Hacker News new | ask | show | jobs
by mstg 2459 days ago
iBoot and BootROM is different. iBoot is software (patchable) while BootROM is read-only. Otherwise, agree! It's really a big achievement.
1 comments
roblabla 2459 days ago
I'm very confused. On one hand, the tweet claims to have a bootrom exploit. On the other hand, the fifth tweet in the chain talks about an iBoot vulnerability that got patched in ios12 beta[1].

Maybe the vulnerable codepath has some code sharing between iBoot and SecureROM?

[1]: https://twitter.com/axi0mX/status/1177544539046703104

link
comex 2458 days ago
> Maybe the vulnerable codepath has some code sharing between iBoot and SecureROM?

It does.

link
mstg 2458 days ago
Comex himself has spoken! It turns out I definitely didn't understand it correctly. Thanks for the clarification!
link
bumblebritches5 2458 days ago
Do you have iBoot's source code from the leak a while back?
link
null_auspices 2457 days ago
https://github.com/PUNISHMENT-POSSE/Apple-iOS-9-Source-Code
link
mstg 2459 days ago
If I've understood this correctly, it was an iBoot vulnerability enabling the exploitation of the BootROM vulnerability untethered (without connecting to a computer again). Since the iBoot vulnerability is patched, the phone has to be connected to a computer every time to boot if there has been any tinkering (custom FW or any change in boot sequence).

So prepatch you could exploit the BootROM vulnerability untethered with the iBoot vulnerability, but postpatch have to connect to a computer to boot every time if you have done any tinkering which is why it is currently only adviced for security researchers. Tinkering with the BootROM also leads to invalidations of APTickets (so a future restore may be impossible without special gear).

link