OTB 1.1.2 iPhone unlock: Bootloader exploits!

You have probably heard that the Dev Team needs a 1.1.3 firmware update
for hacking 1.1.2 OTB. This could not be the case anymore!

2 theoretical exploits have been found on the new bootloader 4.6 !!
And you know what it means! 1.1.2 OTB Software unlock coming very soon!

Geohot reported that there are 2 possible exploits, hardware and software.
The next coming days should be decisive!

In the meantime, read this great tutorial for 1.1.2 OTB activation: click here

Read about the exploits in the extended post…

Hardware exploit:

The version check reads from 0xA0021000 and 0xA0021004 to get the version
of the main firmware. It then compares the values [0xA0021000]==~[0xA0021004].
If that check fails it ignores the version check. It is also the only bootloader access
into high flash. So when A16 goes high, pull any data line high or low.
That will cause the check to fail, and hence the version check to be skipped.
And they shouldn’t be any memory accesses in the bootloader, so it’ll be fine.

Software exploit:

This exploit is in the the way the secpack signature is padded.
They did a lot to remove the really bad signature checking of the old bootloader
that IPSF exploited. Although the secpack still has 0×28 bytes of data at the end
that isn’t checked for normal secpack sigs. The secpack sig is(0×30 header/padding,
0×14 main fw sha, 0×14 secpack sha, 0×28 unchecked padding).
So by spoofing the first 0×58 of the RSA, you can set any secpack and main fw sha hash
you want. It is very easy in exponent 3 RSA cryptosystems to spoof the first 1/3 of the
message bytes. With some clever math and brute force, the whole 0×58 can be spoofed.

Those findings have been reported by Geohot.