+ Reply
Results 1 to 18 of 18

Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.


Thread: [HOW-TO] Be a Firmware Fraud ;)

is a discussion within the

File Mods

forums, a part of the

iPhone Modding

section;
Hey all, I had a little free time and was rooting through my iPhone's folders with WinSCP and I came across a fun little plist. With said plist and a
...
  1. #1
    Developer Drakenza's Avatar
    Join Date
    Oct 2007
    Posts
    211
    Thanks
    1
    Thanked 106 Times in 55 Posts

    Wink [HOW-TO] Be a Firmware Fraud ;)
    Hey all,
    I had a little free time and was rooting through my iPhone's folders with WinSCP and I came across a fun little plist.

    With said plist and a little hackery, the following can be achieved:

    A fake, albeit convincing, restore image:


    Fooling iTunes:


    Real iPhone Snapshots:

    I promise you, none of the above have been doctored in any way other than to remove sensitive information.
    This is extremely easy to do:

    1. Making the fake firmware file:
    All you need to do is take any large file and zip it, then name the zip file to "ipsw." For my screenshot I took the 1.1.1 ipsw, renamed it to zip, unzipped it, then rezipped the new file with a lower compression in order to obtain a larger file size, and finally renamed it.

    2. Modifying the plist on your iPhone:
    SSH into your iPhone and navigate to "/System/Library/CoreServices"
    In this folder, there's a file called "SystemVersion.plist" which is what we edit. That plist looks something like this:
    Code:
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    	<key>BasedOn</key>
    	<string>Whatever It's based on</string>
    	<key>ProductBuildVersion</key>
    	<string>Your Firmware's build number</string>
    	<key>ProductCopyright</key>
    	<string>1983-2007 Apple Inc.</string>
    	<key>ProductName</key>
    	<string>OS X</string>
    	<key>ProductVersion</key>
    	<string>Your firmware's version</string>
    </dict>
    </plist>
    The two bold values are what you need to edit. Apple iPhone firmware numbers typically follow this sort of format: #X###x ("#" being a number and "X" and "x" being upper- and lower-case letters). For example, 3A109a is 1.1.1's build number.

    3. Taking fake screenshots and distributing them:
    Reboot your iPhone and plug it into iTunes, which will see it as whatever firmware you set it as. Now you can take screenshots of iTunes, of your fake ipsw, and of your iPhone using the snap utility by Erica Sadun. Now all you have to do is send a few emails, and you're world famous for having cracked Apple's databases, stolen partially-developed firmware, and jailbreaking it And when everyone starts yelling that you Photoshopped the images, you can honestly say that they're completely real.

    Have fun
    I'll go back to working on iDemocracy now

    -- Drakenza

    Disclaimer:
    Don't really try to get famous by faking screenshots of a new firmware. This tutorial is just for fun... If you get sued by Apple or hated by the MMi community or whatever, you can't hold me responsible.


    Anshu Chimala
    Follow @anshuchimala on Twitter
    Visit http://www.airpoke.com, my latest project for iPhone/iPod touch.

  2. The Following User Says Thank You to Drakenza For This Useful Post:

    jimmytim (11-17-2007)

  3. #2
    What's Jailbreak? jimmytim's Avatar
    Join Date
    Oct 2007
    Location
    Oz
    Posts
    9
    Thanks
    3
    Thanked 2 Times in 1 Post
    You...are...cool!
    I wonder if this stops itunes from doing auto firmware updates.

  4. #3
    My iPhone is a Part of Me
    Join Date
    Aug 2007
    Location
    Heart&soul@Israel, USA
    Posts
    583
    Thanks
    7
    Thanked 44 Times in 36 Posts

    hah, can u edit the # of firmware with letters?

  5. #4
    iPhoneaholic ReVan's Avatar
    Join Date
    Oct 2007
    Location
    BOOTLOADER
    Posts
    458
    Thanks
    6
    Thanked 526 Times in 109 Posts

    Yes, this stop iTunes from Updates. Can be risky when you need to restore your phone during a phone crash. Chances are that it might not detect or perform the right measures during the DFU mode.

  6. #5
    Developer Drakenza's Avatar
    Join Date
    Oct 2007
    Posts
    211
    Thanks
    1
    Thanked 106 Times in 55 Posts

    you can put anything in for the firmware, it's just a string.

    And it will stop autoupdates (which could be a blessing in disguise) but doesn't mess with DFU and is totally reversible as far as I've tested.


    Anshu Chimala
    Follow @anshuchimala on Twitter
    Visit http://www.airpoke.com, my latest project for iPhone/iPod touch.

  7. #6
    Developer
    Join Date
    Aug 2007
    Posts
    191
    Thanks
    20
    Thanked 53 Times in 31 Posts

    Yeah I found this a little while ago too - You got me all excited there though because I thought you found a way to recompress a doctored iPhone firmware

  8. #7
    Developer Drakenza's Avatar
    Join Date
    Oct 2007
    Posts
    211
    Thanks
    1
    Thanked 106 Times in 55 Posts

    @King Chronic: No, but interestingly enough I've been trying with doctored firmware images. I hit a hard stop at one "error 6". I'm thinking iTunes obviously checksums or looks for a signature or something which gets blown away due to de-/re-compressing the ipsw file. One approach would be to just disassemble iTunes and patch the checker but I'm thinking that's illegal


    Anshu Chimala
    Follow @anshuchimala on Twitter
    Visit http://www.airpoke.com, my latest project for iPhone/iPod touch.

  9. #8
    Livin the iPhone Life redcard's Avatar
    Join Date
    Oct 2007
    Location
    Scotchland
    Posts
    2,143
    Thanks
    8
    Thanked 204 Times in 184 Posts

    Quote Originally Posted by jimmytim View Post
    You...are...cool!
    I wonder if this stops itunes from doing auto firmware updates.
    But itunes doesnt do 'auto' firmware upgrades

  10. #9
    My iPhone is a Part of Me
    Join Date
    Jul 2007
    Location
    Orlando FL
    Posts
    767
    Thanks
    17
    Thanked 23 Times in 22 Posts

    Ha Ha Ha Ha Ha Ha Ha Ha Ha Ha

  11. #10
    iPhoneaholic theone77's Avatar
    Join Date
    Oct 2007
    Location
    PlaNeT Earth in the Middle Part
    Posts
    442
    Thanks
    47
    Thanked 276 Times in 112 Posts

    Great ONE!!! can i have a build number of 1.1.2?

    im using 1.1.1 but now im using 1.1.2 accdg to my itunes/about..LOL
    DoNt ForGeT to Say "THanK You" using tHe THANKS ButToN if you found my post helpful

    Apple iPhoNe 3GS Factory Unlocked 3.1.2 All working flawlessly!!
    .

  12. #11
    I'm not a star Imahottguy's Avatar
    Join Date
    Jul 2007
    Location
    MI, USA
    Posts
    2,440
    Thanks
    92
    Thanked 164 Times in 143 Posts

    Pre-modded f/w would be awesome. This way, n00bs couldn't screw up that bad

    Nice find btw!

  13. #12
    Developer
    Join Date
    Aug 2007
    Posts
    191
    Thanks
    20
    Thanked 53 Times in 31 Posts

    Quote Originally Posted by Drakenza View Post
    @King Chronic: No, but interestingly enough I've been trying with doctored firmware images. I hit a hard stop at one "error 6". I'm thinking iTunes obviously checksums or looks for a signature or something which gets blown away due to de-/re-compressing the ipsw file. One approach would be to just disassemble iTunes and patch the checker but I'm thinking that's illegal
    True, but who would know you patched it?

    Perhaps Apple compressed it in a certain way that it is readable by Stuffit/WinRAR (Whether you are on Mac/Win respectively), but also in a way that cannot be reproduced by the above programs

  14. #13
    Developer Drakenza's Avatar
    Join Date
    Oct 2007
    Posts
    211
    Thanks
    1
    Thanked 106 Times in 55 Posts

    Quote Originally Posted by King Chronic View Post
    True, but who would know you patched it?

    Perhaps Apple compressed it in a certain way that it is readable by Stuffit/WinRAR (Whether you are on Mac/Win respectively), but also in a way that cannot be reproduced by the above programs
    If Apple wrote their own compression algorithm I doubt they would make it readable by anything other than iTunes. The fact that WinZip, WinRAR, Stuffit, and all the various other programs can extract ipsw files indicates that they're standard ZIPs. However, the degree of compression is not known.
    I'm going to try to get the MD5 hash of a clean IPSW, unzip it, rezip it on various compressions, and compare hashes.
    It's also very possible that iTunes doesn't care at all about the MD5 and rather, during that extraction phase, it goes through the file list and looks for non-Apple files.


    Anshu Chimala
    Follow @anshuchimala on Twitter
    Visit http://www.airpoke.com, my latest project for iPhone/iPod touch.

  15. #14
    Developer
    Join Date
    Aug 2007
    Posts
    191
    Thanks
    20
    Thanked 53 Times in 31 Posts

    I was looking around in the dev wiki today and appearently people have been trying to do this, but the only problem is, iTunes doesn't like the fact that the modded DMG wasn't re-encrypted. It looks like it sort of came to a halt at that point...

  16. #15
    Owner / Founder - ModMyi
    aka poetic_folly
    Kyle Matthews's Avatar
    Join Date
    May 2007
    Location
    Tampa, Florida, United States
    Posts
    8,476
    Thanks
    569
    Thanked 4,800 Times in 1,224 Posts

    Yah, while this is just a fun joke, being able to distribute (non-officially, of course ) pre-modded firmwares would be a fun, although dangerous (imagine the n00bs trying and getting jacked up stuff on folks phones) hack. Reminiscent of the PSP modding scene.
    .


    ↑ ↑ ↓ ↓ ← → ← → B A [select] [start] Kyle Matthews

  17. #16
    Developer Drakenza's Avatar
    Join Date
    Oct 2007
    Posts
    211
    Thanks
    1
    Thanked 106 Times in 55 Posts

    Pre-modded firmwares would not only be fun, they'd be ridiculously useful Imagine if you could just download a file, restore it with iTunes, and that's it. You're jailbroken, ready for unlocking, ringtones, whatever.
    If we could use the same protocols to restore the image automatically as well, that would be the ultimate one-click solution. I suppose if someone really has the time and the experience they could reverse-engineer iTunes' algorithm... but I doubt anyone is really that good at ASM...

    Of course, that's all wishful thinking I guess.


    Anshu Chimala
    Follow @anshuchimala on Twitter
    Visit http://www.airpoke.com, my latest project for iPhone/iPod touch.

  18. #17
    Owner / Founder - ModMyi
    aka poetic_folly
    Kyle Matthews's Avatar
    Join Date
    May 2007
    Location
    Tampa, Florida, United States
    Posts
    8,476
    Thanks
    569
    Thanked 4,800 Times in 1,224 Posts

    Exactly.
    .


    ↑ ↑ ↓ ↓ ← → ← → B A [select] [start] Kyle Matthews

  19. #18
    iPhoneaholic theone77's Avatar
    Join Date
    Oct 2007
    Location
    PlaNeT Earth in the Middle Part
    Posts
    442
    Thanks
    47
    Thanked 276 Times in 112 Posts

    mine is originally 1.1.2 now and im happy for this firmware coz its stable than 1.1.3 but i did this fraud now and im on 1.1.3 (fake)
    DoNt ForGeT to Say "THanK You" using tHe THANKS ButToN if you found my post helpful

    Apple iPhoNe 3GS Factory Unlocked 3.1.2 All working flawlessly!!
    .

Posting Permissions
  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts