Key iPhone Source Code Gets Posted Online

[blueish]

Here's the link to the github repo, since the article didn't mention it: https://github.com/h1x0rz3r0/iBoot

[softawre]

Source live as of now: https://0xacab.org/sizeofcat/iBoot

[geowwy]

I'm surprised it hasn't been taken down yet

[anta40]

Damn, too late to see this. Dead already.

[evv]

https://github.com/h1x0rz3r0/iBoot/tree/master/include/drive...

Now that these drivers have been leaked, would it be possible to run Linux on old iPhones? From my understanding, the main reason it couldn't be done is because nobody had access to the driver source code, and now..

[joshumax]

We've been able to run Linux on old iPhones for quite a while now, as can be noted from the defunct iDroid project, which managed to successfully port the Linux kernel and Android userspace to the iPhone 2G, 3G, 3GS, and 4 using OpeniBoot. However, this is quite a nice advancement for those of us in the emulation community.

Disclaimer: I'm working with some other team members on the revival of the iEmu iPhone emulator.

[dvfjsdhgfv]

Practically speaking, yes. But these drivers would never be merged into the mainline kernel as the source code was obtained illegally. Writing a Linux driver from scratch on the basis if this code would still mean huge legal problems for the Linux kernel.

[akerro]

Hijacking your post to add link to the repo that's not DMCAd https://0xacab.org/sizeofcat/iBoot/

[dsl]

It looks like just the headers, not the actual source code.

Also iBoot is basically the "BIOS" of the phone. Just enough to get it up and running and then load iOS into memory and kick it off, so it wouldn't have drivers for things like the touch screen or accelerometer for example.

[monocasa]

> in 'Biggest Leak in History'

IDK, the Win2K source leak was pretty big.

[sgillen]

The author of the quote may have meant biggest leak in Apple's history, which it may well be.

As for biggest leak in history, maybe the shadow brokers leak of all those NSA tools? I'm not sure if anything huge resulted from the Win2k leak but I'm not too informed about it.

[beefhash]

Wasn't that one a partial leak stripped of some interesting bits?

[codemusings]

From the source_layout.txt in /docs:

  ...
  
  /arch/arm
          ARM-specific code.
  
  /docs
          Optimisim.
  
  /drivers
          Portable drivers and driver infrastructure.
  ...

There's more documentation in this folder than most projects have :)

[stfwn]

From the IO Spreadsheet Standard document (in /docs):

"This document describes the format of the I/O Spreadsheet for iOS Products. (...) The I/O spreadsheet shall be sheet in an Excel workbook."

Numbers? Nope, Excel.

[linopolus]

I like /docs: Optimism..

[elevated]

All the GitHub repos seem to have been hit with DMCA takedowns, so here is a mirror: https://0xacab.org/sizeofcat/iBoot

[dsl]

In the docs directory there is a guide to fuzzing. On the plus side, from my initial read, it looks like most of the important stuff has fuzzing harnesses already which means the code should be free of most low hanging security bugs. It also means that with the harnesses already in place, it will be easy for outsiders to just throw a ton of compute at it and possibly find some of the deeper issues.

[virgilp]

You mean, more tons of computing than Apple can afford?

[blowski]

How does something like this get leaked? A rogue Apple developer?

[jchb]

Just totally speculating here, but there are some class action suites regarding the Apple battery debacle. Maybe they had to provide source code as part of pre-trial discovery, and it got leaked that way?

[moviuro]

Bad permission management, untrustworthy third-party, USB drives, APT(?), human error, etc.

[TheEnder8]

The newest copyright on any file is 2015. The source code might be quite old.

(Yes, I realize that a copyright header doesn't actually stay in sync with patches. It's just the only indicator of date there is)

[fmntf]

It's just a bootloader. I don't think they changed much between iOS 9 and 11. The probably only added support for newer boards/devices.

[iliketosleep]

The article states that the code is from iOS 9, which was first released in 2015.

[deckard1]

There are a few references to 2016. There is also a target/iphone8 folder. Don't see any reference to iPhone X though.

[okket]

Unless there are encryption keys hidden in source code that I can't find, I fail to see the implications of this leak.

[bitwise-evan]

It is much easier to find security vulnerabilities if you have the source code.

[rambojazz]

How to confirm it's not a farce but the actual source code? I could post anything, whatever, and say "this is iBoot leaked".

[loeg]

https://twitter.com/supersat/status/961480792483381248

[Retroity]

https://github.com/github/dmca/blob/master/2018/2018-02-08-A...

Apple submitted this DMCA to GitHub, and admitted, under penalty of perjury, that this source code is legitimate. Additionally, if it was fake, they wouldn't submit a DMCA.

[NietTim]

Anyone have a clue what the 'thunderbolt'/'thunderboot' driver is? Almost seems like they have proprietary thunderbolt cables for developing this or something? Relevant files: https://github.com/h1x0rz3r0/iBoot/tree/master/drivers/thund...

[ea016]

Some macs have the ability to load OSX from network or from an external hard drive. It might be the same on the iPhone

[solarkraft]

Does this have any real implication for iPhone hacking?

[qrbLPHiKpiux]

Yes, any leak does.

[stuntkite]

Does this mean Jailbreaking might be a thing again? I've been wanting to use some iOS devices (like 6 and newer) for some projects and now jailbreaking is super dead. I am not an embedded wizard, but I think it's pretty hard to get a new bootloader on an iOS device currently. Does anyone have better info on that?

[kiliankoe]

Wasn't an iOS 11 jailbreak announced just the other day? I don't think the scene is dead at all, it's just that many of us who once used jailbreaks on every iOS version no longer do and don't follow those news anymore.

[lorenzofb]

Here's the story behind the leak: https://motherboard.vice.com/en_us/article/xw5yd7/how-iphone...

[EatonZ]

Interesting: https://github.com/h1x0rz3r0/iBoot/blob/master/apps/iBoot/bo...

[amorde]

Looks like it just stands for "find boot images", given the name of the function...

[jonashoechst]

Although there's FBI written, that def just invokes calls of profile() which is probably to profile the certain parts of the bootloader. I doubt that being a backdoor, only clue would be the name, and that would be rather easily hidable.

[moon4u]

Could a potential jailbreak be used to unlock an iphone?

[singularity2001]

where's the mirror?

[flyGuyOnTheSly]

If true, this will be the catalyst to Apple stock tanking this morning... and possibly the entire US stock market.

IT Security is serious stuff.