[HN Gopher] WInd3x, the iPod Bootrom exploit 10 years too late
___________________________________________________________________
WInd3x, the iPod Bootrom exploit 10 years too late
Author : user890104
Score : 314 points
Date : 2023-01-14 01:27 UTC (21 hours ago)
(HTM) web link (q3k.org)
(TXT) w3m dump (q3k.org)
| bigmattystyles wrote:
| Submit it for a bug bounty - https://security.apple.com/bounty/
| saagarjha wrote:
| Apple doesn't seem to have a category for exploits like these.
| I wonder if this is because they can't fix them.
| mike_hock wrote:
| Nor would we want to encourage them to fix these, now would
| we ...
| nier wrote:
| Oh, look! That cloud is shaped like a turtle. (Nevermind,
| I'll vote myself down)
| titaniumtown wrote:
| lol
| xjay wrote:
| iPod. Brings back memories of Mad TV making a parody of the iPod
| ad. It was for something called the "iPad".
|
| This was at least three years before Apple announced iPad.
|
| https://www.youtube.com/watch?v=FTzhXMbOWHE
| IntelMiner wrote:
| Might be worth submitting to the Rockbox project. Their iPod
| support seems to lack these newer devices
| q3k wrote:
| There is not nearly enough for a functioning N5G Rockbox port.
| We're still missing a ton of peripheral drivers, power saving,
| and a flash translation layer implementation. Not to mention
| there's currently no untethered code execution exploit for the
| N5G.
|
| The N3G/N4G have an old WIP code dump from years ago, and
| that's in a much better shape to pick up and try to get
| upstreamed into Rockbox :).
| snvzz wrote:
| >Useless Old Device
|
| A supercomputer in your pocket, by old enough standards.
|
| It is good that these can find a new life other than becoming
| landfill.
|
| What's sad is that it needs to be done by third parties through
| hacking; legislation should be in place so that the vendor has to
| facilitate the reuse of old such devices.
| mmis1000 wrote:
| > What have we learned?
|
| > Don't put a C implementation of a USB stack in your BootROM,
| lol.
|
| Meanwhile
|
| Intel: put the entire network stack into intelMe and enable it by
| default.
| messe wrote:
| You mean put an entire MINIX system into ME. It's not just the
| network stack.
| HeckFeck wrote:
| Intel just decided the decoder unit actually needed to be a
| full embedded OS and system. As for the net stack, sometimes
| the decoder gets confused with esoteric x86 instructions and
| needs to contact the internet for help.
|
| All logically explainable ;)
| eigenform wrote:
| the classic 'usb stack in my boot rom' :^) nice
| hyperman1 wrote:
| I just bought a cheap mp3 player. If I'd known about rockbox, I'd
| probably bought something on their HW list.
|
| As the mp3 player I got has user-hating firmware, I really wonder
| what's wrong with the HW vendors. Rockbox does better on less
| powered HW. If some cheapo chinese clone would just stick it on
| some half decent hardware, they'd kill their whole market
| segment.
|
| All of this points to companies not loving money as much as they
| love playing power games with end user control. For some reason,
| they will rather write their own software and lock down
| everything, than just use good free existing software.
| fallat wrote:
| There are basically no mp3s still made supported by rockbox. I
| tried the same. What one did you buy? I bought the Agptek A02
| and nhere are only breadcrumbs when it comes to finding it's
| official SDK.
| hyperman1 wrote:
| I got this:
|
| https://www.bol.com/be/nl/p/transnect-hifi-audio-
| mp3-speler-...
|
| I wanted something that allows my young son in the car to
| listen to the same 30 songs('kapitein winokio') over and over
| without driving my wife and me bonkers. As he gets sick when
| looking too long at a screen in a car, we wanted the minimum
| number of features outside playing music. Even so, a screen
| good enough to select the album was required, and it must be
| cheap enough that I don't care too much if it gets damaged or
| lost
|
| It claims to support video playback and ebook reading, but
| both features seem basically useless on the tiny screen,
| which is great for my use case. Unfortunately, it doesn't
| believe in alphabetic order when showing a list of files,
| uses left/right for scrolling up/down, uses 'menu' as OK
| button and mostly but not always ignores the OK button.
| Playlists seems too brain damaged to be of any use, so we
| ignore the mp3 menu and use the file browser as mp3 player.
| The usb micro connector dropped off the usb cable within 10
| minutes of plugging it in, but I drown in replacements so who
| cares. The player itself and the headphone are actually
| sturdier than I expected. The firmware identifies itself as
| v1.1 but has no device or vendor information.
|
| So basically, same rock bottom quality as all other cheap
| players. We got the price and quality we expected and can't
| complain, but 15 minutes with the source code and turning the
| keyboard 90 degrees would solve oh so much tiny frictions.
|
| As I own it for a bit more than a day, there might be some
| hidden bonuses or traps I haven't seen. Don't ask me if this
| is a positive or negative review.
| raffraffraff wrote:
| I bought a Shanling Q1 years ago and hated the stock firmware
| so much I never used the device. A while back someone added
| support for it to Rockbox, and it's finally usable.
| illwrks wrote:
| If you can live with iTunes, you really can't beat iPods. I've
| got a classic that's still rock solid and gets regular use at
| home and in the car. I did have to swap out the battery last
| year though.
| stuaxo wrote:
| Great work, it will be interesting to see where this goes.
| londons_explore wrote:
| It kinda amazes me that this device, which sold 10's of millions
| of units, never had an exploit found till now.
|
| Somehow Apple just crushed the hacking and modding community for
| their hardware.
| parker_mountain wrote:
| It's more that nobody cared. By the time this device came out,
| smartphones were already taking over.
| userbinator wrote:
| The lookalike clones probably sold several times more, as they
| had more features (FM radio, voice recorder, _video_ playback,
| expandable storage, generic USB mass storage with no software
| required, even video recording on some later models) at a
| fraction of the cost. Most of those were based on a Z80 + DSP
| SoC running at 24MHz.
| squarefoot wrote:
| Most of them however have terrible firmware. When last one of
| my Clip Zip died I couldn't find a RockBox compatible
| replacement that wasn't either too expensive or too old, so I
| bought first an AgpTek something (identical to the newer A02,
| but mine had no Bluetooth) which at least was useable, but
| died after 3 years: one morning it crashed just after boot
| and any attempt to reset and revive it failed. Then I bought
| a "Jolike" (0) player off Ebay at a really good price, which
| turned out to be half disappointing: construction is
| surprisingly robust and it sounds really clean, but the
| firmware predictably is a disaster: they clearly aimed at
| cramming features in there to show more bullet points in
| advertising, but did never properly develop and test them,
| which happens very often in cheap chinese products. A RockBox
| port would turn it into a great product.
|
| (0) https://www.jolike.com.cn/productinfo/534495.html
| wraptile wrote:
| Sansa Clip Zip/Plus + rockbox were trully exceptional for
| their time. I'm not sure if we'll ever see an open device
| of such all around quality seeing how things are going
| these days.
| Semaphor wrote:
| I still have my Sansa clip flashed with rockbox lying
| around. It was a great device at the time. Maybe I should
| look where it is, now that I accidentally bought one of
| those idiotic no audio jack phones.
| w-ll wrote:
| I remember jailbreaking my 4th Gen U2 version nearly 2 decades
| ago. I think it was the first time I even herd of the term
| "jailbreaking". Previous to that it was "Modding" or "Mod
| Chipping" or "Chipping" for game consoles, but those did
| require a steady had to solder a chip on the console.
|
| I also remember photo friends buying them just to break out the
| 1.8 inch drives to use for cameras because it was cheaper to
| rip a 20gb drive out an iPod than buy them from a supplier.
|
| Lol, I also remember iTunes on Windows being decent, then at
| some point absolutely wrecking my music folder.
|
| https://en.wikipedia.org/wiki/IPod_Classic#U2_Special_Editio...
| numpad0 wrote:
| I think iPhone OS exploits were specifically named _jail_
| break because it allowed sandbox escape into a root shell on
| a Unix, by association with BSD jail. On iPod it was just
| modding/custom ROM flashing.
| kmeisthax wrote:
| My guess is that iOS jailbreaking killed the iPod scene. Keep
| in mind that right when the 5th gen Nano came out, it was
| competing against the iPhone 3GS.
| kitsunesoba wrote:
| This seems likely. Early iPhones and iPod Touches were much
| more attractive targets for jailbreaking, given their more
| generalized nature, better hardware, and more capable native
| OS -- the range of possibilities was far more great.
|
| It's also not practical to upgrade the storage in flash-based
| iPods, which reduces the utility of something like Rockbox.
| The stock OS is perfectly serviceable for the size of library
| one would be carrying around on a Nano.
| eurasiantiger wrote:
| But it only plays MP3 and AAC, not for example OGG, FLAC,
| or tracker music formats.
| kitsunesoba wrote:
| Sure, but the size/quality difference between AAC and OGG
| isn't huge enough for most to want to use OGG instead,
| tracker music formats are niche, and anybody who wants
| FLAC probably wants one of the hard drive based iPods so
| they have the amount of space required to store even a
| small lossless library.
| hyperopt wrote:
| Fantastic! I was involved in the freemyipod project back when the
| 4G was still a current product. In fact, the freemyipod.org wiki
| ran from a server I kept downstairs in my parent's home. My
| favorite memory was when we all built robots to brute force a
| return address (https://freemyipod.org/wiki/Nanotron_3000). Glad
| to see the project is still alive!
| pfoof wrote:
| I totally remember that Notes exploit! And when Nano 3g showed
| corrupted scrollbar
| circleinacircle wrote:
| Nice
| rtpg wrote:
| The 7th gen iPod Nano is basically the idea form factor for an
| everyday mp3 player, and it sucks that the stack not just being
| "upload music files onto a usb drive" means the device is
| susceptible to just not work anymore one day.
|
| One of my "never going to do but will often think about" projects
| is to try and build an open design music player that doesn't try
| to be a universal computational device but is at least not extra
| wonky like all the random ones you find on Amazon nowadays.
| dstaley wrote:
| The iPod nano 7th generation uses the same file structure as
| other iPods, but appears to use a database checksum that hasn't
| been reverse engineered yet. Given that the 7th generation nano
| has Bluetooth, I hope it's a more attractive target for
| exploits and reverse engineering. I agree that it's a lovely
| form factor!
| rtpg wrote:
| oh, I totally had the impression it was its own beast just
| from the UI being what it is. Maybe time for me to dig into
| this
| girvo wrote:
| I'd be 100% down to help, if you do -- my 7th gen iPod Nano
| is the best MP3 player I've ever owned, the Bluetooth
| compatibility alone made it fantastic, and I'd love to get
| some new lease on life with it (or even just tinker with
| it. Being able to not be dependent on iTunes alone would be
| awesome)
___________________________________________________________________
(page generated 2023-01-14 23:02 UTC)