users to sign the 3.0 firmware, it is no longer possible to register your device with Cydia.
Luckily, it has been reported that iPhoneOS 3.1 is vulnerable to another exploit. This means that, once a jailbreak is released for 3.1, users will be able to prepare themselves for future jailbreaks even if they missed the first round of signature storage (which I unfortunately was only able to start very late in the 3.0 game).
Once you even attempt to use this service (or if you tell Cydia to "make your life easier") you will be signed up for the signature tracker, and Cydia HQ will do its best to manage your ability to restore.
And again, if you have any issues with this process, please please please do not e-mail me. Instead, go to ModMyi.com, where there is a special forum called 3G[S] Downgrading, created for the purposes of this article.
NAND Format Invalid
OK, if you were already using 3.0 then this process should "just work". However, if you had already upgraded to 3.1 you will encounted a nasty error: "The iPhone "iPhone" could not be restored. An unknown error occured (1015).". This is expected behavior.
For people who are curious, what has happened is that a section of the NAND storage has been slightly reorganized in 3.1, and the 3.0 iBoot can no longer parse it. If we pulled out iRecovery and checked the iBoot logs over USB we'd see the following messages (the typos are Apple's).
[WMR:ERR] NAND format invalid (mismatch, corrupt, read error or blank NAND device)
[WMR:ERR] boolSignatureFound false boolProductionFormatVerified true nSig 0x0
******************************************************************************
******************************************************************************
AND: NAND initialisaton failed due to format mismatch or uninitialised NAND.
AND: Please reboot with reformatting enabled.
******************************************************************************
******************************************************************************
NAND FTL failed initialisation
The first time this happened to me I actually spent a while with MuscleNerd working out how to do what it asked: "reboot with reformatting enabled". That was a severe waste of time: after you fix this, it still won't boot, and you will need to go through a second restore to finish the process.
However, it turns out a second restore also formats the NAND correctly by itself. So, without bothering to do anything else to the device (leaving it in the recovery mode it is now in: DFU is no longer required), just start the restore over again in the same manner as before, once again selecting the 3.0 firmware.
Stuck in Restore
Unfortuntaely, this second restore is also going to fail (*sigh*), and irritatingly enough it is going to cause the exact same error message: "The iPhone "iPhone" could not be restored. An unknown error occured (1015).". This is still expected behavior.
For those who are again curious, what has happened is that when the device turns on it has to decide what it is going to do: wait for instructions over USB, or continue into the boot process. This is determined by an NVRAM variable named auto-boot, which is currently set to "false".
Normally this is set at the end of the restore process, but technically we were unable to finish the restore: it is my understanding that this is because upgrading to 3.1 installed the 3.1 baseband (which is currently not unlockable, btw), and the baseband upgrade in the 3.0 release then fails, stopping the restore.
However, that seems to be the last and least important part of the restore, so we technically won: we are never, though, going to be able to restore back to 3.0 without hitting this 1015 again, though.
Jailbreak with redsn0w or purplera1n
You have two. The first is to use iRecovery to manually set auto-boot to "true", and the second is to just go ahead and jailbreak your device.
We will go ahead and do option #2 (jailbreak), as even just getting iRecovery working on your computer is something that I don't look forward to trying to describe. ;P (In fact, it still isn't working on my Windows computer.)
At this point, you can just run your jailbreak tool of choice, which should jailbreak the device and boot it into the normal operating system. Congratualations, you just overthrew your orwellian overlord, and have taken back control of your device.
At least today, we will prevail!
Wednesday, August 18, 2010
ipad jb site
http://www.51ipa.com/
http://iphonepk.net/
http://www.iphone4hk.com/app/
http://bbs.weiphone.com/
http://ipad.duowan.com/
http://www.kiwamedia.com/
http://apptrackr.org
http://iphonepk.net/
http://www.iphone4hk.com/app/
http://bbs.weiphone.com/
http://ipad.duowan.com/
http://www.kiwamedia.com/
http://apptrackr.org
ipad app not update
有個更好既方法, 大學家去 Cydia download 一個叫 MetadataRemovr 既app, 安裝及按第一個選擇, 非法下載的apps就唔會係App Store內show update 啦
Friday, February 12, 2010
Apple iPad: Everything You Need to Know - apple ipad - Gizmodo
Apple iPad: Everything You Need to Know - apple ipad - Gizmodo: "Apple iPad: Everything You Need to Know
From the realm of sci-fi to Steve Jobs' stage: The iPad is official. What is it? What can it do? How does it work? Here's everything you need to know about Apple's newest creation, all in one place.
It's almost impossible to overstate the buzz leading up to this device. Immediately after the death of the Newton, rumors began trickling out about a followup from Apple; in the last five years, speculation and scraps of evidence about an Apple tablet have been a fixture in the tech media; in the last year, the rumors were unavoidable. Today, Apple's tablet has finally arrived, and we've got the full rundown—from specs, features, content and price to what it's like to actually use one."
From the realm of sci-fi to Steve Jobs' stage: The iPad is official. What is it? What can it do? How does it work? Here's everything you need to know about Apple's newest creation, all in one place.
It's almost impossible to overstate the buzz leading up to this device. Immediately after the death of the Newton, rumors began trickling out about a followup from Apple; in the last five years, speculation and scraps of evidence about an Apple tablet have been a fixture in the tech media; in the last year, the rumors were unavoidable. Today, Apple's tablet has finally arrived, and we've got the full rundown—from specs, features, content and price to what it's like to actually use one."
Subscribe to:
Posts (Atom)