Month: June 2013

I have a friend with really long nails trying to play this game:

So she needs a stylus. How can I make her a DIY stylus for the iPhone?

There are these DIY clips online that require telescopic antennas, conductive sponges, glue and so on. How many of you have these things at home?

He're my solution:

I need a paperclip, a rubberband and cotton. That's it. The end result is this:

• Cotton can be substituted with toilet paper or a very small piece of sponge. (We need that in order to not scratch the screen).
• The cotton has to be MOIST (WET). When it dries out it stops working.
• The paperclip has to be unshielded with rubber. We need to conduct electricity for the capacitive touchscreen of the iPhone.
• The cotton tip should be wider than the tip of a pen, otherwise it's not going to work.

iOS

Apple distributes new versions of iOS by encrypting it. Before installation, the ECID (id) of the phone plus the hash of several files have to be signed by Apple's TSS service (a hashing service with a special Apple-owned private key). The signature is called a SHSH.

Jay Freeman, aka saurik is the developer behind Cydia an open source repository for iOS devices (iPhones).

bootrom

The bootrom (correct me if I'm wrong) of the phone allows installation of new OS versions only if the phone's ECID matches the one in the SHSH, and the hash of the new installation (the hash of several files actually) matches the one in the SHSH. The problem here is that Apple's TSS only signes current versions.
The bootrom hasn't been broken yet, so this SHSH mechanism cannot be avoided. It exists since iOS v.2.0

How can we install older versions of iOS?

Well, Mr. Freeman here created a database that caches all the SHSH's for all the phones that want that service for all the files in all the versions of iOS. A huge database. Apple limited the caching TSS service of Saurik (Mr. Freeman) - by IP filtering for example - and he distributed it, by putting the extraction of the SHSHs in the Cydia itself and then Cydia uploads them to this database.

The caching is possible, because the SHSH is monolithic.

APTicket

This is the new signature algorithm. It adds a slight but very significant change - a nonce. The nonce is a piece of garbage text (i.e. "fb*&h") that is added to the request the iPhone makes to the Apple's TSS service. For every new installation/update/restore of iOS, a new nonce is created (it's unique) and sent to TSS. Thus caching becomes pointless.

Why hasn't Apple used nonce all along?

It's hard to believe that Apple doesn't know how the SHSH caching can be fixed. I (not Saurik) assume that Apple wants to allow jailbreaking because the community demands it. They just want to delay it after every initial release of new device/OS. Jailbreaking brings open source, but it also brings pirated software and music.

Why I shared this?

A very detailed explanation on how to distribute securely desktop software with the help of encryption and a very sturdy (unbreakable) ROM on the phone itself.

The full article is here: http://www.saurik.com/id/15