{"id":18882155,"url":"https://github.com/cub3d/ipod_sun","last_synced_at":"2025-05-09T03:12:17.802Z","repository":{"id":214561328,"uuid":"736801281","full_name":"CUB3D/ipod_sun","owner":"CUB3D","description":"iPod Nano 6/7 hax","archived":false,"fork":false,"pushed_at":"2024-09-29T02:14:54.000Z","size":291,"stargazers_count":63,"open_issues_count":3,"forks_count":4,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-05-09T03:12:12.578Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CUB3D.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2023-12-28T23:15:03.000Z","updated_at":"2025-04-28T11:59:36.000Z","dependencies_parsed_at":"2024-01-29T04:28:47.933Z","dependency_job_id":"bbc82a17-d240-463b-bbc6-9269f345a884","html_url":"https://github.com/CUB3D/ipod_sun","commit_stats":null,"previous_names":["cub3d/ipod_sun"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CUB3D%2Fipod_sun","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CUB3D%2Fipod_sun/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CUB3D%2Fipod_sun/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CUB3D%2Fipod_sun/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CUB3D","download_url":"https://codeload.github.com/CUB3D/ipod_sun/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253181442,"owners_count":21866994,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T06:54:21.742Z","updated_at":"2025-05-09T03:12:17.784Z","avatar_url":"https://github.com/CUB3D.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ipod_sun\nCode execution on the iPod nano 6th and 7th generation\n\n### How?\nThis tool builds a modified firmware image that abuses two iPod bugs in order to gain code execution:\n\n#### 1) Disk swapping\nBy swapping the 'disk' and 'osos' sections in a firmware image, the iPod will boot into the standard RetailOS when holding the buttons for disk mode. But, when booting into disk mode the iPod won't verify the 'rsrc' partition as disk mode usually doesn't use it.\n\n#### 2) CVE-2010-1797 (better known as star)\nBy using a malformed OTF font, we can trigger a stack overflow in CFF parsing. See `src/exploit.rs` for details \n\n### The result\nCustom SCSI command added that can read/write memory and execute arbitrary code.\n\n## Dependencies\nFor python3:\n```\npyfatfs\nfonttools\n```\nNative:\n```\narm-none-eabi-gcc\n```\n\n## Supported devices:\n- iPod Nano 6th Generation\n- iPod Nano 7th Generation (Mid 2015)\n\n\n# WARNING!\nSome devices are not able to boot into DFU, this may be caused by a non-functional battery.\n\nBad payloads, incorrectly packed firmware and many other causes CAN and HAVE caused permanent bricks.\n\n## Usage\n```shell\n# Build the patched firmware\ncargo r --release -- --device=nano7-refresh\n\n# Flash Firmware-repack.MSE over DFU\n```\n\n## Dumping bootroms\n```shell\n# Enable the VROM clock gates\nsudo sg_raw -o /dev/null -r 512 -vvv /dev/sdc c6 96 04 00 00 00 00\n\n# Dump the rom\ncd tools/scsi_dumper\ncargo r --release -- 0x20000000 0x10000 n7g_bootrom.bin\n```\n\n## Decrypting firmware\nSee `tools/scsi_decrypter`\n\n# Attribution\nBase.ttf is one of the payloads from [star](https://github.com/comex/star), used as a CFF template\n\nhelpers/viafont/original sourced from [here](http://www.publicdomainfiles.com/show_file.php?id=13949894425072)\n\n\n# Thanks\nq3k for the SCSI handler example and for [wInd3x](https://github.com/freemyipod/wInd3x)\n\n760ceb3b9c0ba4872cadf3ce35a7a494 for [ipodhax](https://github.com/760ceb3b9c0ba4872cadf3ce35a7a494/ipodhax) which inspired a lot of the firmware un/packing code\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcub3d%2Fipod_sun","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcub3d%2Fipod_sun","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcub3d%2Fipod_sun/lists"}