From iPodTouchFans: “


The address that the bootrom loads LLB into is 0x22000000, and for some reason, it stores it’s global variables dangerously close, at 0x22024000. Now, when loading LLB from NOR, it does not have any sort of maximum size limit, unlike if it was receiving a file via USB. You just can gracefully overwrite, and for some parts, will need to reconstruct, the beginning of the data (_bss) section. There are a few different ways you could exploit this to actually run unsigned code at this level, but so far the easiest one found is based on another fail decision that Apple made. For some reason, they and put the SHA1 hardware address array smack dab in our way, so at this point, you can change anything there that you want. By changing the pointer to SHA1 Data Input Register 1 into a pointer to where the current LR is on the stack, it will put whatever is at 0x20 of the image in LR, which is all that is important. By putting your payload somewhere in the padding (you need padding, since LLB is less than 0x24000 bytes obviously), you can just put the address of it at 0x20 of the image! If you actually don’t want to run unsigned code but instead just want to run the LLB, then you will first need to have it put the original bytes back at 0x20 in the file before you do anything else, as well as put the original SHA1 hardware address back in the array. Another important thing to remember is that you must 1. add 0x22000000 to whatever the offset of your payload is in the file, since that is where it loads LLB in memory, and 2. reverse it for endianess.”

Untethered Jailbreak Tutorial (no custom boot logo)

UPDATE: There’s another release, same site though so check it out. Seems like it’s the same except that when you reboot you’ll be able to boot normally with the jailbreak merely disabled. Then when you can do the tethered boot you’ll have your jailbreak activated again.


The jailbreak for the ipod touch 2g developed by the iphone dev team has been released into the wild. At this time it is a tethered jailbreak, which means that it needs to be applied at boot time using a computer. Bad news if you shut your ipod down all the time, good news if you’re one of those weirdos who sets it on their chest when they go to bed so it sings them to sleep. I’m glad they released it as there is a better chance of someone in the wild finding something than if the task falls back to ONLY the iphone dev team. I’m sure they’re swamped with work from the iPhone, I mean it’s a phone!

Still for the people who have pockets massive enough to carry a phone and a seperate MP3 player that’s insanely expensive, you can make the thing useful! Much love to the iphone dev team for: redsn0w

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: