iOS 9.2.1 – iPhone 5,2 – Kernel Disassembling | About Jailbreak Exploits
Today, we approach a subject rarely discussed on websites or videos due its complexity, the iOS Kernel. Everybody might have heard once or twice about the Kernel, or more likely, about Kernel Exploits, but what are those?
In today's video, we take the iPhone 5,2's KernelCache file, we decrypt it, we are disassembling it with IDA, and we are explaining what can a developer or a Jailbreaker do with the result.
This file has a crucial importance in terms of Jailbreaking because if you can't find an exploit into the Kernel, or if you can't create one that is powerful enough to allow you to run Arbitrary Code or to escape the SandBox, then making a full Jailbreak (or at least Untethered) is rendered impossible. In order to create a complete Jailbreak Tool for a specific iOS version, a Jailbreak Team like PanGu or TaiG requires at least 10-12 different exploits, therefore, would be great for us to dig a little bit into the Kernel and see what we can find.
At a first glance, we can see a lot of usable information, binary names, process names, kexts, addresses and daemons, knowing how to replace these with something targeting your own Payload will allow you to create Kernel Panics (Crashes) and a lot of Juicy Crash Logs containing precious data for any Jailbreaker.
iCloud Bypass is not left behind either. Knowing the Kernel, renders you the ability to neuter the Setup.app file without even touching the file itself. Of course, such achievements require a lot of practice and Assembly knowledge, but, Assembly, as any other programming language, can be learned by practicing it more and more.
I really hope you will find this video useful. If you do, don't forget to decrypt the like button and to disassemble the SUBSCRIBE button, or, of course, if you consider this video bad, you are free to exploit the dislike one 🙂 Anything helps 🙂
I leave here some additional references:
Check out my iOS-related site:
*I really hope you will find this video useful. If you do, don’t forget to
decrypt the like button and to dissemble the SUBSCRIBE button, or, of
course, if you consider this video bad, you are free to exploit the dislike
one 🙂 Anything helps :)*
+F.C.E. 365 TV – iDevice Central hey bro first of all great job for every
video u make u have been a major help for must of us 🙂 second i know my
questione not related for these video but have u been able to obtain a dumb
file for 4s?
+endoplasmic Hi, it’s ok that is not related, actually, nope, I haven’t
received any DUMP file and now iOS 9.2.1 is useless, we must wait for 9.3
keys for 4S to arrive, meanwhile, maybe I will get the dump. Someone said
he tried to send me an e-mail but I received nothing yet.
+endoplasmic anyways, I will keep you updated in the videos about the
progress every time I discover something new, so stay subscribed 🙂
iam a permanent subscriber ^_^ dont worry bro couse i have learned so much
from ur chaneel it was educational !!!
+F.C.E. 365 TV – iDevice Central Please make video iphone 4 no service fix
for all carrier tnx geo
First! :D
+unslaveble I appreciate 🙂
Nice video :)
+MasterK Thanks
first view :D
+Brainer Quintana Thanks
how i get ipwner? thanks
+Brainer Quintana What is iPwner? If you mean Carmen, you can’t download it
as it is an internal app in BETA right now (due to issues with Apple )
Hey, i am very, very close to get the root key for iphone6,2 ios 9.2. Very
close!
I was wondering if you could help me a little bit on the end now?
+Shaped Studios Sure, how can I help?
when full bypass of iPhone 5,2 will be available to us
+khan bbs When it will be, you will be the first to know 🙂
*If you are also interested in Android Rooting and customizing, check out
my second channel :)*
Nice, intuitive and very well explained, thank you geo
Ho can hackers analize the kernel of ARM64 devices if there are no keys for
those,do they analize the kernel dump?
Yes, they dump it, they can also use serial cable and crash logs
+F.C.E. 365 TV – iDevice Central Thanks,now i understand
Keep goin’ geosn0w! good work
finally someone who knows AND TALK about these
Which program you use?
thanks very much
+Davide Menconi You are welcome 🙂
+F.C.E. 365 TV – iDevice Central You are on twitter?
+Davide Menconi @FCE365
Thanks, i’m following you
Can you show how to flash custom img3 to a device in dfu mode (Mac
preferably)
Without exploit
And .dmg also
+iTrickz Try a NAND attack for DMG. For img3 you can’t. You need at least
Jailbreak
Ok thx
What is your IDA Pro version ?
Can you do how to make an operating system part 2
Hey George, I think I have a Kernel Panic log, how can I send it to you?
office@fce365.info
Thanks a lot but I have a question how can I dumb
I love this channel
Geosn0w can you make a tutorial on how to install libidevice on windows?
Hey! So I have a jailbroken iPhone 6srunning 9.1 and I went into ifile and
changed the version, my phone is now throwing errors and all tweaks are
incompatible also I can’t download apps :/ any ideas? (Restore is not an
option)