Hacking the iPod Touch - Part 1

my new (hacked) ipod touch
So now that I had a little time to play around with this cool gadget, I think its time that I shared some of fun in hacking the iPod Touch. But first a friendly government warning :

<disclaimer>
WARNING: Hacking gadgets is known to cause bricking and in some instances may even void your warranty. As a general rule assume you won't be able to upgrade your firmware in the future. If your doing this, do it AT YOUR OWN RISK!
</disclaimer>

Don't worry in reality its almost impossible to brick the device since you can restore it using iTunes. So if you're still with me then "welcome to a brave new world of hacking!". First let me explain how the iphone/ipod touch hack works in layman's terms.

TIFF Exploit


The key ingredient for performing the hack is around a bug discovered in libtiff, a library used widely to provide tiff image handling capabilities. This bug can be used to cause a buffer overflow, allowing arbitrary code to be executed. Such exploits can aid (in a good sense) to unlock a device which has been locked, limiting its functionality to what ever the device manufacturer wants it to do.

Before the iPhone, the PSP firmware 2.0 was also hacked using a similar TIFF exploit allowing third party home brew apps to be executed.

In the case of the iTouch, you would visit a site containing a specially crafted TIFF image vis the Safari mobile browser. This would crash the browser and execute the payload. What that code does is simply to remount the root file system with full read/write permission, enabling the browser to break out of the chrooted jail its running under - jailbreak. This is possible thanks to Apple running the browser as root (admin), something any one with a little sense of security would not do.

You can read more about the TIFF exploit here.

Jail breaking the Touch


Jail breaking the touch has been made so easy that even a 5 year old could do it. The easiest method which was released less than a week ago, requires you to just visit www.jailbreakme.com and click on a link. It will display a TIFF which will jailbreak the device, making it suitable for running third party apps, install a user friendly App installer app and finally patch the TIFF exploit so you won't be compromised in the future! If your a GNU/Linux user, this also means you no longer need to goto a Mac or Windows to Jail break.

There are also a GUI tools which can be run inside MacOSX (iJailbreak) and Windows (Touchfree).

But I used the almost manual method since I thought it would be more fun going through the steps. I used my Mac Mini (PPC) but there is also a how to for Windows (sorry not for GNU/Linux).

If everything went ok, you will now be able to install apps by launching the Installer.app ifrom the SpringBoard interface. All you need is to be connected to the net.

What ever you install, you'll definitely want to install OpenSSH server (and even client), BSD Subsystem, DNS tools, SummerBoard.

In part 2 I will talk about some of the productivity apps and some other interesting apps that you can run. I'll also try to touch up on getting the Touch to work on GNU/Linux so that you can transfer music, videos and may be even photos (still trying to figure this out) without using iTunes.

If you can't wait... subscribe to my twitter blog for a near real-time update of what I'm upto.

Comments

geekaholic said…
New firmware (1.1.2) for the iphone is out. If you update you loose the ability to run home brew. As a good thing the new iphone firmware has a usb-disk mode so you can now mount it. I'm sure the new one will be hacked soon.
3:21 AM
Sri Labs said…
Ipod Touch's newest firmware(1.1.2) has been hacked,but its not officially available.
But still in Sri Lanka that update isnt available :( anyways my touch works fine and used the both jailbreaking methods,(via jailbreakme)
9:12 AM
geekaholic said…
yup sure has been :) there is a manual method over at touchdev.com. You can manually download the 1.1.2 firmware and get iTunes to ask you to hand pick the ipw file.

But I still haven't found a compelling reason to upgrade, given the hassle of backing up my data. Only if they had the USB disk emulation, i'd upgrade in a flash!
1:48 PM
geekaholic said…
For unlocking the iphone, I was told this HOWTO to be accurate.

http://iphone.unlock.no/
9:57 AM
Duck Season said…
please is there a new or easy way to check for wifi greyED out ipod touch 1g 3.1.3. to is 10.13.2011
rick p
11:41 AM
Duck Season said…
Any new post on IPOD TOUCH 1G . have read alot . Hard to get any the tools. I did get alot of firmware saved. only NOT the

3.1.2... so i'm working with 3.1.3.

i used cydia in the passed
11:44 AM
Post a Comment

Popular posts from this blog

Why KDE4 (might) suck!

Image
I've been a kde user for very long time, since from before version 3.0. I vaguely remember being excited with version 3.0 to the point I was using the beta releases on a daily basis. Similarly I have been anticipating kde 4.0, the next major release since 3.0 I suppose. But it seems that is just its problem! Its too much of a major release to be pushing out in such a hurry. I have been following kde 4 from time to time by reading some of the discussions on the panel-devel list, trying out the alpha releases via the SUSE live cd and of course discussing with Siraj , our local kde developer, on the internals (technology and community wise). While things have improved a bit, with each release of kde 4, its far from ready. We are now at RC1 and the announcement says its ready for prime time testing. Building on this, the majority of applications included in KDE 4.0 are now usable for day to day use. The KDE Release Team has recently underlined this by calling on the community to par...
Read more

Track Your New Year Resolutions With ii.do

Image
I know, I know, it’s a bit of a cheesy title to promote my Open Source project but here me out - it really does work. Though I didn’t really write it to track my new year resolutions (I’ve never found them effective beyond a week), I did write it out of constant frustration with not finding a TODO productivity tool that stuck with me. Let me explain… I’ve tried EVERYTHING! Google Calendar & tasks Sending myself Emails Wiki (Dokuwiki, Mediwiki, Twiki etc.) Tomboy Tomboy with UbuntuOne & Android App EverNote Remember the Milk Gedit notes on my desktop Post-it notes widget Actual Post-it notes Old-skool diary Pieces of paper including backs of payment receipts From the above list, if anything came remotely to sticking as a habit, then it’d be the sticky notes & pieces of paper. I’m not suggesting the other methods suck, but I wouldn’t use it beyond a couple of weeks. Why was it that despite me spending hours on a computer, the best thing that had a chance of r...
Read more

I want my CDMA! How my rights were violated.

Last Wednesday, I went to pick up a CDMA phone from Bell after hearing all good about it and how fast it was. I had been using Bell for now over 5 years, primarily to surf the Internet. Sure it wasn't fast at 33.6, but atleast it was the next best economical thing until ADSL shows up. Naturally when CDMA came along with a lower rental and a 5x claimed speed, it did raise my eye browse. But I had already invested 15,000/- on my current phone, which included paying the old owner his phone deposit of 7500 and another 7500 for the phone transfer. Still, I was paying 600+ on rental alone and wasn't using the two lines that came with it that much. After waiting and rethinking for about two months and checking on ADSL, I decided to bite the bullet and go for CDMA, while disconnecting the old line. Boy! was I in for a surprise as I left to the Bell head office It seemed as if I had committed the ultimate sin, by asking that they disconnect the old phone, while I buy another brand new ...
Read more