La traduction francaise de ce fichier est disponible plus bas.

What about the Jailbreak on iOS 6.X

or

How it is possible to jailbroken an A5+ on iOS 6.1.3

This method is co-released by C & W
This is probably not the only method to do it, but this is the alone we have found.

Actually we worked to make a release without majors bugs.

C&W how have you do to found a method for inject data jailbreak in iDevices ?

C&W : compared to "normal" jailbreak process we found a flaw that we do not
 expect to find this type of device. We did not expect to find this flaw has 
since neither more nor less than a piece of code available under OSX (Mavericks). 
This is certainly due to the fact that Apple's internal teams focus increasingly 
standardize iOS and OSX. (laughs)

How do you know the flaw is about OSX ?

C&W : simply because by analyzing the file set exergs we realized we wore OSX signing :)

Ok, so, how do you have realised that exploit ?

At first the feat was not really a (laughs) he allowed just alter stabiité the OS , which leads us to say that if there had instability at the heart of a vulnerability more ganda magnitude could be at higher (or lower ) .
So we begin to watch line- compiled code of iOS 6.1.3 - about 166,000 -
At this point we still have not found any kernel exploit ...
Nothing to hide there even was beginning a little to say that we would find nothing more than the simple instability and we were wasting our time . So we stop for a few hours and we 'll hid us (laughs).

When we re-motivated to get back to work on the release of this OS we all returned to zero : The flaw found that not even possible to restart the unit.

As much as we were moving in the research we felt that the devices on which we work had more to do (iPhone 4S) .
When a mine is now set to restart , if my memory is good apple is re- displayed 4 times.

We had unknowingly touching a sore point of the OS.

My phone does not seem to succeed to restart properly so I left several minutes to his life. W who worked with me and was sharing Skype could see what I do, so he followed the same way as me in the iOS code and ... the device also mysteriously restart ...

We found like two idiots there with our devices that could not restart .

What we thought could not move for now.

Finally the devices still did not restart after 3H, we have gone through the " PWND DFU " box. iTunes therefore permits us in our research we revived the next day.

In truth , we took that to -morrow for lack of time .

If we could find a time when we were both available to work we are yoked us to the more motivated than ever spot, thinking we had maybe a playing card with this bug.
In the state he was not usable because it does not even manage to restart the device , in other words we were still at the same point .

Infact no, that he be part of the OS with which we played , by adding some arguments would allow us to get a bug that would succeed to correctly restart the device.

/ **
*
* Patch the kernel runtime on iOS .
* /
EnterThumb
  push { lr }
  cpsid if / * Disable
IRQ / FIQs * /

  / * Enter * /
  adr rO , _helloString
  CallFunction ( _ioLogOffset )

  / * Patch boot- args * /
  LoadRegisterSlidden ( _PE_state ,
Inc. , r9 )
  add rl, Inc. , # 0x70
  ldr Inc. , [ rl]
  add rl, Inc. , # 0x38
  / * Copy string * /
    adr r0, _bootArguments
    mov r2 , # 64
copy_loop :
    LDRB r3, [ r0 ]
    strb r3, [ r1]
    add r0 , r0 , # 1
    add r1, r1 , # 1
    subs r2 , r2 , # 1
    cmp r2 , # 0
    bgt copy_loop

    / * Vm_map_enter * /
    LoadRegisterSlidden ( _vmMapEnter , r0 , r9 )
    LoadRegister ( _vmMapEnter_patch , r1)
    str r1, [ r0 ]

    / * Vm_map_protect * /
    LoadRegisterSlidden ( _vmMapProtect , r0 , r9 )
    LoadRegister ( _vmMapProtect_patch , r1)
    str r1, [ r0 ]

    / * Amfi bypass * /
    LoadRegisterSlidden ( _amfiCSEnforcementDisable , r0 , r9 )
    mov r1 , # 1
    strb r1, [ r0 ]

    / * Pe_i_can_has_debugger * /
    LoadRegisterSlidden ( _PE_I_can_has_debugger , r0 , r9 )
    mov r1 , # 1
    str r1, [ r0 ]

    / * Proc_enforce * /
    LoadRegisterSlidden ( _procEnforce , r0 , r9 )
    mov r1 , # 0
    str r1, [ r0 ]

    / * Cs_enforcement * /
    LoadRegisterSlidden ( _csEnforcementDisable , r0 , r9 )
    mov r1 , # 1
    str r1, [ r0 ]

    / * Task for pid - 0 * /
    LoadRegisterSlidden ( _task_for_pid0 , r0 , r9 )
    LoadRegister ( _task_for_pid0_patch , r1)
    str r1, [ r0 ]

__clean_cache :
    mov r0 , # 0

So we try to inject the jailbreak files in our devices hoping that the device would restart with root access ...

And the issue, it was done , we had root access on our devices, it only remained to see if cydia was injectable ...

/ **
 * boilerplate
 * /

    . syntax unified
    . data

    . globl _kernel_code_start
    . globl _kernel_code_end
    . globl _kernelSlide

    . globl _task_for_pid0
    . globl _ioLogOffset
    . globl _PE_state
    . globl _sandboxBuiltin
    . globl _vmMapEnter
    . globl _vmMapProtect

    . globl _procEnforce
    . _amfiCSEnforcementDisable globl
    . globl _csEnforcementDisable
    . globl _PE_I_can_has_debugger

/ *
 * Helper Macros
 * /
# define LoadRegisterSlidden ( _DATA , _Reg , _Scratch ) \
    LoadRegister ( _DATA , _Reg ) \

# define LoadRegister ( _DATA , _Reg ) \
    adr _Reg , _DATA ; \
    ldr _Reg [ _Reg ]

# define CallFunction ( _data ) \
    LoadRegisterSlidden ( _DATA , r12 , r9 ) \
    blx r12

    mcr p15 , 0, r0, c7 , c5 , 4 / * Prefetch Flush * /
    mcr p15 , 0, r0, c8, c7 , 0 / * Invalidate TLB (d + i) * /
    mcr p15 , 0, r0, c7 , c5 , 0 / * Invalidate Cache to PoU * /
    mcr p15 , 0, r0, c7 , c5 , 6 / * Invalidate branch predictor array * /
    isb sy
    dsb sy / * Wait for operation to full . * /

    movs r0 , # 0
    cpsie if / * Re -enable IRQ / FIQs * /

    pop { pc }

. align 4
_ioLogOffset :
    . along 0xAAAAAAAA
_PE_state :
    . along 0xAAAAAAAA

_task_for_pid0_patch :
    . along ( 0xa802e006 )
_task_for_pid0 :
    . along 0xAAAAAAAA

_vmMapProtect_patch :
    . along ( 0x2000e005 )
_vmMapProtect :
    . along 0xAAAAAAAA

_vmMapEnter_patch :
    . along ( 0x46c02806 )
_vmMapEnter :
    . along 0xAAAAAAAA

/ * Data * patches /
_procEnforce :
    . along 0xAAAAAAAA
_amfiCSEnforcementDisable :
    . along 0xAAAAAAAA
_PE_I_can_has_debugger :
    . along 0xAAAAAAAA
_csEnforcementDisable :
    . along 0xAAAAAAAA
_PE_initialize_console :
    . along 0xAAAAAAAA
_kernelSlide :
    . along 0xAAAAAAAA

_helloString :
    . ASCIZ "your kernel is now Supervised by @ @ Cezara winocm . \ n"
    . align 4
_bootArguments :
    . ASCIZ " debug = 0x14e serial = 3 = 1 -v cs_enforcement_disable amfi = 0xff "
    . align 4

    / *
     * Pad out the shellcode .
     * /
    . org 512
    . align 2
_kernel_code_end

Cydia was installable, we therefore does not con too guys anyway-
It was indeed there on our devices version 6.1.3 but ...
It was impossible to run. In the current state of things the general stability of the phone was quite sad (laughs) Cydia was inlancable but we had ...

We had the flaw that allowed us to inject unsigned code to install Cydia.

We did more repenchés on the subject for 5 days.

In the current situation we were able to launch Cydia and improve the stability of the device, but we are not happy.
Many things remain to be done on this but the Jailbreak iOS 6.1.3 jailbreak available.

We wish good luck to the team who gets Evad3rs service for hacked iOS 7.
Good luck to them for the unsealing of the iOS 7 on 64bit processors.

@ C & W.

Thank you @ C & W who told us much desired way so they took for their work on iOS 6.1.3

VERSION FRANCAISE

( a venir)