back

Downgrading iOS: From past to present

If you suspend your transcription on amara.org, please add a timestamp below to indicate how far you progressed! This will help others to resume your work!

Please do not press “publish” on amara.org to save your progress, use “save draft” instead. Only press “publish” when you're done with quality control.

Video duration
00:52:06
Language
English
Abstract
This talk is about the iOS secure boot chain and how it changed throughout different iOS versions, while focusing on downgrading despite countermesures.
It will explain basics like what SHSH blobs and APTickets are and how IMG3 and IMG4 file format works.
Also a new technique called "prometheus" will be introduced which allows for the first time downgrading 64bit devices.

This talk shows how Apple's secure boot chain works and what changes where made with new software and hardware updates.
It explains how the boot/restore process works, what SHSH blobs and APTickets are and how they are structured.
Each time a new feature is introduced to improve the secure boot chain, a technique is shown how it can be bypassed in order to downgrade.
This talk recaps how it was possible to downgrade with TinyUmbrella and limera1n back in the old days and presents a new approach by showing how a technique called odysseus is able to downgrade newer 32bit devices.

It is pointed out why Basebands are such a pain when trying to downgrade, as well as why odysseusOTA is able to downgrade Basebands anyways.
Components new to 64bit devices like IMG4 file format and SEPOS are introduced and embedded into the context of downgrading.

At the end a new technique called "prometheus" is presented, which is the first one to be able to downgrade 64bit device and also the first method since the introduction of APTickets which *can* work without a Jailbreak or Bootrom/iBoot exploits.

Talk ID
7888
Event:
33c3
Day
2
Room
Saal 6
Start
8:30 p.m.
Duration
01:00:00
Track
Security
Type of
lecture
Speaker
tihmstar
Talk Slug & media link
33c3-7888-downgrading_ios_from_past_to_present
English
0.0% Checking done0.0%
0.0% Syncing done0.0%
0.0% Transcribing done0.0%
100.0% Nothing done yet100.0%
  

Work on this video on Amara!

English: Transcribed until

Last revision: 2 years, 2 months ago