https://github.com/cub3d/ipod_sun
iPod Nano 6/7 hax
https://github.com/cub3d/ipod_sun
Last synced: about 1 year ago
JSON representation
iPod Nano 6/7 hax
- Host: GitHub
- URL: https://github.com/cub3d/ipod_sun
- Owner: CUB3D
- License: gpl-3.0
- Created: 2023-12-28T23:15:03.000Z (over 2 years ago)
- Default Branch: master
- Last Pushed: 2024-09-29T02:14:54.000Z (almost 2 years ago)
- Last Synced: 2025-05-09T03:12:12.578Z (about 1 year ago)
- Language: Rust
- Homepage:
- Size: 284 KB
- Stars: 63
- Watchers: 7
- Forks: 4
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# ipod_sun
Code execution on the iPod nano 6th and 7th generation
### How?
This tool builds a modified firmware image that abuses two iPod bugs in order to gain code execution:
#### 1) Disk swapping
By swapping the 'disk' and 'osos' sections in a firmware image, the iPod will boot into the standard RetailOS when holding the buttons for disk mode. But, when booting into disk mode the iPod won't verify the 'rsrc' partition as disk mode usually doesn't use it.
#### 2) CVE-2010-1797 (better known as star)
By using a malformed OTF font, we can trigger a stack overflow in CFF parsing. See `src/exploit.rs` for details
### The result
Custom SCSI command added that can read/write memory and execute arbitrary code.
## Dependencies
For python3:
```
pyfatfs
fonttools
```
Native:
```
arm-none-eabi-gcc
```
## Supported devices:
- iPod Nano 6th Generation
- iPod Nano 7th Generation (Mid 2015)
# WARNING!
Some devices are not able to boot into DFU, this may be caused by a non-functional battery.
Bad payloads, incorrectly packed firmware and many other causes CAN and HAVE caused permanent bricks.
## Usage
```shell
# Build the patched firmware
cargo r --release -- --device=nano7-refresh
# Flash Firmware-repack.MSE over DFU
```
## Dumping bootroms
```shell
# Enable the VROM clock gates
sudo sg_raw -o /dev/null -r 512 -vvv /dev/sdc c6 96 04 00 00 00 00
# Dump the rom
cd tools/scsi_dumper
cargo r --release -- 0x20000000 0x10000 n7g_bootrom.bin
```
## Decrypting firmware
See `tools/scsi_decrypter`
# Attribution
Base.ttf is one of the payloads from [star](https://github.com/comex/star), used as a CFF template
helpers/viafont/original sourced from [here](http://www.publicdomainfiles.com/show_file.php?id=13949894425072)
# Thanks
q3k for the SCSI handler example and for [wInd3x](https://github.com/freemyipod/wInd3x)
760ceb3b9c0ba4872cadf3ce35a7a494 for [ipodhax](https://github.com/760ceb3b9c0ba4872cadf3ce35a7a494/ipodhax) which inspired a lot of the firmware un/packing code